US Patent 9479518 Low false positive behavioral fraud detection

Techniques to detect fraud through behavioral analysis with low false positives are disclosed. In various embodiments, resource access data indicating for each resource in a set of resources respective usage data for each of one or more users of the resource is received. Hierarchical clustering analysis is performed to determine at each of two or more hierarchical levels a set of one or more clusters of users, resources, or both. A level-specific anomaly score is computed at each of said two or more hierarchical levels. The level-specific anomaly scores are aggregated across said two or more hierarchical levels to determine an aggregate anomaly score. The aggregate anomaly score to determine whether an anomaly has been detected.