Sramana Mitra: You are tracking anomalous behavior at a business process level, and then you are correlating that back to individuals who repeatedly trigger such anomalous behavior?
Patrick Taylor: That is correct. We are basically looking at it both ways: “Is there something wrong with this transaction?” Then, as I look over time, I ask myself if there is something wrong with this actor, because he has been marginally involved with a number of other questionable transactions.
SM: You gave lots of examples of heuristics that have to been thought through – what has to be tracked down and what needs to be gone after. It sounds like you produce these heuristics, and then you run algorithms to chase down those heuristics.
PT: The first thing to do is to start back to that idea of evidentiary-based reasoning. We break down the problem into the various indicators. You will find that some of these indicators are dependent on each other. For instance, “This isn’t a problem unless I see this other thing.” Many are completely independent, and some are what we call comforters: “If I see this, it actually lowers my confidence that I found a problem.” That is the first construct. Each of those indicators can be as complicated or as simple as it needs to be. Sitting underneath all that, we have our analytic capabilities, which we developed. The expression language for the indicators is SQL. We have embedded analytics capabilities inside our system that you can essentially leverage in these indicators, but you can do it without having a code. Examples of what we have written are transposed digits, similarity, an abbreviation function, etc. They are all somewhat oriented at helping the computer do something that is really easy for us humans, which is understanding what is normal and what is unusual. We call the overall container that holds all these indicators together an integrity check – it is a frame in AI terms.
We have also taken the core platform and applied our deep domain expertise and our capabilities. An example of that would be a client that is a mobile phone carrier. The issue they had was that their customer service representatives were looking at customer records that had scenarios like: “It turns out my wife and I are in Florida this weekend. So, someone at the phone company can look at our phones and realize that we are going to need access to a GPS. They will figure out that we are connected to two cell towers that are eight hours from our house.” What [phone company employees] were doing was selling that information to people who would then go rob the house. As a phone company, you obviously want to stop that. Customer service representatives have to look at customer records – that is their job. So how do I piece that apart? It gets back to that point where I look at a lot of white data sets, so I have to think about: “Have I called in to the 611 information, because I have problems?” These are open trouble tickets in the CRM system related to my customer records. What are the patterns of records that I as a customer service representative have looked at? It would be somewhat unusual having five or six phone calls from the same ZIP code, unless of course if the cell tower is down. The analytics look at that, and they identify suspicious customer representatives and the internal information security team can see if they really have an issue.
SM: You are almost like a detective system.
PT: Yes. It is like in the TV show “CSI.” These guys are looking for clues and pieces of evidence that you may not have noticed.
This segment is part 3 in the series : Thought Leaders in Big Data: Interview with Patrick Taylor, CEO of Oversight Systems
1 2 3 4 5