Method and apparatus for network fraud detection and remediation through analytics

A method for fraud detection and remediation, comprising:

• by a risk assessment engine:
• accessing first event data for a first event or first attempted event, the first event or the first attempted event corresponding to a first entity;
• determining a first location of the first event or first attempted event in a multidimensional array, the multidimensional array including at least a first axis associated with a first event parameter and a second axis associated with a second event parameter, the first location being defined relative to the first axis and the second axis;
• comparing the first location to at least one first cluster location, the at least one first cluster location corresponding to the first entity and representing a behavior history of the first entity;
• and
• determining, based on the comparison of the first location and the at least one first cluster location, a risk score for the first event;
• determining a confidence score based on a number of events associated with the first entity;
• and
• by a streaming threat remediation engine:
• obtaining, from the risk assessment engine, the risk score;
• identifying, based on the risk score, the confidence score, and a rule, a remedial action;
• and
• providing remediation instructions to perform the remedial action in response to the first event.

A non-transitory computer-readable medium containing operation instructions that, when executed by at least one processor of a system, cause the system to perform operations comprising:

• accessing first event data for a first event corresponding to a first entity;
• updating at least one first cluster location in a multidimensional array using the first event, the at least one first cluster location corresponding to the first entity and representing a behavior history of the first entity, wherein the multidimensional array includes at least a first axis associated with a first event parameter and a second axis associated with a second event parameter, and wherein the first cluster location is defined relative to the first axis and the second axis;
• determining, based on a rule queue and the first event, that the first event requires a first risk assessment;
• performing the first risk assessment, the first risk assessment including:
• determining a risk score by comparing a first location of the first event in the multidimensional array to the at least one first cluster location;
• and
• determining a confidence score based on a number of events associated with the first entity;
• and
• providing, based at least in part on the risk score and the confidence score, remediation instructions to perform a first remedial action concerning the first entity.