Patent ID: 8180873
Filing Date: 2012-05-15
Classification: H04L

Abstract:
1. A method for detecting fraudulent activity, the method comprising: receiving, at a data reconstruction module in a first network, a plurality of interactions between a plurality of data centers and one or more devices, remote from the data centers, of a user, wherein each interaction of the plurality of interactions includes (i) envelope information and (ii) a data transaction request or a response; matching, at the data reconstruction module in the first network, each response to a corresponding data transaction request based on the envelope information to form an aggregate user session representing the user's activity over a period of time with the plurality of data centers via the one or more devices; receiving, by the data reconstruction module, a subscription request for the portion of the aggregate user session from a requesting device, wherein the subscription request is for a set time period; comparing, at a fraud detection module in the first network, at least a portion of the aggregate user session with previous user sessions to determine whether an activity pattern of the user deviates from a baseline of normal activity, wherein the previous user sessions are associated with one or more different users from the user associated with the aggregate user session; if the activity pattern deviates from the baseline of normal activity, redirecting, by the fraud detection module in the first network, one or more subsequent interactions of the user received from the one or more devices to an interdiction module in a second network separate from the first network without indicating to the user that the redirecting step has occurred; monitoring, by the interdiction module in the second network, one or more subsequent data transaction requests of the one or more subsequent interactions using additional fraud detection tools not found on the fraud detection module, the interdiction module configured to respond to each subsequent data transaction request with a response that appears to the user as if the request was executed by the respective data center; comparing, by the interdiction module in the second network, the one or more subsequent interactions to the baseline of normal activity; determining, by the interdiction module in the second network, an additional deviation from the baseline of normal activity indicative of the fraudulent activity by the user; and if the interdiction module in the second network determines that the subsequent interactions are harmful to the data centers: if the interdiction module in the second network is unable to determine whether the subsequent interactions are harmful to the data centers: