Predicting and explaining identity risk, exposure and cost using the ecosystem of identity attributes

Abstract

Personally Identifiable Information (PII) is commonly used in both the physical and cyber worlds to perform personal authentication. A 2014 Department of Justice report estimated that roughly 7% of American households reported some type of identity theft in the previous year, involving the theft and fraudulent use of such PII. Establishing a comprehensive map of PII attributes and their relationships is a fundamental first step to protect users from identity theft. In this paper, we present the mathematical representation and implementation of a model of Personally Identifiable Information attributes for people, named Identity Ecosystem. Each PII attribute (e.g., name, age, and Social Security Number) is modeled as a graph node. Probabilistic relationships between PII attributes are modeled as graph edges. We have implemented this Identity Ecosystem model as a Bayesian Belief Network (with cycles allowed) and we use Gibb's Sampling to approximate the posteriors in our model. We populated the model from two sources of information: 1) actual theft and fraud cases; and 2) experts' estimates. We have utilized our Identity Ecosystem implementation to predict as well as to explain the risk of losing PII and the liability associated with fraudulent use of these PII attributes. For better human understanding of the complex identity ecosystem, we also provide a 3D visualization of the Identity Ecosystem model and queries executed on the model. This research aims to advance a fundamental understanding of PII attributes and leads to better methods for preventing identity theft and fraud.