Fraud analysis in a contact database

• US 8,620,875 B2
• Filed: 01/24/2012
• Issued: 12/31/2013
• Est. Priority Date: 07/25/2011
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Jagota, Arun Kumar
• Primary Examiner(s): Corrielus, Jean M
• Application Number:
  US13/357,523
• Publication Number:
  US 20130031061A1
• Time in Patent Office: 707 Days
• Field of Search: 706/47, 705/35, 705/44, 707/690
• US Class Current: 707/690
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 30/01 Customer relationship services

Abstract

A system and method of identifying fraudulent data in a contact database is disclosed herein. In some embodiments, a set of contact records is received where each of the contact records includes a set of contact field values corresponding to a set of contact fields. Some embodiments determine whether a similar content pattern exists in the contact records using at least one of the set of contact field values. In some embodiments, a determination is made as to whether an unusual content pattern exists in the contact records using at least one of the set of contact field values. The set of contact records is flagged when at least one of the similar content pattern or the unusual content pattern is determined to exist in the contact records.

Claims

1. A method of identifying fraudulent data in a contact database, the method comprising:

receiving a plurality of contact records, each of the plurality of contact records including a set of contact field values corresponding to a set of contact fields;

determining, by a computing device, whether a similar content pattern exists in the plurality of contact records using at least one of the set of contact field values, wherein determining whether the similar content pattern exists in the plurality of contact records comprises;

receiving a threshold value for the similar content pattern;

calculating a dupes-score for at least one of the set of contact fields, the dupes-score indicating an amount of content duplication in the at least one of the set of contact fields; and

determining that the similar content pattern exists when the dupes-score exceeds the threshold value for the similar content pattern; and

flagging, by the computing device, the plurality of contact records when the similar content pattern is determined to exist in the plurality of contact records to verify whether the flagged contact records contain fraudulent data.

2. The method of claim 1, wherein calculating the dupes-score for at least one of the set of contact fields includes using one or more corresponding contact field values from a subset of the plurality of contact records.

3. The method of claim 1, further comprising:

determining, by the computing device, whether an unusual content pattern exists in the plurality of contact records using at least one of the set of contact field values, wherein determining whether the unusual content pattern exists in the plurality of contact records comprises;

receiving a threshold value for the unusual content pattern associated with a particular contact field;

calculating an unusualness score for each of the plurality of contact records, the unusualness score indicating how unlikely a contact field value corresponding to the particular contact field belonged to the particular contact field;

determining an overall unusualness score for the unusual content pattern by averaging the calculated unusualness score for the plurality of contact records;

determining that the unusual content pattern exists when the overall unusualness score exceeds the threshold value for the unusual content pattern; and

flagging, by the computing device, the plurality of contact records when the unusual content pattern is determined to exist in the plurality of contact records to verify whether the flagged contact records contain fraudulent data.

4. The method of claim 3, wherein the unusualness score for a contact record is calculated by comparing the contact field value with a training set that includes a set of values and an associated confidence level such that the unusualness score of the contact field value can be determined by using the associated confidence level.

5. The method of claim 1, wherein at least one of the set of contact fields includes at least one of a first name field, a last name field, a title field or an e-mail address field, wherein determining whether the similar content pattern exists in the plurality of contact records comprises determining whether near-identical contact field values appear in the plurality of contact records beyond a threshold frequency.

6. The method of claim 1, wherein at least one of the set of contact fields includes at least one of a first name field, a last name field, or a title field, wherein determining whether the unusual content pattern exists in the plurality of contact records comprises determining whether seemingly unlikely contact field values appear in corresponding contact fields beyond a threshold frequency.

7. The method of claim 1, wherein at least one of the set of contact fields includes an e-mail field, wherein determining whether the unusual content pattern exists in the plurality of contact records comprises determining whether an e-mail field value for each of the plurality of contact records is syntactically well-formed.

8. The method of claim 1, wherein the plurality of records is provided to an administrator to verify whether the plurality of records contains fraudulent data upon the plurality of records being flagged.

9. A non-transitory computer-readable medium containing program code executable by a processor in a computer to identify fraudulent data for a database system having a corpus of contact information stored therein, the program code including instructions to:

receive a plurality of contact records, each of the plurality of contact records including a set of contact field values corresponding to a set of contact fields;

determine whether a similar content pattern exists in the plurality of contact records using at least one of the set of contact field values, wherein the instruction to determine whether the similar content pattern exists in the plurality of contact records further includes a set of instructions to;

receive a threshold value for the similar content pattern;

calculate a dupes-score for at least one of the set of contact fields, the dupes-score indicating an amount of content duplication in the at least one of the set of contact fields; and

determine that the similar content pattern exists when the dupes-score exceeds the threshold value for the similar content pattern; and

identify the plurality of contact records when the similar content pattern is determined to exist in the plurality of contact records to verify whether the identified contact records contain fraudulent data.

10. The non-transitory computer-readable medium of claim 9, wherein the instruction to calculate the dupes-score for at least one of the set of contact fields includes using one or more corresponding contact field values from a subset of the plurality of contact records.

11. The non-transitory computer-readable medium of claim 9, further comprising an instruction to determine whether an unusual content pattern exists in the plurality of contact records using at least one of the set of contact field values, wherein the instruction to determine whether the unusual content pattern exists in the plurality of contact records comprises further includes a set of instructions to:

receive a threshold value for the unusual content pattern associated with a particular contact field;

calculate an unusualness score for each of the plurality of contact records, the unusualness score indicating how unlikely a contact field value corresponding to the particular contact field belonged to the particular contact field;

determine an overall unusualness score for the unusual content pattern by averaging the calculated unusualness score for the plurality of contact records;

determine that the unusual content pattern exists when the overall unusualness score exceeds the threshold value for the unusual content pattern; and

identify the plurality of contact records when the unusual content pattern is determined to exist in the plurality of contact records to verify whether the identified contact records contain fraudulent data.

12. The non-transitory computer-readable medium of claim 11, wherein the unusualness score for a contact record is calculated by comparing the contact field value with a training set that includes a set of values and an associated confidence level such that the unusualness score of the contact field value can be determined by using the associated confidence level.

13. A system for identifying fraudulent data in a contact database having a corpus of contact information stored therein, the system comprising:

a processor;

a network interface; and

a memory encoded with program code to be executed by the processor, comprising;

program code to receive a plurality of contact records, each of the plurality of contact records including a set of contact field values corresponding to a set of contact fields;

program code to determine whether a similar content pattern exists in the plurality of contact records using at least one of the set of contact field values, wherein the program code to determine whether the similar content pattern exists in the plurality of contact records further includes program code to;

receive a threshold value for the similar content pattern,

calculate a dupes-score for at least one of the set of contact fields, the dupes-score indicating an amount of content duplication in the at least one of the set of contact fields, and

determine that the similar content pattern exists when the dupes-score exceeds the threshold value for the similar content pattern; and

program code to identify the plurality of contact records when at least one of the similar content pattern or the unusual content pattern is determined to exist in the plurality of contact records to verify whether the identified contact records contain fraudulent data.

14. The system of claim 13, wherein the program code to calculate the dupes-score for at least one of the set of contact fields includes using one or more corresponding contact field values from a subset of the plurality of contact records.

15. The system of claim 13, further comprising program code to determine whether an unusual content pattern exists in the plurality of contact records using at least one of the set of contact field values, wherein the program code to determine whether the unusual content pattern exists in the plurality of contact records comprises:

program code to receive a threshold value for the unusual content pattern associated with a particular contact field;

program code to calculate an unusualness score for each of the plurality of contact records, the unusualness score indicating how unlikely a contact field value corresponding to the particular contact field belonged to the particular contact field;

program code to determine an overall unusualness score for the unusual content pattern by averaging the calculated unusualness score for the plurality of contact records;

program code to determine that the unusual content pattern exists when the overall unusualness score exceeds the threshold value for the unusual content pattern; and

program code to identify the plurality of contact records when the unusual content pattern is determined to exist in the plurality of contact records to verify whether the identified contact records contain fraudulent data.

16. The system of claim 15, wherein the unusualness score for a contact record is calculated by comparing the contact field value with a training set that includes a set of values and an associated confidence level such that the unusualness score of the contact field value can be determined by using the associated confidence level.

17. The method of claim 13, wherein at least one of the set of contact fields includes at least one of a first name field, a last name field, a title field or an e-mail address field, wherein determining whether the similar content pattern exists in the plurality of contact records comprises determining whether near-identical contact field values appear in the plurality of contact records beyond a threshold frequency.