Graph-Based Account Breach Detection for Linked Fraud Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Financial institutions face challenges in detecting synthetic accounts and account takeovers, which are types of fraud that compromise computer systems, as existing methods struggle to identify linked accounts involved in fraudulent activities.
Innovation Solution
A method and system that generate nodes and edges from account metadata to create a graph, applying link analysis techniques like PageRank™ to rank accounts based on their likelihood of being associated with a cybersecurity breach, identifying accounts that satisfy a breach threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional fraud detection methods are used, then existing account monitoring is maintained, but the ability to detect linked accounts in synthetic account and account takeover fraud is insufficient
Solution Approach 1:
The system segments the account detection problem into multiple graph types (e.g., device graph, location graph, transaction graph) and processes them independently before integrating results. This allows complex linked account detection to be broken down into manageable analyses of individual relationship dimensions.
Solution Approach 2:
The patent transitions from traditional flat account monitoring to a multi-dimensional graph-based approach. Accounts are represented as nodes connected by edges representing various relationships (device, location, time, transaction patterns), adding relational dimensions to detection capability.
2Reliability
If comprehensive account data is analyzed to detect fraud, then detection capability improves, but system complexity increases
Solution Approach 1:
The system divides comprehensive account data analysis into separate graph construction modules, each handling specific relationship types. This segmentation allows complex data to be processed through standardized, reusable components that reduce overall system complexity.
Solution Approach 2:
The graph data structure serves multiple functions simultaneously: it represents accounts, stores relationships, enables query processing, and supports fraud detection algorithms. This multi-functionality reduces the need for separate systems for each purpose.
3Measurement precision
If link analysis is applied to rank accounts, then identification of compromised accounts improves, but processing time increases
Solution Approach 1:
The system performs preliminary graph construction and relationship indexing before fraud detection queries are executed. By pre-processing and organizing account data into graph structures with pre-computed relationships, the actual fraud detection can proceed faster without re-analyzing all data from scratch.
Data Source
AI summary
Methods, systems, and techniques for detecting a cybersecurity breach. The cybersecurity breach may be a synthetic account or an account having been subjected to an account takeover. Electronic account data representative of accounts is obtained in which a first group of the accounts includes accounts flagged as being associated with the breach, and a second group of the accounts includes a remainder of the accounts. The computer system generates from the account data nodes representing the accounts and edges based on account metadata that connect the nodes. The computer system determines, such as by applying a link analysis method to the nodes and edges, a ranking of the accounts of at least part of the second group indicative of a likelihood that those accounts are also associated with the cybersecurity breach. That ranking may be used to identify which of those accounts is also identified with the cybersecurity breach.