Patent ID: 8972325
Filing Date: 2015-03-03
Classification: G06N,G06Q

Abstract:
1. A method to detect fraudulent behavior, performed by one or more processors, comprising: associating, using the one or more processors, a plurality of users having similar job responsibilities with a common role in a business entity, with the plurality of users performing a certain set of business-related tasks related to the similar job responsibilities, where users performing the certain set of business-related tasks are authorized to perform similar role-related transactions using common web service enabled business applications; monitoring, using the one or more processors, workflow and collaboration processes across the common web service enabled business applications used by the plurality of users associated with the common role when performing the similar role-related transactions; receiving specific individual activities over time that are uniquely associated with each of the user's individual performance of the certain set of business-related tasks related to the common role; in response to the specific individual activities for each user, generating, using the one or more processors, a role profile for each user in the plurality of users associated with the common role, wherein the role profile associated with each user represents behaviors that are unique and vary according to each user performing the certain set of business-related tasks; comparing, using the one or more processors, the role profiles of the plurality of users associated with the common role to identify behavioral differences between the plurality of users performing the certain set of business-related tasks related to the common role; determining, using the one or more processors, a presence of anomalous behavior by analyzing the behavioral differences between the plurality of users to determine whether the behavioral differences represent anomalous behavior with respect to the common role; and outputting, using the one or more processors, an alert in response to determining the behavioral differences represent anomalous behavior.