Patent ID: 8165945

Claim:
A method, comprising: generating, using one or more processing units, one or more memory locations, wherein each memory location stores transaction data that is received during a designated time interval, and wherein a memory location is expired when it receives transaction data outside the designated time interval; receiving, using the one or more processing units, first transaction data, wherein the first transaction data has an associated first timestamp and an associated first characteristic; associating, using the one or more processing units, the first characteristic with a key that describes the first characteristic; storing, using the one or more processing units, the first characteristic key in a current memory location having a designated time interval that includes the first timestamp; receiving, using the one or more processing units, second transaction data, wherein the second transaction data has an associated second timestamp and an associated second characteristic; associating, using the one or more processing units, the second characteristic with a key that describes the second characteristic; determining, using the one or more processors, whether the current memory location has expired using the second timestamp, wherein when the current memory location has expired, the first characteristic key is moved to and stored in a past memory location, the designated time interval of the current memory location is updated to include the second timestamp, and the second characteristic key is stored in the current memory location; maintaining, using the one or more processing units, one or more counts for each current memory location, wherein each count is associated with a characteristic, and wherein each count indicates the number of characteristic keys that are associated with the characteristic; determining, using the one or more processors, a velocity count for a particular characteristic using the count associated with that characteristic; analyzing, using the one or more processing units, the velocity count to identify any anomalies; and generating, using the one or more processing units, a fraud determination using the identified anomalies.