Techniques for fraud monitoring and detection using application fingerprinting

A system for detecting anomalous data submitted to a software application, the system comprising:

• a storage component configured to store a plurality of historical fingerprints, each historical fingerprint generated based on packaging at least a portion of data submitted to the software application by one or more users of the software application via an input field of the software application;
• and
• a processing component communicatively coupled with the storage component, the processing component being configured to:
• receive first data submitted by at least one user of the software application via the input field;
• package at least a portion of the first data submitted by the at least one user of the software application to generate a first application fingerprint that uniquely identifies submission of the first data,
• the first application fingerprint associated with one or more first contexts, wherein the one or more first contexts represent contexts in which the first data was submitted by the at least one user of the software application, an association between the first application fingerprint and the one or more contexts directly identifying in the first application fingerprint either the at least one user or one or more devices of the at least one user used to submit the first data;
• compare the first application fingerprint with at least one historical fingerprint in the plurality of historical fingerprints, wherein the at least one historical fingerprint is associated with one or more second contexts substantially similar to the one or more first contexts in which the first data was submitted by an authorized user of the software application via the input field, the association between the at least one historical application fingerprints directly identifying in the historical application fingerprint the authorized user or one or more devices of the authorized user used to submit the data from which the at least one historical application fingerprint was generated;
• and
• calculate a risk score based on the comparison of the first application fingerprint with the at least one historical fingerprint, the risk score indicating a likelihood that the first data was submitted for a fraudulent or malicious purpose.

A non-transitory machine-readable medium for a computer system, the machine-readable medium having stored thereon a series of instructions which, when executed by a processing component of the computer system, cause the processing component to detect anomalous data submitted to a software application by:

• receiving first data submitted by at least one user of the software application via an input field of the software application;
• packaging, with one or more processors associated with the one or more computer systems, at least a portion of the first data submitted by the at least one user of the software application to generate a first application fingerprint that uniquely identifies submission of the first data,
• the first application fingerprint with one or more first contexts, wherein the one or more first contexts represent contexts in which the first data was submitted by the at least one user of the software application, an association between the first application fingerprint and the one or more contexts directly identifying in the first application fingerprint either the at least one user or one or more devices of the at least one user used to submit the first data;
• comparing the first application fingerprint with at least one second application fingerprint, wherein the at least one second application fingerprint is generated based on packaging at least a portion of second data previously submitted by an authorized user of the software application via the input field, and wherein the at least one second application fingerprint is associated with one or more second contexts substantially similar to the one or more first contexts in which the first data was submitted by the at least one user of the software application, the association between the one or more second application fingerprints directly identifying in the second application fingerprint the authorized user or one or more devices of the authorized user used to submit the second data;
• and
• calculating a risk score based on the comparison of the first application fingerprint with the at least one second application fingerprint, the risk score indicating a likelihood that the first data was submitted for a fraudulent or malicious purpose.