Online fraud is reduced by identifying suspicious activities in real time and providing alerting so that interdiction may be performed. Historical customer behavior is used to identify and flag deviations in activity patterns. An HTTP data stream is parsed, intelligently filtered, and key data is extracted in real time. The key data is periodically extracted from network traffic and used to update corresponding summaries stored in a fraud data mart. The data mart is constantly incrementally updated so that the most current historical information is available to a rules engine for real time comparison with new customer data and patterns occurring on the network. Fraud-related business signatures are applied to this data stream and/or a data mart to identify suspicious online transactions. By understanding the customer session, the customer's intended use of the online application is derived and possible fraudulent activities identified.