Upload
corma-gmbh
View
288
Download
1
Embed Size (px)
Citation preview
Smart Solutions: Data Analytics to
Support Fraud Investigations
About me
Understanding data
Cleansing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
Agenda
2
Jörn Weber
Certified Fraud Investigator
19 years experience - German law
enforcement
since1999 Managing Partner at
corma GmbH:
Solution provider
Partner for corporate security
About me
3
About corma GmbH
4
Stops suspects by:
analytical investigations
operative investigations
Saves time by:
online research
online monitoring
Increases efficiency &
saves money by:
data analytics
global intelligence
solutions
Data Modeling
5
© corma GmbH
Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
6
Understanding data
7
It is a challenge to understand data
What kind of challenge? Data quantity
Data access
Data integration
Understand relationships & background
Bring data into context
Understanding data
8
© Dan Roam
How does it work? In four steps
Understanding data
9
© Dan Roam
Look at the data:
Understanding data
10
© Dan Roam
See the pattern:
Understanding data
11
© Dan Roam
Imagine
Understanding data
12
© Dan Roam
Show – summaries your findings
Understanding data
13
© Dan Roam
Understanding data
14
1. Chain of Custody
• Record all your steps
Software: Hunchly https://www.hunch.ly/
Plain document
• Store original data in a secure area
• Create “digital fingerprints”: MD5 Hash
• Work only with a copy of the original data
corma Workflow
15
2. Identify data format
• Research http://www.file-extensions.org
http://www.filext.com
http://www.fileinfo.com
.gpi
.bqy
.blb
Understanding data
16
Garmin Point of Interest file
BrioQuery database file
ACT! database file
2. Identify data format
• View (read only) http://www.uvviewsoft.com
Understanding data
17
2. Identify data format
• Deep view (editable) http://www.ultraedit.com
Understanding data
18
3. From raw data to smart structured data
Understanding data
19
Develop first ideas for analytical approach
Understanding data
20
Identified & understood data
Understanding data
21
First import & analytics
Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
22
Challenges
High data quality required for good
analysis results
Constantly increasing data quantity
Cleansing/Standardizing data
23
“Poor data quality” samples
Cleansing/Standardizing data
24
Why should data be cleansed:
Reliable analysis results are required
Saves time that otherwise would come
up during the analysis process
Reduces unwanted deviations &
variations
Identify entities (person, organization,
address)
Insights often lead to further findings
Cleansing/Standardizing data
25
Fast and flexible handling of large quantities of data
Flexible import for various data sources
Intuitive research
Analyses, calculations, statistics
Business Intelligence
Ad-hoc reporting
26
Solution
Combine different data formats
Fix data quality issues
Identify missing data
Better link analysis results
Application of different tools for standardized data cleansing
27
Solution
28
Solution
Develop automated queries
29
Benefits
Develop workflow for recurring
processes
Standardize processes (templates)
Benefits:
Time saving
Flexible
Maximize effectiveness
Team “compatibility”
Easy to learn
Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
30
Imagine
Data validation & enrichment
31
Geocoding: http://www.gpsvisualizer.com
Data validation & enrichment
32
Geocoding: http://www.gpsvisualizer.com
Data validation & enrichment
33
Geocoding: http://www.gpsvisualizer.com
Data validation & enrichment
34
Whois (historical records)
Data validation & enrichment
35
Relationships between Entities
Data validation & enrichment
36
Visualization & link analysis
Data validation & enrichment
37
Address verification – manually
Data validation & enrichment
38
Address verification – service
provider or software for large amounts of
data
AddressDoctor http://www.addressdoctor.com
Experian http://www.qas-experian.com.au
Data validation & enrichment
39
Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
40
Importing data
41
42
Sample import: i2 IBM-Database
43
Case study:
Insurance claims audit
Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
44
Analytics … yes … but structured:
Identify needed analytical steps
Develop „questions“ to data
What has prompted the need for the analysis?
What is the key question that needs to be answered?
„Create“ evidence out of data
What can you prove?
What do you want to prove?
Visualize your thinking!
Analyzing data
45
Analytical techniques
Chronologies and timelines (understand
timing and sequence of events)
Sorting (categorizing & hypothesis
generation)
Ranking, scoring, prioritizing (determine
which items are most important)
Network analysis – analyze relationships
between entities (people, organizations,
objects)
Analyzing data
46
Supporting tools:
Documenting processes in intranet/wiki
Select the right tool for each task
Train the users
Keep the users “busy”
Analyzing data
47
Query - an investigative question,
converted into database search
Analysis Sample: i2 IBM
48
How many organizations are known at
this address?
Analysis Sample: i2 IBM
49
50
Analysis Sample (InfoZoom)
Decoding (classification, i.e. phone data)
51
Email analysis with Intella
52
Timelinemaker
i2 IBM Analyst‘s Notebook
Timeline Charts
53
Classic view: Event log
View: Event log Explorer
Windows event log analysis
54
Windows event log analysis
Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
55
Final works starts when single
components are ready
Reporting
56
Reporting
57
Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
58
Proactively maintain a high, consistent
standard of data quality
Monitoring
59
60
Jörn Weber - [email protected]
+49 (162) 1009402
corma GmbH · Hochstr. 2 · D-41379 Brüggen·
Tel: +49 2163 349 0080 · E-Mail: [email protected] · Web: www.corma.de
Thank you!