This is an updated slide set based on my ACFE presentation in 2011. The idea is to present a concept to use Data Analytics in Fraud Investigations. For more information feel free to contact me via www.corma.de.

1. Smart Solutions: Data Analytics to
Support Fraud Investigations

2. About me
Understanding data
Cleansing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
Agenda
2

3. Jörn Weber
Certified Fraud Investigator
19 years experience - German law
enforcement
since1999 Managing Partner at
corma GmbH:
Solution provider
Partner for corporate security
About me
3

4. About corma GmbH
4
Stops suspects by:
analytical investigations
operative investigations
Saves time by:
online research
online monitoring
Increases efficiency &
saves money by:
data analytics
global intelligence
solutions

5. Data Modeling
5
© corma GmbH

6. Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
6

7. Understanding data
7

8.  It is a challenge to understand data
 What kind of challenge?
 Data quantity
 Data access
 Data integration
 Understand relationships & background
 Bring data into context
Understanding data
8
© Dan Roam

9.  How does it work?
 In four steps
Understanding data
9
© Dan Roam

10. Look at the data:
Understanding data
10
© Dan Roam

11. See the pattern:
Understanding data
11
© Dan Roam

12. Imagine
Understanding data
12
© Dan Roam

13. Show – summaries your findings
Understanding data
13
© Dan Roam

14. Understanding data
14

15. 1. Chain of Custody
• Record all your steps
 Software: Hunchly https://www.hunch.ly/
 Plain document
• Store original data in a secure area
• Create “digital fingerprints”: MD5 Hash
• Work only with a copy of the original data
corma Workflow
15

16. 2. Identify data format
• Research
 http://www.file-extensions.org
 http://www.filext.com
 http://www.fileinfo.com
 .gpi
 .bqy
 .blb
Understanding data
16
Garmin Point of Interest file
BrioQuery database file
ACT! database file

17. 2. Identify data format
• View (read only)
 http://www.uvviewsoft.com
Understanding data
17

18. 2. Identify data format
• Deep view (editable)
 http://www.ultraedit.com
Understanding data
18

19. 3. From raw data to smart structured data
Understanding data
19
 Develop first ideas for analytical approach

20. Understanding data
20
Identified & understood data

21. Understanding data
21
First import & analytics

22. Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
22

23. Challenges
 High data quality required for good
analysis results
 Constantly increasing data quantity
Cleansing/Standardizing data
23

24. “Poor data quality” samples
Cleansing/Standardizing data
24

25. Why should data be cleansed:
 Reliable analysis results are required
 Saves time that otherwise would come
up during the analysis process
 Reduces unwanted deviations &
variations
 Identify entities (person, organization,
address)
 Insights often lead to further findings
Cleansing/Standardizing data
25

26. Fast and flexible handling of large
quantities of data
Flexible import for various data sources
Intuitive research
Analyses, calculations, statistics
Business Intelligence
Ad-hoc reporting
26
Solution

27.  Combine different data formats
 Fix data quality issues
 Identify missing data
 Better link analysis results
 Application of different tools for
standardized data cleansing
27
Solution

28. 28
Solution
Develop automated queries

29. 29
Benefits
Develop workflow for recurring
processes
Standardize processes (templates)
Benefits:
 Time saving
 Flexible
 Maximize effectiveness
 Team “compatibility”
 Easy to learn

30. Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
30

31. Imagine
Data validation & enrichment
31

32. Geocoding: http://www.gpsvisualizer.com
Data validation & enrichment
32

33. Geocoding: http://www.gpsvisualizer.com
Data validation & enrichment
33

34. Geocoding: http://www.gpsvisualizer.com
Data validation & enrichment
34

35. Whois (historical records)
Data validation & enrichment
35

36. Relationships between Entities
Data validation & enrichment
36

37. Visualization & link analysis
Data validation & enrichment
37

38. Address verification – manually
Data validation & enrichment
38

39. Address verification – service
provider or software for large amounts of
data
 AddressDoctor
http://www.addressdoctor.com
 Experian
http://www.qas-experian.com.au
Data validation & enrichment
39

40. Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
40

41. Importing data
41

42. 42
Sample import: i2 IBM-Database

43. 43
Case study:
Insurance claims audit

44. Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
44

45. Analytics … yes … but structured:
 Identify needed analytical steps
 Develop „questions“ to data
 What has prompted the need for the
analysis?
 What is the key question that needs to be
answered?
 „Create“ evidence out of data
 What can you prove?
 What do you want to prove?
 Visualize your thinking!
Analyzing data
45

46. Analytical techniques
 Chronologies and timelines (understand
timing and sequence of events)
 Sorting (categorizing & hypothesis
generation)
 Ranking, scoring, prioritizing (determine
which items are most important)
 Network analysis – analyze relationships
between entities (people, organizations,
objects)
Analyzing data
46

47. Supporting tools:
 Documenting processes in intranet/wiki
 Select the right tool for each task
 Train the users
 Keep the users “busy”
Analyzing data
47

48. Query - an investigative question,
converted into database search
Analysis Sample: i2 IBM
48

49. How many organizations are known at
this address?
Analysis Sample: i2 IBM
49

50. 50
Analysis Sample (InfoZoom)
Decoding (classification, i.e. phone data)

51. 51
Email analysis with Intella

52. 52
Timelinemaker
i2 IBM Analyst‘s Notebook
Timeline Charts

53. 53
Classic view: Event log
View: Event log Explorer
Windows event log analysis

54. 54
Windows event log analysis

55. Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
55

56. Final works starts when single
components are ready
Reporting
56

57. Reporting
57

58. Workflow
Understanding data
Cleansing / Standardizing data
Data validation & enrichment
Importing data
Analyzing data
Reporting
Monitoring
What are “Smart Solutions”?
58

59. Proactively maintain a high, consistent
standard of data quality
Monitoring
59

60. 60
Jörn Weber - jw@corma.de
+49 (162) 1009402
corma GmbH · Hochstr. 2 · D-41379 Brüggen·
Tel: +49 2163 349 0080 · E-Mail: mail@corma.de · Web: www.corma.de
Thank you!