Fraud Detection in ERP Systems Using Scenario Matching

Abstract

ERP systems generally implement controls to prevent certain common kinds of fraud. In addition however, there is an imperative need for detection of more sophisticated patterns of fraudulent activity as evidenced by the legal requirement for company audits and the common incidence of fraud. This paper describes the design and implementation of a framework for detecting patterns of fraudulent activity in ERP systems. We include the description of six fraud scenarios and the process of specifying and detecting the occurrence of those scenarios in ERP user log data using the prototype software which we have developed. The test results for detecting these scenarios in log data have been verified and confirm the success of our approach which can be generalized to ERP systems in general.

Detecting Collusive Fraud in Enterprise Resource Planning Systems

“…An alternative approach to anomaly detection is a process that creates fraud scenarios and identifies a means to detect each scenario [7]. Although such signature matching approaches are not widely used in fraud detection, they are commonly used in intrusion detection systems [11,13,14].…”

“…Users may add new scenarios or edit existing scenarios by changing the data profile and list of data types. Interested readers are referred to [7] for details about fraud scenario creation and specification.…”

“…The signature scenarios for detecting fraudulent activities consist of sequences of multiple transactions/components. This paper uses four fraud scenarios [7] to describe the process of extending individual fraud scenarios to include collusion. The scenarios are: Redirected Payment (S01), False Invoice Payment (S02), Misappropriation (S03) and Non-Purchase Payment (S04).…”

“…However, fraud scenarios differ from intrusion scenarios in that they focus on high-level user transactions on financial data rather than computer system states and events. There is a correspondingly greater degree of system independence in fraud detection, which can be exploited by separating the abstract or semantic aspects of fraud signatures from their configuration aspects [7]. For this reason, we have designed a language specifically for defining fraud scenarios.…”

“…We have developed a system for detecting patterns of individual user fraudulent activity called "fraud scenarios" [7]. Fraud scenarios are a set of user activities that indicate the possible occurrence of fraud.…”