TECHNOLOGICAL FIELD

Example embodiments of the present invention relate generally to the efficient detection of fraudulent network access events and use of a multi-tiered network architecture to identify, develop, and deploy targeted approaches for avoiding fraudulent network access events.

BACKGROUND

Fraudulent network access events, particularly in situations where the fraudulent activity targets financial institutions, impose significant costs in the form of lost time, lost resources, and damaged reputations on individuals, businesses, and other innocent entities. Conventional security practices and common-sense precautions are often effective at avoiding simple fraudulent attacks. However, many modern efforts to fraudulently access networks, and the entities that engage in such efforts, have become increasing complex, sophisticated, and targeted.

BRIEF SUMMARY

As individuals, businesses, and other entities have become increasingly comfortable with and reliant upon mobile computing devices that are capable of performing sophisticated operations and data exchanges over wireless networks, many network operators, including those associated with financial institutions, have responded to market demands for mechanisms that allow for a wide array of financial transactions and other network access events to be performed by mobile devices over a wide range of wired and wireless networks from almost anywhere around the planet. While these networks have proven capable of performing millions of transactions safely, securely, and accurately on a daily basis, such networks have also become a target for individuals, groups, and other entities that seek to fraudulently access financial networks to divert funds, misappropriate resources, and otherwise engage in unauthorized conduct.

Conventional systems for detecting and responding to fraudulent network activity are often effective in detecting and responding to basic, conventional fraudulent network activity and attempted activity. However, many individuals and entities have developed, and continue to develop, increasingly complex and sophisticated approaches to attacking networks and otherwise attempting to engage in fraudulent network activity.

The inventor has identified problems with existing systems used to detect and respond to fraudulent network activity that limit the efficacy of such existing fraud detection and response systems, particularly in contexts involving complex and/or otherwise sophisticated schemes that are targeted and/or otherwise specific to a relatively localized geographic area. Existing systems for detecting and responding to fraudulent network activity often take a one-size-fits-all approach, and/or otherwise fail to account for localized differences in the nature of efforts to fraudulently access or use a network. Consequently, such existing systems are not effective at detecting and addressing geographically targeted and/or otherwise localized fraudulent network access efforts and are usually slow to respond to such efforts, if they respond at all. Further, by failing to sufficiently account for differences in fraudulent network access efforts amongst different geographic areas, existing fraud detection and response systems often compound this weakness by applying fraud detection and response mechanisms that may be appropriate for certain areas (e.g., population centers) but which remain a poor match for the particular needs and threats of the fraudulent network access efforts of other areas.

Consequently, there is a need for advanced and improved systems for the detection of fraudulent network access efforts and the deployment of approaches to address such fraudulent network access efforts that are sensitive to geographical variations in network risk and that can identify geographical areas having similar risk profiles that may not otherwise be intuitively recognizable. In particular, there is a need for advanced and improved fraudulent network activity detection and response systems that are capable of efficiently identifying and responding to fraudulent network access activity that may be targeted and/or otherwise specific to a particular geographic area, and ascertaining the extent to which information regarding such localized activity should be shared and deployed across a wider geographic region. Further, there is a need for advanced and improved fraudulent network activity detection and response systems that are capable of rapidly identifying and responding to increasing volumes of complex and/or otherwise sophisticated fraudulent network access efforts, particularly in situations where such efforts tend to evolve rapidly over time and where such efforts tend to exhibit location-specific characteristics designed to exploit one or more perceived vulnerabilities in a particular geographic area.

To address the above needs and others, example embodiments are described herein for detecting and then reducing the likelihood of occurrence of unauthorized network access events. In a first example embodiment, a system having a three-tiered architecture is provided for avoiding unauthorized network access events. The example system includes a user equipment device associated with a first tier of the architecture, a local authority controller associated with a second tier of the architecture, a local knowledge base associated with the second tier of the architecture, a master authority controller associated with a third tier of the architecture, and a master knowledge base associated with the third tier of the architecture. The user equipment device comprises a thin client, the thin client configured to be in communication with the local authority controller. The local authority controller is in communication with the local knowledge base and the master authority controller. And the master authority controller is in communication with the master knowledge base.

In some embodiments, the local authority controller is configured to receive, from the thin client, a set of characteristics of a potentially fraudulent transaction detected by the thin client, determine, based at least in part on the set of characteristics of the potentially fraudulent transaction, whether to cause the transmission of the set of characteristics of the potentially fraudulent transaction to the master authority controller, and, based at least in part on the set of characteristics of the potentially fraudulent transaction, determine a network access rule set to be applied by the thin client. In some such embodiments, the local authority controller comprises an artificial intelligence system configured to analyze the set of characteristics of the potentially fraudulent transaction. Additionally or alternatively, the master authority controller comprises an artificial intelligence system configured to analyze the set of characteristics of the potentially fraudulent transaction. In this regard, the local knowledge base may be configured to store a set of characteristics of one or more fraudulent transactions associated with a predetermined geographic area. Additionally or alternatively, the master knowledge base may be configured to store a set of characteristics of one or more fraudulent transactions associated with multiple predetermined geographic regions.

In another example embodiment, a method is provided for detecting and reducing fraudulent network activity via a system arranged in a three-tiered architecture. The example method includes receiving, by escalation circuitry of an apparatus, an escalation request associated with a potentially fraudulent transaction detected by a user equipment device, determining, by monitoring circuitry of the apparatus and based at least in part on the escalation request, a response to the potentially fraudulent transaction, generating, by abatement circuitry of the apparatus, a network access rule set based on the escalation request, and causing transmission of the network access rule set to the user equipment device from a local authority controller.

In some embodiments of the method, the escalation request comprises a set of characteristics of the potentially fraudulent transaction. In some such embodiments, the network access rule set comprises a set of actions to be taken by the user equipment device based at least in part on the characteristics of the potentially fraudulent transaction. To this end, determining a response to the potentially fraudulent transaction may comprise comparing the characteristics of the potentially fraudulent transaction against one or more sets of characteristics received from a local knowledge base. Moreover, determining a response to the potentially fraudulent transaction may further comprise causing transmission, by reporting circuitry of the apparatus, of the set of characteristics of the potentially fraudulent transaction to a master authority controller. And in this regard, the method may further include a step of receiving a set of instructions from the master authority controller. And in some embodiments, causing transmission of the network access rule set to the user equipment device may include a step of incorporating, by the abatement circuitry of the apparatus, the set of instructions received from the master authority controller.

In another example embodiment, an apparatus is provided for detecting and reducing fraudulent network activity via a system arranged in a three-tiered architecture. The example apparatus includes escalation circuitry configured to receive an escalation request associated with a potentially fraudulent transaction detected by a user equipment device, monitoring circuitry configured to determine, based at least in part on the escalation request, a response to the potentially fraudulent transaction, abatement circuitry configured to generate a network access rule set based on the escalation request, and circuitry configured to cause transmission of the network access rule set to the user equipment device from a local authority controller.

In some embodiments, the escalation request comprises a set of characteristics of the potentially fraudulent transaction. To this end, the network access rule set may comprise a set of actions to be taken by the user equipment device based at least in part on the characteristics of the potentially fraudulent transaction. In one such example, determining a response to the potentially fraudulent transaction may include comparing the characteristics of the potentially fraudulent transaction against one or more sets of characteristics received from a local knowledge base. Moreover, the reporting circuitry of the apparatus may further be configured to determine the response to the potentially fraudulent transaction by causing transmission of the set of characteristics of the potentially fraudulent transaction to a master authority controller. In addition, the apparatus may further include circuitry configured to receive a set of instructions from the master authority controller. Additionally, causing transmission of the network access rule set to the user equipment device may include incorporating, by the abatement circuitry of the apparatus, the set of instructions received from the master authority controller.

The above summary is provided merely for purposes of summarizing some example embodiments to provide a basic understanding of some aspects of the invention. Accordingly, it will be appreciated that the above-described embodiments are merely examples and should not be construed to narrow the scope or spirit of the invention in any way. It will be appreciated that the scope of the invention encompasses many potential embodiments in addition to those here summarized, some of which will be further described below.

