Patent Description:
In the last years many parts of the daily life of people got more and more digital. With this increase of digital transformation, trust and security related to digital means is getting more and more important because also scammers try to enter this digital world. Due to the higher network complexity, a growing number of systems are available via the Internet so that an associated higher number of attack vectors are possible. It is known that these attack vectors are increasingly exploited by criminal actors. To give just one example of how scammers might act: in the 'old' analog word, there was the 'classic' bank robbery, nowadays, 'digital bank robbery' is being performed in industrial scale: a perpetrator industry tries to take over digital identities from customers in a targeted manner and thus inflicts immense damage on risk owners and customers by issuing payment instructions.

Actually, such criminal transactions are processed via the infrastructure of the different telecommunication providers and their associated core networks. Of course, in principle it would be possible to introduce additional queries that could increase the security of customers. However, if additional queries would be introduced, that would conflict with user experience considerations. In principle, user experience considerations have the goal to make it as convenient as possible for the user to use online transactions means. In summary, the challenge for telecommunication providers, users and risk owners is to increase security of online transactions while at the same time providing a convenient use of these online transactions means.

Existing solutions that aim to enhance the security and at the same time providing a good user experience, try to perform security checks in the background, i.e. within the current system of the online transactions. Such approaches have already been launched by the "Mobile Connect" project - also within the context of standardization and operation actions with other telecommunication communication providers - to secure transactions. Those solutions are based on APIs that use individual attributes from telecommunication networks. Examples are that so-called KYC ("know your customer") approach, a date of the SIM card change approach or a validation of location information via a cell ID approach. However, these approaches still have some drawbacks, in particular they do not provide sufficient security for online transactions since criminal elements tend to use multiple attack vectors. This means that the so-called KYC might be efficient with respect to KYC-attacks but insufficient for non-KYC-attacks.

<CIT> shows Methods and systems for configuring a risk assessment engine to predict a risk of a user based on a topic classification across a set of unknown topics generated by a topic model. A risk determination system obtains a plurality of transactions previously conducted by a user. The risk determination system generates a risk document comprising a sequence of words that describe the plurality of transactions. A topic model is used to determine a topic classification for the user based on the sequence of words. The topic model comprises a natural language processor configured to classify the risk document to one or more topics based on the words within the risk document. The risk determination system configures the risk assessment engine to accept the topic classification as input value(s) for predicting a risk associated with the user.

<CIT> shows a system and methods for processing communication numbers or identifiers of various types to prevent fraud in transactions associated with the communication numbers are disclosed. The communication number processing system, in an example embodiment, verifies a communication number by retrieving characteristics data including network-derived characteristics data and/or other attributes relating to the communication number and processing the characteristics data and/or the attributes based on one or more rules. The communication number processing system further generates a fraud score for the communication number. A client system can then use the fraud score to assess a risk associated with engaging in a transaction with a user associated with the communication number.

<CIT> shows a system for managing cyber security risks includes a memory storing instructions and a processor that executes the instructions to perform operations. The operations include receiving raw entity data for one or more entities from a source system and converting the raw entity data to processed entity data having a format different from the first entity data. The operations include extracting attributes for the entities from the processed entity data and generating an initial risk score for a selected entity based on an entity initial attribute associated with that entity. The operations also include receiving a rule for determining a rule-based risk score and generating a rule-based risk score for the selected entity based on the entity attribute of the selected entity. Additionally, the operations include generating a risk score for the selected entity based on the initial and rule-based risk scores.

Therefore, it is the object the invention to provide improved security procedures regarding online transactions that can efficiently protect online transactions with respect to various online attack vectors.

According to a first aspect of the invention, a method is provided to assess a security risk of online based transactions, wherein the method comprises the following steps, in particular the steps of the method are executed by a telecommunication system:.

It is a core idea of the invention that the attributes are data that is associated to the telecommunication provider, in particular exclusively available to the telecommunication provider within its core network.

This provides the advantage that the telecommunication provider has access to those attributes, the access to retrieve the attributes cannot be prevented by the criminal elements.

A possible embodiment is that a company as a first user, in particular a bank, can assess the risk of an online transaction for their customers as second users. The second user sends his request of an online transaction with his user device to the first user. However, it is possible that this second user can be a criminal that tries to cheat the customer of the bank. The company then forwards the online transaction request to the telecommunication provider that can retrieve the attributes associated to the transaction request and return the calculated risk score based on the machine learning algorithm as described above. The returned calculated risk score enables the company to assess the probability if the user is a criminal element. The user can also be a customer whose user device has been hacked. Hence, if the word user will be used in the following, the user can be the company, like a bank, or an actual person.

This provides the advantage of being able to access security risks in a very flexible way with respect to various attack vectors. Basically, the flexibility is introduced by using the machine learning algorithm that is then also able to access a security risks for a certain combination of attributes that was not used by criminal analysts before. In addition, it is possible to assess the security risk in real time and/or to provide privacy because the only information element that is returned is the risk score that does not reveal relevant private information. The risk score can be made available internally but also to external customers, for example by dedicated API interfaces. It is possible to design the risk score on an absolute scale, for example from <NUM> to <NUM>, wherein <NUM> indicates the lowest security risk and <NUM> indicates the highest security risk, but it is also possible to design the risk score as a probability value, wherein zero indicates the lowest security risk and one indicates the highest security risk.

The attributes can be weighted in a very flexible way by the security experts to meet certain security requirements or to be able to cope with new security attacks if criminal elements change their "tactics". It is even possible to weight the attributes differently regarding to different use cases, wherein for every case an individual trained machine learning model can be created. This provides the advantage of a very flexible security risks assessment that takes new attack vectors efficiently into account.

It is possible, that the user and/or the telecommunication provider implements different actions, based on the outcome of the risk score. For example, do not apply a <NUM>nd factor authentication method and allow the transaction based on a "good" risk score or stop a transaction or ask for <NUM>nd factor on case of a "bad" risk score. The risk owner may as well contact the customer and validate the transaction.

Use of the NRFRS scoring in online booking portals or customer portals of a telecommunications provider:.

In an embodiment, use-case-specific machine learning algorithms are implemented for different use cases for online transactions.

This provides the advantage that the use-case-specific machine learning algorithms can take specific requirements of the different use case into account. For example, a online banking transaction might have different attributes, attack vectors and might require a higher security than purchases of low-priced daily life things.

In an embodiment, the use-case-specific machine learning algorithms are trained with specific attributes and associated risks scores.

This provides the advantage that the different use-case-specific machine learning algorithms can yield individual risk scores. By using specific attributes, in particular those attributes that are really used in the context of the different use cases, it is possible to prevent "overfitting" problems of machine learning networks. Those "overfitting" problems can arise if more attributes are used to train the neuronal network than the actual number of attributes which are used by criminals in the distinct use case. Hence, the attributes used when training a specific use case can be a subset of all attributes that are in principle available.

In an embodiment, the telecommunication provider and/or the user and/or the company interrupt the online transaction if the risk score exceeds a predefined risk value. The interruption can be implemented within the system of the telecommunication provider and/or the company and/or the user device in an automated fashion if the risk value exceeds a predefined risk score.

This provides the advantage that risky online transactions can be stopped automatically to prevent damage for the customer. If the interruption is implemented in an automatic way, the online transaction can be stopped even without interaction of the customer which is especially beneficial for all the customers that are prone to new attack tactics.

Based on the risk score, in particular the company can:.

In an embodiment, different use cases for online transactions have individual predefined risk values.

This provides the advantage that use cases can be treated differently regarding the industry segment. For example, a online banking transaction typically requires a higher security level than purchases of low priced daily life things.

In an embodiment, the user can adjust the predefined risk value on his user device or within his computing system.

In particular, this provides the advantage that the user can decide for himself at which risk score the online transaction will be interrupted by his user device or his system.

In an embodiment, the attributes are retrieved from databases of the telecommunication provider. In particular, the databases can be configured as a secure environment. In particular, it can be specified for each use case which attributes shall be retrieved. Furthermore, it can be specified that attributes being older than a predefined timestamp shall not be retrieved.

This provides the advantage of an efficient access to the relevant attributes, wherein the secure environment ensures that criminal elements cannot manipulate the attributes. The advantage of retrieving only attributes being younger than predefined timestamp helps to discard attributes that are out of date.

Possible attributes are SIM SWAPs, Fraud history, Type Allocation Code ("TAC"), eID, SIM Type, stolen credentials, contract data, operating system (OS), Coordinated Vulnerability Database ("CVD"), IMEI Blacklist (devices of perpetrators), Mobile Protect Pro, applications, location information, access information.

In an embodiment, the attributes are grouped into the following data classes of attributes:.

Using attributes from different areas or dimensions result in a robust score that cannot be irritated by one attribute showing strange behavior.

In addition, the score may be applied for various business areas and fraud vectors without variations - even if those vectors were unknown at the time of score invention.

Through a holistic risk assessment of all data from the environment of the process, interface, network, credential, device and fraud, risks and the likelihood of abuse can be determined in near real-time and digital processes are available for intelligent risk management.

In an embodiment, training data of the machine learning algorithm comprises annotated and/or non-annotated historic fraud data.

Using historic fraud data provides the advantage according to an old well-known principle of physics "the experiment is the best teacher". In this context that means that historic fraud data is data that was actually used to commit online attacks so that this historic fraud data is the best starting point to train the machine learning algorithm because it covers real cases. By annotating this historic fraud data, security experts can update historic fraud data regarding recent approaches of criminal elements that did not happen in the original historic fraud data set.

In an embodiment, a feedback loop is used to update the machine learning algorithm.

This provides the advantage that the machine learning algorithm, in other words the AI model that calculates the risks scores, gets better over time and can take new developments of online attacks into account.

In an embodiment, the user and/or telecommunication provider triggers the feedback loop by editing the returned calculated risk score.

This provides an efficient way of triggering the feedback loop by providing new training data at the same time. The user and/or the communication provider will edit the returned calculated risk score if they think the return risk score was not accurate, for example because the returned risk score did not prevent a cyber-attack regarding the online transaction.

According to a second aspect of the invention, a data communication system, in particular a telecommunication system, is provided, wherein the telecommunication system is configured to execute the steps of the methods described above. The telecommunication system comprises servers that are configured to execute the steps of the method. In addition, the telecommunication system comprises appropriate interfaces to communicate over the Internet, in particular to receive the online transaction requests and return the calculated score results via REST API interfaces.

According to a third aspect of the invention, a user device is provided, wherein the user device is configured to perform a request and to receive and process the calculated risk score as described above.

According to a fourth aspect of the invention, a computer program product is provided, wherein the computer program product comprises instructions which, when the program is executed by a telecommunication system, cause the telecommunication system to carry out the steps of the method described above.

<FIG> shows a schematic overview of the training process of the machine learning algorithm of the inventive method.

A database <NUM>, in particular a Short Message Service Center Large Account <NUM>, comprises numbers "MSISDN" with passwords, in particular in the area of direct carrier billing. In a sense that database <NUM> comprises all possible events which means that every number of this database can trigger an online transaction.

Since a trained machine learning algorithm, in other words a trained AI-model, shall be able to identify in particular such online transactions that were affected, by criminals. It follows that not all numbers of the database <NUM> are needed to train the machine learning algorithm. Hence, all the numbers of the database <NUM> enter into the decision <NUM>, wherein the decision <NUM> filters those numbers "MSISDN" that were actually affected by criminals.

In the next step <NUM>, the attributes that can be used to calculate the risk score are retrieved from databases of the telecommunication provider. The attributes can comprise one and/or a combination of the following attributes: SIM SWAPs, Fraud History, TAC, eID, SIM Type, Stolen Credentials, Contract data, OS, CVD, IMEI BL, Mobile Protect Pro, type of connection, applications running an the user device, and/or Location verification.

In an optional step <NUM> the "MSISDN" and the associated attributes and the decision <NUM>, wherein the decision <NUM> pseudonymises the "MSISDN" in order to maintain data privacy.

In step <NUM>, the pseudonyms and the attributes served as the first input training data for the machine learning algorithm <NUM>. The numeral reference 18a shows that it is possible to assign specific pseudonyms and the attributes for different use cases, in the example for cases A - D, as the first input training data. This would yield different trained machine learning models A - D, wherein each of the models is tailored to one of the use cases A - D. AI-models that are tailored in such a way provide general results which are more accurate.

The lower part of <FIG> shows the second part of the training data for the machine learning algorithm <NUM>. In particular, in step <NUM> security experts evaluate a risk score of the corresponding events from which the attributes were retrieved in step <NUM>. Based on their expertise, these security experts assign a risk score to each of the events in which criminals were involved. The numeral reference 22a shows that it is possible to assign specific risk scores for the different use cases, in the example for cases A - D, as the second input training data.

The machine learning algorithm <NUM> can be trained with the first and second input training data so that the trained machine learning algorithm <NUM> can return a risk score to determine the probability of criminal action if the associated attributes of the online transaction are given as input to the trained machine learning algorithm <NUM>.

<FIG> shows schematically a request for an online transaction of a user and the returning of a calculated risk score of that very online transaction.

A user <NUM> requests a risk score by using his user device <NUM>, for example a computer <NUM> and/or a smartphone <NUM>, of a certain online transaction. The user <NUM> can use an API interface <NUM>, in particular an API gateway <NUM>, to send his request to a telecommunication system <NUM> of a telecommunication provider. The telecommunication system <NUM> comprises a network to transfer data and server entities to perform the tasks of a telecommunication system.

In step <NUM>, the request is being enriched with the attributes that correspond to the request. To facilitate this enrichment <NUM>, the attributes are retrieved from one or more databases <NUM> of the telecommunication provider. After the attributes have been added to the requests, the request serves as input for the trained machine learning algorithm <NUM>. The trained machine learning algorithm <NUM> is implemented on a server <NUM> of the telecommunication provider and generates a calculated risk score <NUM> and returns the calculated risk score <NUM> to the user, in particular the calculated risk score <NUM> is returned as a response to the user via the API interface <NUM>, in particular the API gateway <NUM>.

Depending on the return value of the calculated risk score <NUM>, the user can decide the probability of criminal action regarding his online transaction and can apply the appropriate measures. Possible measures are to continue with the online transaction, if the calculated risk <NUM> is below a predefined threshold or to stop the online transaction if the calculated risk are <NUM> is higher than the predefined threshold.

This shall be illustrated in the following by using examples:
In the following examples, a higher risk score indicates a less critical transaction regarding fraud - of course, this is merely a convention.

Source: synthetic test data. According to the rules for the synthetic test data: local distance to home unusually large and a SIM swap/change occurred under <NUM> days result in a fraud case.

In example <NUM>, even without a value of 'Last MNP-Import', it is possible to calculate the risk score.

Example <NUM>: ID (<NUM>): <NUM>; timestamp (<NUM>): <NUM>-<NUM>-<NUM><NUM>:<NUM>:<NUM>; Last MNP-Import (<NUM>): <NUM>-<NUM>-<NUM><NUM>:<NUM>:<NUM>; Activation Date (<NUM>): <NUM>-<NUM>-<NUM><NUM>:<NUM>:<NUM>; Last SIM-Change (<NUM>): 'empty'; local distance (<NUM>): <NUM>;.

In example <NUM>, Last SIM-Change (<NUM>): 'empty' means that according to the data available a SIM swap/change has never happened.

Another exemplary use case is described in the following:.

Now an additional individual interpretation can already be done here. For example: risk score <NUM> <= <NUM> --> traffic light RED; risk score <NUM> > <NUM> <= <NUM> -- > traffic light YELLOW; risk score <NUM> > <NUM> --> traffic light GREEN.

However, the interpretation can also be left to the user/risk owner. Depending on the value of the risk score <NUM>, the telecommunication provider and/or the user can implement appropriate security means. For example, if the risk score is below <NUM>, a <NUM>-factor-autentification is started to secure the online transaction.

<FIG> shows schematically an implementation of a feedback loop in the telecommunication system to update the machine learning algorithm according to the inventive method.

To make <FIG> even clearer, the machine learning algorithm <NUM> has been divided into the to-be-trained machine learning algorithm 20a and into the trained machine learning algorithm 20b that can also be described as being the operational machine learning algorithm 20b.

In step <NUM>, a user <NUM> makes a risk score request for an online transaction, wherein the request is almost performed in real time. This request can be submitted to the operational machine learning algorithm 20b as described in <FIG>, wherein the attributes belonging to the request are retrieved from the database <NUM>. The operational machine learning algorithm 20b then returns the calculated risk score <NUM> and returns the score resulted in step <NUM> to the user.

The user <NUM> can mark the returned risk score <NUM> as being true or false in step <NUM>. In particular, he can mark the return risk score <NUM> as being false if it turned out that the transaction was actually affected by criminal action even if the returned risk score <NUM> indicated that the online transaction should be safe. This feedback of the user <NUM> can be transferred to a feedback loop <NUM>, wherein this new information about the risk score can be used to train <NUM>, in particular to retrain <NUM>, the to-be-trained machine learning algorithm 20a. In addition to the feedback <NUM>, fraud expertise <NUM> from security experts can be used to train the to-be-trained machine learning algorithm 20a. After the to-be-trained machine learning algorithm 20a was updated, it becomes the operational machine learning 20b in step <NUM>.

Claim 1:
A method to assess a security risk of online based transactions, wherein the method comprises the following steps executed by a telecommunication system:
• Receiving an online transaction request (<NUM>), in particular receiving an online transaction request (<NUM>) by a user with means of a user device (<NUM>);
• Retrieving (<NUM>) by a telecommunication provider at least one attribute associated to the transaction request;
• Handing over the at least one attributes of the transaction request to a trained machine learning algorithm (<NUM>),
o wherein the machine learning algorithm was trained with multiple data sets of at least one attribute and an associated risks score;
o wherein the trained machine learning algorithm is configured to calculate a risk score (<NUM>), in particular a network related forensic risk score "NRFRS", based on the provided attributes;
• Returning the calculated risk score, in particular returning the calculated risk score to the user and/or to a company that is associated with the online transaction request (<NUM>),
characterized in that
the attributes is data that is exclusively available to the telecommunication provider.