System and method for determining a risk root cause

• US 8,661,538 B2
• Filed: 05/09/2012
• Issued: 02/25/2014
• Est. Priority Date: 05/09/2012
• Status: Active Grant

• Current Assignee: Nice Ltd
• Original Assignee: Nice Systems Limited (Nice Ltd)
• Inventors: Cohen-Ganor, Shlomi, Wilhelm, Wesley Kenneth, Ben-Or, Pinchas
• Primary Examiner(s): Truong, Thanhnga B
• Assistant Examiner(s): LANE, GREGORY A
• Application Number:
  US13/467,412
• Publication Number:
  US 20130305356A1
• Time in Patent Office: 657 Days
• Field of Search: 726/22, 705/30
• US Class Current: 726/22
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system and method for determining a risk root cause are provided. A first and second fraud related risk scores respectively associated with a first and second nodes may be determined. A relation strength value related to at least one relation between the first and second nodes may be determined. A relation strength value and a first and second node risk scores may be used to calculate a cluster risk score for a cluster including the first and second nodes. Other embodiments are described and claimed.

Claims

1. A method for determining risk root cause link, the method comprising:

determining, by a computing device, a first and second fraud related risk scores respectively associated with a first and second nodes;

determining, by the computing device, a relation strength value related to at least one relation between the first and second nodes; and

using by the computing device, a value function that monotonically increases according to the first and second node risk scores and the relation strength value to calculate a cluster risk score for a cluster of nodes, the cluster including at least the first and second nodes; and

wherein calculating a cluster risk score comprises;

determining at least one path between a first and second nodes, the at least one path including at least one relation between two nodes included in the cluster;

determining a relation strength value of at least one relation included in the path and a first and second node risk scores respectively associated with the first and second nodes; and

calculating the cluster risk score based on the relation strength values and based on the node risk scores.

2. The method of claim 1, comprising extending the cluster to include an additional node, wherein extending the cluster includes:

determining an additional relation strength value related to at least one relation between the additional node and a node included in the cluster; and

using the additional relation strength value and a node risk score associated with the additional node to calculate a cluster risk score for the extended cluster.

3. The method of claim 1, wherein a path between the first and second nodes includes a relation between the first node and a third node and a relation between the third node and the second node.

4. The method of claim 1, comprising associating a node with a constant node risk score if not all paths traversing the node have been determined.

5. The method of claim 1, comprising producing an alert if the cluster risk score is greater than a determined threshold.

6. The method of claim 1, comprising:

determining a relation between a first node included in a first cluster and a second node included in a second cluster;

joining the first and second clusters to produce an extended cluster; and

calculating a cluster risk score for the extended cluster.

7. The method of claim 1, comprising selecting one of the first and second nodes based on estimating their respective potential contribution to the cluster risk score.

8. The method of claim 1, comprising dynamically modifying a cluster risk score based on an event related to a node included in the cluster.

9. An article comprising a non-transitory computer-readable storage medium, having stored thereon instructions, that when executed on a computer, cause the computer to:

determine a first and second fraud related risk scores respectively associated with a first and second nodes;

determine a relation strength value related to at least one relation between the first and second nodes; and

use a value function that monotonically increases according to the first and second node risk scores and the relation strength value to calculate a cluster risk score for a cluster of nodes, the cluster including at least the first and second nodes; and

wherein calculating a cluster risk score comprises;

determining at least one path between a first and second nodes, the at least one path including at least one relation between two nodes included in the cluster;

determining a relation strength value of at least one relation included in the path and a first and second node risk scores respectively associated with the first and second nodes; and

calculating the cluster risk score based on the relation strength values and based on the node risk scores.

10. The article of claim 9, wherein the instructions when executed further result in extending the cluster to include an additional node, wherein extending the cluster includes:

determining an additional relation strength value related to at least one relation between the additional node and a node included in the cluster; and

using the additional relation strength value and a node risk score associated with the additional node to calculate a cluster risk score for the extended cluster.

11. The article of claim 9, wherein a path between the first and second nodes includes a relation between the first node and a third node and a relation between the third node and the second node.

12. The article of claim 9, wherein the instructions when executed further result in associating a node with a constant node risk score if not all paths traversing the node have been determined.

13. The article of claim 9, wherein the instructions when executed further result in producing an alert if the cluster risk score is greater than a determined threshold.

14. The article of claim 9, wherein the instructions when executed further result in:

determining a relation between a first node included in a first cluster and a second node included in a second cluster;

joining the first and second clusters to produce an extended cluster; and

calculating a cluster risk score for the extended cluster.

15. The article of claim 9, wherein the instructions when executed further result in selecting one of the first and second nodes based on estimating their respective potential contribution to the cluster risk score.

16. The article of claim 9, wherein the instructions when executed further result in dynamically modifying a cluster risk score based on an event related to a node included in the cluster.