Finding suspicious association rules in data records

A method of operating a data processor to process data records to discover a suspicious association rule, the method comprising:

• receiving data records that had been stored on a data storage device, the data records having at least a first field and a second field;
• analyzing the data records to find at least one association rule;
• and
• for an association rule found that correlates a first value in the first field of a record as a condition with a second value in the second field of the record as a result, indicating that the association rule is suspicious if:
• only one or at least a first predetermined minimum number of other association rules are found having the first value in the first field;
• there exist at least a second predetermined minimum number of different alpha-numeric strings or segments of real numbers in the first field and, for each of those strings or segments, there exist at least a third predetermined minimum number of records having in the first field the string or the real numbers of the segments, respectively;
• other association rules are found that correlate a value in the first field as a condition;
• and
• all of said other association rules correlate the first field with a third value in the second field.

A system for processing data records to discover a suspicious association rule, the system comprising:

• a processing unit;
• and
• a memory unit holding instructions that, when executed by the processing unit, cause the processing unit to
• a. receive data records that had been stored on a data storage device, the data records having at least a first field and a second field;
• b. analyze the data records to find at least one association rule;
• and
• c. for an association rule found that correlates a first value in the first field of a record as a condition with a second value in the second field of the record as a result, indicate that the association rule is suspicious if:
• only one association rule is found having the first value in the first field;
• there exist at least a first predetermined minimum number of different alpha-numeric strings or segments of real numbers in the first field and, for each of those strings or segments, there exist at least a second predetermined minimum number of records having in the first field the string or the real numbers of the segment, respectively;
• and
• no other association rules are found that correlate any value in the first field with a value in the second field.

A system for processing data records to discover a suspicious association rule, the system comprising:

• a processing unit;
• and
• a memory unit holding instructions that, when executed by the processing unit, cause the processing unit to
• a. receive data records that had been stored on a data storage device, the data records having at least a first field and a second field;
• b. analyze the data records to find at least one association rule;
• and
• c. for an association rule found that correlates a first value in the first field of a record as a condition with a second value in the second field of a record as a result, indicate that the association rule is suspicious if:
• only one or at least a first predetermined minimum number of other association rules are found having the first value in the first field;
• there exist at least a second predetermined minimum number of different alpha-numeric strings or segments of real numbers in the first field and, for each of those strings or segments, there exist at least a third predetermined minimum number of records having in the first field the string or the real numbers of the segment, respectively;
• other association rules are found that correlate a value in the first field as a condition;
• and
• all of said other association rules correlate the first field with a third value in the second field.

A non-transitory machine readable storage medium containing instructions associated with discovering suspicious association rules, the instructions when executed causing the following:

• receiving data records that had been stored on a data storage device, the data records having at least a first field and a second field;
• analyzing the data records to find at least one association rule;
• and
• for an association rule found that correlates a first value in the first field of a record as a condition with a second value in the second field of the record as a result, indicating that the association rule is suspicious if:
• only one association rule is found having the first value in the first field;
• there exist at least a first predetermined minimum number of different alpha-numeric strings or segments of real numbers in the first field and, for each of those strings or segments, there exist at least a second predetermined minimum number of records having in the first field the string or the real numbers of the segment, respectively;
• and
• no other association rules are found that correlate any value in the first field with a value in the second field.

A non-transitory machine readable storage medium containing instructions associated with discovering suspicious association rules, the instructions when executed causing the following:

• receiving data records that had been stored on a data storage device, the data records having at least a first field and a second field;
• analyzing the data records to find at least one association rule;
• and
• for an association rule found that correlates a first value in the first field of a record as a condition with a second value in the second field of the record as a result, indicating that the association rule is suspicious if:
• only one or at least a first predetermined minimum number of other association rules are found having the first value in the first field;
• there exist at least a second predetermined minimum number of different alpha-numeric strings or segments of real numbers in the first field and, for each of those strings or segments, there exist at least a third predetermined minimum number of records having in the first field the string or the real numbers of the segments, respectively;
• other association rules are found that correlate a value in the first field as a condition;
• and
• all of said other association rules correlate the first field with a third value in the second field.