DETECTION OF INTERNAL FRAUDS

• US 20170140391A1
• Filed: 11/12/2015
• Published: 05/18/2017
• Est. Priority Date: 11/12/2015
• Status: Active Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Marin, Mike A., Paramashivapa, Vivek K., Prasad, Balunaini
• Application Number:
  US14/938,901
• Publication Number:
  US 20170140391A1
• Time in Patent Office: Days
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud

Abstract

Embodiments of the present invention provide systems and methods for detecting internal fraud. The systems and methods for detecting internal fraud involve: receiving information pertaining to a case; receiving information pertaining to a case worker assigned to a case; compiling and configuring the sensitivity of the tasks needed to complete a case; determining a path by which a case is completed; and comparing a path of a first case with the path of a second case. A threshold value is configured to determine the level of deviation between the path of the first case and the path of the second case. If a case is determined to have a level of deviation at or above a threshold value, then an alarm is triggered to indicate a potential fraud.

Claims

1. A method comprising:

identifying, by one or more processors, respective paths executed by each case in a plurality of cases, wherein each case includes respective case information;

responsive to receiving a new case, creating, by one or more processors, an OLAP schema that specifies respective paths associated with the new case; and

determining, by one or more processors, whether the new case is a candidate for audit based on a measure of deviation between the respective paths associated with the new case and the respective paths of each case within the plurality of cases.

2. The method of claim 1, wherein determining whether the new case is a candidate for audit based on the measure of deviation between the respective paths associated with the new case and the respective paths of each case within the plurality of cases, comprises:

comparing, by one or more processors, case information associated with the new case to case information associated with each case in the plurality of cases; and

configuring, by one or more processors, a threshold, wherein the threshold is a value used to compare a similarity level between the plurality of cases and the new case.

3. The method of claim 1, wherein the knowledge base provides case information for each completed case.

4. The method of claim 1, wherein creating the OLAP schema, comprises:

identifying, by one or more processors, a plurality of tasks, a respective sensitivity index, case worker information, and business processes associated with the new case;

populating, by one or more processors, relational tables for the plurality of tasks, the respective sensitivity index, case worker information, and business processes associated with the new case; and

grouping, by one or more processors, the plurality of tasks into subsets of tasks based on a similarity between the tasks, case worker information, and business processes associated with the new case.

5. The method of claim 1, wherein the measure of deviation is based on a set of tasks performed for the new case and another set of tasks associated with the plurality of cases.

6. The method of claim 4, further comprising:

responsive to receiving a business process change, modifying, by one or more processors, the OLAP schema based on identified paths specified by the business process change.

7. The method of claim 2, further comprising:

responsive to determining the configured threshold value does not exceed the predetermined similarity level to the plurality of the stored cases, generating, by one or more processors, an indication that the new case is potentially fraudulent;

determining, by one or more processors, whether tasks associated with the new case are associated with a high sensitivity index; and

responsive to determining at least one tasks of the tasks associated with a high sensitivity index are associated with the new case, triggering, by one or more processors, a fraud alarm for the new case and alerting users associated with the new case.

8. A computer program product comprising:

a computer readable storage device program instructions stored on the computer readable storage device, the program instructions comprising;

program instructions to identify respective paths executed by each case in a plurality of cases, wherein each case includes respective case information;

responsive to receiving a new case, program instructions to create an OLAP schema that specifies respective paths associated with the new case; and

program instructions to determine whether the new case is a candidate for audit based on a measure of deviation between the respective paths associated with the new case and the respective paths of each case within the plurality of cases.

9. The computer program product of claim 8, wherein the program instructions to determine whether the new case is a candidate for audit based on the measure of deviation between the respective paths associated with the new case and the respective paths of each case within the plurality of stored cases, comprise:

program instructions to compare case information associated with the new case to case information associated with each case within the plurality of cases; and

program instructions to configure a threshold, wherein the threshold is a value used to compare a similarity level between the plurality of stored cases and the new case.

10. The computer program product of claim 8, wherein the knowledge base provides case information for each completed case.

11. The computer program product of claim 8, program instructions to create the OLAP schema, comprise:

program instructions to identify a plurality of tasks, a respective sensitivity index, case worker information, and business processes associated with the new case;

program instructions to populate relational tables for the plurality of tasks, the respective sensitivity index, case worker information, and business processes associated with the new case; and

program instructions to group the plurality of tasks into subsets of tasks based on a similarity between the tasks, case worker information, and business processes associated with the new case.

12. The computer program product of claim 8, wherein the measure of deviation is based on a set of tasks performed for the new case and another set of tasks associated with the plurality of the cases.

13. The computer program product of claim 11, further comprising:

responsive to receiving a business process change, program instructions to modify the OLAP schema based on identified paths specified by the business process change.

14. The computer program product of claim 9, further comprising:

responsive to determining the configured threshold value does not exceed the predetermined similarity level to the plurality of cases, program instructions to generate an indication that the new case is potentially fraudulent;

program instructions to determine whether tasks associated with the new case are associated with a high sensitivity index; and

responsive to determining at least one tasks of the tasks associated with a high sensitivity index are associated with the new case, program instructions to trigger a fraud alarm for the new case and alerting users associated with the new case.

15. A computer system comprising:

one or more computer processors;

one or more computer readable storage device; and

program instructions stored on the one or more computer readable storage device for execution by at least one of the one or more processors, the program instructions comprising;

program instructions to identify respective paths executed by each case in a plurality of cases, wherein each case includes respective case information;

responsive to receiving a new case, program instructions to create an OLAP schema that specifies respective paths associated with the new case; and

program instructions to determine whether the new case is a candidate for audit based on a measure of deviation between the respective paths associated with the new case and the respective paths of each case within the plurality of cases.

16. The computer system of claim 15 wherein the program instructions to determine whether the new case is a candidate for audit based on a measure of deviation between the respective paths associated with the new case and the respective paths of each case within the plurality of cases, comprise:

program instructions to compare case information associated with the case to case information associated with each case within the plurality of cases; and

program instructions to configure a threshold, wherein the threshold is a value used to compare a similarity level between the plurality of cases and the new case.

17. The computer system of claim 15, wherein the knowledge base provides case information for each completed case.

18. The computer system of claim 15, program instructions to create the OLAP schema, comprise:

program instructions to identify a plurality of tasks, a respective sensitivity index, case worker information, and business processes associated with the new case;

program instructions to populate relational tables for the plurality of tasks, the respective sensitivity index, case worker information, and business processes associated with the new case; and

program instructions to group the plurality of tasks into subsets of tasks based on a similarity between the tasks, case worker information, and business processes associated with the new case.

19. The computer system of claim 15, wherein the measure of deviation is based on a set of tasks performed for the new case and another set of tasks associated with the plurality of cases.

20. The computer system of claim 16, further comprising:

responsive to determining the configured threshold value does not exceed the predetermined similarity level to the plurality of cases, program instructions to generate an indication that the new case is potentially fraudulent;

program instructions to determine whether tasks associated with the new case are associated with a high sensitivity index; and

responsive to determining at least one tasks of the tasks associated with a high sensitivity index are associated with the new case, program instructions to trigger a fraud alarm for the new case and alerting users associated with the new case.