US-20260127613-A1 - REAL-TIME COUNTER-FACILITATED RETRIEVAL OF AGGREGATED VALUES FOR PERFORMANCE OF A PROCESSING OPERATION

US20260127613A1US 20260127613 A1US20260127613 A1US 20260127613A1US-20260127613-A1

Abstract

A computer system performs a processing operation in real time on an aggregated value stored in a counter of a set of counters corresponding to time periods associated with events. The computer system maintains the set of counters usable to store aggregated values of an event metric. In response to detection of the events, the computer system stores, in a database, event details for the received events and updates those counters of the set of counters that correspond to time periods associated with the received events. In response to receipt, in a current time period, of an update to a particular event of the received events associated with a previous time period, the computer system, in real time, retrieves, from the set of counters, a particular aggregated value of the event metric for the previous time period and performs a processing operation based on the particular aggregated value.

Inventors

Arpit Kumar
Priya Gopalakrishnan
Murali Krishna Sampath Kumar
Jayaram Venugopal
Ravidutta Ramesh Kodre
Anup Rameshrao Ghagre
Shu Liu
Yingying Tao

Assignees

PAYPAL, INC.

Dates

Publication Date: 20260507
Application Date: 20241121
Priority Date: 20241101

Claims (20)

1 . A method, comprising: maintaining, by a computer system configured to process events associated with a plurality of users, a set of counters that is usable to store, for a first user of the plurality of users over each of a plurality of time periods, aggregated values of an event metric; in response to receiving an indication of events associated with the first user in different ones of the plurality of time periods, the computer system: storing, in a database, event details for the received events; and updating those ones of the set of counters that correspond to time periods associated with the received events, wherein the updating is performed based on determining: counter functionality is enabled for the first user based on comparing an identifier of the first user with a list of user identifiers for which counter functionality is enabled: and information associated with the received events satisfies a set of filter parameters; and in response to receiving, in a current time period, an update to a particular event of the received events associated with a previous time period, the computer system, in real time: retrieving, from the set of counters, a particular aggregated value of the event metric for the previous time period; performing a processing operation that uses the particular aggregated value, wherein computing the particular aggregated value from event details in the database in order to perform the processing operation is not calculable in real time; and sending an indication of a result of the processing operation to the first user.
2 . The method of claim 1 , wherein the set of counters is maintained in response to the computer system receiving an indication from the first user to provide an update event service.
3 . The method of claim 1 , wherein the update is included in a batch file that includes updates received for events of the plurality of users since creation of a previous batch file, and wherein the method further includes performing the processing operation for each of the received updates in real time using aggregated values of the event metric retrieved from corresponding counters maintained by the computer system.
4 . The method of claim 1 , wherein the set of counters also includes update counters for the first user for each of the plurality of time periods, and wherein the calculating a result of the processing operation includes determining whether a value in an update counter for the previous time period meets a threshold that is based on the particular aggregated value.
5 . The method of claim 4 , wherein the processing operation further includes updating, in response to determining that the threshold is not met, the update counter for the previous time period.
6 . The method of claim 4 , wherein events handled by the computer system are payment transactions, the event metric is total payment volume, and wherein the processing operation determines whether an aggregated amount of chargebacks for payment transactions during the previous time period meets the threshold, wherein the threshold is a percentage of the total payment volume for the first user during the previous time period, as indicated by the particular aggregated value.
7 . The method of claim 1 , wherein the set of filter parameters includes one or more of the following filter parameters: a time range, a transaction amount, and security characteristics.
8 . The method of claim 1 , wherein the indication of the result of the processing operation specifies that the update is a chargeback relating to the particular event.
9 . The method of claim 1 , wherein the particular event corresponds to a security intrusion event within a computer network, and wherein the update corresponds to a lateral attack related to the particular event.
10 . A non-transitory, computer-readable medium storing program instructions that are executable on a computer system of a computer transaction service to perform operations comprising: asynchronously updating a set of counters based on monitoring events associated with transactions for a plurality of entities of the computer transaction service, wherein the set of counters is usable to store aggregated values of a transaction metric for the transactions occurring in respective ones of a plurality of time periods, wherein the updating includes: updating, responsive to detecting a particular event for a particular transaction associated with a first entity of the plurality of entities during a particular time period of the plurality of time periods, a certain counter of the set of counters to store an aggregated value of the transaction metric, the certain counter of the set of counters corresponding to the first entity and to the particular time period, wherein the updating is performed based on determining: counter functionality is enabled for the first entity based on comparing an identifier of the first entity with a list of entity identifiers for which counter functionality is enabled; and information associated with the particular event satisfies a set of filter parameters; detecting, in a later time period that is subsequent to the particular time period, an update event for the particular transaction; and in response to the detecting, in real time: accessing, from the certain counter, a particular aggregated value of the transaction metric for the particular time period; performing a processing operation that uses the particular aggregated value; and sending an indication of a result of the processing operation to the first entity.
11 . The computer-readable medium of claim 10 , wherein the operations comprise: updating a transaction database with transaction details for transactions handled by the computer transaction service, the transaction details for a given transaction including a value of the transaction metric, wherein the particular aggregated value of the transaction metric for the particular time period is not derivable from the transaction database in real time.
12 . The computer-readable medium of claim 10 , wherein performing the processing operation includes: determining that an update to an update counter associated with the first entity and the particular time period is warranted; and updating the update counter with an update transaction metric associated with the update event.
13 . The computer-readable medium of claim 10 , wherein the set of counters is maintained for the plurality of entities in response to receiving individual indications from the plurality of entities to implement an update service for those entities.
14 . The computer-readable medium of claim 10 , wherein the update event is detected by reading the updated event from a batch file that includes a plurality of update events.
15 . The computer-readable medium of claim 10 , wherein the set of filter parameters includes one or both of a time range filter parameter and a transaction amount filter parameter.
16 . A computer system configured to implement a transaction service, the computer system comprising: a processing system including one or more processor circuits; a memory system configured to store program instructions executable by the processing system to implement: a counter subsystem executable to manage a set of counters for users of the transaction service; and an update subsystem; wherein the counter subsystem is executable to: detect, during a particular time period, an event associated with a transaction between a first user and a second user of the transaction service, the transaction including a parameter having a particular value; and update, in response to receiving the transaction, a certain counter of the set of counters that corresponds to the first user and to the particular time period, wherein the certain counter has a current value of the parameter, and wherein the certain counter is updated by adding the particular value to the current value to replace the current value, wherein the counter subsystem is executable to perform the update based on determining: counter functionality is enabled for the first user based on comparing an identifier of the first user with a list of user identifiers for which counter functionality is enabled; and information associated with the transaction satisfies a set of filter parameters; and wherein the update subsystem is executable to: detect, in a later time period that is subsequent to the particular time period, an update event for the transaction; and in response to detection of the update event, process the update event in real time, wherein, to process the update event in real time, the update subsystem is further executable to: retrieve, from the set of counters, the current value of the parameter for the particular time period, the current value representing an aggregated value of the parameter for transactions involving the first user and occurring during the particular time period; perform a processing operation that uses the current value of the parameter; and send an indication of a result of the processing operation to the first user.
17 . The computer system of claim 16 , further comprising: a database system operable to store transaction details for transactions, including those of the first user, a given set of transaction details including a value of the parameter; wherein the aggregated value of the parameter for transactions involving the first user and occurring during the particular time period is not derivable from the database system in real time.
18 . The computer system of claim 16 , further comprising: an interface for the first user, wherein the computer system is operable to receive, via the interface, indications to activate features of the transaction service for the first user, including a particular indication that causes the transaction service to activate the counter subsystem and the update subsystem for subsequent transactions involving the first user.
19 . The computer system of claim 16 , wherein the set of filter parameters includes one or both of a time range filter parameter and a security characteristics filter parameter.
20 . The computer system of claim 16 , wherein the update subsystem is executable to perform the processing operation by updating an update counter with the set of counters within the counter subsystem, the update counter corresponding to updated events for the first user and the particular time period.

Description

The present application claims priority to PCT Appl. No. PCT/CN2024/129211, entitled “REAL-TIME COUNTER-FACILITATED RETRIEVAL OF AGGREGATED VALUES FOR PERFORMANCE OF A PROCESSING OPERATION”, filed Nov. 1, 2024, which is incorporated by reference herein in its entirety. BACKGROUND Technical Field This disclosure relates generally to processing of events by computer systems, and more particularly, to real-time processing of updates to events. Description of the Related Art Real-time processing performed by computer services is a critical aspect of modern technology, allowing for rapid responses to data input. This type of processing is essential in various industries, including finance, healthcare, computer security, and telecommunications, in which split-second decisions and actions can have significant consequences. Real-time processing allows for quick decision-making, rapid responses to changing conditions, and the ability to provide up-to-date information to users. Computer services today are also commonly tasked with processing extremely large volumes of data. Payment services, for example, may be expected to handle at least millions of transactions a minute, and store information about these transactions for some length of time. Computer security services, as another example, may monitor and evaluate at least hundreds of thousands of security events at a time to adequately protect against cyber threats and data breaches. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 illustrates one embodiment of a computer system configured to perform a processing operation in real time based on retrieving an aggregated value from a counter of a set of counters. FIG. 2 illustrates an example event processing subsystem of the computer system. FIG. 3 depicts an example database operable to store event details associated with an event. FIG. 4A depicts an example plurality of counters usable to store aggregated values and aggregated update values for a plurality of time periods. FIG. 4B depicts an example of counter logic. FIG. 5A depicts examples of an event and an update event corresponding to the event. FIG. 5B depicts an example batch file that includes a plurality of update events. FIG. 6A illustrates one embodiment of an update control subsystem. FIG. 6B is a flow diagram of one embodiment of a method to initiate a processing operation. FIG. 7 is a flow diagram of one embodiment of a processing operation. FIG. 8 is a flow diagram illustrating a specific example of a processing operation applied to a chargeback scenario. FIG. 9 is an example timing diagram illustrating temporal aspects of a processing operation. FIG. 10 is a block diagram illustrating an example of a computer system configured to implement a transaction service. FIG. 11 is a flow diagram of one embodiment of a method for real-time counter-facilitated retrieval of aggregated values for performance of a processing operation. FIG. 12 is a flow diagram of one embodiment of a method for real-time counter-facilitated retrieval of aggregated values for performance of a processing operation. FIG. 13 is a block diagram of another embodiment of a computer system configured to implement a transaction service. DETAILED DESCRIPTION This disclosure concerns computer services that execute on computer systems that are referred to as event processing systems. These computer systems are operable to recognize and take action in response to detection of certain occurrences or triggers, which are referred to herein as “events.” A given event processing system is operable to recognize a particular set of events. In one such system, receipt of a user financial transaction is an event. Detecting a network communication (e.g., source IP address, destination IP address, ports involved, etc.) is an event for another event processing system. Event processing systems are operable to gather data associated with events (which may be referred to herein as “event data” or “event details”) and use this data to determine how to respond to those events. Services implemented by computer systems frequently handle large volumes of events. Additionally, computer services may frequently need or desire to retain information about events for subsequent processing. When the number of such events is large (e.g., in the billions) and the length of retention is relatively long (e.g., up to one year), the size of the data store (e.g., a database) needed to house this information can be exceedingly large. The latency required to access such a data store grows with the size of the data store. Consider a scenario in which a computer service receives an indication of an event that is related to one or more prior events stored in a high-volume data store, and the processing of which depends on accessing—in real time—information about those prior events. The event may be considered an “update event” to a prior event in some cases. In a payment context, the update event may be a “chargeback”—that is, an indica