Online fraud solution

• US 9,684,888 B2
• Filed: 04/07/2015
• Issued: 06/20/2017
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: Camelot UK Bidco Limited (Clarivate Plc)
• Inventors: Shraim, Ihab, Shull, Mark, Hepworth, James
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US14/680,898
• Publication Number:
  US 20150235177A1
• Time in Patent Office: 805 Days
• Field of Search: 726 26
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Various embodiments of the invention provide solutions (including inter alia, systems, methods and software) for dealing with online fraud. Some embodiments function to access and/or obtain information from (and/or receive data from) a data source; the data might, for example, indicate a possible instance of online fraud. Certain embodiments, therefore, can be configured to analyze the data, e.g., to determine whether the data indicate a likely instance of online fraud. Such instances may be further investigated, and/or a response may be initiated. Data sources can include, without limitation, web pages, email messages, online chat sessions, domain zone files, newsgroups (and/or postings thereto), etc. Data obtained from the data sources can include, without limitation, suspect domain registrations, uniform resource locators, references to trademarks, advertisements, etc.

Claims

1. A computer system for investigating suspicious information associated with a suspect server to determine whether the suspect server is associated with fraudulent activities, the computer system comprising:

a master computer; and

at least one memory device coupled with the master computer, the at least one memory device having stored therein a sequence of instructions which, when executed by the master computer, cause the computer system to;

obtain, by the master computer, a data set associated with the suspect server;

analyze, by the master computer, the data set to detect potential fraudulent activity associated with a data set by identifying, within the data set, a request for specified personal information from a user;

detect potential fraudulent activity;

generate, in response to detecting potential fraudulent activity and by using a dilution engine, a plurality of responses to the request for specified personal information, each response including a set of safe data responsive to the request for specified personal information;

associate each of the plurality of responses with one of a plurality of IP addresses from at least one network block or one or more proxy servers;

transmit the plurality of responses to the suspect server;

monitor for the use of the set of safe data on a network; and

trace the use of the set of safe data to a potential perpetrator.

2. The system of claim 1, wherein the plurality of responses is generated using the dilution engine, and wherein the dilution engine operates on a computer separate from the master computer.

3. The system of claim 1, wherein the master computer is configured to analyze at least one of an e-mail message, a newsgroup posting, a web page and a transcript, in conjunction with analyzing the data set to detect fraudulent activity.

4. The system of claim 1, wherein the master computer is configured to identify potential fraudulent activity by detecting that the request for specified personal information comprises a request for at least one of a financial institution account number, a credit card number including an expiration date and/or security code, a userID, a password, a mother'"'"'s maiden name, a social security number, and a driver'"'"'s license number.

5. The system of claim 1, wherein the plurality of responses are generated using a plurality of response computers, each response computer comprising the dilution engine.

6. The system of claim 1, further comprising a megaproxy, the megaproxy configured to transmit the plurality of responses to the suspect server to assist in making the plurality of responses appear to originate from an IP address contained within the at least one network block.

7. The system of claim 1, wherein the one or more proxy servers are configured so that the plurality of responses are transmitted serially through at least two of the proxy servers before being transmitted to the suspect server.

8. The system of claim 7, wherein header information within the plurality of responses is disguised to hide the identity of a computer upon which the plurality of responses are generated.

9. The system of claim 7, wherein at least one of the plurality of proxy servers omits data from, and/or substitutes false or pseudorandom data into, at least one field in an HTTP request associated with the transmission of the plurality of responses.

10. A method of investigating suspicious information associated with a suspect server to determine whether the suspect server is associated with fraudulent activities, comprising:

obtaining, by a master computer, a data set associated with the suspect server;

analyzing, by the master computer, the data set to detect potential fraudulent activity associated with the data set by identifying, within the data set, a request for specified personal information from a user;

detecting potential fraudulent activity in response to identifying the request for specified personal information;

generating, in response to detecting potential fraudulent activity and by using a dilution engine, a plurality of responses to the request for specified personal information, each response including a set of safe data responsive to the request for specified personal information;

associating each of the plurality of responses with one of a plurality of IP addresses from at least one network block or one or more proxy servers;

transmitting the plurality of responses to the suspect server;

monitoring for the use, subsequent to said transmitting, of the set of safe data on a network; and

tracing the use of the set of safe data to a potential perpetrator.

11. The method of claim 10, wherein the master computer is configured to analyze at least one of an e-mail message, a newsgroup posting, a web page and a transcript, in conjunction with analyzing the data set to detect fraudulent activity.

12. The method of claim 10, wherein the master computer is configured to identify potential fraudulent activity by detecting that the request of specified personal information comprises a request for at least one of a financial institution account number, a credit card number including an expiration date and/or security code, a userID, a password, a mother'"'"'s maiden name, a social security number, and a driver'"'"'s license number.

13. The method of claim 10, wherein the plurality of responses are generated using a plurality of response computers, each response computer comprising the dilution engine.

14. The method of claim 10, wherein the plurality of responses are transmitted to the suspect server using a megaproxy, the megaproxy configured to assist in making the plurality of responses appear to originate from an IP address contained within the at least one network block.

15. The method of claim 10, wherein the one or more proxy servers are configured so that the plurality of responses are transmitted serially through at least two proxy servers before being transmitted to the suspect server.

16. The method of claim 15, wherein header information within the plurality of responses is disguised to hide the identity of a computer upon which the plurality of responses are generated.

17. The method of claim 15, wherein at least one of the plurality of proxy servers omits data from, and/or substitutes false or pseudorandom data into, at least one field in an HTTP request associated with the transmission of the plurality of responses.

18. The method of claim 10, wherein at least one proxy server is an internet service provider, and the plurality of responses are transmitted to the internet service provider before being transmitted to the suspect server.

19. The method of claim 10, wherein the generating the plurality of responses is done using the dilution engine.