SYSTEM AND METHOD FOR DETECTING AND MANAGING FRAUD
2 Assignments
0 Petitions
Accused Products
Abstract
A system, method and computer program product for processing event records. The present invention includes a detection layer, an analysis layer, an expert systems layer and a presentation layer. The layered system includes a core infrastructure and a configurable, domain-specific implementation. The detection layer employs one or more detection engines, such as, for example, a rules-based thresholding engine and a profiling engine. The detection layer can include an AI-based pattern recognition engine for analyzing data records, for detecting new and interesting patterns and for updating the detection engines to insure that the detection engines can detect the new patterns. In one embodiment, the present invention is implemented as a telecommunications fraud detection system. When fraud is detected, the detection layer generates alarms which are sent to the analysis layer. The analysis layer filters and consolidates the alarms to generate fraud cases. The analysis layer preferably generates a probability of fraud for each fraud case. The expert systems layer receives fraud cases and automatically initiates actions for certain fraud cases. The presentation layer also receives fraud cases for presentation to human analysts. The presentation layer permits the human analysts to initiate additional actions.
-
Citations
21 Claims
-
1. (canceled)
-
2. A method performed by one or more servers, the method comprising:
-
generating a first fraud alarm upon detection of suspected fraud by a first fraud detection test, the first fraud detection test applying a first fraud detection rule of a plurality of fraud detection rules to a first network event record; generating a second, different fraud alarm upon detection of suspected fraud by a second fraud detection test, the second fraud detection test applying a second, different fraud detection rule of the plurality of fraud detection rules to a second network event record, the plurality of fraud detection rules being dynamically reconfigured in accordance with changing patterns of fraud; correlating the generated first fraud alarm with the generated second, different fraud alarm into a fraud case; and performing a fraud prevention action on the fraud case. - View Dependent Claims (3, 4, 5, 6, 7, 8, 9)
-
-
10. A system comprising:
one or more servers to implement; a detection element to; generate a first fraud alarm when a first network event record is in violation of a first fraud detection rule of a plurality of fraud detection rules, generate a second different fraud alarm when a second network event record is in violation of a second fraud detection rule of the plurality of fraud detection rules, and dynamically adjust the plurality of fraud detection rules in accordance with changing patterns of fraud; an analysis element to; correlate the first fraud alarm and the second different fraud alarm to form a fraud case; and an expert element to; perform a fraud prevention action on the fraud case. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18)
-
19. A method performed by one or more servers, the method comprising:
-
receiving network event records relating to use of calling cards in a network; analyzing the network event records to identify a fraudulent pattern; dynamically modifying at least one threshold detection rule based on the identified fraudulent pattern; and generating a fraud alarm for a new network event record using the modified at least one threshold detection rule. - View Dependent Claims (20, 21)
-
Specification