Abstract:
A system and method for detecting fraudulent activity in the execution of transactions is disclosed. The system comprises a monitoring device for reviewing data relating to execution of transactions, a transaction profile and an alert module. The transaction profile includes a plurality of historic data items relating to typical transactions, which can be compared with current execution of transactions to generate an alert by the alert module if unusual activity is determined.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    The present application is a continuation of U.S. patent application Ser. No. 14/180,723, filed Feb. 14, 2014, which is hereby incorporated by reference in its entirety. The present application is also related to U.S. patent application Ser. No. 12/965,226, filed Dec. 10, 2010, and to U.K. Patent Application No. GB 1316319.1, filed Sep. 13, 2013, both of which are herein incorporated by reference in their entirety. 
     
    
     FIELD 
       [0002]    This application relates to an apparatus, a method and a computer program product for detection of rogue trading. 
       BACKGROUND 
       [0003]    A rogue trader is an individual who acts recklessly and independent of fellow employees to make unauthorized trades on behalf of their employer. The term is most often applicable to financial trading, in which professional traders make and approve financial transactions. Rogue traders typically trade in high-risk investments, which may cause considerable losses. These losses may be preceded by large, but unsustainable, profits. Financial institutions have, in the past, tended to largely ignore this potentially catastrophic form of operational risk, as described in the paper ‘A Review of Operational Risk in Banks and its Role in the Financial Crisis’, by De Jongh et al. and published in the SAJEMS NS 16 [2013] No. 4: 364-382. 
         [0004]    An article on the Forbes website ‘Corporate Culture is Key element in Fighting Rogue Trading’, by Steve Culp, dated 21 Jun. 2012 notes that detection and prevention of rogue trading activity is not easy. Large financial institutions have made significant investments in sophisticated systems to identify unauthorized activities. The ability of individuals acting as rogue traders to avoid detection and to continue to make unauthorized trade remains a concern for risk management and executive teams in many leading organizations. 
         [0005]    Current attempts at combatting rogue trading rely on rule-based systems in which transaction relating to trades are analyzed and, if the transactions trigger one or more of the rules, then the transaction is either not performed or an alert triggered. U.S. Pat. No. 6,965,886 [Goovrin et al., assigned to Actimize Limited Ltd, Petach Tikva, Israel] teaches such a system and method for collecting, filtering, analyzing, distributing and effectively utilizing highly relevant events in real time from huge quantities of data. 
         [0006]    U.S. Pat. No. 8,145,560 [Kulkarni et al., assigned to FMR, Boston, Mass.] also teaches a rule-based system for detecting fraudulent activity on a network. 
         [0007]    The known prior art methods for detection of fraudulent activity rely on a rule-based system. It is, however, established that rogue traders can circumvent the rules in the rule-based system if the traders understand how the rules operate. For example, a rogue trader may break down one trade into a number of smaller trades executed through different brokers in order to circumvent any rules restricting the size of a trade. Clearly it would be possible to construct a rule to avoid such circumvention once the issue has become known. There is, however, a need to develop a system, which can be used to identify potentially rogue trades at an earlier stage. 
       SUMMARY 
       [0008]    A system and a method for detecting fraudulent activity are taught in this disclosure. The system comprises a monitoring device for reviewing any data relating to execution of transactions, such as trades, as well as an alert module for generating an alert on detection of irregularities in the transaction. The monitoring device is able to access a transaction profile, which includes a plurality of historic data items relating to typical transactions. The transaction profile is used to establish a profile base line for the execution of transactions, which are allowed by a financial institution&#39;s internal rules. The data items in the transaction profile could include but are not limited to sales transactions, put options, sale options, address lookup through a DNS server, network addresses, routing information, time, date and device cookies stored on a trader&#39;s computer. These data items taken alone may not indicate that an unauthorized transaction has taken place. However, the data items enable the transaction profile to be constructed for a trader carrying out authorized trades. Should any one of the traders in the financial institution deviate from the constructed transaction profile, then the pattern of trades can be investigated manually by, for example, a compliance officer in order to determine whether the trader is acting in accordance with the bank&#39;s accepted guidelines. The alert module generates an alert generally in real-time or at a later date on detection of irregularities or deviations form the transaction profile. The irregularities or deviation may not indicate directly that one of the traders is a rogue trader, but will allow the investigation by a financial institution&#39;s compliance department to ensure that no issue is raised. 
         [0009]    In one aspect of the invention, the system may include a number of transaction profiles indicating different skills or responsibility levels of the traders. For example, a junior trader may only be able to undertake certain transactions and/or execute a certain level of transactions. A more experienced trader will be empowered to execute different types of transactions. It would be expected that the transaction profiles for the different skill levels of the traders will therefore be different. A group transaction profile can be established for a particular group of traders. 
         [0010]    The method for detecting fraudulent activity involves the receipt from a first device such as a trader&#39;s computer, phone or tablet, and comparing the data items with a transaction profile. The alert will be generated and can then be passed to a supervisor for action. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1  shows an overview of a user computer connected to a network. 
           [0012]      FIG. 2  shows a flow diagram of the method. 
       
    
    
     DETAILED DESCRIPTION 
       [0013]    The invention will now be described on the basis of the drawings. It will be understood that the embodiments and aspects of the invention described herein are only examples and do not limit the protective scope of the claims in any way. The invention is defined by the claims and their equivalents. It will be understood that features of one aspect or embodiment of the invention can be combined with a feature of a different aspect or aspects and/or embodiments of the invention. 
         [0014]      FIG. 1  shows a system  100  for detecting fraudulent activity according to one aspect of the invention. The system includes a user computer  10  with a plurality of outgoing connections  20  and a plurality of incoming connections  30 . The user computer  10  could alternatively be a smartphone or tablet as well as a desktop or laptop computer and the term is intended to cover these alternates. The outgoing connections  20  and the incoming connections  30  are connected to one or more transactional servers  15   a  or  15   b . The transmission of data over the outgoing connections  20  and the incoming connections  30  in the system  100  is carried out using, for example, packet-based networks or circuit-based networks. Packet-based networks include, but are not limited to, the Internet, a private internet protocol (IP) network, or a wireless network (such as GPRS, UMTS or LTE). Circuit-based networks include, but are not limited to, the public switched telephone network (PSTN), a wireless network (such as RAN Bluetooth, CDMA, TDMA or GSM). 
         [0015]    A user at the user computer  10  is a stock trader, who is engaged in the buying and selling of financial products, such as bonds, stocks, futures, derivatives and shares, in for example the stock exchange (bourse) or commodity markets. The trader interacts with the user computer  10  to retrieve information about financial products from information sources, such as Reuters or Bloomberg through a webserver  16  linked to the Internet  17  or an intranet, and to execute trades in the financial products. The trades include buy and sell orders. The buy and sell orders can be carried out using a program running on a transactional server  15 , using a browser program on the user computer  10  or by using a dedicated trading application program running on the user computer  10 . The user computer  10  can include a verification device  12  for verifying the identity of the trader wishing to execute the trade, and the authenticity of the trade. Suitable verification devices  12  include, but are not limited to, card readers, one-time key devices, password entry or a combination thereof. The verification device  12  includes an alert module  67  for generating an alert in the event that the trade is not authorized. Messages  70  are passed between the user computer  10  and the transaction servers  15   a - b  to instruct the transaction servers  15   a - b  to execute the trades. 
         [0016]    The transaction server  15   a  can also include an authorization device  19 , which reviews the transaction before execution for compliance with the financial institution&#39;s compliance rules. The authorization device  19  is, for example, a rules-based device, as known in the art. The authorization device  19  is shown only in the transaction server  15   a . The authorization device  19  could be on all of the transaction servers  15   a - b  or on a single transaction server  15   a , but accessed by other ones of the transaction servers  15   a.    
         [0017]    A monitoring device  60  installed within the system  100  in which the user computer  10  and the transactional servers  15  are operating. The monitoring device  60  continually monitors the system  100  and the user computer  10  as well as the messages  70  exchanged within the system  100  and/or generated by the user computer  10  and/or generated by the transaction server B. The monitoring device  60  uses a variety of data and data sources for performing the monitoring. 
         [0018]    Examples of the data collected by the monitoring device  60  include data items  66  relating to the websites accessed by the trader. These data items include but are not limited to global address lookup (i.e., global IP address used by ICAAN), network address, routing information, time, date, device cookies downloaded or used, device fingerprints as well as volume and timing of trades and combinations thereof. The monitoring device  60  can also use data sources based on network flow traffic statistics through the system  100  and to the outside network. These data sources include proxy logs and NetFlow records, which record the destination of data sent through outgoing ports  25  of the user computer  10  and/or the transactional server  15  as well as the source of incoming data received through the incoming ports  35  at the user computer  10  and/or the transactional server  15 . 
         [0019]    Many computer networks  130  also have a DNS server  110  located in a private network, as well as having access to public DNS servers  120 . The DNS server  110  includes a variety of data log entries, including time stamps, indicating which ones of the trader computers attempted to access which web sites or external servers at which period of time. 
         [0020]    The monitoring device  60  can also review headers in emails and/or other messages  70  sent throughout the computer network  130 . The email headers will include information, such as the time, the destination and the source, as well as having information about the size of the email. 
         [0021]    It will be appreciated that these data sources are merely exemplary and that other data sources can be used or supplied. Only a single user computer  10  is shown in  FIG. 1  for simplicity. In practice, there will be a large number of user computers  10  and transactional servers  15 . It will be appreciated that the system  100  may also contain other devices that can generate messages  70  or other data. 
         [0022]    The monitoring device  60  creates a transaction profile  62  for the traders/users and/or the user computer  10  based on behaviour of the user or a group of users. The transaction profile  62  is stored in a user profile database  65  attached to the monitoring device  60 . It will be appreciated that the user profile database  65  contains more than one transaction profile  62  and that each one of the traders (and possibly the user computers  10 ) can have a separate transaction profile  62  and/or a group transaction profile  62  can be created for a group of traders. The transaction profile  62  in the user profile database  65  receives the data items  66  that indicate how the user computer  10  generally reacts with the system  100  as well as with the transactional servers  15  and other devices in the system  100  such as the web server  16  or the DNS server  110 . The user profile database  62  will continually be updated as new ones of the data items  66  relating to activity of the user computer  10  are generated. The transaction profile  62  creates in essence a baseline from which a ‘normal’ behavior of the trader and/or the user computer  10  can be deduced. 
         [0023]    The transaction profile  62  will be built up from the trader&#39;s typical interactions. For example, a trader will typically make trades at a particular rate, volume and price. The traders will also potentially typically trade in particular markets or stocks and exhibit periodic and seasonal variances. The transaction profile  62  is therefore a statistical model of the trader based on these trades. The transaction profile  62  represents the probability of a specific interaction based on historical behavior and is thus a baseline against which rogue trading activities can be detected. 
         [0024]    The transaction profile  62  for a group of traders can be built up to represent the baseline for a particular trading activity. One example would be a group of commodity traders. The user profile database  65  could have both the individual transaction profile  62  for an individual one of the traders and a further group transaction profile for the group of commodity traders. 
         [0025]    Suppose now that a trader (or a person using the user computer  10 ) initiates the rogue trading activities. The monitoring device  60  will receive further data items  66  relating to the rogue behavior. The further data items  66  indicate that behavior of the user computer  10  deviates from the normal baseline behaviour expected by comparison with the transaction profile  62  stored in the user profile database  65 . Non limiting examples of such deviant behaviour include massive amounts of data being transferred to one of the transaction servers  15 , unusual patterns of orders or access to a rarely used website or automated execution of trades. The monitoring device  60  can notify in real time an administrator of a possible fraudulent activity initiated by the user computer  10  and the administrator or compliance department can investigate the activities from the user computer  10 . 
         [0026]      FIG. 2  shows an outline of a process  200  for the detection of fraudulent activity by the rogue trader. The process  200  starts at  210  by a log in of the trader at the user computer  10  and in step  220  the data items  66  from the various data sources are gathered. In step  230  the gathered data items  66  are compared with one or more of the transaction profiles  62 . There may be more than one transaction profile  62  and, in this case, the transaction profile  62  most representative of the trader at the user computer  10  is chosen. If an anomaly or irregularity is discovered, an alert is generated in step  240  such that the administrator or the compliance officer can investigate in step  250 . In step  260 , the transaction profile  62  is updated from the newly gathered data items  66 . 
         [0027]    The updating of the transaction profile  62  in step  260  ensures that the transaction profile  62  is continually adapted to new types of orders or data sources or other transactional servers  15  inserted into the system  100 . 
         [0028]    In a further aspect of the invention, the system and method can be used to detect further types of fraudulent behaviour using the user computer  10  or in the system  100 . It would be possible, for example, to use the teachings of a disclosure to detect other types of fraud by users of the user computer  10 . The fraud can be detected by, for example, identifying anomalous attempts to access certain websites, which are not normally accessed, or, by an attempt to transfer significant amounts of data to a computer or memory device that is not normally in use, or by the generation of a large number of emails in a particular period of time. 
         [0029]    The detection of fraud is made by detection of unusual activity in the transaction profile  62 . One further method for identifying fraud is by comparing the different ones of the transaction profiles  62  of different users of the computer  10 . If one of the transaction profiles  62  is substantially different than other ones of the transaction profiles  62 , then notification can be made to an administrator or a compliance officer to investigate activities of the trader and the user computer  10 . Another method for identifying fraud is if the transaction profile  62  suddenly changes or is unexpectedly modified. Similarly if the activity at the user computer  10  does not reflect the transaction profile for the expected group transaction profile  62 , then the notification can also be issued. 
         [0030]    The transaction profile  62  can be initially created by using a set of training data obtained from analysing over a period of time. The training data will represent real-life, non-rogue situations. 
       REFERENCE NUMERALS 
       [0000]    
       
           10  User Computer 
           12  Verification Device 
           15  Transactional Servers 
           16  Web server 
           17  Internet 
           19  Authorization Device 
           20  Outgoing Connections 
           25  Outgoing port 
           30  Incoming Connections 
           35  Incoming port 
           60  Monitoring Device 
           62  Transaction Profile 
           65  User profile database 
           66  Data Items 
           67  Alert module 
           70  Message 
           100  System 
           110  Private DNS Server 
           120  Public DNS Server 
           130  Computer Network