Method and system for performing fraud detection for users with infrequent activity

• US 10,467,687 B2
• Filed: 11/25/2009
• Issued: 11/05/2019
• Est. Priority Date: 11/25/2009
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Lanxner, Eyal S., Raz, Shay
• Primary Examiner(s): Ouellette, Jonathan P
• Application Number:
  US12/626,061
• Publication Number:
  US 20110125658A1
• Time in Patent Office: 3,632 Days
• Field of Search: 702185, 705 35, 705 1439, 705 38, 705 39, 705318, 705325, 705 11-912
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 30/0282 Rating or review of business operators or products
• CPC Class Codes: G06Q 30/0603 Catalogue ordering
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety

Abstract

A method of categorizing a recent transaction as anomalous includes a) receiving information about a recent transaction and b) accessing information about one or more historical transactions. The one or more historical transactions have at least one party in common with the recent transaction. The method also includes c) determining a similarity value between the recent transaction and a transaction i of the one or more historical transactions and d) determining if the similarity value is greater than or equal to a predetermined threshold value. The method further includes e) if the similarity is greater than or equal to the predetermined threshold value, categorizing the recent transaction as not anomalous or f) if the similarity is less than the predetermined threshold value, determining if there are additional transactions. If there are additional transactions, incrementing counter i and repeating steps c) through f).

Claims

1. A non-transitory computer readable medium having instructions stored thereon which, when executed by a computer processor, cause the computer processor to perform operations comprising:

for each previous transaction among one or more historical transactions for a party;

determining, by the computer processor configured to automate categorization, a similarity value between a current transaction for the party and the previous transaction, wherein the similarity value is determined by computing an initial weight for each of the properties of a set of properties, computing a similarity between each of the properties of the current transaction and the properties of the previous transaction, adjusting the initial weight for each of the properties based on a measure of the commonness of each of the properties of the set of properties, normalizing the adjusted weights, and computing the similarity value by summing the products of the normalized adjusted weights and the computed similarities;

determining, by the computer processor configured to automate categorization, that the similarity value is greater than or equal to a predetermined threshold value;

categorizing, by an anomaly confidence generator component of the computer processor, the current transaction as not anomalous in response to determining that the similarity value is greater than or equal to the predetermined threshold value;

determining, by the computer processor configured to automate categorization, a factor for the previous transaction based on an age of the previous transaction;

computing, by the computer processor configured to automate categorization, a rank for the previous transaction using the similarity value and the factor; and

storing, by the computer processor configured to automate categorization, the computed rank in a database configured to store the computed rank; and

computing, by the computer processor configured to automate categorization, a confidence in the categorization of the current transaction as not anomalous based on the stored ranks, wherein the confidence indicates whether the current transaction for the party is a fraudulent transaction, and wherein the current transaction is an Internet log-in.

2. The computer readable medium of claim 1 wherein the factors for the one or more historical transactions increase with the age of the one or more historical transactions.

3. The computer readable medium of claim 1 wherein the operations further comprise determining a maximum of the stored ranks, and wherein the confidence is based on the maximum of the stored ranks.

4. The computer readable medium of claim 1 wherein the party comprises an Internet user.

5. The computer readable medium of claim 1 wherein the computed rank is a function of the similarity value multiplied by the factor.

6. The computer readable medium of claim 1 wherein the computed rank is based on a status of the previous transaction and the similarity value for the previous transaction.

7. A computer-implemented method comprising:

for each previous transaction among one or more historical transactions for a party;

determining, by a computer processor configured to automate categorization, a similarity value between a current transaction for the party and the previous transaction, wherein the similarity value is determined by computing an initial weight for each of the properties of a set of properties, computing a similarity between each of the properties of the current transaction and the properties of the previous transaction, adjusting the initial weight for each of the properties based on a measure of the commonness of each of the properties of the set of properties, normalizing the adjusted weights, and computing the similarity value by summing the products of the normalized adjusted weights and the computed similarities;

determining, by the computer processor configured to automate categorization, that the similarity value is greater than or equal to a predetermined threshold value;

categorizing, by an anomaly confidence generator component of the computer processor, the current transaction as not anomalous in response to determining that the similarity value is greater than or equal to the predetermined threshold value;

determining, by the computer processor configured to automate categorization, a factor for the previous transaction based on an age of the previous transaction;

computing, by the computer processor configured to automate categorization, a rank for the previous transaction using the similarity value and the factor; and

storing, by the computer processor configured to automate categorization, the computed rank in a database configured to store the computed rank; and

computing, by the computer processor configured to automate categorization, a confidence in the categorization of the current transaction as not anomalous based on the stored ranks, wherein the confidence indicates whether the current transaction for the party is a fraudulent transaction, and wherein the current transaction is an Internet log-in.

8. The method of claim 7 further comprising determining a maximum of the stored ranks, and wherein the confidence is based on the maximum of the stored ranks.

9. The method of claim 7 wherein the one or more historical transactions comprise three or more transactions.

10. The method of claim 7 wherein the computed rank is a function of the similarity value multiplied by the factor.

11. The method of claim 7 wherein the computed rank is based on a status of the previous transaction and the similarity value for the previous transaction.

12. The method of claim 11 wherein the status of at least one of the historical transactions is a rejected status.

13. The method of claim 12 wherein the factor is equal to one for the rejected status.

14. The method of claim 7 wherein the factors for the one or more historical transactions increase with the age of the one or more historical transactions.

15. A computer-implemented method comprising:

for each previous transaction among one or more historical transactions for a party;

determining, by a computer processor configured to automate categorization, a similarity value between a current transaction for the party and the previous transaction, wherein the similarity value is determined by computing an initial weight for each of the properties of a set of properties, computing a similarity between each of the properties of the current transaction and the properties of the previous transaction, adjusting the initial weight for each of the properties based on a measure of the commonness of each of the properties of the set of properties, normalizing the adjusted weights, and computing the similarity value by summing the products of the normalized adjusted weights and the computed similarities;

determining, by the computer processor configured to automate categorization, that the similarity value is less than a predetermined threshold value;

categorizing, by an anomaly confidence generator component of the computer processor, the current transaction as anomalous in response to determining that the similarity value is less than the predetermined threshold value;

determining, by the computer processor configured to automate categorization, a factor for the previous transaction based on an age of the previous transaction;

computing, by the computer processor configured to automate categorization, a rank for the previous transaction using the similarity value and the factor; and

storing, by the computer processor configured to automate categorization, the computed rank in a database configured to store the computed rank; and

computing, by the computer processor configured to automate categorization, a confidence in the categorization of the current transaction as anomalous based on the stored ranks, wherein the confidence indicates whether the current transaction for the party is a fraudulent transaction, and wherein the current transaction is an Internet log-in.

16. The method of claim 15 further comprising determining a maximum of the stored ranks, and wherein the confidence is based on the maximum of the stored ranks.

17. The method of claim 15 wherein the one or more historical transactions comprise three or more transactions.

18. The method of claim 15 wherein the computed rank is based on a status of the previous transaction and the similarity value for the previous transaction.

19. The method of claim 18 wherein the status of at least one of the historical transactions is a rejected status.

20. The method of claim 19 wherein the factor is equal to one for the rejected status.

21. The method of claim 15 wherein the factors for the one or more historical transactions increase with the age of the one or more historical transactions.

22. The method of claim 15 wherein the computed rank is a function of the similarity value multiplied by the factor.

23. A system comprising:

a computer processor configured to automate categorization; and

a non-transitory computer readable medium coupled to the computer processor and having instructions stored thereon, which when executed by the computer processor, cause the computer processor to;

for each previous transaction among one or more historical transactions for a party;

determine a similarity value between a current transaction for the party and the previous transaction, wherein the similarity value is determined by computing an initial weight for each of the properties of a set of properties, computing a similarity between each of the properties of the current transaction and the properties of the previous transaction, adjusting the initial weight for each of the properties based on a measure of the commonness of each of the properties of the set of properties, normalizing the adjusted weights, and computing the similarity value by summing the products of the normalized adjusted weights and the computed similarities;

determine that the similarity value is greater than or equal to a predetermined threshold value;

categorize, via an anomaly confidence generator component of the computer processor, the current transaction as not anomalous in response to the determination that the similarity value is greater than or equal to the predetermined threshold value;

determine a factor for the previous transaction based on an age of the previous transaction;

compute a rank for the previous transaction using the similarity value and the factor; and

store the computed rank in a database configured to store the computed rank; and

compute a confidence in the categorization of the current transaction as not anomalous based on the stored ranks, wherein the confidence indicates whether the current transaction for the party is a fraudulent transaction, and wherein the current transaction is an Internet log-in.

24. The system of claim 23 wherein the factors for the one or more historical transactions increase with the age of the one or more historical transactions.

25. The system of claim 23 wherein the instructions further cause the computer processor to determine a maximum of the stored ranks, and wherein the confidence is based on the maximum of the stored ranks.

26. The system of claim 23 wherein the party comprises an Internet user.

27. The system of claim 23 wherein the computed rank is a function of the similarity value multiplied by the factor.

28. The system of claim 23 wherein the computed rank is based on a status of the previous transaction and the similarity value for the previous transaction.