Detection of activity patterns
First Claim
1. A fraud linking system for identifying links between determined fraud events detected in external systems, each external system having at least one fraud detection engine, the fraud linking system comprising:
- an external interface configured to receive alerts reporting determined fraud events detected in the external systems by the respective at least one fraud detection engine;
a storage device configured to store determined historical fraud events in a database including the received determined fraud events in the alerts;
a processor comprising hardware configured to provide;
an alert classifier arranged to implement a plurality of match methods for detecting links between a received alert from one of the external systems and one or more stored determined historical fraud events or another received alert from another one of the external systems, each match method implementing different matching criteria, the alert classifier thereby generating and outputting a respective score for each match method representative of the extent of matching with one or more identified determined historical fraud events or another received alert; and
a voting engine for applying a set of weightings to the scores generated by the classifier for each of the match methods and for determining that there is a link with an identified determined historical fraud event or another received alert if a combination of the weighted scores exceeds a predetermined threshold.
3 Assignments
0 Petitions
Accused Products
Abstract
A monitoring system (1) comprises an interface (2) for receiving source alerts from at least one detection engine, a database (7) of historical events; and a classifier (3) for classifying received source alerts by linking a source alert with an historical event or a current source alert to provide a link, and providing said link as an output alert. The classifier comprises match methods (9) for processing source alerts and generating a score for extent of matching of a source alert with an historical event or current source alert, a voting engine (4) for weighting scores from the match methods (9), and a linking function (6) for determining that there is a link if a combination of the weighted outputs of a plurality of match methods exceeds a threshold. At least some match methods (9) are each associated with a specific field of a source alert such as a numerical value field or a name field of a source alert. A feedback function (6) notifies a case management system (5) of links, and the voting engine (4) receives from the case management system (5) feedback (11) of success of each match method (9), and adjusts match method weights (12) accordingly.
-
Citations
18 Claims
-
1. A fraud linking system for identifying links between determined fraud events detected in external systems, each external system having at least one fraud detection engine, the fraud linking system comprising:
-
an external interface configured to receive alerts reporting determined fraud events detected in the external systems by the respective at least one fraud detection engine; a storage device configured to store determined historical fraud events in a database including the received determined fraud events in the alerts; a processor comprising hardware configured to provide; an alert classifier arranged to implement a plurality of match methods for detecting links between a received alert from one of the external systems and one or more stored determined historical fraud events or another received alert from another one of the external systems, each match method implementing different matching criteria, the alert classifier thereby generating and outputting a respective score for each match method representative of the extent of matching with one or more identified determined historical fraud events or another received alert; and a voting engine for applying a set of weightings to the scores generated by the classifier for each of the match methods and for determining that there is a link with an identified determined historical fraud event or another received alert if a combination of the weighted scores exceeds a predetermined threshold. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18)
-
Specification