Systems and methods for fraud detection via interactive link analysis

Patent metadata

Field	Value
Publication number	US-10769290-B2
Application number	US-17585808-A
Country	US
Kind code	B2
Filing date	Jul 18, 2008
Priority date	May 11, 2007
Publication date	Sep 8, 2020
Grant date	Sep 8, 2020

Abstract

Fraud detection is facilitated by developing account cluster membership rules and converting them to database queries via an examination of clusters of linked accounts abstracted from the customer database. The cluster membership rules are based upon certain observed data patterns associated with potentially fraudulent activity. In one embodiment, account clusters are grouped around behavior patterns exhibited by imposters. The system then identifies those clusters exhibiting a high probability of fraud and builds cluster membership rules for identifying subsequent accounts that match those rules. The rules are designed to define the parameters of the identified clusters. When the rules are deployed in a transaction blocking system, when a rule pertaining to an identified fraudulent cluster is triggered, the transaction blocking system blocks the transaction with respect to new users who enter the website.

First claim

What is claimed is:

1. A system for detecting fraud by displaying visual representations of data relating to entities-of-interest that are indicative of fraud, the system comprising:
a first database that stores at least one attribute of a plurality of the entities-of-interest;
a second database, remote from the first database, that stores at least one attribute of the plurality of the entities-of-interest;
a pattern match generator that generates pattern matching rules;
a pattern matcher that receives the pattern matching rules and applies the pattern matching rules to recognize links between at least one attribute of two or more of the entities-of-interest according to one or more of the pattern matching rules, where the pattern matching rules are generated using the pattern match generator;
a layer builder that, based on the links recognized by the pattern matcher, creates an internal data structure that represents relationships between the two or more of the entities-of-interest in terms of types of links between the two or more of the entities-of-interest, number of links between the two or more of the entities-of-interest, and numerical strength of links between the two or more of the entities-of-interest;
a cluster explainer that derives rules that define requirements for the two or more of the entities-of-interest to be included in a cluster and categorize the two or more of the entities-of-interest that satisfy the defined requirements as potentially fraudulent entities, wherein the derived rules are applied to one or more first database-related transactions in real time and to one or more second database-related transactions in real-time to detect credit history transactions categorized as potentially fraudulent; and
an interface for displaying a visual representation of the relationships between the two or more of the entities-of-interest, as expressed by the layer builder, to a user, and
an editor for receiving an input from the user that indicates a user-generated requirement to modify the defined requirements to be included in the cluster and categorized as potentially fraudulent entities;
where displaying the visual representation comprises:
displaying in one of a plurality of locations of the interface different types of links between the two or more of the entities-of-interest as different colors, and displaying in another of the plurality of locations of the interface the numerical strength of links between the two or more of the entities-of-interest as lines of different thickness between the two or more of the entities-of-interest.

2. The system of claim 1 , wherein the editor is configured to query the first database to determine if additional entities-of-interest satisfy modified requirements to be included in the cluster and categorized as a potentially fraudulent entity.

3. The system of claim 2 , wherein the pattern matcher creates a dataset comprising a list of the two or more of the entities-of-interest and the links by which they are connected; and
the dataset is loaded into the layer builder.

4. The system of claim 3 , further comprising:
a pattern editor that creates new pattern matching rules based on additional requirements input by the user.

5. The system of claim 1 , wherein the at least one attribute includes a credit history of an individual.

6. The system of claim 1 , wherein the at least one attribute includes insurance claims.

7. The system of claim 1 , wherein the at least one attribute includes debit card transactions.

8. A fraud detection method, the method comprising:
searching a first database that stores at least one attribute of a plurality of entities-of-interest;
searching a second database that stores at least one attribute of the plurality of entities-of-interest;
generating pattern matching rules;
applying the generated pattern matching rules to recognize links between at least one attribute of two or more of the entities-of-interest according to one or more of the pattern matching rules;
expressing relationships in terms of types of links between the two or more of the entities-of-interest, number of links between the two or more of the entities-of-interest, and numerical strength of links between by the two or more of the entities-of-interest;
electronically displaying the relationship between the two or more of the entities-of-interest, to a user;
deriving rules that define requirements for the two or more of the entities-of-interest to be included in a cluster and categorize the two or more of the entities-of-interest that satisfy the defined requirements as potentially fraudulent entities, wherein the derived rules are applied to one or more first database-related transactions in real time and to one or more second database-related transactions in real-time to detect credit history transactions categorized as potentially fraudulent; and
receiving input from the user to modify the defined requirements to be included in the cluster and categorized as potentially fraudulent entities; and
electronically displaying different types of links between the two or more of the entities-of-interest as different colors, and displaying the numerical strength of links between the two or more of the entities of interest as lines of different thickness between the two or more of the entities-of-interest.

9. The method of claim 8 , further comprising:
querying the first database to determine if additional entities satisfy the modified requirements to be included in the cluster and categorized as a potentially fraudulent entity.

10. The method of claim 9 , further comprising:
creating a dataset comprising a list of the two or more of the entities-of-interest and the links by which they are connected; and
loading the dataset.

11. The method of claim 10 , further comprising:
creating new pattern matching rules based on additional requirements input by the user.

12. The method of claim 8 , wherein the at least one attribute includes a credit history of an individual comprising an entity of interest.

13. The method of claim 8 , wherein the at least one attribute includes insurance claims.

14. The method of claim 8 , wherein the at least one attribute includes debit card transactions.

Assignees

• Crawford Stuart L
• Erickson Chris
• Miagkikh Victor
• Steele Michael
• Thorsen Megan
• Tolmanov Sergei
• Fair Isaac Corp

Inventors

• Crawford Stuart L
• Erickson Chris
• Miagkikh Victor
• Steele Michael
• Thorsen Megan
• Tolmanov Sergei

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06Q30/0601

  Electronic shopping [e-shopping] · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06Q30/06

  Buying, selling or leasing transactions · CPC title