Systems and methods for dynamic detection and prevention of electronic fraud

• US 7,721,336 B1
• Filed: 06/16/2006
• Issued: 05/18/2010
• Est. Priority Date: 03/15/2001
• Status: Active Grant

• Current Assignee: Brighterion Inc.
• Original Assignee: Brighterion Inc.
• Inventors: Adjaoute, Akli
• Primary Examiner(s): Orgad; Edan
• Assistant Examiner(s): Jackson; Jenise E
• Application Number:
  US11/455,146
• Time in Patent Office: 1,432 Days
• Field of Search: 726/25
• US Class Current: 726/25
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/403 Solvency checks
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

The present invention provides systems and methods for dynamic detection and prevention of electronic fraud and network intrusion using an integrated set of intelligent technologies. The intelligent technologies include neural networks, multi-agents, data mining, case-based reasoning, rule-based reasoning, fuzzy logic, constraint programming, and genetic algorithms. The systems and methods of the present invention involve a fraud detection and prevention model that successfully detects and prevents electronic fraud and network intrusion in real-time. The model is not sensitive to known or unknown different types of fraud or network intrusion attacks, and can be used to detect and prevent fraud and network intrusion across multiple networks and industries.

Claims

1. A method for detecting and preventing electronic fraud in electronic transactions between a client and a user using a fraud detection and prevention model to determine whether information sent by the user to the client associated with a new electronic transaction is fraudulent, comprising:

during a training process, training the model on a database of past electronic transactions provided by the client;

querying the model with a current electronic transaction to determine whether information sent by the user to the client associated with the current electronic transaction is fraudulent by providing the information as input to a binary file and running the binary file to generate a binary output decision on whether the electronic transaction is fraudulent or not; and

updating the model with the current electronic transaction by updating the binary file without repeating the training process, wherein the database of past electronic transactions comprises tables with fields and wherein the model comprises multiple agents, each agent being associated with a respective one of the fields, the method further comprising using the multiple agents to evaluate whether values in the fields for a given electronic transaction are normal, wherein evaluating whether values in the fields for a given electronic transaction are normal comprises creating intervals of normal values for a given field in the tables and wherein creating the intervals of normal values comprises creating a list of distinct couples v_ai, n_ai, where v_ai represents the i^th distinct value for field a and n_ai represents how many times value v_ai appears in the tables.

2. The method defined in claim 1 wherein running the binary file to generate the output decision on whether the electronic transaction is fraudulent comprises running a plurality of sub-models to generate a plurality of sub-model decisions and combining the plurality of sub-model decisions to generate the output decision.

3. The method defined in claim 1 further comprising:

if the given electronic transaction is not normal, generating a warning.

4. The method defined in claim 1 further comprising using the multiple agents to determine whether dependencies between the fields of a given electronic transaction are coherent with known field dependencies from the past electronic transactions.

5. The method defined in claim 1 further comprising:

using the multiple agents to determine whether dependencies between the fields of a given electronic transaction are coherent with known field dependencies from the past electronic transactions; and

if the dependencies between the fields of the given electronic transaction are not coherent with known field dependencies from the past electronic transactions, generating a warning.

6. The method defined in claim 1 wherein running the binary file to generate the output decision on whether the electronic transaction is fraudulent comprises running a plurality of sub-models to generate a plurality of sub-model decisions and combining the plurality of sub-model decisions to generate the output decision, and wherein each sub-model uses a single field in the database as an output class and all other fields in the database as inputs.

7. The method defined in claim 1 wherein running the binary file to generate the output decision on whether the electronic transaction is fraudulent comprises running a plurality of sub-models to generate a plurality of sub-model decisions and combining the plurality of sub-model decisions to generate the output decision, wherein the database has fields, wherein each sub-model uses a single field in the database as an output class and all other fields in the database as inputs, and wherein the output class is a field that indicates whether a data record in the database is fraudulent.

8. The method defined in claim 1 wherein creating the intervals of normal values further comprises:

copying members of the list to a new list whenever n_ai exceeds a threshold.

9. The method defined in claim 1 wherein creating the intervals of normal values comprises determining whether the given field is symbolic or numeric.

10. The method defined in claim 1 wherein the model comprises a data mining sub-model, a neural network sub-model, a multi-agent sub-model, and a case-based reasoning sub-model and wherein querying the model comprises querying the data mining sub-model, the neural network sub-model, the multi-agent sub-model, and the case-based reasoning sub-model.

11. The method defined in claim 1 wherein querying the model comprises querying the model automatically for each of a plurality of incoming transactions.

12. The method defined in claim 1 wherein querying the model comprises querying the model using a model query form that lists fields in tables that are used as model inputs.

13. The method defined in claim 1 wherein the model comprises a data mining sub-model, a neural network sub-model, and a multi-agent sub-model and wherein querying the model comprises querying the data mining sub-model, the neural network sub-model, and the multi-agent sub-model.

14. The method defined in claim 1 wherein the model comprises a data mining sub-model and a multi-agent sub-model and wherein querying the model comprises querying the data mining sub-model and the multi-agent sub-model.

15. The method defined in claim 1 wherein the model comprises a data mining sub-model and a neural network sub-model and wherein querying the model comprises querying the data mining sub-model and the neural network sub-model.

16. The method defined in claim 1 wherein the model comprises a data mining sub-model and a case-based reasoning sub-model and wherein querying the model comprises querying the data mining sub-model and the case-based reasoning sub-model.