Patent ID: 8595200

Claim:
A method of operating a data processor to process data records to discover a suspicious association rule, the method comprising: receiving data records that had been stored on a data storage device, the data records having at least a first field and a second field; analyzing the data records to find at least one association rule; and for an association rule found that correlates a first value in the first field of a record as a condition with a second value in the second field of the record as a result, indicating that the association rule is suspicious if: only one or at least a first predetermined minimum number of other association rules are found having the first value in the first field; there exist at least a second predetermined minimum number of different alpha-numeric strings or segments of real numbers in the first field and, for each of those strings or segments, there exist at least a third predetermined minimum number of records having in the first field the string or the real numbers of the segments, respectively; other association rules are found that correlate a value in the first field as a condition; and all of said other association rules correlate the first field with a third value in the second field.