Cognitive fraud detection through variance-based network analysis

A fraud detection system for detecting fraud based on identified pathways in a graph of interconnected nodes, comprising:

• a processor;
• and
• a memory containing instructions that when executed by the processor causes the following method to be performed:
• providing a data store and a network of interconnected nodes, wherein the nodes are configured to capture data passed from transactional or operational systems;
• capturing a time series of graph data corresponding to events occurring at different nodes in the graph;
• traversing the graph to identify consistent and variable pathways, respectively, at an instance level within the graph;
• scoring the identified pathways according to a particular feature to establish an expected variance model for the events contained within the graph;
• comparing newly received data against the expected variance model to determine a degree to which the newly received data deviates from the expected variance;
• generating an alert in the fraud detection system in response to detecting that a deviation between the newly received data and the expected variance exceeds a predetermined threshold;
• and
• automatically adjusting the variance model based on the newly encountered data.

A computer program product for detecting fraud based on identified pathways in a graph of interconnected nodes, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions being executable by a processor to cause the processor to perform a method comprising:

• providing a data store and a network of interconnected nodes, wherein the nodes are configured to capture data passed from transactional or operational systems;
• capturing a time series of graph data corresponding to events occurring at different nodes in the graph;
• traversing the graph to identify consistent and variable pathways, respectively, at an instance level within the graph;
• scoring the identified pathways according to a particular feature to establish an expected variance model for the events contained within the graph;
• comparing newly received data against the expected variance model to determine a degree to which the newly received data deviates from the expected variance;
• generating an alert in the fraud detection system in response to detecting that a deviation between the newly received data and the expected variance exceeds a predetermined threshold;
• and
• automatically adjusting the variance model based on the newly encountered data.