Identifying fraudulent activities and the perpetrators thereof

• US 7,581,112 B2
• Filed: 12/30/2004
• Issued: 08/25/2009
• Est. Priority Date: 12/30/2004
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: eBay Inc.
• Inventors: Lalonde, Chris, Brown, Andrew Millard, Henley, Mathew Gene
• Primary Examiner(s): Peeso; Thomas
• Application Number:
  US11/027,783
• Publication Number:
  US 20060156389A1
• Time in Patent Office: 1,699 Days
• Field of Search: 713/182, 713/193, 713/194
• US Class Current: 713/182
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system for identifying perpetrators of fraudulent activity includes location logic for locating, extracting, or capturing identifying information from a client communication received from a client device. For example, the location logic may locate, or extract, a variety of message headers from an HTTP client request. The system may also include analyzer logic to analyze the identifying information, for example, by comparing the identifying information with previously captured identifying information from a previously received client communication. Finally, the system may include account identifier logic to identify user accounts associated with the previous client communication in which the same identifying information was extracted.

Claims

1. A system for identifying a perpetrator of a fraudulent activity, the system comprising:

location logic to locate identifying information from a client communication;

analyzer logic to analyze the identifying information from the client communication; and

account identifier logic to identify multiple user accounts associated with a previous client communication in which the same identifying information was located.

2. The system of claim 1, said system further comprising:

comparison logic to compare the identifying information associated with the client communication to previously captured identifying information associated with one or more user accounts.

3. The system of claim 1, said system further comprising:

display logic to display the multiple user accounts associated with a previous client communication in which the same identifying information was located.

4. The system of claim 1, wherein the client communication includes a request for access to data associated with a particular user account, and the identifier logic is to identify the particular user account and to associate the identifying information with the particular user account.

5. The system of claim 4, said system further comprising:

storage logic to store the identifying information associated with the particular user account.

6. A computer-implemented method for identifying a perpetrator of a fraudulent activity, the method comprising:

capturing identifying information associated with a client communication; and

analyzing the identifying information associated with the client communication to identify at least one user account associated with a previous client communication in which the same identifying information was captured.

7. The computer-implemented method of claim 6, wherein analyzing the identifying information associated with the client communication to identify the at least one user account associated with the previous client communication in which the same identifying information was captured includes comparing the identifying information associated with the client communication to previously captured identifying information associated with one or more user accounts.

8. The computer-implemented method of claim 7, said method further comprising:

displaying the at least one user account associated with the previous client communication in which the same identifying information was captured.

9. The computer-implemented method of claim 6, wherein the client communication includes a data request, and the identifying information includes a message header.

10. The computer-implemented method of claim 9, wherein the message header is a HTTP header.

11. The computer-implemented method of claim 6, wherein the data request includes a request for data associated with a particular user account.

12. A computer-implemented method for identifying a perpetrator of a fraudulent activity, the method comprising:

capturing an HTTP header included in an HTTP request from a client device; and

analyzing the HTTP header included in the HTTP request from the client device to identify at least one user account associated with a previous client communication in which the same HTTP header was utilized.

13. The computer-implemented method of claim 12, wherein analyzing the HTTP header included in the HTTP request from the client device comprises:

comparing the HTTP header included in the HTTP request with previously captured HTTP headers included in one or more previous HTTP requests, wherein each previously captured HTTP request is associated with a known user account; and

based on the comparison, displaying the at least one user account associated with the previous HTTP request in which the same HTTP header were captured.

14. The method of claim 12, wherein the HTTP request includes a request for data associated with a particular user account.

15. The method of claim 14, said method further including:

associating the HTTP header included in the HTTP request from the client device with the particular user account; and

storing the HTTP header.

16. A system for identifying a perpetrator of a fraudulent activity, the system including:

means for locating identifying information from a client communication;

means for analyzing the identifying information from the client communication; and

means for identifying at least one user account associated with a previous client communication in which the same identifying information was located.

17. A machine-readable medium including a set of instructions that, when executed by a machine, cause the machine to:

capture identifying information associated with a client communication; and

analyze the identifying information associated with the client communication to identify at least one user account associated with a previous client communication in which the same identifying information was captured.

18. A machine-readable medium including a set of instructions that, when executed by a machine, cause the machine to:

capture an HTTP header included in an HTTP request from a client device; and

analyze the HTTP header included in the HTTP request from the client device to identify at least one user account associated with a previous client communication in which the same HTTP header was utilized.