Detecting and interdicting fraudulent activity on a network
Described are computer-based methods and apparatuses, including computer program products, for detecting and interdicting fraudulent activity on a network. An user utilizes a transmitting device to transmit user requests that are split between a plurality of data centers for processing. The user requests are captured at the data centers. The user requests are unified into an user session. The user session can be analyzed for fraud detection, marketing analysis, network intrusion detection, customer service analysis, and/or performance analysis. If fraudulent activity is detected, then the user can be interdicted to prevent further fraudulent activity.
1. A method for detecting and interdicting fraudulent activity on a network, the method comprising:
receiving, by a fraud detection device, at least a portion of a user session comprising a plurality of interactions between a plurality of data centers and one or more devices, remote from the data centers, of a user, from a data reconstruction device;
determining, at the fraud detection device and based on geo-location information associated with the at least a portion of the user session, whether a communication path between the plurality of data centers and the one or more remote devices includes a suspicious network to generate a fraudulent geo-location indicator;
determining, at the fraud detection device and based on user behavior information associated with the at least a portion of the user session, whether the user behavior information deviates from a baseline of normal activity to generate a fraudulent behavior indicator;
determining, at the fraud detection device and based on a plurality of application interactions associated with the at least a portion of the user session, whether the plurality of application interactions fall outside a normal range of interactions to generate a fraudulent application interaction indicator, wherein the plurality of application interactions originate from application modules at the plurality of data centers and the remote user devices;
determining, at the fraud detection device and based on financial transaction information associated with the at least a portion of the user session, whether the financial transaction information includes pre-defined patterns associated with fraudulent financial account activity to generate a fraudulent financial transaction indicator;
combining, at the fraud detection device, the fraudulent geo-location indicator, the fraudulent behavior indicator, the fraudulent application interaction indicator, and the fraudulent financial transaction indicator to generate a session confidence value; and
interdicting, by the fraud detection device, the user session if the session confidence value falls below a predetermined threshold.
2. The method of claim 1 , wherein interdicting the user session further comprises notifying, by the fraud detection device, an authentication system to prevent the user session from accessing the network.
3. The method of claim 1 , further comprising generating, by the fraud detection device, a rule based on the combined indicators.
4. The method of claim 3 , further comprising communicating, by the fraud detection device, the rule to an authentication system associated with the network.
5. The method of claim 1 , wherein interdicting the user session requires the user to authenticate onto the network via the one or more devices.
6. The method of claim 1 , wherein interdicting the user session notifies the user of fraudulent activity based on the combined indicators.
7. The method of claim 1 , wherein interdicting the user session cuts off the one or more devices from the network.
8. The method of claim 1 , wherein interdicting the user session redirects the plurality of interactions to a separate network.
9. The method of claim 1 , wherein the plurality of data centers receive the plurality of interactions from a load balancer.
10. The method of claim 9 , wherein the load balancer sends the plurality of interactions to different data centers in the plurality of data centers according to available capabilities of the plurality of data centers, conditions of the network, quality of service indicators on the data packets, application availability, number of connections to each data center of the plurality of data centers, pre-defined routing instructions, or combinations thereof.
11. A system for detecting and interdicting fraudulent activity on a network, the system comprising:
a fraud detection device configured to:
receive at least a portion of a user session comprising a plurality of interactions between a plurality of data centers and one or more devices, remote from the data centers, of a user, from a data reconstruction device;
determine, based on geo-location information associated with the at least a portion of the user session, whether the communication path between the plurality of data centers and the one or more remote devices includes a suspicious network to generate a fraudulent geo-location indicator;
determine, based on user behavior information associated with the at least a portion of the user session, whether the user behavior information deviates from a baseline of normal activity to generate a fraudulent behavior indicator;
determine, based on a plurality of application interactions associated with the at least a portion of the user session, whether the plurality of application interactions fall outside a normal range of interactions to generate a fraudulent application interaction indicator, wherein the plurality of application interactions originate from application modules at the plurality of data centers and the remote user devices;
determine, based on financial transaction information associated with the at least a portion of the user session, whether the financial transaction information includes pre-defined patterns associated with fraudulent financial account activity to generate a fraudulent financial transaction indicator;
combine the fraudulent geo-location indicator, the fraudulent behavior indicator, the fraudulent application interaction indicator, and the fraudulent financial transaction indicator to generate a session confidence value; and
interdict the user session if the session confidence value falls below a predetermined threshold.
12. A computer program product, tangibly embodied in a computer readable storage medium, for detecting and interdicting fraudulent activity on a network, the computer program product including instructions operable to cause a fraud detection device to:
receive at least a portion of a user session comprising a plurality of interactions between a plurality of data centers and one or more devices, remote from the data centers, of a user, from a data reconstruction device;
determine, based on geo-location information associated with the at least a portion of the user session, whether the communication path between the plurality of data centers and the one or more remote devices includes a suspicious network to generate a fraudulent geo-location indicator;
determine, based on user behavior information associated with the at least a portion of the user session, whether the user behavior information deviates from a baseline of normal activity to generate a fraudulent behavior indicator;
determine, based on a plurality of application interactions associated with the at least a portion of the user session, whether the plurality of application interactions fall outside a normal range of interactions to generate a fraudulent application interaction indicator, wherein the plurality of application interactions originate from application modules at the plurality of data centers and the remote user devices;
determine, based on financial transaction information associated with the at least a portion of the user session, whether the financial transaction information includes pre-defined patterns associated with fraudulent financial account activity to generate a fraudulent financial transaction indicator;
combine the fraudulent geo-location indicator, the fraudulent behavior indicator, the fraudulent application interaction indicator, and the fraudulent financial transaction indicator to generate a session confidence value; and
interdict the user session if the session confidence value falls below a predetermined threshold.
13. A system for detecting and interdicting fraudulent activity on a network, the system comprising:
means for receiving at least a portion of a user session comprising a plurality of interactions between a plurality of data centers and one or more devices, remote from the data centers, of a user, from a data reconstruction device;
means for determining, based on geo-location information associated with the at least a portion of the user session, whether the communication path between the plurality of data centers and the one or more remote devices includes a suspicious network to generate a fraudulent geo-location indicator;
means for determining, based on user behavior information associated with the at least a portion of the user session, whether the user behavior information deviates from a baseline of normal activity to generate a fraudulent behavior indicator;
means for determining, based on a plurality of application interactions associated with the at least a portion of the user session, whether the plurality of application interactions fall outside a normal range of interactions to generate a fraudulent application interaction indicator, wherein the plurality of application interactions originate from application modules at the plurality of data centers and the remote user devices;
means for determining, based on financial transaction information associated with the at least a portion of the user session, whether the financial transaction information includes pre-defined patterns associated with fraudulent financial account activity to generate a fraudulent financial transaction indicator;
means for combining the fraudulent geo-location indicator, the fraudulent behavior indicator, the fraudulent application interaction indicator, and the fraudulent financial transaction indicator to generate a session confidence value; and
means for interdicting the user session if the session confidence value falls below a predetermined threshold.
14. A method for detecting and interdicting fraudulent activity on a network, the method comprising:
receiving, at a data reconstruction module, a plurality of interactions between a plurality of data centers and one or more devices, remote from the data centers, of a user, wherein each interaction of the plurality of interactions includes (i) envelope information and (ii) a user request for information, a data center request for information, a user response, or a data center response;
matching, at the data reconstruction module, based on the envelope information of the each interaction of the plurality of interactions, at least one of (i) each user response to a corresponding data center request or (ii) each data center response to a corresponding user request, to form reconstructed data of the user;
aggregating, at the data reconstruction module, the reconstructed data into a user session, the user session comprising a representation of the user's activity over a period of time with the plurality of data centers via the one or more devices;
processing, at the data reconstruction module, the user session into a format that conforms with a particular protocol, the formatted user session adapted for determining an activity pattern of the user by a fraud detection device;
transmitting, by the data reconstruction module, at least a portion of the formatted user session to the fraud detection device;
determining, at the fraud detection device and based on geo-location information associated with the at least a portion of the user session, whether a communication path between the plurality of data centers and the one or more remote devices includes a suspicious network to generate a fraudulent geo-location indicator;
determining, at the fraud detection device and based on user behavior information associated with the at least a portion of the user session, whether the user behavior information deviates from a baseline of normal activity to generate a fraudulent behavior indicator;
determining, at the fraud detection device and based on a plurality of application interactions associated with the at least a portion of the user session, whether the plurality of application interactions fall outside a normal range of interactions to generate a fraudulent application interaction indicator, wherein the plurality of application interactions originate from application modules at the plurality of data centers and the remote user devices;
analyzing, at the fraud detection device and based on financial transaction information associated with the at least a portion of the user session, whether the financial transaction information includes pre-defined patterns associated with fraudulent financial account activity to generate a fraudulent financial transaction indicator;
combining, at the fraud detection device, the fraudulent geo-location indicator, the fraudulent behavior indicator, the fraudulent application interaction indicator, and the fraudulent financial transaction indicator to generate a session confidence value; and
interdicting, by the fraud detection device, the user session if the session confidence value falls below a predetermined threshold.