SYSTEM AND METHOD FOR DETERMINING A RISK ROOT CAUSE

• US 20140122311A1
• Filed: 01/05/2014
• Published: 05/01/2014
• Est. Priority Date: 05/09/2012
• Status: Abandoned Application

• Current Assignee: Nice Systems Limited (Nice Ltd)
• Original Assignee: Nice Systems Limited (Nice Ltd)
• Inventors: COHEN-GANOR, Shlomi, WILHELM, Wesley Kenneth, BEN-OR, Pinchas
• Application Number:
  US14/147,539
• Publication Number:
  US 20140122311A1
• Time in Patent Office: Days
• US Class Current: 705/35
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system and method for determining a risk root cause are provided. A first and second fraud related risk scores respectively associated with a first and second nodes may be determined. A relation strength value related to at least one relation between the first and second nodes may be determined. A relation strength value and a first and second node risk scores may be used to calculate a cluster risk score for a cluster including the first and second nodes. Other embodiments are described and claimed.

Claims

1. A method for determining risk root cause link, the method comprising:

determining by a computing device, at least one path between a first and second nodes included in a cluster of nodes, the at least one path including at least one relation between the first and second nodes;

determining, by the computing device, a first and second fraud related risk scores respectively associated with the first and second nodes;

determining, by the computing device, a relation strength value related to the at least one relation between the first and second nodes;

calculating, by the computing device, a cluster risk score for the cluster based on the relation strength value and based on the fraud related risk scores using a value function that monotonically increases according to the first and second fraud related risk scores.

2. The method of claim 1, comprising extending the cluster to include an additional node, wherein extending the cluster includes:

determining an additional relation strength value related to at least one relation between the additional node and a node included in the cluster; and

using the additional relation strength value and a fraud related risk score associated with the additional node to calculate a cluster risk score for the extended cluster.

3. The method of claim 1, wherein a path between the first and second nodes includes a relation between the first node and a third node and a relation between the third node and the second node.

4. The method of claim 1, comprising associating a node with a constant node risk score if not all paths traversing the node have been determined.

5. The method of claim 1, comprising producing an alert if the cluster risk score is greater than a determined threshold.

6. The method of claim 1, comprising:

determining a relation between a first node included in a first cluster and a second node included in a second cluster;

joining the first and second clusters to produce an extended cluster; and

calculating a cluster risk score for the extended cluster.

7. The method of claim 1, comprising selecting one of the first and second nodes based on estimating their respective potential contribution to the cluster risk score.

8. The method of claim 1, comprising dynamically modifying a cluster risk score based on an event related to a node included in the cluster.

9. An article comprising a non-transitory computer-readable storage medium, having stored thereon instructions, that when executed on a computer, cause the computer to:

determine at least one path between a first and second nodes included in a cluster of nodes, the at least one path including at least one relation between the first and second nodes;

determine a first and second fraud related node risk scores respectively associated with the first and second nodes;

determine a relation strength value related to at least one relation between the first and second nodes; and

calculate a cluster risk score for the cluster based on the relation strength value and based on the fraud related node risk scores using a value function that monotonically increases according to the first and second node risk scores.

10. The article of claim 9, wherein the instructions when executed further result in extending the cluster to include an additional node, wherein extending the cluster includes:

determining an additional relation strength value related to at least one relation between the additional node and a node included in the cluster; and

using the additional relation strength value and a node risk score associated with the additional node to calculate a cluster risk score for the extended cluster.

11. The article of claim 9, wherein a path between the first and second nodes includes a relation between the first node and a third node and a relation between the third node and the second node.

12. The article of claim 9, wherein the instructions when executed further result in associating a node with a constant node risk score if not all paths traversing the node have been determined.

13. The article of claim 9, wherein the instructions when executed further result in producing an alert if the cluster risk score is greater than a determined threshold.

14. The article of claim 9, wherein the instructions when executed further result in:

determining a relation between a first node included in a first cluster and a second node included in a second cluster;

joining the first and second clusters to produce an extended cluster; and

calculating a cluster risk score for the extended cluster.

15. The article of claim 9, wherein the instructions when executed further result in selecting one of the first and second nodes based on estimating their respective potential contribution to the cluster risk score.

16. The article of claim 9, wherein the instructions when executed further result in dynamically modifying a cluster risk score based on an event related to a node included in the cluster.