| CPC G06Q 20/4016 (2013.01) [H04L 51/216 (2022.05)] | 17 Claims |

|
1. A method of reporting an exchange of messages between nodes in a network, the method comprising:
receiving from a first device, using circuitry, a first fraud investigation request for data for a target node, the data indicative of an exchange of messages between nodes in a network linked to the target node, the first fraud investigation request indicating that the target node is linked to potentially fraudulent activity, the target node and the nodes being separate from the first device;
building, by the circuitry, first data indicative of a first exchange of one or more messages between nodes in the network linked to the target node, the first data being built in response to receiving the first fraud investigation request;
storing, by the circuitry, a record of the fraud investigation request in a database configured to store records corresponding to fraud investigation requests associated with potentially fraudulent activity in the network;
receiving, from the first device, using the circuitry, a second fraud investigation request for data for the target node, the data indicative of an exchange of messages between nodes in the network linked to the target node, the nodes being separate from the first device;
determining, by the circuitry, that a fraud investigation request for data for the target node has previously been received, the determination including querying the database to identify the record of the first fraud investigation request, the determination indicating that the target node was subject to the first fraud investigation request;
based on the determination that the first fraud investigation request was previously received,
building, by the circuitry, second data indicative of a second exchange of one or more messages between nodes in the network linked to the target node;
based on the determination that the first fraud investigation request has previously been received, identifying, by the circuitry, a new portion of the second data based on a comparison of the second data with the first data built for the target node, the new portion of the second data excluding the first data; and
reporting, to the first device, by the circuitry, the new portion of the second data.
|