System and Method of Fraud and Misuse Detection

• US 20070220604A1
• Filed: 03/19/2007
• Published: 09/20/2007
• Est. Priority Date: 05/31/2005
• Status: Active Grant

• Current Assignee: Fairwarning IP LLC
• Original Assignee: Kurt Long
• Inventors: Long, Kurt
• Granted Patent: US 8,578,500 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: Y02A 90/10 Information and communication technologies [ICT] supporting adaptation to climate change, e.g. for weather forecasting or climate simulation

Abstract

A system and method are provided for detecting fraud and/or misuse of data in a computer environment through generating a rule for monitoring at least one of transactions and activities that are associated with the data. The rule can be generated based on one or more criteria related to the at least one of the transactions and the activities that is indicative of fraud or misuse of the data. The rule can be applied to the at least one of the transactions and the activities to determine if an event has occurred, where the event occurs if the at least one criteria has been met. A hit is stored if the event has occurred and a notification can be provided if the event has occurred. A compilation of hits related to the rule can be provided.

Claims

1. A method of detecting fraud or misuse of data in a computer environment, the method comprising:

generating a rule for monitoring at least one of transactions and activities that are associated with the data, the rule comprising at least one criteria related to the at least one of the transactions and the activities that is indicative of fraud or misuse of the data;

applying the rule to the at least one of the transactions and the activities to determine if an event has occurred, the event occurring if the at least one criteria has been met;

storing a hit if the event has occurred;

providing modification if the event has occurred; and

providing a compilation of hits related to the rule.

2. The method of claim 1, further comprising scheduling application of the rule to the at least one of the transactions and the activities.

3. The method of claim 1, further comprising:

determining if the rule is to be applied to the at least one of the transactions and the activities in real time; and

scheduling the application of the rule to the at least one of the transactions and the activities if the rule is not to be applied in real time.

4. The method of claim 1, further comprising designating a recipient of the notification and generating a message to be sent with the notification.

5. The method of claim 1, further comprising choosing the at least one criteria for the rule based at least in part on at least one of a time parameter, a volume parameter and a user parameter.

6. The method of claim 1, further comprising applying the rule to the at least one of the transactions and the activities associated with the data from a plurality of databases.

7. The method of claim 1, further comprising choosing the at least one criteria for the rule based at least in part on a time parameter and a volume parameter.

8. The method of claim 1, further comprising providing a rule management page for selection of the at least one criteria and generating the rule based at least in part on the at least one criteria selected.

9. The method of claim 8, further comprising:

providing a rule scheduling page for selection of a schedule for application of the rule to the at least one of the transactions and the activities; and

applying the rule to the at least one of the transactions and the activities according to the schedule to determine if the event has occurred.

10. The method of claim 1, further comprising scheduling the application of the rule in real time.

11. The method of claim 1, further comprising designating an electronic mail address for receipt of the notification.

12. A system for detecting fraud or misuse of data in a computer environment, the system comprising:

a user interface for selection of at least one criteria related to at least one of transactions and activities associated with the data that is indicative of fraud or misuse of the data and for selection of a schedule for application of a rule for monitoring the at least one of the transactions and the activities; and

a microprocessor in communication with the user interface and having access to the transactions and the activities of the data, the microprocessor generating the rule based at least in part on the at least one criteria selected and applying the rule to the at least one of the transactions and the activities according to the schedule selected to determine if an event has occurred, wherein the event occurs if the at least one criteria has been met, wherein the microprocessor stores a hit if the event has occurred, wherein the microprocessor provides notification if the event has occurred, and wherein the microprocessor provides notification if the event has occurred, and wherein the microprocessor generates a compilation of hits related to the rule.

13. The system of claim 12, wherein the microprocessor determines if the rule is to be applied to the at least one of the transactions and the activities in real time.

14. The system of claim 12, wherein the microprocessor generates a message to be sent with the notification.

15. The system of claim 12, wherein the microprocessor generates the rule based at least in part on at least one of a time parameter, a volume parameter and a user parameter.

16. The system of claim 12, wherein the microprocessor applies the rule to the at least one of the transactions and the activities associated with the data from a plurality of databases.

17. A computer readable program embodied in an article of manufacture comprising computer readable program instructions for detecting fraud or misuse of data in a computer environment, said program comprising:

program instructions for causing the computer to provide a selection of at least one criteria related to at least one of transactions and activities associated with the data that is indicative of fraud or misuse of the data;

program instructions for causing the computer to generate a rule based at least in part on the at least one criteria for monitoring the at least one of the transactions and the activities;

program instructions for causing the computer to provide a selection for a schedule for application of the rule to the at least one of the transactions and the activities;

program instructions for causing the computer to apply the rule according to the schedule selected to the at least one of the transactions and the activities to determine if an event has occurred, the event occurring if the at least one criteria has been met;

program instructions for causing the computer to store a hit if the event has occurred;

program instructions for causing the computer to provide notification if the event has occurred; and

program instructions for causing the computer to provide a compilation of hits related to the rule.

18. The program of claim 17, further comprising program instructions for causing the computer to apply the rule to the at least one of the transactions and the activities associated with the data from a plurality of databases.

19. The program of claim 17, further comprising program instructions for causing the computer to apply the rule to the at least one of the transactions and the activities in real time.

20. The program of claim 17, further comprising program instructions for causing the computer to generate the rule based at least in part on at least one of a time parameter, a volume parameter and a user parameter.