Extraction of transaction data for compliance monitoring

• US 8,694,347 B2
• Filed: 04/29/2011
• Issued: 04/08/2014
• Est. Priority Date: 03/19/2004
• Status: Active Grant

• Current Assignee: Oversight Systems, Inc.
• Original Assignee: Oversight Technologies, Inc. (Oversight Systems, Inc.)
• Inventors: Kennis, Peter H., Kuokka, Daniel R., Coombs, Charles A., Addison, Stayton D., Otwell, Andrew T., Johnson, Jeffrey Z., Taylor, Patrick J. D., Lortz, Michael E.
• Primary Examiner(s): Nguyen, Nga B.
• Application Number:
  US13/097,482
• Publication Number:
  US 20110208663A1
• Time in Patent Office: 1,075 Days
• Field of Search: 705/7, 705/8, 705/10
• US Class Current: 705/7
• CPC Class Codes: G06F 16/258 Data format conversion from or to a database
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 30/018 Certifying business or products
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G06Q 40/04 Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange

Abstract

A knowledge base and methods for use in connection with a policy compliance monitoring system operative to determine exceptions to policies expressed by computer-executable policy statements. The system allows establishment, codification, and maintenance of enterprise policies, monitors electronic transactions of the enterprise from various and possibly heterogeneous data sources, detects exceptions to established policies, reports exceptions to authorized users such as managers and auditors, and/or provides a case management system for tracking exceptions and their underlying transactions. The knowledge base comprises extractor files that are utilized for extracting information from data sources for utilization in policy compliance monitoring, a mapper for normalizing data from the data sources against a system ontology and storing normalized data in a monitoring database, and computer-executable compliance policy statements used by a transaction analysis engine. The policy statements represent predetermined policies of the enterprise that apply to data stored in the monitoring database.

Claims

1. A method of monitoring transactions stored in an enterprise database comprising a plurality of source records and a plurality of source fields in each of the plurality of source records, the method comprising:

identifying, by a computer system, a subset of source fields of the plurality of source fields;

during an initial extraction, capturing, by the computer system, initial information from the subset of source fields in a first source record, of the subset of source records, corresponding a monitored entity;

storing, by the computer system, the initial information in a staging database;

transforming, by the computer system, the initial information into a first monitoring entity by storing the initial information in a plurality of target fields of a first target record of a plurality of target records in a monitoring database based on an ontology describing a mapping between the plurality of source fields and the plurality of target fields;

during a subsequent extraction, occurring after the initial extraction, capturing, by the computer system, subsequent information from the subset of source fields in the first source record corresponding the monitored entity;

storing, by the computer system, the subsequent information in the staging database;

transforming, by the computer system, the subsequent information into a second monitoring entity by storing the subsequent information in the plurality of target fields of a second target record of the plurality of target records in the monitoring database based on the ontology describing the mapping between the plurality of source fields and the plurality of target fields; and

processing, by the computer system, the first monitoring entity and the second monitoring entity to identify an occurrence of improper activity with respect to the monitored entity.

2. The method of claim 1 wherein processing the first monitoring entity and the second monitoring entity to identify the occurrence of improper activity with respect to the monitored entity comprising comparing the first monitoring entity to the second monitoring entity.

3. The method of claim 2 wherein the occurrence of improper activity is identified based on differences between the initial information from the first source record as stored in the first monitoring entity and the subsequent information from the first source record as stored in the second monitoring entity.

4. The method of claim 3 further comprising, during an additional subsequent extraction occurring after the subsequent extraction, capturing, by the computer system, additional subsequent information from the subset of source fields in the first source record of the subset of source records corresponding the monitored entity;

storing, by the computer system, the additional subsequent information in the staging database; and

transforming, by the computer system, the additional subsequent information into a third monitoring entity by storing the additional subsequent information in the plurality of target fields of a third target record of the plurality of target records in the monitoring database based on the ontology describing the mapping between the plurality of source fields and the plurality of target fields.

5. The method of claim 4 wherein processing the first monitoring entity and the second monitoring entity to identify the occurrence of improper activity with respect to the monitored entity comprises:

processing the first monitoring entity, the second monitoring entity, and the third monitoring entity to identify the occurrence of improper activity with respect to the monitored entity.

6. The method of claim 5 wherein the monitored entity comprises a vendor name, wherein the initial information comprises initial characters representing the vendor name, wherein the subsequent information comprises subsequent characters representing the vendor name, and wherein:

for the occurrence of improper activity to be identified based on differences between the initial information and the subsequent information, the initial characters are compared to the subsequent characters to determine if any of the initial characters differ from the subsequent characters.

7. A non-transitory computer readable medium having stored thereon program instructions for monitoring transactions stored in an enterprise database comprising a plurality of source records and a plurality of source fields in each of the plurality of source records that, when executed by a computer system, direct the computer system to:

identify a subset of source fields of the plurality of source fields;

during an initial extraction, capture initial information from the subset of source fields in a first source record, of the subset of source records, corresponding a monitored entity;

store the initial information in a staging database;

transform the initial information into a first monitoring entity by storing the initial information in a plurality of target fields of a first target record of a plurality of target records in a monitoring database based on an ontology describing a mapping between the plurality of source fields and the plurality of target fields;

during a subsequent extraction, occurring after the initial extraction, capture subsequent information from the subset of source fields in the first source record corresponding the monitored entity;

store the subsequent information in the staging database;

transform the subsequent information into a second monitoring entity by storing the subsequent information in the plurality of target fields of a second target record of the plurality of target records in the monitoring database based on the ontology describing the mapping between the plurality of source fields and the plurality of target fields; and

process the first monitoring entity and the second monitoring entity to identify an occurrence of improper activity with respect to the monitored entity.

8. The non-transitory computer readable medium of claim 7 wherein processing the first monitoring entity and the second monitoring entity to identify the occurrence of improper activity with respect to the monitored entity comprising comparing the first monitoring entity to the second monitoring entity.

9. The non-transitory computer readable medium of claim 8 wherein the occurrence of improper activity is identified based on differences between the initial information from the first source record as stored in the first monitoring entity and the subsequent information from the first source record as stored in the second monitoring entity.

10. The non-transitory computer readable medium of claim 9 further comprising, during an additional subsequent extraction occurring after the subsequent extraction, capturing additional subsequent information from the subset of source fields in the first source record of the subset of source records corresponding the monitored entity;

storing the additional subsequent information in the staging database; and

transforming the additional subsequent information into a third monitoring entity by storing the additional subsequent information in the plurality of target fields of a third target record of the plurality of target records in the monitoring database based on the ontology describing the mapping between the plurality of source fields and the plurality of target fields.

11. The non-transitory computer readable medium of claim 10 wherein processing the first monitoring entity and the second monitoring entity to identify the occurrence of improper activity with respect to the monitored entity comprises:

processing the first monitoring entity, the second monitoring entity, and the third monitoring entity to identify the occurrence of improper activity with respect to the monitored entity.

12. The non-transitory computer readable medium of claim 11 wherein the monitored entity comprises a vendor name, wherein the initial information comprises initial characters representing the vendor name, wherein the subsequent information comprises subsequent characters representing the vendor name, and wherein:

for the occurrence of improper activity to be identified based on differences between the initial information and the subsequent information, the initial characters are compared to the subsequent characters to determine if any of the initial characters differ from the subsequent characters.

13. A method of monitoring transactions, the method comprising:

capturing, by a computer system, in an initial extraction from an enterprise database being monitored, initial information relating to a monitored entity;

storing, by the computer system, the initial information in a staging database;

transforming, by the computer system, the initial information into a first monitoring entity corresponding to the monitored entity and storing the first monitoring entity in a monitoring database;

capturing, by the computer system, in a subsequent extraction from the enterprise database occurring after the initial extraction, subsequent information relating to the monitored entity;

storing, by the computer system, the subsequent information in the staging database;

transforming, by the computer system, the subsequent information into a second monitoring entity corresponding to the monitored entity and storing the second monitoring entity in the monitoring database with the first monitoring entity;

comparing, by the computer system, the first monitoring entity to the second monitoring entity to identify an occurrence of improper activity with respect to the monitored entity.