Method and system for providing fraud detection for remote access services
View Patent ↗An approach provides fraud detection in support of data communication services. A usage pattern associated with a particular account for remote access to a data network is monitored. The usage pattern is compared with a reference pattern specified for the account. A fraud alert is selectively generated based on the comparison.
1. A method for providing fraud detection in support of data communication services, the method comprising providing at least one computer processor programmed to perform the steps of:
establishing a usage pattern based on one or more factors;
monitoring the usage pattern associated with an account for remote dial-up access to the data network;
comparing the usage pattern with a reference pattern specified for the account;
selectively generating fraud alarms based on the comparison;
correlating the alarms into cases, wherein alarms within a case are initially set as active when added to the case and thereafter remain active until a fraud determination is made with regard to the case, at which time all of the alarms in the case are set to be inactive;
prioritizing the alarms for analysis, wherein active alarms contribute to case priority; and
assigning the alarm an initial priority associated with a configurable value.
2. A method according to claim 1 , further comprising:
categorizing the account according to one of a plurality of behavioral groups, wherein the reference pattern corresponds to the one behavioral group.
3. A method according to claim 1 , further comprising:
designating a different reference pattern for the account, wherein the usage pattern is compared with the different reference pattern.
4. A method according to claim 1 , further comprising:
assigning a plurality of user identifiers for the account for access to the data network,
wherein login activities associated with the user identifiers are monitored to establish the usage pattern.
5. A method according to claim 4 , wherein the fraud alarms are generated based on overlap of times of communication sessions established over the data network, login from separate geographic locations, and duration of the communication sessions.
6. A method according to claim 1 , wherein the data network interfaces a telephony network supporting a call for communicating with a host within the data network; and
wherein the usage pattern is further based on one of origin of the call and type of call used to reach the host.
7. A system for providing fraud detection in support of data communication services, the system comprising:
a fraud detection system establishing a usage pattern based on one or more factors;
a monitoring device communicating with the data network, the monitoring device being configured to monitor the usage pattern associated with an account for remote dial-up access to the data network; and
a fraud detection system in communication with the monitoring device and being configured to compare the usage pattern with a reference pattern specified for the account, and to selectively generate a fraud alert based on the comparison,
wherein the fraud detection system uses detection rules for generating alarms and consolidates the alarms into cases, the alarms within a case being initially set as active when added to a case, and thereafter remain active until a fraud determination is made with regard to the case, at which time all of the alarms in the case are set to be inactive, where active alarms contribute to case priority and each alarm is assigned an initial priority associated with a configurable value, and wherein the fraud detection system and monitoring device comprise at least one computer processor.
8. A system according to claim 7 , wherein the account is categorized according to one of a plurality of behavioral groups, and the reference pattern corresponds to the one behavioral group.
9. A system according to claim 7 , wherein the fraud detection system designates a different reference pattern for the account, and the usage pattern is compared with the different reference pattern.
10. A system according to claim 7 , wherein a plurality of user identifiers are assigned for the account for access to the data network, and login activities associated with the user identifiers are monitored to establish the usage pattern.
11. A system according to claim 10 , wherein the fraud alert is generated based on overlap of times of communication sessions established over the data network, login from separate geographic locations, and duration of the communication sessions.
12. A system according to claim 7 , wherein the data network interfaces a telephony network supporting a call for communicating with a host within the data network; and wherein the usage pattern being established is further based on one of origin of the call and type of call used to reach the host.
13. A non-transitory computer-readable storage medium carrying one or more sequences of one or more instructions for providing fraud detection in support of data communication services, the one or more sequences of one or more instructions including instructions which, when executed by one or more processors, cause the one or more processors to perform the steps of:
establishing a usage pattern based on one or more factors;
monitoring the usage pattern associated with an account for remote dial-up access to a data network;
comparing the usage pattern with a reference pattern specified for the account;
selectively generating fraud alarms based on the comparison;
correlating the alarms into cases, wherein alarms within a case are initially set as active when added to the case, and thereafter remain active until a fraud determination is made with regard to the case, at which time all of the alarms in the case are set to be inactive;
prioritizing the alarms for analysis, wherein active alarms contribute to case priority; and
assigning the alarm an initial priority associated with a configurable value.
14. A non-transitory computer-readable storage medium according to claim 13 , further including instructions for causing the one or more processors to perform the step of:
categorizing the account according to one of a plurality of behavioral groups, wherein the reference pattern corresponds to the one behavioral group.
15. A non-transitory computer-readable storage medium according to claim 13 , further including instructions for causing the one or more processors to perform the step of:
designating a different reference pattern for the account, wherein the usage pattern is compared with the different reference pattern.
16. A non-transitory computer-readable storage medium according to claim 13 , further including instructions for causing the one or more processors to perform the step of:
assigning a plurality of user identifiers for the account for access to the data network,
wherein login activities associated with the user identifiers are monitored to establish the usage pattern.
17. A non-transitory computer-readable storage medium according to claim 16 , wherein the fraud alarms are generated based on overlap of times of communication sessions established over the data network, login from separate geographic locations, and duration of the communication sessions.
18. A non-transitory computer-readable storage medium according to claim 13 , wherein the data network interfaces a telephony network supporting a call for communicating with a host within the data network, the computer-readable medium further including instructions for causing the one or more processors to perform the step of:
establishing the usage pattern based, further, on one of origin of the call and type of call used to reach the host.