# US 8,788,445 B2 · System and method for quantifying and detecting non-normative behavior > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,445 B2 - Document ID: US8788445B2 - Status: Granted - Kind: B2 - Application number: 12/416,819 - Filed: 2009-04-01 - Published: 2009-10-01 - Granted: 2014-07-22 - Earliest claimed: 2008-04-01 - Assignees: Certona Corporation - Applicants: Geoffrey J. Hueter - Inventors: Geoffrey J. Hueter - Web page: https://patentgrep.com/patent/US8788445B2 ## CPC - G06Q 30/0631: {Recommending goods or services} - G06N 20/00: Machine learning - G06Q 10/00: Administration; Management - G06Q 30/00: Commerce - G06Q 30/0185: {Product, service or business identity fraud} - G06Q 30/0201: Market modelling; Market analysis; Collecting market data - G06Q 30/0202: Market predictions or forecasting for commercial activities - G06Q 30/0204: Market segmentation - G06Q 30/0255: {based on user history} - G06Q 30/0269: {based on user profile or attribute} - H04L 51/212: using filtering or selective blocking - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method is disclosed for monitoring human interactions, including transactions and communications, profiling the subject and objects in those interactions, and comparing subject profiles to profiles of subjects with known characteristics to determine whether the test subject is normal or abnormal subjects. The behavior data can be collected electronically in a virtual environment, such as a website, through video surveillance, card access, phone records, purchase histories, or any other consistent identified record of behavior. The invention has application in detecting various types of unusual and malicious activity, including spam, viruses, terrorism, identity theft, and money laundering, to name but a few applications. ## Claims ### Claim 1 A system for quantifying and detecting non-normative behavior, comprising: a web-based service system to collect, profile, and assess subject object behavior, said system being configured to: (a) identify objects as discrete entities that involve interactions from different subjects and are extractable from on-line transaction events; (b) represent the similarity between two objects by coincidence in time by subject of the corresponding transaction events of those objects, aggregated across all subjects; (c) represent said objects in vector form; (d) aggregate transaction events by subject to determine the subject's affinity to each object that the subject has interacted with: (e) represent, in vector form, subjects identifying individuals involved in transactions involving said objects; (f) filter by matching a vector of a subject against subject vectors of persons of interest; (g) determine a threshold to assess said matching falls within a pre-set detection range; and (h) trigger further investigation or testing against a population of normal subjects when said matching falls within said pre-set detection range, whereby said system quantifies and detects a non-normative behavior of said subject by applying a suspicion threshold, and further whereby the subject vector and the object vector each have a respective number of dimensions; and further whereby the predicted similarity of one object to another object is calculated by matching their object vectors; and further whereby the system is configured to generate the object vectors by producing object vectors having respective initial dimensions, to determine predicted similarity values based on the initial object vectors, and to calculate a cost function that measures the difference between the predicted similarity values and the said similarity between two objects by coincidence in time by subject; and further whereby the system iteratively increases the dimensions of the generated object vectors, and recalculates the cost function based on the differences between the predicted similarity values and actual similarity values, until the cost function reaches a predetermined value, and wherein the actual similarity values are based on said transaction events; and further whereby the system is configured to generate the subject vectors from the said object vectors and said affinities derived from said transaction events. ### Claim 2 (depends on 1) The system for quantifying and detecting non-normative behavior, according to claim 1, wherein said objects in vector form provide a common, universal representation across all types of said objects, whether physical or virtual. ### Claim 3 (depends on 2) The system for quantifying and detecting non-normative behavior, according to claim 2, wherein said interactions are e-mail messages, and wherein said system is configured to profile of said objects without the classification, parsing or translation of said e-mail messages. ### Claim 4 (depends on 1) The system for quantifying and detecting non-normative behavior, according to claim 1, wherein determine said threshold includes automated detection by matching subject vectors and applying a suspicion threshold matching metric including a dot product or Euclidean distance matching metric. ### Claim 5 (depends on 1) The system for quantifying and detecting non-normative behavior, according to claim 1, wherein subject and object vectors derived solely from said subject's transactions involving said objects comprise subject object interactions including: credit card transactions; consumer products; locations; businesses; websites, phone numbers; and any other discrete entity that involves interaction from different subjects and is identified and extracted from a variety of transaction flows, including said credit card transactions, cell phone messages, bank transactions, travel records, and website browsing. ### Claim 6 (depends on 1) The system for quantifying and detecting non-normative behavior, according to claim 1, wherein profiling subject object behavior includes profiling subject e-mail behavior. ### Claim 7 (depends on 6) The system for quantifying and detecting non-normative behavior, according to claim 6, wherein said profiling of subject e-mail behavior includes determinations of e-mail signatures or categorizations based on word frequency. ### Claim 8 (depends on 6) The system for quantifying and detecting non-normative behavior, according to claim 6, wherein a profile of said subject is stored locally in the subject's e-mail client application. ### Claim 9 (depends on 1) The system for quantifying and detecting non-normative behavior, according to claim 1, wherein determine said threshold to assess whether said matching falls within said pre-set detection range includes profile matching compatibility thresholding employing a comparison against said population of normal subjects and testing for mismatch. ### Claim 10 (depends on 1) The system for quantifying and detecting non-normative behavior, according to claim 1, wherein determine said threshold to assess whether said matching falls within said pre-set detection includes profile matching compatibility thresholding employing a comparison against a non-normal population and testing for match. ### Claim 11 A method for quantifying and detecting non-normative behavior, comprising the steps of: (a) providing a service system to collect, profile, and assess subject object behavior, said system identifying objects as discrete entities that involve interactions from different subjects and are extractable from on-line transaction events; (b) representing the similarity between two objects by coincidence in time by subject of the corresponding transaction events of those objects, aggregated across all subjects; (c) providing objects represented in vector form; (d) aggregating transaction events by subject to determine the subject's affinity to each object that the subject has interacted with; (e) providing subject vectors derived solely from said subject's transactions with said objects; (f) filtering by matching a vector of a subject against subject vectors of persons of interest; (g) determining a threshold to assess whether said matching falls within a pre-set detection range; and (h) triggering further investigation or testing against a population of normal subjects when said matching falls within said pre-set detection range, whereby said method quantifies and detects non-normative behavior by applying a suspicion threshold, and further whereby the subject vector and the object vector each have a respective number of dimensions; and further whereby the predicted similarity of one object to another object is calculated by matching their object vectors; and further whereby object vectors are generated by producing object vectors having respective initial dimensions, to determine predicted similarity values based on the initial object vectors, and to calculate a cost function that measures the difference between the predicted similarity values and the said similarity between two objects by coincidence in time by subject; and further whereby the dimensions of the generated object vectors are iteratively increased, and the cost function is recalculated based on the differences between the predicted similarity values and actual similarity values, until the cost function reaches a predetermined value, and wherein the actual similarity values are based on said transaction events; and further whereby the subject vectors are generated from the said object vectors and said affinities derived from said transaction events. ### Claim 12 (depends on 1) The method for quantifying and detecting non-normative behavior, according to claim 1, wherein said step of providing objects represented in vector form comprises providing object vectors generating a common, universal representation across all types of said objects, whether physical or virtual. ### Claim 13 (depends on 1) The method for quantifying and detecting non-normative behavior, according to claim 1, wherein said interactions are e-mail messages, and wherein said step of identifying objects includes the step of subject and object profiling using said subject and object vectors derived solely from said subject's interactions with said without the classification, parsing or translation of said e-mail messages. ### Claim 14 (depends on 11) The method for quantifying and detecting non-normative behavior, according to claim 11, wherein said step of determining a includes the step of determining a threshold whether said matching falls within a pre-set detection range includes automated detection by matching said subject vectors and applying to a suspicion threshold a matching metric including a dot product or Euclidean distance matching metric, and wherein said subject and object vectors derived solely from said subject's interactions with said objects include subject object interactions including: credit card transactions; consumer products; locations; businesses; websites; phone numbers; and any other discrete entity that involves interaction from different subjects and can be identified and extracted from a variety of transaction flows, including said credit card transactions, cell phone messages, bank transactions, travel records, and website browsing. ### Claim 15 (depends on 1) The method for quantifying and detecting non-normative behavior, according to claim 1, wherein said step of threshold determining includes the step of profiling subject object behavior, and wherein said objects include e-mails. ### Claim 16 (depends on 15) The method for quantifying and detecting non-normative behavior, according to claim 15, wherein said step of profiling subject object behavior further includes the step of profiling subject e-mail behavior, wherein said step of profiling subject e-mail behavior includes determinations of e-mail signatures or categorizations based on word frequency, and wherein a profile of said subject is stored locally in the subject's e-mail client application. ### Claim 17 (depends on 11) The method for quantifying and detecting non-normative behavior, according to claim 11, wherein said step of determining a threshold includes the step of determining a threshold to assess whether similarity between said subject and said population of normal subjects is within said pre-set detection range, wherein determining said threshold includes profile matching compatibility thresholding employing a comparison against said population of normal subjects and testing for mismatch. ### Claim 18 (depends on 1) The method for quantifying and detecting non-normative behavior, according to claim 1, wherein said step of determining a threshold includes the step of determining a threshold to assess whether similarity between said subject and said population of normal subjects is within said pre-set detection range, wherein determining a threshold includes profile matching compatibility thresholding employing a comparison against a non-normal population and testing for match. ### Claim 19 A method for using a system for quantifying and detecting non-normative behavior, comprising the steps of: (a) collecting subject object behavior; (b) profiling subjects and objects by generating subject and object vectors; (c) matching test subject profiles to target population subject profiles; and (d) detecting abnormality according to comparison of test target match to a pre-set detection range, whereby behavior data is collected electronically in an environment that provides a consistent record of behavior, said environment comprising a website, video surveillance, card access, phone records, or purchase histories, and further whereby the subject vector and the object vector each have a respective number of dimensions; and further whereby the predicted similarity of one object to another object is calculated by matching their object vectors; and further whereby object vectors are generated by producing object vectors having respective initial dimensions, to determine predicted similarity values based on the initial object vectors, and to calculate a cost function that measures the difference between the predicted similarity values and the said similarity between two objects by coincidence in time by subject; and further whereby the dimensions of the generated object vectors are iteratively increased, and the cost function is recalculated based on the differences between the predicted similarity values and actual similarity values, until the cost function reaches a predetermined value, and wherein the actual similarity values are based on said transaction events; and further whereby the subject vectors are generated from the said object vectors and said affinities derived from said transaction events, and without parsing transaction contents, all accomplished in a non-invasive, mentor-less fashion and being scalable to large numbers of said subjects and said objects. ### Claim 20 (depends on 19) The method for using a system for quantifying and detecting non-normative behavior, according to claim 19, wherein said step of detecting abnormality further includes the step of detecting: (a) spam e-mail; and (b) a person or persons of interest.