The focus of security for internet shopping has been on preventing a third party from obtaining a shopper's personal details, but now researchers at the University of Technology, Sydney have devised a method for detecting fraud by company insiders.

Led by Professor Chengqi Zhang of the Faculty of Information Technology, the researchers have found that collusion between employees of an online retailer and a financial provider could be detected by using what's called data mining.

Internet security hinges on dividing up a shopper's personal details, like the delivery address and credit card details, to ensure that no one person can access all the information. But according to Professor Zhang the pieces could be put together if several people from within the system decided to conspire.

"If staff from the various verification areas colluded it would be very difficult to trace the culprits using a traditional security profile to find them," Professor Zhang said. "There might be three or more people in a complex financial transaction, which makes it difficult to trace."

He said data mining, which involves drawing patterns from vast quantities of data, had been used effectively for some time to detect security problems. The UTS work had set out to take this further – to find out how a security breach has happened and who the culprits are.

The research builds on existing security protocols using a three-step process. The first step determines what the problem is, the second step involves data mining to narrow down possibilities of what might have happened, and then a security profile is used to identify the people responsible.

The method has been tested using simulated as well as actual databases and the next step is for a prototype to be developed to allow implementation in a real-life commercial setting.

Besides Professor Zhang, the research team includes Senior Research Fellow Shichao Zhang, former UTS PhD student Qingfeng Chen and Yi-Ping Phoebe Chen from Deakin University.