Modeling Users for Fraud Detection and Analysis

• US 20100094767A1
• Filed: 06/12/2009
• Published: 04/15/2010
• Est. Priority Date: 06/12/2008
• Status: Active Grant

• Current Assignee: Guardian Analytics Incorporated (Nice Ltd)
• Original Assignee: Guardian Analytics Incorporated (Nice Ltd)
• Inventors: Miltonberger, Tom
• Granted Patent: US 10,115,111 B2
• Time in Patent Office: Days
• US Class Current: 705/325
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 30/0225 Avoiding frauds
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety

Abstract

Systems and methods are provided for predicting expected behavior of a user in an account. The systems and methods automatically generate a causal model corresponding to a user. The systems and methods estimate a plurality of components of the causal model using event parameters of a first set of events undertaken by the user in an account of the user. The systems and methods predict expected behavior of the user during a second set of events using the causal model.

Claims

1. A method comprising:

automatically generating a causal model corresponding to a user;

estimating a plurality of components of the causal model using event parameters of a first set of events undertaken by the user in an account of the user; and

predicting expected behavior of the user during a second set of events using the causal model.

2. The method of claim 1, wherein automatically generating the causal model includes generating statistical relationships between components of the plurality of components.

3. The method of claim 1, comprising representing the causal model as a Bayesian network.

4. The method of claim 1, wherein automatically generating the causal model includes generating a joint probability distribution that includes the plurality of components.

5. The method of claim 4, wherein the plurality of components includes a plurality of probability distribution functions that represent the event parameters.

6. The method of claim 5, wherein the event parameters are observable parameters collected during the first set of events.

7. The method of claim 6, wherein the event parameters include one or more of Internet Protocol (IP) data and Hypertext Transfer Protocol (HTTP) data.

8. The method of claim 7, wherein the IP data includes one or more of an IP address, IP address country, IP address city, IP network block, and internet service provider supporting an event.

9. The method of claim 7, wherein the HTTP data includes one or more of data of an operating system, a user agent string, a referrer string, and internet browser of a computer used for an event.

10. The method of claim 1, wherein automatically generating the causal model includes generating statistical relationships between the event parameters and derived parameters.

11. The method of claim 10, wherein the derived parameters include one or more of geographic area from which a device is initiating the second set of events, location of the device, identification of the device, and electronic service provider of the device.

12. The method of claim 1, wherein predicting the expected behavior of the user includes generating expected event parameters of the second set of events.

13. The method of claim 12, wherein generating the expected event parameters includes generating a first set of predicted probability distributions that represent the expected event parameters, wherein generating the first set of predicted probability distributions assumes the user is conducting the second set of events.

14. The method of claim 1, comprising:

receiving a predictive fraud model; and

generating a second set of predicted probability distributions that represent expected fraud event parameters, wherein generating the second set of predicted probability distributions assumes a fraudster is conducting the second set of events, wherein the fraudster is any person other than the user.

15. The method of claim 14, comprising automatically generating the predictive fraud model by estimating a plurality of fraud components of the predictive fraud model using fraud event parameters of previous fraudulent events undertaken in a plurality of accounts, wherein the previous fraudulent events are events suspected as having been conducted by the fraudster.

16. The method of claim 15, wherein automatically generating the predictive fraud model includes generating statistical relationships between fraud components of the plurality of fraud components.

17. The method of claim 15, wherein automatically generating the predictive fraud model includes generating statistical relationships between the fraud event parameters and derived fraud parameters.

18. The method of claim 17, wherein the derived fraud parameters include one or more of a location of the device, identification of the device, and electronic service provider of the device.

19. The method of claim 14, comprising generating in real-time a risk score of an event of the second set of events using the expected event parameters and the expected fraud event parameters along with the observed parameters.

20. The method of claim 1, comprising generating an alert corresponding to an event of the second set of events when the expected behavior indicates a person other than the user is conducting the event.

21. The method of claim 1, comprising automatically updating the causal model using a second set of event parameters collected during the second set of events.

22. The method of claim 21, wherein the second set of event parameters are observable parameters collected during the second set of events.

23. The method of claim 21, wherein automatically updating the causal model includes updating a joint probability distribution that includes the plurality of components.

24. The method of claim 21, wherein automatically updating the causal model includes updating at least one of the plurality of components.

25. The method of claim 21, wherein automatically updating the causal model includes updating at least one of a plurality of probability distribution functions that represent the event parameters, the updating modifying the at least one of the plurality of probability distribution functions by considering data of the second set of event parameters.

26. The method of claim 21, comprising:

generating a probability distribution function for each of the event parameters of the first set of events; and

generating an updated probability distribution function for each of the event parameters by applying data of a second set of event parameters of the second set of events to the probability distribution function.

27. The method of claim 26, comprising:

receiving a baseline causal model that corresponds to the user, the baseline causal model generated without using data of any event; and

generating the causal model by generating a joint probability distribution that includes the plurality of components, wherein the plurality of components includes the updated probability distribution function for any event parameter represented in the causal model.

28. The method of claim 1, wherein the first set of events and the second set of events comprises at least one of online events, offline events, and multiple channel events.

29. The method of claim 28, wherein online events are events undertaken via electronic access to the account.

30. The method of claim 1, wherein events comprise login events.

31. The method of claim 1, wherein events comprise activity events.

32. The method of claim 1, wherein a set of events comprises a session, wherein the session is a sequence of related events.

33. The method of claim 32, wherein the sequence of related events comprises a session login event and a termination event.

34. The method of claim 33, wherein the sequence of related events comprises at least one activity event.

35. The method of claim 1, comprising:

determining probabilistically that the second set of events was conducted by the user;

automatically updating the causal model using a second set of event parameters collected during the second set of events.

36. The method of claim 35, comprising updating the causal model to include a trust factor, the trust factor representing a probability that the second set of events was in fact conducted by the user.

37. The method of claim 35, comprising updating the causal model to include an accumulated trust factor, the accumulated trust factor representing a cumulative probability across a plurality of sets of events that an event parameter in the plurality of sets of events was in fact conducted by the user.

38. The method of claim 1, wherein automatically generating the causal model comprises generating the causal model to include a decay parameter.

39. The method of claim 38, wherein the decay parameter comprises an exponential decay function by which a relative weight of each event in a set of events in the account changes with passage of time since the event.

40. A method comprising:

receiving a plurality of observations corresponding to a first event, the first event including actions taken in an account during electronic access of the account;

generating probabilistic relationships between the observations and derived parameters of an owner of the account;

automatically generating an account model to include the probabilistic relationships; and

estimating actions of the owner during a second event using the account model, wherein the second event follows the first event in time.

41. A method comprising:

automatically generating a causal model corresponding to a user, the generating comprising estimating a plurality of components of the causal model using event parameters of a previous event undertaken by the user in an account of the user;

predicting expected behavior of the user during a next event in the account using the causal model, wherein predicting the expected behavior of the user includes generating predicted event parameters of the next event;

receiving observed event parameters of the next event; and

updating the causal model for use in a future event, the updating comprising regenerating the plurality of components based on a relationship between the expected event parameters and the observed event parameters.

42. A system comprising a processor executing at least one application, the application receiving event parameters of a first set of events undertaken by the user in an account of the user, the application automatically generating a causal model corresponding to a user by estimating a plurality of components of the causal model using the event parameters of the first set of events, the application using the causal model to output a prediction of expected behavior of the user during a second set of events.

43. The system of claim 42, wherein automatically generating the causal model includes generating statistical relationships between components of the plurality of components.

44. The system of claim 42, wherein automatically generating the causal model includes generating a joint probability distribution that includes the plurality of components.

45. The system of claim 44, wherein the plurality of components includes a plurality of probability distribution functions that represent the event parameters.

46. The system of claim 45, wherein the event parameters are observable parameters collected during the first set of events.

47. The system of claim 46, wherein the event parameters include one or more of Internet Protocol (IP) data and Hypertext Transfer Protocol (HTTP) data.

48. The system of claim 47, wherein the IP data includes one or more of an IP address, IP address country, IP address city, IP network block, and internet service provider supporting an event.

49. The system of claim 47, wherein the HTTP data includes one or more of data of an operating system, a user agent string, a referrer string, and internet browser of a computer used for an event.

50. The system of claim 42, wherein automatically generating the causal model includes generating statistical relationships between the event parameters and derived parameters.

51. The system of claim 50, wherein the derived parameters include one or more of geographic area from which a device is initiating the second set of events, location of the device, identification of the device, and electronic service provider of the device.

52. The system of claim 42, wherein predicting the expected behavior of the user includes generating expected event parameters of the second set of events.

53. The system of claim 52, wherein generating the expected event parameters includes generating a first set of predicted probability distributions that represent the expected event parameters, wherein generating the first set of predicted probability distributions assumes the user is conducting the second set of events.

54. The system of claim 53, comprising:

receiving a predictive fraud model; and

generating a second set of predicted probability distributions that represent expected fraud event parameters, wherein generating the second set of predicted probability distributions assumes a fraudster is conducting the second set of events, wherein the fraudster is any person other than the user.

55. The system of claim 54, comprising generating in real-time a risk score of an event of the second set of events using the expected event parameters and the expected fraud event parameters along with the observed parameters.

56. The system of claim 42, comprising generating an alert corresponding to an event of the second set of events when the expected behavior indicates a person other than the user is conducting the event.

57. The system of claim 42, comprising automatically updating the causal model using a second set of event parameters collected during the second set of events.

58. The system of claim 57, wherein automatically updating the causal model includes updating at least one of a plurality of probability distribution functions that represent the event parameters, the updating modifying the at least one of the plurality of probability distribution functions by considering data of the second set of event parameters.

59. The system of claim 57, comprising:

generating a probability distribution function for each of the event parameters of the first set of events; and

generating an updated probability distribution function for each of the event parameters by applying data of a second set of event parameters of the second set of events to the probability distribution function.

60. The system of claim 42, wherein the first set of events and the second set of events comprises at least one of online events, offline events, and multiple channel events.

61. The system of claim 60, wherein online events are events undertaken via electronic access to the account.

62. The system of claim 42, wherein events comprise login events.

63. The system of claim 42, wherein events comprise activity events.

64. The system of claim 42, wherein a set of events comprises a session, wherein the session is a sequence of related events.

65. The system of claim 42, comprising:

determining probabilistically that the second set of events was conducted by the user;

automatically updating the causal model using a second set of event parameters collected during the second set of events.

66. The system of claim 65, comprising updating the causal model to include a trust factor, the trust factor representing a probability that the second set of events was in fact conducted by the user.

67. The system of claim 65, comprising updating the causal model to include an accumulated trust factor, the accumulated trust factor representing a cumulative probability across a plurality of sets of events that an event parameter in the plurality of sets of events was in fact conducted by the user.

68. The system of claim 42, wherein automatically generating the causal model comprises generating the causal model to include a decay parameter.

69. The system of claim 68, wherein the decay parameter comprises an exponential decay function by which a relative weight of each event in a set of events in the account changes with passage of time since the event.

70. A system comprising a processor executing at least one application, the application receiving event parameters of a first set of events undertaken by a user in an account of the user, the application automatically generating an account model corresponding to the user, the account model comprising a plurality of components, wherein generating the account model comprises generating the plurality of components using the event parameters of the first set of events, the application predicting expected behavior of the user during a second set of events using the account model, the application generating an updated version of the account model for use in a future set of events, the updating comprising regenerating the plurality of components using the second set of events.