Patent Document ID: 20170103203
Application ID: 14881976
Patent Flag: 0

Claim One:
1. A computer system, comprising: a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: receiving, by a data receiver module, data for a plurality of accounts; analyzing, by a cluster analyzer module, the data for the accounts based on a clustering model to assign each of the accounts to one of multiple peer groups associated with the clustering model; detecting, by an anomaly detector module, anomalous account behavior in a peer group based on scatteredness scores computed for each account in the peer group, the scatteredness score each being computed in view of a neighborhood of accounts in the peer group determined for each respective account of the peer group; and generating, by a security manager module, a report comprising account and scatteredness score information for one or more of the accounts in the peer group associated with detected anomalous account behavior.