Network Kinetix, LLC

Carissa Richards

Peter Richards

Hariharan Ramachandran

Myvan Quoc

Neal Coddington

George McCarthy

A method for detecting a fraudulent attempt to activate a new PIN, SIM Card or mobile device includes monitoring, at a first processing node associated with a network interconnecting a first network point and a second network point, a mirrored live-data flow of a live data flow passing through the first processing node in a non-intrusive manner that does not affect the first live-data flow passing through the first processing node. The live-data flow comprises data that is in active transmission between the first network point and the second network point and prior to storage of the data in a database. The first processing node detects that a transaction within the monitored live-data flow relates to an activation of the new PIN, SIM card or mobile device and compares the detected transaction to a list of known fraud situations stored in the first processing node to determine if the detected transaction relates to a known fraud situation. The first processing node generates an alert indication responsive to a determination the detected data relates to one of a plurality of known fraud situations. The first processing node identifies the detected transaction as a potential fraud situation responsive to a determination the detected data does not relate to one of the plurality known fraud situations. An automatically generated dialog verification with a party requesting the new PIN, SIM Card or mobile device is performed to verify identity of the party requesting the new PIN, SIM Card or mobile device for the detected transaction identified as the potential fraud situation.

System and method for an automated system for continuous observation, audit and control of user activities as they occur within a mobile network

A system for monitoring a live-data flow through a network includes at least one server communicating with the network. A processor within each of the at least one server implements a first processing node for monitoring a mirrored live-data flow of the live-data flow passing through at least one selected point within the network in a non-intrusive manner that does not affect the live-data flow passing through the at least one selected point. The first processing node decodes data within the mirrored live-data flow according to each protocol associated with the data. The first processing node detects at least one predetermined or deduced condition defined by at least one of a plurality of applications implemented on a second processing node and executes at least one predetermined or deduced response responsive to an indication of occurrence of the at least one predetermined or deduced condition within the decoded data. The first processing node also forwards data from the first processing node to a second processing node data from at least one of the plurality of simultaneous live-data flows based upon occurrence of the at least one predetermined or deduced condition. The processor within the at least one server the processor further implements the second processing node for accessing from the second processing node, external data from an external data source. The second processing node also processes at least a portion of the data forwarded from the first processing node using at least one of the plurality of applications implemented on the second processing node and the external data. The processing of the data by the at least one of the plurality of applications and the external data causes execution of the at least one predetermined or deduced response to determine a manner for controlling an operation of the network at a same time the live-data flow is in active transmission between the endpoints in the network. The operation of the network is controlled in response to the executed at least one predetermined or deduced response while events associated with the live-data flow are occurring within the network.

System and method for real-time analysis of network traffic

A system for providing continuous automated verification of user identity and intent includes a processor within at least one server that implements a first processing node and a second processing node for monitoring a mirrored live-data flow of a live-data flow passing through the first processing node in a non-intrusive manner that does not affect the live-data flow passing through the first processing node to detect relevant network access and activity in the mirrored live data flow. At the second processing node, a first set of verification criteria, comprising a first set of dynamically generated dialog of questions with associated answers to be provided by the at least one user, are dynamically generated based on live data inputs from the mirrored live-data flow and external data sources to verify an identify and an activity of the at least one user attempting to access the network prior to access and performing an activity on the network. A second set of verification criteria, comprising a second set of dynamically generated dialog of questions with associated answers to be provided by the at least one user, are dynamically generated at the second processing node based on the responses provided by the at least one user to the first set of dynamically generated dialog of questions to verify the identity and the activity of the at least one user attempting to access the network. A required threshold level is adjusted at which the first and second verification criteria must be met by the at least one user attempting the network access in order to allow or deny the network access and activity by the at least one user. The relevant network access and activity are denied if the verification criteria are not met at the required threshold level, to preempt unverified and unwanted access to and activity on the network by the at least one user. The relevant network access and activity are allowed if the verification criteria are met at the required threshold level. The system continues to monitor and verify the user identity and the user activity for a dynamic time period after access and activity on the network is granted to ensure continued user identity and activity fidelity.

A method for detecting and intercepting at least one of fraud, security breach, intrusion or misuse of network resources monitors at least one of a plurality of simultaneous live data flows that are in active transmission between a first endpoint and a second endpoint in a network prior to the storage of data within the live data flows in a database, to take action to control the operation of a network. Prescribed detection algorithms are updated for detecting prescribed patterns and deduced detection algorithms are updated for detecting deduced patterns within the plurality of simultaneous live data flows with at least one of live data conditions and external data sources. The deduced and prescribed patterns that indicate occurrence of at least one of fraud, security breach, intrusion or misuse of the network are detected from at least one of the live data flows and the external data sources using the prescribed detection algorithms and the deduced detection algorithms. An interceptive action is taken with respect to the live data flows responsive to the detected deduced and prescribed patterns, to control the operation of the network.

A system and method monitors for fraudulent transactions relating to a mobile device. Either of first and second processing nodes places a hold on a transaction associated with the first live-data flow and the second live-data flow responsive to detection of a potentially fraudulent condition. A third processing node generates an interactive verification communication responsive to the first data associated with the first live-data flow and the second data associated with the second live-data flow to establish a validity of the transaction. The third processing node releases the hold on the transaction responsive to the interactive verification communication determining the potentially fraudulent condition relates to a non-fraudulent transaction and generates a fraud detection response responsive to the interactive verification communication determining the potentially fraudulent condition relates to a fraudulent transaction before the transaction completes.

A system for monitoring live-data flow through a network includes a processor implementing a first processing node including an ingestor virtual machine (ingestor VM) for monitoring a mirrored live-data flow of the live-data flow passing through a selected point within the network in a non-intrusive manner that does not affect the live-data flow of at least one live data flow passing through the selected point. The ingestor VM further decodes each packet within the mirrored data flow according to each protocol associated with a packet and manages processes occurring within and between the first processing node and a second processing node. A time dependent buffer virtual machine (TDB VM) allocates a time dependent buffer (TDB) within the memory for executing the processes performed within and between the first processing node and a second processing node, and releasing the allocated TDB after completion of the processes. A governor virtual machine (governor VM) allocates memory resources within the memory between the first processing node and the second processing node for the processes performed within and between the first processing node and a second processing node. A grid virtual machine (grid VM) controls communications within and between the first processing nodes and between the first processing node and the second processing node.

A mirrored live-data flow of the live-data flow passing through a selected point within a network is monitored at a first processing node. The live-data flow comprises data that is in active transmission between endpoints in the network and prior to exit from the network and onward storage of the data in a database. Each packet within the mirrored data flow is decoded at the first processing node according to each protocol associated with a packet. Packets having a plurality of protocols associated therewith are decoded in parallel with each other. Each of the decoded packets are compared at the first processing node to a set of predetermined or deduced conditions. A predetermined or deduced response is executed based upon detection of a predetermined or deduced condition within the decoded packets. At least a portion of the decoded packets of the live-data flow causing execution of the predetermined or deduced response are processed at a second processing node to determine a manner for controlling an operation of the network at a same time the live-data flow is in active transmission between the endpoints in the network. The operation of the network is controlled in response to the processing step.

Growing community of inventors

Georgetown, TX, United States of America

Carissa Richards