Patent ID: 8145560

Claim:
A method of detecting fraudulent activity, the method comprising: receiving, by a fraud detection device in a first network, at least a portion of a user session comprising a plurality of interactions between a plurality of data centers and one or more devices, remote from the data centers, of a user, from a data reconstruction device, wherein each interaction of the plurality of interactions includes (i) envelope information and (ii) at least one request for information, a data center request for information, a user response, or a data center response; comparing, at the fraud detection device, the at least a portion of the user session to one or more application contexts to determine whether the at least a portion of the user session includes fraudulent activity, wherein each of the one or more application contexts includes a set of fraudulent behavior indicators; generating, at the fraud detection device, a session confidence value based on the comparison of the at least a portion of the user session to one or more application contexts; and redirecting, by the fraud detection device, subsequent interactions received from the one or more devices to a second network isolated from the plurality of data centers if the activity pattern is found to deviate from the baseline of normal activity; and monitoring, by the fraud detection device, the subsequent interactions to determine additional deviations from the baseline of normal activity.