Risk scoring for internet protocol networks

An article of manufacture comprising a non-transitory processor-readable storage medium having processor-readable instructions tangibly embodied thereon which, when implemented, cause a processor to carry out steps comprising:

• identifying a network to which a first network element belongs, wherein said first network element comprises corresponding risk-related information comprising one of (i) a fraudulent activity on the network within a given time period and (ii) a genuine activity on the network within the given time period;
• determining each of multiple network elements previously identified as belonging to the network, wherein said multiple network elements comprise risk-related information comprising (i) one or more fraudulent activities on the network within the given time period and (ii) one or more genuine activities on the network within the given time period;
• calculating a risk score assigned to the network to attribute a likelihood of fraudulent activity to occur in connection with any of the network elements belonging to the network, wherein said calculating comprises aggregating (i) the risk-related information corresponding to the first network element and (ii) the risk-related information corresponding to the multiple network elements previously identified as belonging to the network, and wherein said calculating further comprises applying a weight to each item of risk-related information based on a level of trust associated with each entity responsible for providing the item of risk-related information;
• applying the risk score assigned to the network to (i) the first network element and (ii) to each of the multiple network elements previously identified as belonging to the network, thereby attributing the same likelihood of fraudulent activity occurring in connection with (i) the first network element and (ii) each of the multiple network elements previously identified as belonging to the network;
• and
• iteratively updating the risk score assigned to the network upon receipt of each additional item of risk-related information pertaining to any network element belonging to the network.

An apparatus comprising:

• a memory;
• and
• at least one processor coupled to the memory and configured to:
• identify a network to which a first network element belongs, wherein said first network element comprises corresponding risk-related information comprising one of (i) a fraudulent activity on the network within a given time period and (ii) a genuine activity on the network within the given time period;
• determine each of multiple network elements previously identified as belonging to the network, wherein said multiple network elements comprise risk-related information comprising (i) one or more fraudulent activities on the network within the given time period and (ii) one or more genuine activities on the network within the given time period;
• calculate a risk score assigned to the network to attribute a likelihood of fraudulent activity to occur in connection with any of the network elements belonging to the network, wherein said calculating comprises aggregating (i) the risk-related information corresponding to the first network element and (ii) the risk-related information corresponding to the multiple network elements previously identified as belonging to the network, and wherein said calculating further comprises applying a weight to each item of risk-related information based on a level of trust associated with each entity responsible for providing the item of risk-related information;
• apply the risk score assigned to the network to (i) the first network element and (ii) to each of the multiple network elements previously identified as belonging to the network, thereby attributing the same likelihood of fraudulent activity occurring in connection with (i) the first network element and (ii) each of the multiple network elements previously identified as belonging to the network;
• and
• iteratively update the risk score assigned to the network upon receipt of each additional item of risk-related information pertaining to any network element belonging to the network.

A method comprising:

• obtaining an item of input data from an entity, wherein said item of input data comprises identification of a first network element and corresponding risk-related information comprising one of (i) a fraudulent activity on the network within a given time period and (ii) a genuine activity on the network within the given time period;
• identifying a network to which the first network element belongs;
• determining each of multiple network elements previously identified as belonging to the network, wherein said multiple network elements comprise risk-related information comprising (i) one or more fraudulent activities on the network within the given time period and (ii) one or more genuine activities on the network within the given time period;
• calculating a risk score assigned to the network to attribute a likelihood of fraudulent activity to occur in connection with any of the network elements belonging to the network based on (i) the risk-related information corresponding to the first network element, (ii) the risk-related information corresponding to the multiple network elements previously identified as belonging to the network, and (iii) one or more items of information pertaining to a level of trust associated with the entity, wherein said calculating comprises applying a weight to each item of risk-related information based on a level of trust associated with each entity responsible for providing the item of risk-related information;
• applying the risk score assigned to the network to (i) the first network element and to (ii) each of the multiple network elements previously identified as belonging to the network, thereby attributing the same likelihood of fraudulent activity occurring in connection with (i) the first network element and (ii) each of the multiple network elements previously identified as belonging to the network;
• and
• iteratively updating the risk score assigned to the network upon receipt of each additional item of risk-related information pertaining to any network element belonging to the network;
• wherein the steps are carried out by at least one computing device.