The Role of Complex Event Processing and Application Performance Management in Fraud Detection

Many industries are concerned with fraud detection--insurance, trade and finance, retail. For each of these industries there is one technology that takes much of the guesswork out of fraud detection--complex event processing (CEP). CEP provides the backbone for application performance management.

Background Enabling Fraud Detection

According to an article available at msdn.microsoft.com, complex event processing (CEP) engines are driving the ability to develop event driven IT environments. Application performance management works with event-driven service oriented architecture (SOA) as well as legacy applications. This is possible because a CEP engine is not limited to working with data from a single source type. It can be used to correlate information from diverse sources, such as information technology (IT) and business key performance indicators (KPIs). This last point is especially important in that the CEP can be used to correlate IT metrics and business KPIs and thus, quantitatively explain the impact IT issues have on business metrics.

Of the many functions connected to providing application performance management, all of them are enhanced by integration of complex event processing within the APM solution-end-user experience monitoring, user-defined transaction profiling, application component discovery and modeling, application component deep-dive monitoring and application performance management database.

It is this same capability to develop a consistent view of events and standardize taxonomy that makes CEP the perfect choice for designing systems that are capable of detecting fraud.

• Business process models need the power of CEP to establish enterprise-level standards for data.


• Complex event processing enables background testing of models and problem trouble-shooting in a safe environment.


• CEP makes it easier to set transaction pattern expectations, to design and model business processes because it leverages information contextually.


• CEP enhances the ability to build in scalability without creating security vulnerability.


• CEP enables event harvesting, making every transaction visible at not only the IT level, but at the business level where decisions are made.

Detecting fraud depends upon the ability of to establish parameters. Event "normal" vs. event "abnormal" can only be identified once "normal" has been established. Yet, even once this standard has been achieved, the sheer volume of information requires the ability to evaluate that data.

The properly designed complex event processing engine must have both of these capabilities-ability to crunch huge volumes of data and ability to identify patterns and correlate those patterns to normal vs. abnormal. For example, a financial institution that is monitoring transactions from end-to-end can establish that any transaction that comes from outside a set geographical area, within a time range and over a specific dollar amount triggers a potential fraud alert. The failure to process a certain volume of transactions could also be set as an alert trigger. Other data that can indicate fraud can be integrated into the APM solution. Outside feeds from public records databases and credit bureaus can be used to trigger fraud alerts as well.

The types of alerts that can be established when an application performance monitoring solution is using a complex event processing engine are infinite. Create a fraud-detection rule and the CEP engine automates alerts instantly. This enables the correct action to be taken early. The mean time to know (MTTK) that a problem has occurred is cut significantly, reducing risk and cost substantially..

Advantages of APM over Stand-alone Fraud Detection Software

While there are solutions that offer only fraud detection, finding an APM solution that allows you to leverage the full power of application performance management and complex event processing across your business is the more efficient. Fraud detection is only one of the benefits APM offers. Business transaction performance reporting, business transaction management and end-use experience reporting are just three of the additional functions you can expect if you choose the right APM solution.

While some APM solutions are designed to embrace separate technologies rather than replacing them, if you don't already have a separate fraud detection solution, a carefully chosen APM solution will provide many more benefits than a fraud detection solution would on its own. It pays to shop carefully and to ask questions. The presence of a complex event processing engine and application performance management capabilities isn't a guarantee that the product will provide the level of fraud detection protection your company needs.