smart solutions: data analytics to support fraud examinations

Smart Solutions: Data Analytics to

Support Fraud Investigations

About me

Understanding data

Cleansing data

Data validation & enrichment

Importing data

Analyzing data

Reporting

Monitoring

Agenda

2

Jörn Weber

Certified Fraud Investigator

19 years experience - German law

enforcement

since1999 Managing Partner at

corma GmbH:

Solution provider

Partner for corporate security

About me

3

About corma GmbH

4

Stops suspects by:

analytical investigations

operative investigations

Saves time by:

online research

online monitoring

Increases efficiency &

saves money by:

data analytics

global intelligence

solutions

Data Modeling

5

© corma GmbH

Workflow

Understanding data

Cleansing / Standardizing data

Data validation & enrichment

Importing data

Analyzing data

Reporting

Monitoring

What are “Smart Solutions”?

6

Understanding data

7

It is a challenge to understand data

What kind of challenge? Data quantity

Data access

Data integration

Understand relationships & background

Bring data into context

Understanding data

8

© Dan Roam

How does it work? In four steps

Understanding data

9

© Dan Roam

Look at the data:

Understanding data

10

© Dan Roam

See the pattern:

Understanding data

11

© Dan Roam

Imagine

Understanding data

12

© Dan Roam

Show – summaries your findings

Understanding data

13

© Dan Roam

Understanding data

14

1. Chain of Custody

• Record all your steps

Software: Hunchly https://www.hunch.ly/

Plain document

• Store original data in a secure area

• Create “digital fingerprints”: MD5 Hash

• Work only with a copy of the original data

corma Workflow

15

2. Identify data format

• Research http://www.file-extensions.org

http://www.filext.com

http://www.fileinfo.com

.gpi

.bqy

.blb

Understanding data

16

Garmin Point of Interest file

BrioQuery database file

ACT! database file

2. Identify data format

• View (read only) http://www.uvviewsoft.com

Understanding data

17

2. Identify data format

• Deep view (editable) http://www.ultraedit.com

Understanding data

18

3. From raw data to smart structured data

Understanding data

19

Develop first ideas for analytical approach

Understanding data

20

Identified & understood data

Understanding data

21

First import & analytics

Workflow

Understanding data

Cleansing / Standardizing data

Data validation & enrichment

Importing data

Analyzing data

Reporting

Monitoring

What are “Smart Solutions”?

22

Challenges

High data quality required for good

analysis results

Constantly increasing data quantity

Cleansing/Standardizing data

23

“Poor data quality” samples

Cleansing/Standardizing data

24

Why should data be cleansed:

Reliable analysis results are required

Saves time that otherwise would come

up during the analysis process

Reduces unwanted deviations &

variations

Identify entities (person, organization,

address)

Insights often lead to further findings

Cleansing/Standardizing data

25

Fast and flexible handling of large quantities of data

Flexible import for various data sources

Intuitive research

Analyses, calculations, statistics

Business Intelligence

Ad-hoc reporting

26

Solution

Combine different data formats

Fix data quality issues

Identify missing data

Better link analysis results

Application of different tools for standardized data cleansing

27

Solution

28

Solution

Develop automated queries

29

Benefits

Develop workflow for recurring

processes

Standardize processes (templates)

Benefits:

Time saving

Flexible

Maximize effectiveness

Team “compatibility”

Easy to learn

Workflow

Understanding data

Cleansing / Standardizing data

Data validation & enrichment

Importing data

Analyzing data

Reporting

Monitoring

What are “Smart Solutions”?

30

Imagine

Data validation & enrichment

31

Geocoding: http://www.gpsvisualizer.com

Data validation & enrichment

32

Geocoding: http://www.gpsvisualizer.com

Data validation & enrichment

33

Geocoding: http://www.gpsvisualizer.com

Data validation & enrichment

34

Whois (historical records)

Data validation & enrichment

35

Relationships between Entities

Data validation & enrichment

36

Visualization & link analysis

Data validation & enrichment

37

Address verification – manually

Data validation & enrichment

38

Address verification – service

provider or software for large amounts of

data

AddressDoctor http://www.addressdoctor.com

Experian http://www.qas-experian.com.au

Data validation & enrichment

39

Workflow

Understanding data

Cleansing / Standardizing data

Data validation & enrichment

Importing data

Analyzing data

Reporting

Monitoring

What are “Smart Solutions”?

40

Importing data

41

42

Sample import: i2 IBM-Database

43

Case study:

Insurance claims audit

Workflow

Understanding data

Cleansing / Standardizing data

Data validation & enrichment

Importing data

Analyzing data

Reporting

Monitoring

What are “Smart Solutions”?

44

Analytics … yes … but structured:

Identify needed analytical steps

Develop „questions“ to data

What has prompted the need for the analysis?

What is the key question that needs to be answered?

„Create“ evidence out of data

What can you prove?

What do you want to prove?

Visualize your thinking!

Analyzing data

45

Analytical techniques

Chronologies and timelines (understand

timing and sequence of events)

Sorting (categorizing & hypothesis

generation)

Ranking, scoring, prioritizing (determine

which items are most important)

Network analysis – analyze relationships

between entities (people, organizations,

objects)

Analyzing data

46

Supporting tools:

Documenting processes in intranet/wiki

Select the right tool for each task

Train the users

Keep the users “busy”

Analyzing data

47

Query - an investigative question,

converted into database search

Analysis Sample: i2 IBM

48

How many organizations are known at

this address?

Analysis Sample: i2 IBM

49

50

Analysis Sample (InfoZoom)

Decoding (classification, i.e. phone data)

51

Email analysis with Intella

52

Timelinemaker

i2 IBM Analyst‘s Notebook

Timeline Charts

53

Classic view: Event log

View: Event log Explorer

Windows event log analysis

54

Windows event log analysis

Workflow

Understanding data

Cleansing / Standardizing data

Data validation & enrichment

Importing data

Analyzing data

Reporting

Monitoring

What are “Smart Solutions”?

55

Final works starts when single

components are ready

Reporting

56

Reporting

57

Workflow

Understanding data

Cleansing / Standardizing data

Data validation & enrichment

Importing data

Analyzing data

Reporting

Monitoring

What are “Smart Solutions”?

58

Proactively maintain a high, consistent

standard of data quality

Monitoring

59

60

Jörn Weber - jw@corma.de

+49 (162) 1009402

corma GmbH · Hochstr. 2 · D-41379 Brüggen·

Tel: +49 2163 349 0080 · E-Mail: mail@corma.de · Web: www.corma.de

Thank you!