Patent Document ID: 8868728
Application ID: 12950251
Patent Flag: 1

Claim One:
1. A computer implemented method for detecting and investigating insider fraud, comprising: identifying, by one or more computer processors, one or more insider threat detection rules for an enterprise organization, the enterprise organization associated with a plurality of enterprise insiders, wherein the insider threat detection rules include one or more enterprise-specific rules generated to enforce particular enterprise policies across the enterprise organization and one or more industry-specific threat detection rules applied to a plurality of other enterprise organizations in a same industry as the enterprise organization; obtaining, from a plurality of behavioral data sources of the enterprise organization monitoring actions of the plurality of enterprise insiders, behavioral data for the plurality of enterprise insiders and parsing the behavioral data to identify actions for a first enterprise insider of the plurality of enterprise insiders, the behavioral data for the first enterprise insider describing one or more actions of the first enterprise insider; determining, by the one or more computer processors, a threat score representing a likelihood that the actions of the first enterprise insider represent insider fraud for the first enterprise insider based on applying the one or more insider threat detection rules to the behavioral data for the first enterprise insider; initiating, when the threat score satisfies a first threat threshold, one or more protective actions limiting access of the first enterprise insider to the enterprise organization and generating a case for activity of the behavioral data of the first enterprise insider, wherein once the case is generated the case is periodically re-scored as additional behavioral data for the first enterprise insider is gathered and, when the threat score satisfies a second threshold, a notification is provided to the enterprise organization prompting an additional protective action; receiving first feedback from the enterprise organization including one or more of flagged false positives, rules that were applied to generate false positives, and false negatives when insider fraud was not recognized; updating, by the one or more computer processors, the one or more enterprise-specific rules of the insider threat detection rules in response to the received first feedback; receiving second feedback from a plurality of other enterprise organizations associated with the same industry as the enterprise organization, wherein enterprise-specific details are removed from the second feedback and the second feedback identifies and reports industry-specific trends; and updating the one or more industry-specific threat detection rules of the insider threat detection rules based on the first feedback and the second feedback.