SYSTEM AND METHOD FOR QUANTIFYING AND DETECTING NON-NORMATIVE BEHAVIOR

• US 20090248497A1
• Filed: 04/01/2009
• Published: 10/01/2009
• Est. Priority Date: 04/01/2008
• Status: Active Grant

• Current Assignee: Certona Corporation (StartApp, Inc.)
• Original Assignee: Certona Corporation (StartApp, Inc.)
• Inventors: Hueter, Geoffrey J.
• Granted Patent: US 8,788,445 B2
• Time in Patent Office: Days
• US Class Current: 705/10
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 30/00 Commerce
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 30/0201 Market modelling; Market analysis; Collecting market data
• CPC Class Codes: G06Q 30/0202 Market predictions or forecasting for commercial activities
• CPC Class Codes: G06Q 30/0204 Market segmentation
• CPC Class Codes: G06Q 30/0255 based on user history
• CPC Class Codes: G06Q 30/0269 based on user profile or attribute
• CPC Class Codes: G06Q 30/0631 Item recommendations
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A system and method is disclosed for monitoring human interactions, including transactions and communications, profiling the subject and objects in those interactions, and comparing subject profiles to profiles of subjects with known characteristics to determine whether the test subject is normal or abnormal subjects. The behavior data can be collected electronically in a virtual environment, such as a website, through video surveillance, card access, phone records, purchase histories, or any other consistent identified record of behavior. The invention has application in detecting various types of unusual and malicious activity, including spam, viruses, terrorism, identity theft, and money laundering, to name but a few applications.

Claims

1. A system for quantifying and detecting non-normative behavior, comprising:

(a) a service system to collect, profile, and assess subject object behavior;

(b) subjects and objects represented in vector form;

(c) subject and object vectors derived solely from said subject'"'"'s interactions with objects;

(d) subject comparison to determine similarity of a test subject to members of a target population; and

(e) threshold determination to decide whether similarity between said test subject and target population is within a pre-set detection range;

whereby said system is capable of quantifying and detecting abnormalities within a user'"'"'s behavior by applying a suspicion threshold

all accomplished in a non-invasive, mentor-less and scalable fashion, scalable to large numbers of users and objects.

2. The system for quantifying and detecting non-normative behavior, according to claim 1, wherein said object vectors provide a common, universal representation across all types of objects, whether physical or virtual.

3. The system for quantifying and detecting non-normative behavior, according to claim 2, wherein said object profiling and representation is language independent and culture independent.

4. The system for quantifying and detecting non-normative behavior, according to claim 1, wherein said threshold determination includes automated detection by matching subject vectors and applying a suspicion threshold matching metric including a dot product or Euclidean distance matching metric.

5. The system for quantifying and detecting non-normative behavior, according to claim 1, wherein said subject and object vectors derived solely from said subject'"'"'s interactions with objects includes subject object interactions further including:

credit card transactions;

consumer products;

locations, such as neighborhoods, cities, states, and countries;

businesses, including banks, restaurants, clubs, and other member associations;

websites;

phone numbers; and

any other discrete entity that involves interaction from different subjects and can be identified and extracted from a variety of transaction flows, including credit card transactions, cell phone messages, bank transactions, travel records, and website browsing.

6. The system for quantifying and detecting non-normative behavior, according to claim 1, wherein said profiling subject object behavior includes profiling subject e-mail behavior.

7. The system for quantifying and detecting non-normative behavior, according to claim 6, wherein said profiling of subject e-mail behavior includes determinations of e-mail signatures or categorizations based on word frequency.

8. The system for quantifying and detecting non-normative behavior, according to claim 6, wherein said subject profiles are stored locally in the subject'"'"'s e-mail client application.

9. The system for quantifying and detecting non-normative behavior, according to claim 1, wherein said threshold determination to decide whether similarity between said test subject and target population is within the detection range includes profile matching compatibility thresholding employing a comparison against a normal population and test for mismatch.

10. The system for quantifying and detecting non-normative behavior, according to claim 1, wherein said threshold determination to decide whether similarity between said test subject and target population is within the detection range includes profile matching compatibility thresholding employing a comparison against a non-normal population and test for match.

12. The method for quantifying and detecting non-normative behavior, according to claim 1 wherein said step of providing subjects and objects represented in vector form includes the step of providing subjects and objects represented in vector form wherein said object vectors provide a common, universal representation across all types of objects, whether physical or virtual.

13. The method for quantifying and detecting non-normative behavior, according to claim 1 wherein said step of providing subject and object vectors derived solely from said subject'"'"'s interactions with objects includes the step of subject and object profiling using subject and object vectors derived solely from said subject'"'"'s interactions with objects wherein said object profiling and representation is language independent and culture independent.

15. The method for quantifying and detecting non-normative behavior, according to claim 1 wherein said step of profiling subject object behavior includes the step of profiling subject object behavior wherein said objects include e-mails.

16. The method for quantifying and detecting non-normative behavior, according to claim 15, wherein said step of profiling subject e-mail behavior further includes the step of profiling subject e-mail behavior wherein said e-mail profiling includes determinations of e-mail signatures or categorizations based on word frequency, and further wherein said subject profiles are stored locally in the subject'"'"'s e-mail client application.

18. The method for quantifying and detecting non-normative behavior, according to claim 1 wherein said step of determining a threshold to decide whether similarity between said test subject and target population is within a pre-set detection range includes the step of determining a threshold to decide whether similarity between said test subject and target population is within a pre-set detection range wherein said threshold determination to decide whether similarity between said test subject and target population is within the detection range includes profile matching compatibility thresholding employing a comparison against a non-normal population and test for match.

11. A method for quantifying and detecting non-normative behavior, comprising the steps of:

(a) providing a service system to collect, profile, and assess subject object behavior;

(b) providing subjects and objects represented in vector form;

(c) providing subject and object vectors derived solely from said subject'"'"'s interactions with objects;

(d) comparing subjects to determine similarity of test subject to members of a target population; and

(e) determining a threshold to decide whether similarity between said test subject and target population is within a pre-set detection range;

whereby said method is capable of quantifying and detecting abnormalities within a user'"'"'s behavior by applying a suspicion threshold,

all accomplished in a non-invasive, mentor-less and scalable fashion, scalable to large numbers of users and objects.

14. The method for quantifying and detecting non-normative behavior, according to claim 11, wherein said step of determining a threshold to decide whether similarity between said test subject and target population is within a pre-set detection range includes the step of determining a threshold to decide whether similarity between said test subject and target population is within a pre-set detection range wherein said threshold determination includes automated detection by matching subject vectors and applying to a suspicion threshold a matching metric including a dot product or Euclidean distance matching metric, and further wherein said subject and object vectors derived solely from said subject'"'"'s interactions with objects includes subject object interactions further including:

credit card transactions;

consumer products;

locations, such as neighborhoods, cities, states, and countries;

businesses, including banks, restaurants, clubs, and other member associations;

websites;

phone numbers; and

any other discrete entity that involves interaction from different subjects and can be identified and extracted from a variety of transaction flows, including credit card transactions, cell phone messages, bank transactions, travel records, and website browsing.

17. The method for quantifying and detecting non-normative behavior, according to claim 11, wherein said step of determining a threshold to decide whether similarity between said test subject and target population is within a pre-set detection range includes the step of determining a threshold to decide whether similarity between said test subject and target population is within a pre-set detection range wherein said threshold determination to decide whether similarity between said test subject and target population is within a pre-set detection range includes profile matching compatibility thresholding employing a comparison against a normal population and test for mismatch.

19. A method for using a system for quantifying and detecting non-normative behavior, comprising the steps of:

(a) collecting subject object behavior;

(c) profiling subjects and objects;

(e) matching test subject profiles to target population subject profiles; and

(e) detecting abnormality according to comparison of test target match to pre-set detection range,

whereby behavior data can be collected electronically in a virtual environment, such as a website, through video surveillance, card access, phone records, purchase histories, or any other consistent record of behavior.

20. The method for using a system for quantifying and detecting non-normative behavior, according to claim 19, wherein said step of detecting abnormality further includes the step of detecting:

(a) spam e-mail; and

(b) a person or persons of interest.