ENHANCED FRAUD MONITORING SYSTEMS

• US 20070028301A1
• Filed: 06/30/2006
• Published: 02/01/2007
• Est. Priority Date: 07/01/2005
• Status: Abandoned Application

• Current Assignee: MarkMonitor Inc.
• Original Assignee: MarkMonitor Inc.
• Inventors: Shull, Mark, Shraim, Ihab
• Application Number:
  US11/428,072
• Publication Number:
  US 20070028301A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Various embodiments of the invention provide systems and methods for the enhanced detection and/or prevention of fraud. A set of embodiments provides, for example, a facility where companies (online businesses, banks, ISPs, etc.) provide a security provider with fraud feeds (such as, to name one example, a feed of email messages from third parties addressed to customers of those businesses), as well as systems and methods of implementing such a facility. In some embodiments, feeds (such as messages) may be analyzed to create normalized direct and/or derived data which then may be made available to such companies (perhaps for a fee). By defining and controlling access to the direct and derived data, a security provider may enable such companies to negotiate bilateral and other agreements between themselves as to who they will exchange data with, what data will be exchanged, and under what commercial and other terms such data will be exchanged.

Claims

1. A method for providing enhanced fraud monitoring, the method comprising:

receiving from a first entity direct information related to fraudulent online activity;

analyzing the direct information;

creating a set of normalized data related to the fraudulent online activity, wherein the set of normalized data is in a form readable by a plurality of entities; and

storing the set of normalized data.

2. The method of claim 1, wherein analyzing the direct information comprises generating a set of derived information related to the fraudulent online activity.

3. The method of claim 2, wherein generating the set of derived information related to the fraudulent online activity is based on the direct information and previously saved information related to other fraudulent online activity.

4. The method of claim 3, wherein the saved information comprises direct information and derived information.

5. The method of claim 2, wherein the set of normalized data includes the direct information and the derived information.

6. The method of claim 1, further comprising:

receiving from a second entity of the plurality of entities a request to access the stored normalized data; and

controlling access to the stored normalized data by the second entity.

7. The method of claim 6, wherein controlling access to the stored normalized data by the second entity is based on an agreement between the first entity and the second entity.

8. The method of claim 6, further comprising providing at least a portion of the stored normalized data to the second entity.

9. The method of claim 6, wherein receiving the direct information from the first entity comprises receiving the direct information via an Application Program Interface (API).

10. The method of claim 9, wherein receiving the request to access the stored normalized data comprises receiving the request via the API.

11. The method of claim 10, wherein the stored normalized data is maintained by the first entity and the API provides finctions for the second entity to request the stored normalized data from the first entity.

12. The method of claim 10, wherein the stored normalized data is maintained by a security service and the API provides functions for the first entity to provide the direct information to the security service and for the second entity to request the stored normalized data from the security service.

13. The method of claim 10, wherein the API provides for receiving the direct information, analyzing the direct information, creating the set of normalized data, and accessing the stored normalized data through a plurality of data attributes.

14. The method of claim 13, wherein the data attributes comprise entity specific attributes specific to either the first entity or the second entity.

15. The method of claim 13, wherein the data attributes comprise shared attributes that can be shared between the first entity and the second entity based on permissions established by the first entity and the second entity.

16. The method of claim 13, wherein the API further comprises a schema defining the data attributes.

17. The method of claim 16, wherein the schema comprises an extensible Markup Language (XML) schema.

18. The method of claim 16, wherein the schema further comprises metadata tagged to the data attributes.

19. The method of claim 18, wherein the metadata tracks the data attributes to which it is tagged.

20. A machine-readable medium having stored thereon a series of instructions that, when executed by a processor, cause the processor to provide enhanced fraud monitoring by:

receiving from a first entity direct information related to fraudulent online activity;

analyzing the direct information;

creating a set of normalized data related to the fraudulent online activity, wherein the set of normalized data is in a form readable by a plurality of entities; and

storing the set of normalized data.

21. The machine-readable medium of claim 20, further comprising:

receiving from a second entity of the plurality of entities a request to access the stored normalized data; and

controlling access to the stored normalized data by the second entity.

22. The machine-readable medium of claim 21, wherein controlling access to the stored normalized data by the second entity is based on an agreement between the first entity and the second entity.

23. The machine-readable medium of claim 21, further comprising providing at least a portion of the stored normalized data to the second entity.

24. The machine-readable medium of claim 21, wherein receiving the direct information from the first entity comprises receiving the direct information via an Application Program Interface (API).

25. The machine-readable medium of claim 20, wherein receiving the request to access the stored normalized data comprises receiving the request via the API.

26. The machine-readable medium of claim 25, wherein the stored normalized data is maintained by the first entity and the API provides functions for the second entity to request the stored normalized data from the first entity.

27. The machine-readable medium of claim 25, wherein the stored normalized data is maintained by a security service and the API provides functions for the first entity to provide the direct information to the security service and for the second entity to request the stored normalized data from the security service.

28. The machine-readable medium of claim 25, wherein the API provides for receiving the direct information, analyzing the direct information, creating the set of normalized data, and accessing the stored normalized data through a plurality of data attributes.

29. The machine-readable medium of claim 28, wherein the data attributes comprise entity specific attributes specific to either the first entity or the second entity.

30. The machine-readable medium of claim 28, wherein the data attributes comprise shared attributes that can be shared between the first entity and the second entity based on permissions established by the first entity and the second entity.

31. A system for providing enhanced fraud monitoring, the system comprising:

a communication network;

a first client communicatively coupled with the communication network and adapted to provide direct information related to fraudulent online activity; and

a server communicatively coupled with the communication network and adapted to receive from the first client direct information related to fraudulent online activity, analyze the direct information, create a set of normalized data related to the fraudulent online activity, wherein the set of normalized data is in a form readable by a plurality of clients, and store the set of normalized data.

32. The system of claim 31, wherein the server is further adapted to generate a set of derived information related to the fraudulent online activity.

33. The system of claim 32, wherein the server is adapted to generate the set of derived information related to the fraudulent online activity based on the direct information and previously saved information related to other fraudulent online activity.

34. The system of claim 33, wherein the saved information comprises direct information and derived information.

35. The system of claim 32, wherein the set of normalized data includes the direct information and the derived information.

36. The system of claim 31, further comprising a second client and wherein the server is further adapted to receive from the second client a request to access the stored normalized data and control access to the stored normalized data by the second client.

37. The system of claim 36, wherein the server is adapted to control access to the stored normalized data by the second client based on an agreement between the first client and the second client.

38. The system of claim 36, wherein the server is further adapted to provide at least a portion of the stored normalized data to the second client.

39. The system of claim 36, wherein the server is adapted to receive the direct information from the first client via an Application Program Interface (API).

40. The system of claim 39, wherein the server receives the request to access the stored normalized data via the API.

41. The system of claim 40, wherein the API provides for receiving the direct information, analyzing the direct information, creating the set of normalized data, and accessing the stored normalized data through a plurality of data attributes.

42. The system of claim 41, wherein the data attributes comprise entity specific attributes specific to either the first client or the second client.

43. The system of claim 41, wherein the data attributes comprise shared attributes that can be shared between the first client and the second client based on permissions established by the first client and the second client.

44. A system for providing enhanced fraud monitoring, the system comprising:

a communication network;

a first client communicatively coupled with the communication network and adapted to generate direct information related to fraudulent online activity, analyze the direct information, create a set of normalized data related to the fraudulent online activity, wherein the set of normalized data is in a form readable by a plurality of clients, and store the set of normalized data;

a second client communicatively coupled with the communication network and adapted to request to access stored the stored normalized data;

a server communicatively coupled with the communication network and adapted to receive from the second a request to access the stored normalized data and control access to the stored normalized data by the second client.

45. The system of claim 44, wherein the server is adapted to control access to the stored normalized data by the second client based on an agreement between the first client and the second client.

46. The system of claim 44, wherein the first client is further adapted to provide at least a portion of the stored normalized data to the second client.

47. The system of claim 44, wherein the server is adapted to receive the request to access the stored normalized data from the second client by receiving the request via an Application Program Interface (API).

48. The system of claim 47, wherein the API provides for accessing the stored normalized data through a plurality of data attributes.

49. The system of claim 48, wherein the data attributes comprise client specific attributes specific to either the first client or the second client.

50. The system of claim 48, wherein the data attributes comprise shared attributes that can be shared between the first client and the second client based on permissions established by the first client and the second client.