Detecting Fraudulent Activity on a Network Using Stored Information

• US 20080115213A1
• Filed: 11/14/2006
• Published: 05/15/2008
• Est. Priority Date: 11/14/2006
• Status: Abandoned Application

• Current Assignee: FMR LLC
• Original Assignee: FMR Corporation (FMR LLC)
• Inventors: Singh, Stephen, Kulkarni, Rajandra Laxman, Bhatt, Vijay C., Greenberg, Adam
• Application Number:
  US11/559,771
• Publication Number:
  US 20080115213A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Described are computer-based methods and apparatuses, including computer program products, for detecting fraudulent activity on a network using stored information. An user utilizes a transmitting device to transmit user requests that are split between a plurality of data centers for processing. The user requests are captured at the data centers. The user requests are unified into an user session. The user session can be analyzed for fraud detection, marketing analysis, network intrusion detection, customer service analysis, and/or performance analysis. If fraudulent activity is detected, then the user can be interdicted to prevent further fraudulent activity.

Claims

1. A method of detecting fraudulent activity on a network, the method comprising:

receiving user requests from a plurality of data centers;

combining the user requests to form a user session, wherein the user requests were separated for processing among the plurality of data centers;

storing elements associated with the user session in a memory module; and

performing an analysis of the user session using the elements stored in the memory module.

2. The method of claim 1 wherein the memory module is volatile memory.

3. The method of claim 1 wherein the elements in the memory module are stored in persistent storage.

4. The method of claim 1 wherein the elements comprise user identification, network address, time, network path, length of time logged into the system, transactions, or combinations thereof.

5. The method of claim 1 wherein the plurality of data centers receive the user requests from a load balancer.

6. The method of claim 5 wherein the load balancer sends the user requests to the different data centers in the plurality of data centers according to available capabilities of the data centers, conditions of the network, quality of service indicators on the data packets, application availability, number of connections to each data center, pre-defined routing instructions, or combinations thereof.

7. The method of claim 1 wherein servers at the data centers process the user requests at or near the same time and separately from the unification engine unifying the user session.

8. A computer program product, tangibly embodied in an information carrier, the computer program product including instructions being operable to cause a data processing apparatus to:

receive user requests from a plurality of data centers;

combine the user requests to form a user session, wherein the user requests were separated for processing among the plurality of data centers; and

store elements associated with the user session in a memory module; and

perform an analysis of the user session using the elements stored in the memory module.

9. A system for detecting fraudulent activity on a network, the system comprising:

a unification engine configured and adapted to receive user requests from a plurality of data centers and process the user requests to unify user sessions;

a database system configured and adapted to store elements associated with the user session in a memory module; and

a fraud detection system configured and adapted to determine whether the user session is fraudulent using the elements stored in the memory module.

10. The system of claim 9 wherein the memory module is volatile memory.

11. The system of claim 9 wherein the elements in the memory module are stored in persistent storage.

12. The system of claim 9 wherein the fraud detection system comprises a memory module, a profiling engine, a rule engine, or combinations thereof.

13. The system of claim 9, further comprising:

a data collection system configured and adapted to collect user requests at a data center.

14. The system of claim 9, further comprising:

a load balancer configured and adapted to transmit the user requests to the data center selected from a plurality of data centers.

15. The system of claim 9, further comprising:

one or more servers at the data centers configured and adapted to process the user requests at or near the same time and separately from the unification engine unifying the user sessions.

16. A system for detecting fraudulent activity on a network, the system comprising:

a means for unifying user sessions to receive user requests from a plurality of data centers and process the user requests to unify user sessions;

a means for storing elements associated with the user session in a memory module; and

a means for fraud detection to determine whether the user session is fraudulent.

17. The system of claim 16, further comprising:

a means for load balancing to transmit the user requests to the data center selected from a plurality of data centers.