Trail Log Analysis System for Fraud Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting fraudulent operations in information systems from trail logs are limited, as they often rely on the latest log data and struggle to accurately identify fraudulent activities due to changing system usage patterns, leading to incomplete pattern detection and failure to confirm normal system actions.
Innovation Solution
A trail log analysis system that generates an information development table from trail logs, accumulating data across time zones and comparing it with an accumulative table to identify fraudulent or abnormal actions, allowing for high-speed detection without pre-defined patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional methods use only the latest trail log for detection, then the detection process is simple and fast, but the detection accuracy is low and fraudulent operations are not easily detected
Solution Approach 1:
The system performs preliminary actions by collecting and storing trail logs over multiple time zones before detection is needed. The information development table is pre-built with accumulated data from multiple time zones, allowing the detection to compare against historical patterns rather than just the latest log, thereby improving accuracy without making the detection process itself complex.
Solution Approach 2:
The system transitions from one-dimensional detection (only latest log) to multi-dimensional detection by incorporating multiple time zones. The information development table structures data across different time zones, enabling comparison along the time dimension and improving detection accuracy by analyzing patterns across multiple temporal dimensions.
2Adaptability or versatility
If pattern matching with pre-defined fraudulent operation patterns is used, then detection can be performed, but the number of patterns is restricted and many fraudulent operations cannot be detected
Solution Approach 1:
The system implements self-service by automatically generating detection patterns from the accumulated trail log data itself. Rather than requiring manual definition of fraudulent operation patterns, the system learns normal operation patterns from historical data and automatically identifies deviations, thereby expanding detection coverage without the complexity of manual pattern management.
Solution Approach 2:
The system changes the parameter of pattern definition from static pre-defined patterns to dynamic patterns generated from data. The information development table enables the system to adapt patterns based on actual operational data, allowing detection coverage to expand as more data is accumulated without increasing pattern management complexity.
3Reliability
If the information system usage patterns change every day, then the system is flexible and adaptable, but conventional detection methods fail to detect fraudulent operations accurately
Solution Approach 1:
The system applies dynamics by making the detection patterns adaptive rather than static. The information development table accumulates data from multiple time zones, allowing the system to dynamically adjust to changing usage patterns. Detection reliability improves because the system learns from historical variations and adapts to new patterns as they emerge in the data.
Solution Approach 2:
The system implements feedback by continuously comparing new trail logs against historical patterns from the information development table. This feedback mechanism allows the system to detect deviations from normal patterns while adapting to legitimate changes in usage patterns, thereby maintaining detection reliability despite usage pattern variability.
Data Source
AI summary
A trail log analysis system detects a fraudulent operation from a trail log of an information system, and confirms the correctness of a system action. An information development device generates an information development table from a trail log to be analyzed. The information development table defines a subject (who), an object (what), and an action (what is to be done) as comparison targets, and counts and record an event occurrence number corresponding to an event occurrence time recorded in a trail log for each combination of comparison targets. An accumulation device generates an accumulative information development table by accumulating the information development table corresponding to a trail log recorded previously and up to a time point immediately before the last collected trail log to be analyzed. A comparison device compares the information development table with the accumulative information development table, and outputs a comparison result.