Online Fraud Detection Dynamic Scoring Aggregation Systems and Methods

• US 20130185802A1
• Filed: 01/17/2012
• Published: 07/18/2013
• Est. Priority Date: 01/17/2012
• Status: Active Grant

• Current Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Original Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Inventors: TIBEICA, Marius N., DAMIAN, Alin O., VISAN, Razvan
• Granted Patent: US 8,813,239 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

In some embodiments, an online fraud prevention system combines the output of several distinct fraud filters, to produce an aggregate score indicative of the likelihood that a surveyed target document (e.g. webpage, email) is fraudulent. Newly implemented fraud filters can be incorporated and ageing fraud filters can be phased out without the need to recalculate individual scores or to renormalize the aggregate fraud score. Every time the output of an individual filter is calculated, the aggregate score is updated in a manner which ensures the aggregate score remains within predetermined bounds defined by a minimum allowable score and a maximum allowable score (e.g., 0 to 100).

Claims

1. A method comprising:

employing a computer system to determine an aggregate fraud score of a target document as a combination of a first fraud score and a second fraud score of the target document, wherein the first and second fraud scores are determined according to distinct fraud-evaluation procedures;

employing the computer system to determine a third fraud score of the target document;

in response to determining the third fraud score, employing the computer system to modify the aggregate fraud score by a first amount determined according to a product of the third fraud score and a difference between the aggregate score and a maximum allowable aggregate score; and

in response to modifying the aggregate fraud score, employing the computer system to determine whether the target document is fraudulent according to the modified aggregate score.

2. The method of claim 1, wherein employing the computer system to determine the third fraud score of the target document is performed in response to adding a distinct fraud-evaluating procedure corresponding to the third fraud score to a set of fraud-evaluating procedures used to generate the aggregate fraud score.

3. The method of claim 1, wherein the first amount is determined as a function of:

(S_max−

S_A)wσ

wherein S_A and S_max are the aggregate score and the maximum allowable aggregate score, respectively, wherein σ

is the third fraud score, and wherein w is a number indicative of a reliability of the third score.

4. The method of claim 1, wherein determining the third fraud score comprises determining whether the target document includes a fraud-indicative feature, and wherein modifying the aggregate fraud score comprises increasing the aggregate fraud score by the first amount when the target document includes the fraud-indicative feature.

5. The method of claim 1, further comprising, in response to employing the computer system to determine the aggregate score:

employing the computer system to determine a fourth fraud score of the target document; and

employing the computer system to modify the aggregate fraud score by a second amount determined according to a product of the fourth fraud score and a difference between the aggregate score and a minimum allowable aggregate score.

6. The method of claim 5, wherein the second amount is determined as a function of:

(S_A−

S_min)wσ

wherein S_A and S_min are the aggregate score and the minimum allowable aggregate score, respectively, wherein σ

is the fourth fraud score, and wherein w is a number indicative of a reliability of the fourth score.

7. The method of claim 5, wherein determining the fourth fraud score comprises determining whether the target document includes a legitimacy-indicative feature, and wherein modifying the aggregate fraud score comprises decreasing the aggregate fraud score by the second amount when the target document includes the legitimacy-indicative feature.

8. The method of claim 1, wherein determining the third fraud score comprises evaluating a referrer document comprising a hyperlink to the target document.

9. The method of claim 8, wherein evaluating the referrer document comprises determining whether the referrer document is a social networking webpage.

10. The method of claim 8, wherein evaluating the referrer document comprises determining whether the referrer document is a spam message.

11. The method of claim 1, wherein determining the third fraud score comprises determining whether the target document comprises a fraud-indicative layout feature.

12. The method of claim 11, wherein the layout feature comprises an electronic form.

13. The method of claim 1, wherein determining the third fraud score comprises determining whether an Internet domain hosting the target document has been hacked into.

14. A computer system comprising at least a processor programmed to:

determine an aggregate fraud score of a target document as a combination of a first fraud score and a second fraud score of the target document, wherein the first and second fraud scores are determined according to distinct fraud-evaluation procedures;

determine a third fraud score of the target document;

in response to determining the third fraud score, modify the aggregate fraud score by a first amount determined according to a product of the third fraud score and a difference between the aggregate score and a maximum allowable aggregate score; and

in response to modifying the aggregate fraud score, determine whether the target document is fraudulent according to the modified aggregate score.

15. The computer system of claim 14, wherein determining the third fraud score of the target document is performed in response to adding a distinct fraud-evaluating procedure corresponding to the third fraud score to a set of fraud-evaluating procedures used to generate the aggregate fraud score.

16. The computer system of claim 14, wherein the first amount is determined as a function of:

(S_max−

S_A)wσ

wherein S_A and S_max are the aggregate score and the maximum allowable aggregate score, respectively, wherein a is the third fraud score, and wherein w is a number indicative of a reliability of the third score.

17. The computer system of claim 14, wherein determining the third fraud score comprises determining whether the target document includes a fraud-indicative feature, and wherein modifying the aggregate fraud score comprises increasing the aggregate fraud score by the first amount when the target document includes the fraud-indicative feature.

18. The computer system of claim 14, wherein the processor is further programmed to, in response to determining the aggregate score:

determine a fourth fraud score of the target document; and

modify the aggregate fraud score by a second amount determined according to a product of the fourth fraud score and a difference between the aggregate score and a minimum allowable aggregate score.

19. The computer system of claim 18, wherein the second amount is determined as a function of:

(S_A−

S_min)wσ

wherein S_A and S_min are the aggregate score and the minimum allowable aggregate score, respectively, wherein σ

is the fourth fraud score, and wherein w is a number indicative of a reliability of the fourth score.

20. The computer system of claim 19, wherein determining the fourth fraud score comprises determining whether the target document includes a legitimacy-indicative feature, and wherein modifying the aggregate fraud score comprises decreasing the aggregate fraud score by the second amount when the target document includes the legitimacy-indicative feature.

21. The computer system of claim 14, wherein determining the third fraud score comprises evaluating a referrer document comprising a hyperlink to the target document.

22. The computer system of claim 21, wherein evaluating the referrer document comprises determining whether the referrer document is a social networking webpage.

23. The computer system of claim 21, wherein evaluating the referrer document comprises determining whether the referrer document is a spam message.

24. The computer system of claim 14, wherein determining the third fraud score comprises determining whether the target document comprises a fraud-indicative layout feature.

25. The computer system of claim 24, wherein the layout feature comprises an electronic form.

26. The computer system of claim 14, wherein determining the third fraud score comprises determining whether an Internet domain hosting the target document has been hacked into.

27. A method comprising:

employing a computer system to determine whether a target document comprises a fraud-indicative feature;

in response to determining whether the target document comprises the target-indicative feature, when the target document comprises the fraud-indicative feature, employing the computer system to modify a current value of an aggregate fraud score for the target document by an amount proportional to a difference between the current value of the aggregate score and a maximum allowable value of the aggregate fraud score, wherein the aggregate score is determined as a combination of a plurality of individual fraud scores; and

in response to modifying the current value of the aggregate fraud score, employing the computer system to determine whether the electronic document is fraudulent according to the modified current value of the aggregate fraud score.