Fraud and financial crime detection model using malware forensics

• Published in: Multimedia tools and applications Vol. 68; no. 2; pp. 479 - 496
• Main Authors: Kim, Ae Chan, Kim, Seongkon, Park, Won Hyung, Lee, Dong Hoon
• Format: Journal Article
• Language: English
• Published: Boston Springer US 2014; Springer Nature B.V
• Subjects: Analysis; Anomalies; Automation; Bank fraud; Communication; Computer Communication Networks; Computer forensics; Computer Science; Computer viruses; Correlation analysis; Criminal investigations; Cybercrime; Data Structures and Information Theory; Electronic banking; Financial services; Forensic sciences; Fraud; Internet; Malware; Multimedia Information Systems; Special Purpose and Application-Based Systems; Studies; Electronic financial transaction; Fraud detection; Malware forensics
• ISSN: 1380-7501; 1573-7721
• DOI: 10.1007/s11042-013-1410-3

Recently various electronic financial services are provided by development of electronic devices and communication technology. By diversified electronic financial services and channels, users of none face-to-face electronic financial transaction services continuously increase. At the same time, under financial security environment, leakage threats of inside information and security threats against financial transaction users steadily increase. Accordingly, in this paper, based on framework standards of financial transaction detection and response, digital forensics techniques that has been used to analyze system intrusion incidents traditionally is used to detect anomaly transactions that may occur in the user terminal environment during electronic financial transactions. Particularly, for the method to analyze user terminals, automated malware forensics techniques that is used as supporting tool for malware code detection and analysis is used, and for the method to detect anomaly prior behaviors and transaction patterns of users, moving average based on the statistical basis is applied. In addition, the risk point calculation model is proposed by scoring anomaly transaction cases in the detection step by items. This model logs calculated risk point results as well as maintains incident accountability, which can be utilized as basic data for establishing security incident response and security policies.