EP4619906A1

EP4619906A1 - Framework for refining machine learning model from pre-trained base model

Info

Publication number: EP4619906A1
Application number: EP23892324.7A
Authority: EP
Inventors: Sheng Wang; Dan Wang; Claudia Carolina BÁRCENAS CARDENAS
Original assignee: Visa International Service Association
Current assignee: Visa International Service Association
Priority date: 2022-11-14
Filing date: 2023-11-09
Publication date: 2025-09-24
Also published as: CN120188173A; EP4619906A4; WO2024107587A1

Abstract

Using historical access requests for resources received from requestors, base training data is generated as text and arranged as requestor books, each corresponding to a set of historical access requests associated with account of respective requestor and including paragraphs, each corresponding to respective historical access request from the set and including access context and access outcomes for access states associated with respective historical access request. Untrained model is trained using base training data to generate base model that predicts part of paragraph based on other parts of paragraph. Labels for group books are obtained, each group book including paragraphs from requestor books associated with same entity. Labels indicate security state of access requests included in group books. Classification training data is generated using labels and group books. Refinement training on base model is performed using classification training data, to generate refined model that classifies security states of group books.

Description

FRAMEWORK FOR REFINING MACHINE LEARNING MODEL FROM PRETRAINED BASE MODEL

CROSS-REFERENCE TO RELATED APPLICATION(S)

[0001] This application is based on and claims priority to US Provisional Application No. 63/425,134 filed November 14, 2022, the disclosure of which is incorporated by reference herein in its entirety.

BACKGROUND

[0002] Machine learning (ML) is an area of artificial intelligence (Al) where computers have the capability to learn without being explicitly programmed. There are different types of ML techniques including supervised learning techniques, unsupervised learning techniques, and others. In a supervised learning technique, an ML model is created and trained using training data, where the training data includes multiple training examples, each training example including an input and a known output corresponding to the input. An input can include one or multiple features.

[0003] As a part of the training, the model being trained learns a function that maps the inputs in the training data to their corresponding known outputs. After a model has been adequately trained using the training data, it can then be used for making output predictions for new inputs where the outputs are not known. This is often referred to as the inferencing phase.

[0004] Models trained using supervised learning techniques are typically used to solve two types of tasks: a classification task or a regression task. For a classification task, as a part of the training, a model learns a function that maps an input to an output value, where the output value is from a discrete set of classes (or class labels). Accordingly, in a classification problem, the model learns to map an input to one or more of the classes in a set of discrete classes. For a regression task, the model learns a function that maps inputs to continuous output values (e.g., continuous real numbers). [0005] Typical models are trained for specific use cases. Examples of the use cases include determining (approval or decline) on transaction authorization, flagging fraud transaction, clearing amount and delay prediction, etc. Although the models may use the same information regarding the same transaction, the same user, the same merchant, etc., they are built separately for each use case and are executed separately for each use case. Because each model is developed independently with little reuse across models, the costs are increased and computational resources are not used efficiently.

[0006] Accordingly, there is a need for a single model that may be used for different use cases.

SUMMARY

[0007] Embodiments of the present disclosure provide systems, methods, and apparatuses for addressing the above problems through the generation of a single pre-trained base model that allows knowledge-sharing across different use cases, easy adaptation to new use case(s) with minimal resource engagement, and shorter development and deployment cycle.

[0008] Embodiments of the disclosure can use historical access requests and their outcomes, for a plurality of use cases, to generate base training data, and use base training data to generate a single base model capable of predicting outcomes for the plurality of use cases. The base model may be further trained to develop refined model(s) for different use cases or new use cases.

[0009] Some embodiments of the present disclosure include a method performed by one or more processors of a computer system. A plurality of historical access requests for one or more resources are received from a plurality of requestors, each historical access request of the plurality of historical access requests including access information about a requestor of the historical access request, an access context, and access outcomes for access states of the historical access request. Base training data is generated in a text format using the plurality of historical access requests, the base training data in the text format being arranged in a plurality of requestor books, where each of the plurality of requestor books corresponds to a set of historical access requests associated with an account of a respective requestor of the plurality of requestors and includes a plurality of paragraphs, each of the plurality of paragraphs corresponding to a respective historical access request from the set and including access context and access outcomes for access states associated with the respective historical access request among a plurality of access states. A model of a predetermined architecture is trained using the base training data to generate a base model that predicts a part of a paragraph based on other parts of the paragraph. Labels for a plurality of group books are obtained, each of the plurality of group books including paragraphs from requestor books associated with a same entity among the plurality of requestor books, the labels indicating a security state of access requests included in the plurality of group books. Classification training data is generated using the labels and the plurality of group books. Refinement training on the base model is performed using the classification training data, to generate a refined model that classifies security states of the plurality of group books, respectively.

[0010] These and other embodiments of the disclosure are described in detail below. For example, other embodiments are directed to systems, devices, and computer-readable media associated with methods described herein.

[0011] A better understanding of the nature and advantages of embodiments of the present disclosure may be gained with reference to the following detailed description and the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0012] FIG. 1 shows a resource security system for authorizing access to resources, in accordance with some embodiments of the present invention.

[0013] FIG. 2 shows a block diagram of an exemplary model training system, in accordance with some embodiments of the present invention.

[0014] FIG. 3 shows an example of requestor books, in accordance with some embodiments of the present invention.

[0015] FIG. 4 shows an exemplary content of a paragraph, in accordance with some embodiments of the present invention.

[0016] FIG. 5 shows an example of annotated data, according to embodiments of the present invention.

[0017] FIG. 6 shows an example of annotated data, according to embodiments of the present invention.

[0018] FIG. 7 shows an exemplary flowchart of a method, according to embodiments of the present invention.

[0019] FIG. 8 shows an exemplary flowchart of a method, according to embodiments of the present invention.

[0020] FIG. 9 shows an exemplary flowchart of a method, according to embodiments of the present invention.

[0021] FIG. 10 shows an exemplary flowchart of a method, according to embodiments of the present invention. [0022] FIG. 11 shows a block diagram of an exemplary computer apparatus, in accordance with some embodiments of the present invention.

TERMS

[0023] Prior to discussing embodiments of the disclosure, description of some terms may be helpful in understanding embodiments of the disclosure.

[0024] The term “resource” generally refers to any asset that may be used or consumed. For example, the resource may be an electronic resource (e.g., stored data, received data, a computer account, a network-based account, an email inbox), a physical resource (e.g., a tangible object, a building, a safe, or a physical location), or other electronic communications between computers (e.g., a communication signal corresponding to an account for performing a transaction). Thus, a physical resource can be a physical object.

[0025] The term “resource provider” may refer to an entity that can provide resources such as goods, services, information, and/or access. Examples of a resource provider includes merchants, access devices, secure data access points, etc. A “merchant” may typically be an entity that engages in transactions and can sell goods or services, or provide access to goods or services.

[0026] The term “access request” (also referred to as an “authentication request”) generally refers to a request to access a resource. The access request may be received from a requesting computer, a user device, or a resource computer, for example. The access request may include authentication information (also referred to as authorization information), such as a username, resource identifier (ID), or password. The access request may also include and access request parameters, such as an access request identifier, a resource identifier, a timestamp, a date, a device or computer identifier, a geo-location, or any other suitable information. A real-time access request occurs when access to a resource is desired at the time the request is made. In such situations, it is desirable to provide a quick determination for whether to provide access to the resource.

[0027] The term “access result” generally refers to an outcome of an access request. The access result may be received from a resource computer or an access server. The access result may include all of the elements of the access request. For example, the access result may include authentication information (also referred to as authorization information), such as a username, resource identifier, or password. The access result may also include access request parameters, such as an access request identifier, a resource identifier, a timestamp, a date, a device or computer identifier, a geo-location, or any other suitable information. In addition, the access result may include an evaluation score, or any suitable means of determination, for whether the access request was accepted (e.g., indicated by a positive evaluation score) or denied (e.g., indicated by a negative evaluation score). For example, if the access result includes a positive evaluation score or determination, the user is granted access to the resource. Similarly, if the access result includes a negative evaluation score or determination, the resource computer denies access to the resource.

[0028] The term “access result values” generally refers to possible outcomes of an access request, e.g., acceptances, rejections, fraud, and review. The set of outcomes determine whether or not access to the resource was granted to a user. The access result values can be counted to provide a set of counts of access results. As examples, the access result values can include a count for accepted access results, a count for rejected access results, a count for fraudulent access results, and a count for access results that need to be reviewed. The access result values may be included within historical access result data and used by a detector to generate a measure of approval for an access request.

[0029] The term “access rule” may include any procedure or definition used to determine an access rule outcome for an access request based on certain criteria. In some embodiments, the rule may include one or more rule conditions and an associated rule outcome. A “rule condition” may specify a logical expression describing the circumstances under which the outcome is determined for the rule. A condition of the access rule may involve authentication information, as well as request parameters. For example, the authentication information can be required to sufficiently correspond to information categorized as legitimate, e.g., based on a match to critical nodes of a data structure and/or to a sufficient number of nodes. A condition can require a specific parameter value, a parameter value to be within a certain range, a parameter value being above or below a threshold, or any combination thereof.

[0030] The term “server computer” may include a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of computers functioning as a unit. In one example, the server computer may be a database server coupled to a web server. The server computer may be coupled to a database and may include any hardware, software, other logic, or combination of the preceding for servicing the requests from one or more other computers.

[0031] The term “computer system” may generally refer to a system including one or more server computers coupled to one or more databases.

[0032] The term “memory” may refer to any suitable device or devices that may store electronic data. A suitable memory may include a non-transitory computer-readable medium that stores instructions that can be executed by a processor to implement a desired method. Examples of memories include one or more memory chips, disk drives, etc. Such memories may operate using any suitable electrical, optical, and/or magnetic mode of operation.

[0033] The term “processor” may refer to any suitable data computation device or devices. A processor may include one or more microprocessors working together to accomplish a desired function. The processor may include a CPU that includes at least one high-speed data processor adequate to execute program components for executing user and/or system generated requests. The CPU may be a microprocessor such as AMD’s Athlon, Duron and/or Opteron; IBM and/or Motorola’s PowerPC; IBM’s and Sony’s Cell processor; Intel’s Celeron, Itanium, Pentium, Xenon, and/or XScale; and/or the like processor(s).

[0034] The term “classification” may refer to a process by which something (such as a data value, feature vector, etc.) is associated with a particular class of things. For example, an image can be classified as being an image of a dog. “Anomaly detection” can refer to a classification process by which something is classified as being normal or an anomaly. An “anomaly” may refer to something that is unusual, infrequently observed, or undesirable. For example, an anomaly may be a data breach, a compromised account, a fraudulent activity, etc. Classification and anomaly detection can be carried out using a machine learning model.

[0035] The term “classifier” or “classification model” typically refers to a machine learning model that produces classifications corresponding to input data. A binary classifier produces one of two classifications for an input, such as normal or anomalous (e.g., fraudulent).

[0036] The term “machine learning model” may refer to a program, file, method, or process, used to perform some function on data, based on knowledge “learned” during a training phase. For example, a machine learning model can be used to classify feature vectors as normal or anomalous. In “supervised learning,” during a training phase, a machine learning model can learn correlations between features contained in feature vectors and associated labels. After training, the machine learning model can receive unlabeled feature vectors and generate the corresponding labels. For example, during training, a machine learning model can evaluate labeled images of dogs, then after training, the machine learning model can evaluate unlabeled images, in order to determine if those images are of dogs.

[0037] Machine learning models may be defined by “parameter sets,” including “parameters,” which may refer to numerical or other measurable factors that define a system (e.g., the machine learning model) or the condition of its operation. In some cases, training a machine learning model may include identifying the parameter set that results in the best performance by the machine learning model. This can be accomplished using a “loss function,” which may refer to a function that relates a model parameter set to a “loss value” or “error value,” a metric that relates the performance of a machine learning model to its expected or desired performance.

[0038] The term “entities” may include things with distinct and independent existence. For example, entities may include people, organizations (e.g., partnerships and businesses), computers, and computer networks, among others. An entity can communicate or interact with its environment. Further, an entity can operate, interface, or interact with a computer or computer network during the course of its existence.

[0039] The term “authorization request message” may be an electronic message that is sent to request authorization for a transaction. In certain embodiments, the authorization request message can be sent to a payment processing network and/or an issuer of a payment card. An authorization request message according to some embodiments may comply with ISO 8583, which is a standard for systems that exchange electronic transaction information associated with a payment made by a user using a payment device or payment account. Other standard message formats may include ISO 20022 as well as blockchain message format. The authorization request message may include information that can be used to identify an account. An authorization request message may also include additional data elements such as one or more of a service code, an expiration date, etc. An authorization request message may also include transaction information, such as any information associated with a current transaction, such as the transaction amount, merchant identifier, merchant location, etc., as well as any other information that may be utilized in determining whether to identify and/or authorize a transaction.

[0040] The term “authorization response message” refers to an electronic message reply to an authorization request message. In some embodiments, the authorization response message can be generated by an issuing financial institution or a payment processing network. The authorization response message may include, by way of example only, one or more of the following status indicators: Approval — transaction was approved; Decline — transaction was not approved; or Call Center — response pending more information, merchant must call the toll-free authorization phone number. The authorization response message may also include an authorization code, which may be a code that a credit card issuing bank returns in response to an authorization request message in an electronic message (either directly or through the payment processing network) to the merchant computer that indicates approval of the transaction. The code may serve as proof of authorization. For example, the transaction may be approved or declined based on a value of the fraud risk score. [0041] The term “payment processing network” may include data processing subsystems, networks, and operations used to support and deliver authorization services, exception file services, and clearing and settlement services. The payment processing network may use any suitable wired or wireless network, including the Internet.

[0042] The term “acquirer” refers to a business entity (e.g., a commercial bank) that has a business relationship with a particular merchant or other entity. Some entities can perform both issuer and acquirer functions. Some embodiments may encompass such single entity issuer-acquirers.

[0043] The term “authorizing entity” refers to an entity that authorizes an access request. Examples of an authorizing entity may be an issuer, a governmental agency, a document repository, an access administrator, etc.

[0044] The term “issuer” refers to a business entity (e.g., a bank) that maintains an account for a user. An issuer may also issue payment credentials stored on a user device, such as a cellular telephone, smart card, tablet, or laptop to the consumer.

[0045] The term “clearing” refers to the settlement of the transaction. For example, at the end of the business day, the merchant collects all the authorization messages that have been processed and approved throughout the day, generates a package, and sends over to acquirer and to the payment processing network. At the payment processing network, a determination is made whether to proceed with the clearing of the transaction. If the clearing is approved, the money is taken out of consumer’s account and sent to the merchant’s account. Accordingly, a clearing message is generated.

[0046] A clearing process is a process of exchanging financial details between an acquirer and an authorizing entity to facilitate posting to a user's payment account and reconciliation of the user's settlement position. For example, the clearing may be approved or declined based on a value of the fraud risk score.

[0047] The term “chargeback” refers to a demand by an issuer for a merchant to make good on the loss on a fraudulent or disputed transaction.

DETAILED DESCRIPTION

[0048] Embodiments can provide a single base model trained and refined for various use cases.

Embodiments of the disclosure can use historical access requests and their outcomes, for a plurality of use cases, to generate base training data, and use base training data to generate a single base model capable of predicting outcomes for the plurality of use cases. The base model may be further trained to develop refined model(s) for different use cases or new use cases.

[0049] The base training data is arranged into a book for each entity, e.g., account, merchant, acquirer, etc. The training may involve multiple stages. At a first training stage, the base model may be trained based on historical access requests (e.g., historical transaction data) that are arranged in books and converted to text, to predict the outcomes for the “primary” use cases including transaction authorization, clearing, refund, chargeback, and fraud. The base model trained at the first training stage may be used as an “off-the-shelf’ model for making predictions concerning the outcomes of the life components for one or more access requests for one or more requestors desiring to access one or more resources.

[0050] A second training stage may include training where the base model is extended to be used for other use cases. For example, the base model may be trained for predictions regarding an account or a unique ID associated with an entity, e.g., to identify a primary account number (PAN) of the requestor (e.g., a customer), and/or an account of a resource provider (e.g., a merchant), an issuer, an acquirer, etc. As a result of the second training stage, the enhanced base model is obtained that can be further trained to perform finer specific tasks.

[0051] A third training stage may involve training where the enhanced base model obtained at the second training stage is further trained to obtain a refined model capable of differentiating between fraudulent accounts and honest accounts, or identifying an account that is stolen or being attacked (e.g., compromised by a cyberattack) and an entity that is secure.

[0052] In certain embodiments, once the base model is trained at the first training stage, the base model may be further trained at the second training stage, to generate the enhanced base model, for making certain predictions for specific use cases, where it is possible to add any additional new use case models, e.g., sub-models, to the trained enhanced base model, by additionally training the trained enhanced base model using an enhanced base training data corresponding to a new use case. Once a new use case is added to the enhanced base model, the third training stage may be performed to add any additional new use case models, e.g., sub-models, to the trained refined model, by additionally training the trained refined model using classification data corresponding to a new use case. As such, adding new cases may be done efficiently and with lower computational resources as compared to the related art where each use case requires training from scratch of a separate model. [0053] Authentication using a resource security system is first discussed, followed by a description of the model training.

I. ACCESSING A PROTECTED RESOURCE

[0054] Generally, access requests for a computer resource or account (e.g., transactions over the Internet) go through an authentication system to determine whether the transaction is authorized or rejected, for example, due to being fraudulent. Thus, a resource security system may receive requests to access a resource. The resource security system may include an access server for determining an outcome for the access request based on access rules. An exemplary resource security system is described in further detail below.

[0055] FIG. 1 shows a resource security system 100 for authorizing access to resources, in accordance with some embodiments. The resource security system 100 may be used to provide authorized users (e.g., via authentication) access to a resource while denying access to unauthorized users. In addition, the resource security system 100 may be used to deny fraudulent access requests that appear to be legitimate access requests of authorized users. The resource security system 100 may implement access rules to identify fraudulent access requests based on parameters of the access request. Such parameter may correspond to fields (nodes) of a data structure that is used to distinguish fraudulent access requests from authentic access requests.

[0056] The resource security system 100 includes a resource computer 110. The resource computer 110 may control access to a physical resource 118, such as a building or a lockbox, or an electronic resource 116, such as a local computer account, digital files or documents, a network database, an email inbox, a payment account, or a website login. In some embodiments, the resource computer may be a webserver, an email server, or a server of an account issuer. The resource computer 110 may receive an access request from a user 140 via a user device 150 (e.g., a computer or a mobile phone) of the user 140. The resource computer 110 may also receive the access request from the user 140 via a request computer 170 coupled with an access device 160 (e.g., a keypad or a terminal). In some embodiments, the request computer 170 may be a resource provider. For example, the request computer 170 and the resource computer 110 may be the same, wherein the access request from the user 140 is generated directly at the resource computer 110.

[0057] The access device 160 and the user device 150 may include a user input interface such as a keypad, a keyboard, a fingerprint reader, a retina scanner, any other type of biometric reader, a magnetic stripe reader, a chip card reader, a radio frequency identification reader, or a wireless or contactless communication interface, for example. The user 140 may input authentication information into the access device 160 or the user device 150 to access the resource. Authentication information may also be provided by the access device 160 and/or the user device 150. The authentication information may include, for example, one or more data elements of a username, an account number, a token, a password, a personal identification number, a signature, a digital certificate, an email address, a phone number, a physical address, and a network address. The data elements may be labeled as corresponding to a particular field, e.g., that a particular data element is an email address. In response to receiving authentication information input by the user 140, the user device 150 or the request computer 170 may send an access request, including authentication information, to the resource computer 110 along with one or more parameters of the access request.

[0058] In one example, the user 140 may enter one or more of an account number, a personal identification number, and password into the access device 160, to request access to a physical resource (e.g., to open a locked security door in order to access a building or a lockbox) and the request computer 170 may generate and send an access request to the resource computer 110 to request access to the resource. In another example, the user 140 may operate the user device 150 to request that the resource computer 110 provide access to the electronic resource 116 (e.g., a website or a file) that is hosted by the resource computer 110. In another example, the user device 150 may send an access request (e.g., an email) to the resource computer 110 (e.g., an email server) in order to provide data to the electronic resource 116 (e.g., deliver the email to an inbox). In another example, the user 140 may provide an account number and/or a personal identification number to an access device 160 in order to request access to a resource (e.g., a payment account) for conducting a transaction.

[0059] In some embodiments, the resource computer 110 may verify the authentication information of the access request based on information stored at the request computer 170. In other embodiments, the request computer 170 may verify the authentication information of the access request based on information stored at the resource computer 110.

[0060] The resource computer 110 may receive the request substantially in real-time (e.g., account for delays computer processing and electronic communication). Once the access request is received, the resource computer 110 may determine parameters of the access request. In some embodiments, the parameters may be provided by the user device 150 or the request computer 170. For example, the parameters may include one or more of: a time that the access request was received, a day of the week that the access request was received, the source-location of the access request, the amount of resources requested, an identifier of the resource being request, an identifier of the user 140, the access device 160, the user device 150, the request computer 170, a location of the user 140, the access device 160, the user device 150, the request computer 170, an indication of when, where, or how the access request is received by the resource computer 110, an indication of when, where, or how the access request is sent by the user 140 or the user device 150, an indication of the requested use of the electronic resource 116 or the physical resource 118, and an indication of the type, status, amount, or form of the resource being requested. In other embodiments, the request computer 170 or the access server 120 may determine the parameters of the access request.

[0061] The resource computer 110 or the request computer 170 may send the parameters of the access request to the access server 120 in order to determine whether the access request is fraudulent. The access server 120 may store one or more access rules 122 for identifying an illegal access request. Each of the access rules 122 may include one or more conditions corresponding to one or more parameters of the access request. The access server 120 may determine an access request outcome indicating whether the access request should be accepted (e.g., access to the resource granted), rejected (e.g., access to the resource denied), or reviewed by comparing the access rules 122 to the parameters of the access request as further described below. In some embodiments, instead of determining an access request outcome, the access server 120 may determine an evaluation score based on outcomes of the access rules. The evaluation score may indicate the risk or likelihood of the access require being fraudulent. If the evaluation score indicates that the access request is likely to be fraudulent, then the access server 120 may reject the access request.

[0062] The access server 120 may send the indication of the access request outcome to the resource computer 110 (e.g., accept, reject, review, accept and review, or reject and review). In some embodiments, the access server 120 may send the evaluation score to the resource computer 110 instead. The resource computer 110 may then grant or deny access to the resource based on the indication of the access request outcome or based on the evaluation score. The resource computer 110 may also initiate a review process for the access request.

[0063] In some embodiments, the access server 120 may be remotely accessed by an administrator for configuration. The access server 120 may store data in a secure environment and implement user privileges and user role management for accessing different types of stored data. For example, user privileges may be set to enable users to perform one or more of the following operations: view logs of received access request, view logs of access request outcomes, enable or disable the execution of the access rules 122, update or modify the access rules 122, change certain access request outcomes. Different privileges may be set for different users. [0064] The resource computer 110 may store access request information for each access requests that it receives. The access request information may include authentication information and/or the parameters of each of the access requests. The access request information may also include an indication of the access request outcome for the access request, e.g., whether access request was actually fraudulent or not. The resource computer 110 may also store validity information corresponding to each access request. The validity information for an access request may be initially based on its access request outcome. The validity information may be updated based on whether the access request is reported to be fraudulent. In some embodiments, the access server 120 or the request computer 170 may store the access request information and the validity information.

II. MODEL TRAINING SYSTEM

[0065] As described in detail below, embodiments of the disclosure can use historical access requests and their outcomes, for a plurality of use cases, to generate base training data, and use base training data to generate a single base model capable of predicting outcomes for the plurality of use cases. The base model may be further trained to develop refined model(s) for different use cases or new use cases.

[0066] FIG. 2 is a simplified block diagram of a model training system 200 according to certain embodiments. The model training system 200 may be implemented using one or more computer systems, each computer system having one or more processors. The model training system 200 may include multiple components and subsystems communicatively coupled to each other via one or more communication mechanisms. For example, in the embodiment shown in FIG. 2, the model training system 200 includes a base training data generation subsystem 210, a base model generation subsystem 212, an enhanced base model generation subsystem 214, and a refined model generation subsystem 218. These subsystems may be implemented as one or more computer systems. The systems, subsystems, and other components shown in FIG. 2 may be implemented in software (e.g., code, instructions, program) executed by one or more processing units (e.g., processors, cores) of the respective systems, using hardware, or combinations thereof. The software may be stored on a non- transitory storage medium (e.g., on a memory device). Model training system 200 shown in FIG. 2 is merely an example and is not intended to unduly limit the scope of embodiments. Many variations, alternatives, and modifications are possible. For example, in some implementations, model training system 200 may have more or fewer subsystems or components than those shown in FIG. 2, may combine two or more subsystems, or may have a different configuration or arrangement of subsystems. The model training system 200 and subsystems shown in FIG. 2 may be implemented using one or more computer systems, such as the computer system shown in FIG. 11.

[0067] As shown in FIG. 2, the model training system 200 also includes a storage subsystem 220 that may store the various data constructs and programs used by the model training system 200. For example, the storage subsystem 220 may store historical access requests 222. However, this is not intended to be limiting. In alternative implementations, the historical access requests 222 may be stored in other memory storage locations (e.g., different databases) that are accessible to the model training system 200, where these memory storage locations can be local to or remote from the model training system 200. As described in detail below, based on the historical access requests 222, the base training data generation subsystem 210 generates a base training data that is used to generate the base model.

[0068] For example, the historical access requests 222 may be historical transaction data collected by a payment processing network over time and made available to the storage subsystem 220 and/or the model training system 200. The historical access requests 222 correspond to a plurality of customers, e.g., resource requestors or requestors, and include historical transaction data corresponding to a variety of access requests for a variety of the primary use cases for each of the resource requests. As an example, the historical transaction data may include sets of access requests from a number of corresponding requestor accounts, e.g., 5 million accounts for one requestor, collected over a time period, e.g., a year. However, this is not intended to be limiting. The number of corresponding requestor accounts may be smaller or greater than 5 million accounts for one requestor and may be collected for a time period less or more than a year.

[0069] As used herein, the primary use cases include access request authorization, clearing, refund, chargeback, and fraud. However, this is not intended to be limiting, and the primary use cases may include fewer or more of the use cases.

[0070] Further, other data used by the model training system 200 or generated by the model training system 200 as a part of its functioning may be stored in the storage subsystem 220. For example, information identifying various param eter(s), score(s), threshold(s), metric(s), etc. used by or determined by the model training system 200 may be stored in the storage subsystem 220. A. Base Training Data Generation

[0071] As discussed above, based on the historical access requests 222, the base training data generation subsystem 210 generates a base training data that is used to generate the base model.

[0072] In detail, the base training data generation subsystem 210 receives the historical access requests 222, e.g., tabular data, corresponding to the requestors, and converts the tabular transaction data of the historical access requests 222 into text. The base training data generation subsystem 210 provides annotations to the text, and groups the text-based historical access requests by a requestor account.

[0073] One requestor’s account is considered as a requestor book, where the book identifier (ID) is the personal account number (PAN) of the requestor, e.g., the card number. All the historical access requests from the same account are collected and grouped. The requestor book is composed of multiple paragraphs. Each access request is a paragraph that represents a term called transaction lifecycle or access request lifecycle. The description of the access request lifecycle in the paragraph starts with an access request context followed by descriptions corresponding to multiple states. The descriptions for each of the states are structured to start with a tag followed by a sentence describing the state outcome.

[0074] Referring again to FIG. 2, the base training data generation subsystem 210 includes an access requests to text converter 224, a sorter 226, and an annotator 228. The access requests to text converter 224 receives the historical access requests 222 corresponding to the requestors, and converts the transaction data of the historical access requests 222 into the sentences of the paragraphs in the text format. The access requests to text converter 224 extracts information from tabular data corresponding to the historical access requests 222, converts tabular data to plain language, e.g., English, and, by using a template, inserts the converted transaction data into the corresponding fields of the template.

[0075] The sorter 226 sorts the historical access requests by the requestor account so that all of the access requests associated with the same requestor account are arranged as one requestor book. For example, each of the requestor books may have an ID associated with the requestor’s account. Within the book, the access requests are further sorted by a time of event.

[0076] However, this is not intended to be limiting and, in some embodiments, the sorter 226 may be omitted. In these embodiments, the access requests to text converter 224 may receive the historical access requests 222 as sets of the historical access requests each corresponding to the requestor account, convert the sets of the historical access requests into the paragraphs in the text format, and form the requestor books based on the converted sets of the historical access requests.

1. Requestor Books & Paragraphs

[0077] FIG. 3 shows a plurality of requestor books 300 including a first requestor book 301 to an Nth requestor book 302. For example, the first requestor book 301 is associated with a PAN of a first requestor and contains text records corresponding to the historical access requests associated the PAN of the first requestor. The text records of the first requestor book 301 include a plurality of paragraphs 306, each of the plurality of paragraphs 306 corresponding to a lifecycle of one access request. The Nth requestor book 302 is associated with a PAN of an Nth requestor and contains text records corresponding to the historical access requests associated the PAN of the Nth requestor. The text records of the Nth requestor book 302 include a plurality of paragraphs 308, each of the plurality of paragraphs 306 corresponding to a lifecycle of one access request.

[0078] Each paragraph of the plurality of paragraphs 306, 308 corresponds to an access request lifecycle and includes a plurality of sentences corresponding to the states of the historical access requests 222.

2. States of Access Requests

[0079] FIG. 4 shows an example of description of the states of one of the paragraphs of the requestor book. In an embodiment of FIG. 4, the paragraph 400 may be included in the plurality of paragraphs of one of the plurality of requestor books 300 and corresponds to a lifecycle of one transaction, e.g., a given access request.

[0080] The paragraph 400 includes a plurality of sentences 402, each providing a corresponding description related to an associated access request, e.g., an access request context and/or an outcome or a status of a corresponding state associated with a given access request. Examples of the possible states associated with the access request include:

[0081] State 0 - Authorization Request Response (Approval/Decline),

[0082] State 1 - Clearing,

[0083] State 2 - Refund,

[0084] State 3 - Chargeback, and

[0085] State 4 - Fraud.

[0086] For example, a first sentence corresponding to access request context 410 may describe an access request context, e.g., a transaction context on the point of sale. For example, the first sentence may contain some or all of time, geolocation, amount, terminal type, resource provider ID (e.g., merchant ID), acquirer ID, and issuer ID. [0087] A second sentence corresponding to an outcome of state 0 (reference numeral 412) may describe an outcome of state 0 associated with the access request. State 0 corresponds to “Authorization Request Response” or “Response.”

[0088] A third sentence corresponding to an outcome of state 1 (reference numeral 414) may describe an outcome of state 1 associated with the access request. State 1 corresponds to “Clearing.”

[0089] A fourth sentence corresponding to an outcome of state 2 (reference numeral 416) may describe an outcome of state 2 associated with the access request. State 2 corresponds to “Refund.”

[0090] A fifth sentence corresponding to an outcome of state 3 (reference numeral 418) may describe an outcome of state 3 associated with the access request. State 3 corresponds to “Chargeback.”

[0091] A sixth sentence corresponding to an outcome of state 4 (reference numeral 420) may describe an outcome of state 4 associated with the access request. State 4 corresponds to “Fraud.”

3. Paragraph Sentences & Annotations

[0092] With reference again to FIG. 2 and further reference to FIG. 5, the access requests to text converter 224 uses a template to convert the transaction data of the historical access requests 222 into the text sentences. The access requests to text converter 224 inserts the transaction data into the fields of the template as shown by characters in bold in FIG. 5.

[0093] The annotator 228 provides annotations to the sentences, e.g., tags or tokens identifying a sentence corresponding to a given state.

[0094] In an embodiment of FIG. 5, a tag 502 “Context” is provided to a first sentence 504, “The transaction is made 02/04/2022 xx:xx:xx worth $80 USD, type is e-commerce, cross- border, merchant is xyz2635, with acquiring bank Barclay-UK, Issuing bank Chase-USA, local currency Euro, and the credential provided is zip 64398, Expdt 11/25, CW 263.” Accordingly, the description in the first sentence provides the context of the access request, e.g., that the transaction is made on this date and at this time, the requested money amount, the type of the transaction (e.g., e-commerce), whether the transaction is domestic or international (e.g., cross-border), the merchant name, the acquiring bank for this merchant, the issuing bank, the type of the local currency, and the requestor’s credentials, e.g., the user- provided zip code, the expiration date, and the CVV of the credit card. However, the described-above is not intended to be limiting and the first sentence may omit some of the described items and/or may include additional items. [0095] A tag 510 “Auth Resp” is provided to a second sentence 514, “The transaction is approved with $80 USD in full, with reason issuer-approved.” As described above, the second sentence 514 corresponds to an outcome of the “Authorization Request Response,” e.g., state 0. For example, when the issuer receives the authorization request for a resource that is initiated by the requestor, the issuer generates and sends, to the resource provider (e.g., a merchant), the response indicating an issuer determination whether the issuer approves or declines the authorization request. For example, the authorization request may be approved or declined based on a value of the fraud risk score. In an embodiment of FIG. 5, the second sentence 514 contains an outcome of state 0, e.g., the transaction is approved by the issuer (e.g., reason = issuer-approved) for a full amount of $80.00.

[0096] A tag 520 “Clearing” is provided to a third sentence 524, “The transaction is cleared on 02/06/2022, worth $82 USD.” As described above, the third sentence 520 corresponds to an outcome of the state 1. For example, when the transaction is approved, this transaction is later settled. The resource provider sends the authorization response regarding an approved transaction to the acquirer and to the issuer. At the issuer, a determination is made whether to proceed with the clearing of the transaction. If the clearing is approved, the money is taken out of consumer’s account and sent to the merchant’s account. For example, the clearing may be approved or declined based on a value of the fraud risk score. Accordingly, a clearing message is generated. In an embodiment of FIG. 5, the third sentence 524 (e.g., a clearing message) contains an outcome of state 1, e.g., the transaction is cleared two days after the authorization was approved, for the amount of $82. As shown, this amount is different versus the amount that was approved in the authorization stage, e.g., state 0.

[0097] A tag 530 “Refund” is provided to a fourth sentence 534, “The transaction is returned on 02/15/2022, with credit $22 USD.” As described above, the fourth sentence 534 corresponds to an outcome of the state 2. For example, the refund happens when the requestor, e.g., a consumer, returns the purchased item so that the resource provider may provide the credit back to the requestor’s account. One of the factors to determine to approve or decline the refund request is a value of the fraud risk score. In an embodiment of FIG. 5, the fourth sentence 534 (e.g., a refund message) contains an outcome of state 2, e.g., the date when the transaction is returned and a value of the return amount.

[0098] A tag 540 “Chargeback” is provided to a fifth sentence 544, “The transaction is chargebacked on 02/25/2022, with credit $60 USD.” As described above, the fifth sentence 544 corresponds to an outcome of the state 3. For example, the chargeback may happen when the issuer decides to charge the money back from the resource provider, to make good on the loss on a fraudulent or disputed transaction, e.g., the issuer finds an abnormality based on a chargeback request of a requestor. One of the factors to determine to approve or decline the chargeback request of the requestor is a value of the fraud risk score. In an embodiment of FIG. 5, the fifth sentence 544 (e.g., a chargeback message) contains an outcome of state 3, e.g., the date when the transaction is credited to the requestor’s account and a value of the refund amount.

[0099] A tag 550 “Fraud” is provided to a sixth sentence 554, “The transaction is reported as fraud on 02/26/2022, with amount $60 USD.” As described above, the sixth sentence 554 corresponds to an outcome of the state 4. The fraud detection is applicable to states 0 to 3 and the value of the fraud risk score is used to determine a transaction abnormality. In an embodiment of FIG. 5, the sixth sentence 554 (e.g., a fraud message) contains an outcome of state 4, e.g., the date when the transaction is reported as fraud and a value of the fraudulent amount.

[0100] However, the described-above is not intended to be limiting and not all of the states are present for each access request.

[0101] FIG. 6 depicts a paragraph 600 where some of the states are not present for the request access. Contents of a first sentence 604, a second sentence 614, and a third sentence 624 respectively correspond to the first sentence 504, the second sentence 514, and the third sentence 524 described above.

[0102] In an embodiment of FIG. 6, states 2 to 4 are not present, and, thus, the content which would have corresponded to the fourth sentence 534, the fifth sentence 544, and the sixth sentence 554 of FIG. 5 is not provided in sentences 634. Instead, the annotator 228 inserts a token “not applicable” to signal that there is no corresponding status or activities corresponding to states 2 to 4.

B. First Training Stage - Generation of Base Model

[0103] With reference again to FIG. 2, the model training system 200 is configured to perform multiple-stage training on an input untrained model. In some implementations, the model training performed by the model training system 200 includes three training stages that are performed by the base model generation subsystem 212, the enhanced base model generation subsystem 214, and the refined model generation subsystem 218, respectively. Each of these training stages and the functions performed by these subsystems are described below in more detail. [0104] The base model generation subsystem 212 is configured to perform training corresponding to the first training stage. The base model generation subsystem 212 receives, as an input, an untrained model 233 of a desired architecture. The base model generation subsystem 212 then performs processing on the untrained model 233 corresponding to the first training stage, which results in the generation of a base model 234 that is output by the base model generation subsystem 212 and is capable of making predictions regarding the lifecycle components of the access request. The output base model is then used as an input for the second training stage performed by the enhanced base model generation subsystem 214. Further, the base model trained at the first training stage is used as an “off-the-shelf’ model for making predictions concerning the outcomes of the life components for one or more access requests for one or more requestors desiring to access one or more resources.

[0105] In some implementations, the untrained model 233 may be a machine learning model. A “machine learning model” can refer to a software module configured to be run on one or more processors to provide a classification or numerical value of a property of one or more samples. An example type of model is supervised learning that can be used with embodiments of the present disclosure. Example supervised learning models may include different approaches and algorithms including analytical learning, artificial neural network, backpropagation, boosting (meta-algorithm), Bayesian statistics, case-based reasoning, decision tree learning, inductive logic programming, Gaussian process regression, genetic programming, group method of data handling, kernel estimators, learning automata, learning classifier systems, minimum message length (decision trees, decision graphs, etc.), multilinear subspace learning, naive Bayes classifier, maximum entropy classifier, conditional random field, nearest neighbor algorithm, probably approximately correct learning (PAC) learning, ripple down rules, a knowledge acquisition methodology, symbolic machine learning algorithms, subsymbolic machine learning algorithms, minimum complexity machines (MCM), random forests, ensembles of classifiers, ordinal classification, statistical relational learning, or Proaftn, a multicriteria classification algorithm.

[0106] The model may include linear regression, logistic regression, deep recurrent neural network (e.g., long short term memory, LSTM), hidden Markov model (HMM), linear discriminant analysis (LDA), k-means clustering, density-based spatial clustering of applications with noise (DBSCAN), random forest algorithm, support vector machine (SVM), or any model described herein. Supervised learning models can be trained in various ways using various cost/loss functions that define the error from the known label (e.g., least squares and absolute difference from known classification) and various optimization techniques, e.g., using backpropagation, steepest descent, conjugate gradient, and Newton and quasi-Newton techniques.

[0107] In some embodiments, the machine learning models could include, but not limited to, convolutional neural network (CNN), linear regression, logistic regression, deep recurrent neural network (e.g., fully-connected recurrent neural network (RNN), Gated Recurrent Unit (GRU), long short-term memory, (LSTM)), transformed-based methods (e.g. XLNet, BERT, XLM, RoBERTa), Bayes’ classifier, hidden Markov model (HMM), linear discriminant analysis (LDA), k-means clustering, density-based spatial clustering of applications with noise (DBSCAN), random forest algorithm, adaptive boosting (AdaBoost), extreme Gradient Boosting (XGBoost), support vector machine (SVM), or a composite model comprising one or more models proposed above.

[0108] In certain implementations, the architecture of the untrained model 233 may be one of the architectures known to those skilled in the relevant art as being appropriate for the task. For example, a transformer based architectures may be used, e.g., for natural language processing (NLP) tasks. The transformer model may be used in a Bidirectional Encoder Representations from Transformers (BERT) model, known to those skilled in the relevant art. However, this is not intended to be limiting, and, in some implementations, the architecture of the untrained model 233 may be a specialized architecture to support the model training according to embodiments.

[0109] In certain implementations, the base model generation subsystem 212 includes a base model training subsystem 242 and a base model validation subsystem 244. The base model training subsystem 242 receives, as an input, the untrained model 233, and iteratively trains the untrained model 233 using the base training data generated by the base training data generation subsystem 210, to generate one or more base model versions.

[0110] In the training performed by the base model generation subsystem 212, one or more parts of the paragraph are randomly masked, and the model in training predicts the masked parts of the paragraph based on other (not masked) parts of the paragraph.

[OHl] The base model generation subsystem 212 may randomly mask one or more lifecycle components, e.g., one or more of sentences 514 to 554 of FIG. 5, and the model in training predicts, e.g., estimates, the description that corresponds to the tag of the masked sentence. The goal of the first training stage is to, based on the access request context and/or not masked sentences, predict how the sequence of the states 0 to 4 will develop. For example, as a result of the first stage training, the base model is capable of predicting whether the “Authorization Request Response,” e.g., state 0, will be approved or declined, whether the transaction corresponding to “Authorization Request Response” will be cleared, and whether any of states 2 to 4 will happen.

[0112] For example, the base training data includes training datapoints, each training datapoint including an input and a corresponding output corresponding to the input, where the input corresponds to a paragraph with a masked sentence, and the output is a prediction of the text that is masked, e.g., the prediction of the lifecycle component behind the mask.

[0113] The base model training subsystem 242 may perform training using the untrained model 233 and the base training data, and the base model validation subsystem 244 may perform a validation of the result of the training performed by the base model training subsystem 242 using the base training data and/or additional set of data. The base model version that passes the validation phase based on one or more prespecified criteria is output as the base model 234, e.g., a final base model.

[0114] As a result of the training performed by the base model generation subsystem 212, a single model capable of making predictions involving the states 0 to 4 is generated.

[0115] FIG. 7 depicts a flowchart of a method 700 performed by the model training system 200 according to certain embodiments. For example, the method 700 may be performed by some or all of the base training data generation subsystem 210 and the base model generation subsystem 212.

[0116] The method 700 may be implemented in software (e.g., code, instructions, program) executed by one or more processing units (e.g., processors, cores) of the respective subsystems, using hardware, or combinations thereof. The software may be stored on a non- transitory storage medium (e.g., on a memory device). The method presented in FIG. 7 and described below is intended to be illustrative and non-limiting. Although FIG. 7 depicts the various processing operations occurring in a particular sequence or order, this is not intended to be limiting. In certain alternative embodiments, the method 700 may be performed in some different order or some operations may be performed in parallel or omitted.

[0117] In operation 702, the base training data may be obtained. For example, the base training data may be generated, using the historical access requests 222, by the base training data generation subsystem 210 to obtain the base model, as described above.

[0118] In operation 704, the untrained model may be trained, as described above, by the base model generation subsystem 212 using the base training data. The base model generation subsystem 212 receives, as an input, an untrained model 233 and performs processing on the untrained model 233 corresponding to the first training stage, using the base training data. The base model generation subsystem 212 can iteratively train the untrained model 233 using the base training data, where one or more parts of the paragraph can be randomly masked. During the training, the model being trained can be tasked to predict the masked parts of the paragraph based on other (not masked) parts of the paragraph.

[0119] In operation 706, the base model may be obtained, by the base model generation subsystem 212, as a result of the training performed at the first training stage (operation 704). [0120] In operation 708, the base model may be used for predicting outcomes of access requests of various requestors requesting an access to one or more resources. For example, the base model is capable of predicting whether the “Authorization Request Response,” e.g., state 0, will be approved or declined, whether the transaction corresponding to “Authorization Request Response” will be cleared, and whether any of states 2 to 4 will happen.

C. Second Training Stage - Generation of Enhanced Base Model(s) [0121] The enhanced base model generation subsystem 214 is configured to perform training corresponding to the second training stage. The second training stage may have one or more training sub-stages to incorporate use cases, where the base model obtained at the first training stage is trained at each training sub-stage with respect to the use case. The output of the second training stage is the enhanced base model that learned the overall behaviors of related entities PAN(s), resource provider(s), issuer(s), acquirer(s), etc. As a result of the second training stage, the base model will learn the corresponding entities and their embedding representations. More specifically, in the second training stage, the task is to differentiate between pairs of two books of entities, that is, to predict whether the two books are from same entity or from two different entities. For example, whether two books of PANs are from the same PAN, whether two books of resource providers are from the same resource provider, etc. The base training data used at the first training stage can be re-used and reorganized such that paragraphs within a book are always from same entity. The labels can be provided to predict whether the two books are from same entity or not. The second training stage can involve multiple training sub-stages. For example, the second training stage may be first performed for PANs, and then performed to differentiate resource providers. The second training stage may be then performed again to differentiate issuers and/or acquirers. Order of these training sub-stages can be arbitrary and there can be many combinations pertaining to the use cases, leading to the generation of the “revised” enhanced base model at each training sub-stage following the first training sub-stage. [0122] With reference to FIG. 2, the enhanced base model generation subsystem 214 receives the base model 234 as an input. The enhanced base model generation subsystem 214 then performs processing corresponding to the second training stage, which results in the generation of an enhanced base model 250 that is then output by the enhanced base model generation subsystem 214. The enhanced base model 250 is used as an input for the third training stage performed by the refined model generation subsystem 218. Further, the enhanced base model trained at the second training stage may be used as a model for predicting similarities between entities participating in transactions using a payment processing network. The entities may include, without limitation, customers, users, computers, computer networks, issuers, resource providers, acquirers, etc.

[0123] The enhanced base model 250 generated by the enhanced base model generation subsystem 214 may then be further fine-tuned for the specific use cases.

[0124] In some embodiments, the model training system 200 may include an enhanced base training data generation subsystem 258. The enhanced base training data generation subsystem 258 may generate enhanced base training data for a variety of entity categories, e.g., a resource provider category, a PAN category, an issuer category, etc. The enhanced base model generation subsystem 214 uses the enhanced base training data in the training of the base model 234 at the second training stage. The enhanced base training data may include group books, where each group book is from the same entity and includes labels to predict if two group books are from the same entity or not. Within a group book, each paragraph is the same as described above with respect to the first training stage. For any group book, the paragraphs are sorted by timestamp of the request context.

[0125] As an example, the enhanced base training data generation subsystem 258 generates first enhanced base training data for training the base model 234 to obtain the PAN-based enhanced base model by forming, based on the base training data, groups of the annotated access requests so that the annotated access requests in the same group are associated with the same PAN. Two of the group books are then input to the base model 234 that is tasked to estimate whether two group books are associated with the same PAN. For example, all of the annotated access requests from the same account may be used as an input into the model being trained. As a result of the training performed by the enhanced base model generation subsystem 214, the base model 234 learns consumer behaviors, the account level embeddings, and each individual account’s behavior.

[0126] As another example, the enhanced base training data generation subsystem 258 generates second enhanced base training data for training the base model 234 to obtain the resource provider-based enhanced base model by forming, based on the base training data, groups of the annotated access requests so that the annotated access requests in the same group are associated with the same resource provider ID. Two of the group books are then input to the base model 234 that is tasked to estimate whether two group books are associated with the same resource provider. For example, all of the annotated access requests associated with the same resource provider may be used as an input into the model being trained. As a result of the training performed by the enhanced base model generation subsystem 214, the base model 234 learns the individual resource provider’s behavior, embeddings, etc.

[0127] The issuer-based enhanced base model (or other user case specific based enhanced base models) may be obtained by training the base model similarly to the above-described, and, thus, the description below is focused on two examples described above. For example, the base model is trained for PANs and then is trained for resource providers. However, this is not intended to be limiting. The training may be performed in any order, e.g., first for the resource providers and then for the PANs. Further, the enhanced base model 250 may include any combination of use cases and new use cases may be added on the on-going basis.

[0128] In certain implementations, the enhanced base model generation subsystem 214 includes an enhanced base model generation subsystem 260 and an enhanced base model validation subsystem 262. To obtain the PAN-based enhanced base model, the enhanced base model generation subsystem 260 receives, as an input, the base model 234 and the first enhanced base training data, and iteratively trains the base model 234 using the first enhanced base training data, to generate one or more PAN-based enhanced base model versions. The first enhanced base training data may include group books, where each group book is from the same PAN and includes labels to predict if two group books are from the same PAN or not. Within a group book, each paragraph is the same as described above with respect to the first training stage.

[0129] In some instances, as shown in FIG. 2, the enhanced base training data generation subsystem 258 may receive a user input through a user interface (UI) subsystem 264 that provides labels for the group books of the first enhanced base training data.

[0130] Accordingly, the first enhanced base training data includes groups of the annotated access requests, e.g., the group books, where each group book is associated with the same PAN and includes labels to predict if two group books are from the same PAN or not.

[0131] The enhanced base model validation subsystem 262 performs validation on the PAN-based enhanced base model versions. The PAN-based enhanced base model version that passes the validation phase based on one or more prespecified criteria is output as the enhanced base model 250.

[0132] To obtain the resource provider-based enhanced base model, the enhanced base model generation subsystem 260 receives, as an input, the base model 234 and the second enhanced base training data, and iteratively trains the base model 234 using the second enhanced base training data, to generate one or more resource provider-based enhanced base model versions. The second enhanced base training data may include group books, where each group book is from the same resource provider and includes labels to predict if two group books are from the same resource provider or not. Within a group book, each paragraph is the same as described above with respect to the first training stage.

[0133] Similarly to what is described above, the enhanced base training data generation subsystem 258 may receive a user input through the UI subsystem 264 that provides labels for the group books of the second enhanced base training data. Accordingly, the second enhanced base training data includes groups of the annotated access requests, e.g., group books, where each group book contains access requests of various requestors and is associated with the same resource provider ID and includes labels to predict if two group books are from the same resource provider or not.

[0134] The enhanced base model validation subsystem 262 performs validation on the resource provider-based enhanced base model versions. The resource provider-based enhanced base model version that passes the validation phase based on one or more prespecified criteria is output as the enhanced base model 250.

[0135] As described above, at the second training stage, the base model can be trained to learn whether group books are from at least one of the same resource provider, the same requestor account, the same issuer, the same acquirer, etc. The enhanced base model 250 can be further trained at the third training stage to perform specific tasks.

[0136] For example, at the third training stage described in detail below, the trained enhanced base model 250 may be trained to estimate whether the PAN account of the requestor is breached, whether the resource provider has a data breach, etc.

[0137] FIG. 8 depicts a flowchart of a method 810 performed by the model training system 200 according to certain embodiments. For example, the method 810 may be performed by some or all of the base training data generation subsystem 210, the enhanced base training data generation subsystem 258, the base model generation subsystem 212, and the enhanced base model generation subsystem 214. [0138] The method 810 may be implemented in software (e.g., code, instructions, program) executed by one or more processing units (e.g., processors, cores) of the respective subsystems, using hardware, or combinations thereof. The software may be stored on a non- transitory storage medium (e.g., on a memory device). The method presented in FIG. 8 and described below is intended to be illustrative and non-limiting. Although FIG. 8 depicts the various processing operations occurring in a particular sequence or order, this is not intended to be limiting. In certain alternative embodiments, the method 810 may be performed in some different order or some operations may be performed in parallel or omitted.

[0139] Referring to FIG. 8, operations 702, 704, and 706 are the same as described above with reference to FIG. 7.

[0140] In operation 812, the enhanced base training data is obtained. As described above, the enhanced base training data may be obtained by the enhanced base training data generation subsystem 258. In some embodiments, the enhanced base training data generation subsystem 258 can form, based on the base training data, group books containing the annotated access requests so that the annotated access requests in the same group book are associated with the same entity ID.

[0141] In operation 814, the base model may be trained, by the enhanced base model generation subsystem 214, using the enhanced base training data, e.g., the group books created for a variety of entity categories. For example, two of the group books within the same entity category and each associated with the same entity are provided as an input to the base model 234 tasked to estimate whether two group books are associated with the same entity. As a result of the training performed at 814, the base model 234 learns the individual entity’s behavior, embeddings, etc.

[0142] In operation 816, the enhanced base model may be obtained, by the enhanced base model generation subsystem 214, as a result of the training performed at the second training stage (operation 814). As described above, at the second training stage, the base model is trained to learn whether group books are from the same entity, e.g., from the same resource provider, the same requestor account, the same issuer, the same acquirer, etc. As a result, the obtained enhanced base model can predict similarities between entities of one or more entity categories.

[0143] With respect to multiple sub-stages of the second training stage described above, operations 812 to 816 may be performed for each sub-stage.

[0144] As a result of the training performed at the second training stage, the enhanced base model 250 can be further trained at the third training stage to obtain individual refined models, each associated with a corresponding entity category and capable of individually performing various specific tasks for that entity category. However, this is not intended to be limiting. In certain implementations, the enhanced base model 250 can be further trained at the third training stage, to obtain a refined model capable of performing one or more various specific tasks for a plurality of entity categories.

D. Third Training Stage - Generation of Refined Model(s)

[0145] The refined model generation subsystem 218 is configured to perform training corresponding to the third training stage. The refined model generation subsystem 218 receives the enhanced base model 250 as an input. The refined model generation subsystem 218 then performs processing corresponding to the third training stage, which results in the generation of one or more refined models 266 that are then output by the refined model generation subsystem 218. Each of one or more refined models 266 is used as an input for a model for making predictions regarding, for example, security states of entities, e.g., an account anomaly or a data breach.

[0146] The examples of the refined models 266 output by the refined model generation subsystem 218 include a PAN model (e.g., a first refined model) for predicting anomalies in requestors’ accounts, a resource provider model (e.g., a second refined model) for predicting anomalies in resource providers’ accounts, and an issuer model (e.g., a third refined model), for predicting anomalies in issuers’ accounts. However, this is not intended to be limiting. In certain implementations, the refined models 266 may be generated as sub-models included in a unified refined model (e.g., “off-the-shelf’ refined model) capable of making a plurality of predictions for the entities participating in financial transactions.

[0147] In some embodiments, the model training system 200 may include a refined training data generation subsystem 268. The refined training data generation subsystem 268 generates classification training data used by the refined model generation subsystem 218 in the training performed on the enhanced base model 250 at the third training stage. The classification training data includes books, where each paragraph of the book is a transaction lifecycle and all paragraphs are from same entity. The labels can be provided that indicate whether the account associated with the entity has anomalies.

[0148] As an example, the refined training data generation subsystem 268 obtains first classification training data for training the enhanced base model 250, to obtain the PAN model. The first classification training data may include books, each associated with a PAN, where each paragraph of the book is a transaction lifecycle, and all paragraphs of the book are associated with the same PAN. Within the book, the transactions (paragraphs) are sorted by time. The first classification training data may further include labels indicating one or more anomalies in one or more PANs, e.g., whether the account is compromised, e.g., hacked or under cyber-attack. As a result of the training performed by the refined model generation subsystem 218, the PAN model is output that is capable of predicting an anomaly related to one or more PANs, e.g., whether the requestor’s account is breached.

[0149] As another example, the refined training data generation subsystem 268 generates second classification training data for training the enhanced base model 250 to obtain the resource provider model. The second classification training data may include books, each associated with a resource provider ID and containing all the transactions (in text format) of the given resource provider). Within the book, the transactions (paragraphs) are sorted by time. The second classification training data further includes labels indicating whether a particular book (resource provider) is being compromised or not, e.g., whether the account is compromised, e.g., breached, under cyber-attack, bankrupt, etc. As a result of the training performed by the refined model generation subsystem 218, the resource provider model is output that is capable of predicting an anomaly related to one or more resource providers, e.g., whether the resource provider’s data is breached, whether the resource provider is bankrupt, etc.

[0150] As shown in FIG. 2, the refined training data generation subsystem 268 may receive labeled training data through the UI subsystem 264, via a user input.

[0151] The issuer model (or other specific use-case refined models) may be obtained by training the enhanced base model 250 similarly to the above-described. However, the abovedescribed is not limiting. The specific use-case refined models (e.g., sub-models) may be generated by performing additional training on the trained refined model, to generate the refined model suitable for making predictions corresponding to the third training stage for a variety of use cases. For simplicity, the description below is focused on two examples described above - e.g., generation of the PAN model and the resource provider model.

[0152] In certain implementations, the refined model generation subsystem 218 includes a refined model generation subsystem 270 and a refined model validation subsystem 272.

[0153] To obtain the PAN model, the refined model generation subsystem 270 receives, as an input, the enhanced base model 250, which is obtained by the enhanced base model generation subsystem 214, and the first classification training data, and iteratively trains the enhanced base model 250 using the first classification training data, to generate one or more PAN model versions. In the training performed by the refined model generation subsystem 270, the first classification training data provides, as an input, a book associated with a PAN, as described above, and the training is performed on the enhanced base model 250 to predict whether the PAN is compromised or not.

[0154] The refined model validation subsystem 272 performs validation on the PAN model versions. The PAN model version that passes the validation phase based on one or more prespecified criteria is output as the refined model 266, e.g., the PAN model.

[0155] To obtain the resource provider model, the refined model generation subsystem 270 receives, as an input, the enhanced base model 250, which is obtained by the enhanced base model generation subsystem 214, and the second classification training data, and iteratively trains the enhanced base model 250 using the second classification training data, to generate one or more resource provider model versions. In the training performed by the refined model generation subsystem 270, the second classification training data provides, as an input, a book, which contains all the transactions (in text format) of the given resource provider, and a label indicating whether this book (resource provider) is being compromised or not. The training is performed on the enhanced base model 250 to predict the compromised resource providers.

[0156] The refined model validation subsystem 272 performs validation on the resource provider model versions. The resource provider model version that passes the validation phase based on one or more prespecified criteria is output as the refined model 266, e.g., the resource provider model.

[0157] As described above, in various embodiments, the unified refined model may be generated and may be used for making predictions related to anomalies of various transaction-involved entities.

[0158] Further, in various embodiments, the unified refined model may be used for making predictions related to the transaction recommendation, e.g., estimating what next transaction will be for a particular requestor.

[0159] FIG. 9 depicts a flowchart of a method 920 performed by the model training system 200 according to certain embodiments. For example, the method 920 may be performed by some or all of the base training data generation subsystem 210, the enhanced base training data generation subsystem 258, the refined training data generation subsystem 268, the base model generation subsystem 212, the enhanced base model generation subsystem 214, and the refined model generation subsystem 218.

[0160] The method 920 may be implemented in software (e.g., code, instructions, program) executed by one or more processing units (e.g., processors, cores) of the respective subsystems, using hardware, or combinations thereof. The software may be stored on a non- transitory storage medium (e.g., on a memory device). The method presented in FIG. 9 and described below is intended to be illustrative and non-limiting. Although FIG. 9 depicts the various processing operations occurring in a particular sequence or order, this is not intended to be limiting. In certain alternative embodiments, the method 920 may be performed in some different order or some operations may be performed in parallel or omitted.

[0161] Referring to FIG. 9, operations 702, 704, and 706 are the same as described above with reference to FIG. 7, and operations 812, 814, and 816 are the same as described above with reference to FIG. 8.

[0162] In operation 922, the classification training data is obtained. For example, the classification training data may be obtained by the refined training data generation subsystem 268, for the training performed on the enhanced base model 250 at the third training stage. The classification training data may include data for a variety of entity categories that identifies anomalies for one or more IDs associated with one or more entities.

[0163] In operation 924, the enhanced base model 250 may be trained, by the refined model generation subsystem 218, using a set of classification training data corresponding to the entity category, e.g., corresponding to PAN, resource provider, etc.

[0164] In operation 926, one or more refined models may be obtained, by the refined model generation subsystem 218, as a result of the training performed at the third training stage (operation 924), e.g., a specific use-case refined models may be obtained by training the enhanced base model 250 similarly to the above-described.

[0165] In operation 928, one or more refined models may be used for security states predictions for the accounts associated with various entities. Further, in various embodiments, the unified refined model may be used for making predictions related to the transaction recommendation, e.g., estimating what next transaction will be for a particular requestor.

[0166] However, the described-above is not intended to be limiting. In certain embodiments, once the base model is trained at the first training stage, the base model may be further trained at the second training stage, to generate the enhanced base model with respect to specific use cases, where it is possible to add any additional new use case to the trained enhanced base model, by additionally training the trained enhanced base model using an enhanced base training data corresponding to a new use case. Once a new use case is added to the enhanced base model, the third training stage may be performed to add any additional new use cases to the trained refined model, by additionally training the trained refined model using classification data corresponding to a new use case. As such, adding new cases may be done efficiently and with lower computational resources as compared to the related art methods where each use case requires training from scratch of a separate model.

[0167] The operations at the second training stage, to train the base model with respect to the new cases, e.g., to generate the PAN-based enhanced base model and the resource provider-based enhanced base model, may be performed successively or at least partially in parallel. Likewise, the operations at the third training stage, to train the enhanced base model with respect to the new cases, e.g., to generate the PAN model and the resource provider model (or to generate the refined model including the PAN model and the resource provider model) may be performed successively or at least partially in parallel.

III. METHOD

[0168] FIG. 10 depicts a flowchart of a method performed by the model training system 200 according to certain embodiments. As described above, the training performed by the model training system 200 may involve multiple stages. At the first training stage, the base model may be trained based on historical access requests, to predict the outcomes for the “primary” use cases. The second training stage may include training where the base model is extended to be primed, e.g., to obtain the enhanced base model that can be further trained to perform finer specific tasks. The third training stage may involve training where the enhanced base model obtained at the second training stage is subjected to the training to obtain the refined model capable of differentiating between fraudulent accounts and honest accounts, or identifying an account that is stolen or being attacked (e.g., compromised by a cyberattack) and an entity that is secure. FIG. 10 shows an example of an embodiment where the second training stage and the third training stage are combined.

[0169] Referring to FIG. 10, a method 1000 may be performed by some or all of the base training data generation subsystem 210, the enhanced base training data generation subsystem 258, the refined training data generation subsystem 268, the base model generation subsystem 212, the enhanced base model generation subsystem 214, and the refined model generation subsystem 218.

[0170] The method 1000 may be implemented in software (e.g., code, instructions, program) executed by one or more processing units (e.g., processors, cores) of the respective subsystems, using hardware, or combinations thereof. The software may be stored on a non- transitory storage medium (e.g., on a memory device). The method presented in FIG. 10 and described below is intended to be illustrative and non-limiting. Although FIG. 10 depicts the various processing operations occurring in a particular sequence or order, this is not intended to be limiting. In certain alternative embodiments, the method 1000 may be performed in some different order or some operations may be performed in parallel or omitted.

[0171] Referring to FIG. 10, at operation 1002, the plurality of historical access requests for one or more resources may be received from a plurality of requestors, where each historical access request of the plurality of historical access requests includes access information about a requestor of the historical access request, an access context, and access outcomes for access states of the historical access request.

[0172] At operation 1004, the base training data in a text format may be generated using the plurality of historical access requests. The base training data in the text format is arranged in a plurality of requestor books, where each of the plurality of requestor books corresponds to a set of historical access requests that is associated with an account of a respective requestor of the plurality of requestors, e.g., with a unique ID, such as a PAN of a customer. Each of the plurality of requestor books includes a plurality of paragraphs, each corresponding to a respective historical access request from the set and including access context and access outcomes for access states associated with the respective historical access request among a plurality of access states. In the plurality of paragraphs, each of the plurality of access states is identified by a tag corresponding to a sentence, where the sentence corresponds to the outcome of that access state. As a non-limiting example, the plurality of access states can include an authorization response, a clearing, a refund, a chargeback, and a fraud. Information about the plurality of access states of a lifecycle of one access request is included in one paragraph of the requestor book.

[0173] At operation 1006, the model of a predetermined architecture is trained using the base training data to generate a base model that predicts a part of a paragraph based on other parts of the paragraph. In an embodiment, the model of the predetermined architecture is a transformer model. However, this is not intended to be limiting, and the architecture of the model may be other than the transformer. Various architectures of the model trained at the first training stage are described above.

[0174] For example, the training of the model includes randomly masking one or more sentences or masking one or more parts of one or more sentences. Then, the model in training is tasked to predict sentences or parts of the sentences corresponding to the masked tags, in one or more parts of the paragraph, based on other parts of the paragraph. As a result of the training performed at operation 1006, a single base model is obtained that may be trained to predict outcomes for the authorization response, the clearing, the refund, the chargeback, and the fraud. However, this is not limiting and the single base model may be trained to predict outcomes for fewer or more access states.

[0175] At operation 1008, labels for a plurality of group books are obtained. Each of the plurality of group books includes paragraphs from requestor books associated with a same entity among the plurality of requestor books, where the labels indicate a security state of access requests included in the plurality of group books. As an example, the group book can have an ID of the entity, e.g., the PAN of the customer, as a group book ID.

[0176] At operation 1010, classification training data is generated using the labels and the plurality of group books.

[0177] At operation 1012, refinement training on the base model is performed using the classification training data, to generate a refined model that classifies security states of the plurality of group books, respectively. The refinement training at operation 1012 can involve some or all of the training described above with respect to the second training stage and the third training stage. In certain implementations, the refinement training at operation 1012 can include operations 814, 816, 924, and 926 of FIG. 9. However, this is not intended to be limiting. In certain implementations, at least one of operations 814, 816, and 924 may be omitted or combined with other operations. As a non-limiting example, operation 816 may be omitted, and operations 816 and 924 may be combined. As a result of the refinement training at operation 1012, the refined model is obtained that is capable of classifying security states of entities associated with the plurality of group books, and/or performing other specific tasks, as described above with regard to the refined model(s) obtained at the third training stage.

IV. EXAMPLE COMPUTER SYSTEM

[0178] Any of the computer systems mentioned herein may utilize any suitable number of subsystems. Examples of such subsystems are in computer system 10 of FIG. 11. In some embodiments, a computer system includes a single computer apparatus, where the subsystems can be the components of the computer apparatus. In other embodiments, a computer system can include multiple computer apparatuses, each being a subsystem, with internal components. A computer system can include desktop and laptop computers, tablets, mobile phones and other mobile devices.

[0179] The subsystems shown in FIG. 11 are interconnected via a system bus 75. Additional subsystems such as a printer 74, keyboard 78, storage device(s) 79, monitor 76 (e.g., a display screen, such as an LED), which is coupled to display adapter 82, and others are shown. Peripherals and input/output (I/O) devices, which couple to I/O controller 71, can be connected to the computer system by any number of means known in the art such as input/output (I/O) port 77 (e.g., USB, FireWire®). For example, VO port 77 or external interface 81 (e.g. Ethernet, Wi-Fi, etc.) can be used to connect computer system 10 to a wide area network such as the Internet, a mouse input device, or a scanner. The interconnection via system bus 75 allows the central processor 73 to communicate with each subsystem and to control the execution of a plurality of instructions from system memory 72 or the storage device(s) 79 (e.g., a fixed disk, such as a hard drive, or optical disk), as well as the exchange of information between subsystems. The system memory 72 and/or the storage device(s) 79 may embody a computer-readable medium. Another subsystem is a data collection device 85, such as a camera, microphone, accelerometer, and the like. Any of the data mentioned herein can be output from one component to another component and can be output to the user.

[0180] A computer system can include a plurality of the same components or subsystems, e.g., connected together by external interface 81, by an internal interface, or via removable storage devices that can be connected and removed from one component to another component. In some embodiments, computer systems, subsystem, or apparatuses can communicate over a network. In such instances, one computer can be considered a client and another computer a server, where each can be part of a same computer system. A client and a server can each include multiple systems, subsystems, or components.

[0181] Aspects of embodiments can be implemented in the form of control logic using hardware circuitry (e.g. an application specific integrated circuit or field programmable gate array) and/or using computer software with a generally programmable processor in a modular or integrated manner. As used herein, a processor can include a single-core processor, multicore processor on a same integrated chip, or multiple processing units on a single circuit board or networked, as well as dedicated hardware. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art will know and appreciate other ways and/or methods to implement embodiments of the present invention using hardware and a combination of hardware and software.

[0182] Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C, C++, C#, Objective-C, Swift, or scripting language such as Perl or Python using, for example, any related art or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer-readable medium for storage and/or transmission. A suitable non-transitory computer-readable medium can include random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a compact disk (CD) or DVD (digital versatile disk) or Blu-ray disk, flash memory, and the like. The computer-readable medium may be any combination of such storage or transmission devices. [0183] Such programs may also be encoded and transmitted using carrier signals adapted for transmission via wired, optical, and/or wireless networks conforming to a variety of protocols, including the Internet. As such, a computer-readable medium may be created using a data signal encoded with such programs. Computer-readable media encoded with the program code may be packaged with a compatible device or provided separately from other devices (e.g., via Internet download). Any such computer-readable medium may reside on or within a single computer product (e.g. a hard drive, a CD, or an entire computer system), and may be present on or within different computer products within a system or network. A computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user.

[0184] Any of the methods described herein may be totally or partially performed with a computer system including one or more processors, which can be configured to perform the steps. Thus, embodiments can be directed to computer systems configured to perform the steps of any of the methods described herein, potentially with different components performing a respective step or a respective group of steps. Although presented as numbered steps, steps of methods herein can be performed at a same time or at different times or in a different order. Additionally, portions of these steps may be used with portions of other steps from other methods. Also, all or portions of a step may be optional. Additionally, any of the steps of any of the methods can be performed with modules, units, circuits, or other means of a system for performing these steps.

[0185] The specific details of particular embodiments may be combined in any suitable manner without departing from the spirit and scope of embodiments of the invention. However, other embodiments of the invention may be directed to specific embodiments relating to each individual aspect, or specific combinations of these individual aspects.

[0186] The above description of example embodiments of the present disclosure has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the disclosure to the precise form described, and many modifications and variations are possible in light of the teaching above.

[0187] A recitation of "a", "an" or "the" is intended to mean "one or more" unless specifically indicated to the contrary. The use of “or” is intended to mean an “inclusive or,” and not an “exclusive or” unless specifically indicated to the contrary. Reference to a “first” component does not necessarily require that a second component be provided. Moreover, reference to a “first” or a “second” component does not limit the referenced component to a particular location unless expressly stated. The term “based on” is intended to mean “based at least in part on.”

[0188] All patents, patent applications, publications, and descriptions mentioned herein are incorporated by reference in their entirety for all purposes. None is admitted to be prior art.

Claims

WHAT IS CLAIMED IS:

1. A method performed by one or more processors of a computer system, the method comprising: receiving a plurality of historical access requests for one or more resources from a plurality of requestors, each historical access request of the plurality of historical access requests including access information about a requestor of the historical access request, an access context, and access outcomes for access states of the historical access request; generating base training data in a text format using the plurality of historical access requests, the base training data in the text format being arranged in a plurality of requestor books, wherein each of the plurality of requestor books corresponds to a set of historical access requests associated with an account of a respective requestor of the plurality of requestors and includes a plurality of paragraphs, each of the plurality of paragraphs corresponding to a respective historical access request from the set and including access context and access outcomes for access states associated with the respective historical access request among a plurality of access states; training a model of a predetermined architecture using the base training data to generate a base model that predicts a part of a paragraph based on other parts of the paragraph; obtaining labels for a plurality of group books, each of the plurality of group books including paragraphs from requestor books associated with a same entity among the plurality of requestor books, the labels indicating a security state of access requests included in the plurality of group books; generating classification training data using the labels and the plurality of group books; and performing refinement training on the base model using the classification training data, to generate a refined model that classifies security states of the plurality of group books, respectively, wherein the paragraph is one of the paragraphs.

2. The method of claim 1, wherein: each of the plurality of access states is identified by a tag corresponding to a sentence, and the training the model further comprises randomly masking sentences and predicting sentences corresponding to the masked tags, for a plurality of parts of the paragraph.

3. The method of claim 1, wherein each of the plurality of paragraphs contains information about the plurality of access states of a lifecycle of one access request.

4. The method of claim 1, wherein the plurality of access states includes an authorization response, a clearing, a refund, and a fraud.

5. The method of claim 4, wherein the base model is a single model trained to predict outcomes for the authorization response, the clearing, the refund, and the fraud.

6. The method of claim 1, wherein each of the plurality of requestor books is associated with a unique identifier (ID).

7. The method of claim 6, wherein the unique ID is associated with a primary account number (PAN) of the plurality of requestors, respectively.

8. The method of claim 7, wherein the refined model classifies security states of PANs associated with the plurality of requestors.

9. The method of claim 6, wherein the refined model classifies security states of entities associated with the plurality of group books.

10. The method of claim 1, wherein the model of the predetermined architecture is a transformer model.

11. A computer system comprising: one or more processors; and a non-transitory computer-readable medium storing one or more instructions that, when executed by the one or more processors, cause the one or more processors to perform the method of any one of claims 1-10.