Systems and methods for fraud detection via interactive link analysis

A system for detecting fraud by displaying visual representations of data relating to entities-of-interest that are indicative of fraud, the system comprising:

• a first database that stores at least one attribute of a plurality of the entities-of-interest;
• a second database, remote from the first database, that stores at least one attribute of the plurality of the entities-of-interest;
• a pattern match generator that generates pattern matching rules;
• a pattern matcher that receives the pattern matching rules and applies the pattern matching rules to recognize links between at least one attribute of two or more of the entities-of-interest according to one or more of the pattern matching rules, where the pattern matching rules are generated using the pattern match generator;
• a layer builder that, based on the links recognized by the pattern matcher, creates an internal data structure that represents relationships between the two or more of the entities-of-interest in terms of types of links between the two or more of the entities-of-interest, number of links between the two or more of the entities-of-interest, and numerical strength of links between the two or more of the entities-of-interest;
• a cluster explainer that derives rules that define requirements for the two or more of the entities-of-interest to be included in a cluster and categorize the two or more of the entities-of-interest that satisfy the defined requirements as potentially fraudulent entities, wherein the derived rules are applied to one or more first database-related transactions in real time and to one or more second database-related transactions in real-time to detect credit history transactions categorized as potentially fraudulent;
• and
• an interface for displaying a visual representation of the relationships between the two or more of the entities-of-interest, as expressed by the layer builder, to a user, and
• an editor for receiving an input from the user that indicates a user-generated requirement to modify the defined requirements to be included in the cluster and categorized as potentially fraudulent entities;
• where displaying the visual representation comprises:
• displaying in one of a plurality of locations of the interface different types of links between the two or more of the entities-of-interest as different colors, and displaying in another of the plurality of locations of the interface the numerical strength of links between the two or more of the entities-of-interest as lines of different thickness between the two or more of the entities-of-interest.