Back to results
US 10,896,381 B2Granted
Behavioral misalignment detection within entity hard segmentation utilizing archetype-clustering
AssigneeFair Isaac Corporation
InventorsScott Michael Zoldi, Joseph F. Murray
Life of this patent
Estimating the term…
Abstract
An automated way of learning archetypes which capture many aspects of entity behavior, and assigning entities to a mixture of archetypes, such that each entity is represented as a distribution across multiple archetypes. Given those representations in archetypes, anomalous behavior can be detected by finding misalignment with a plurality of entities archetype clustering within a hard segmentation. Extensions to sequence modeling are also discussed. Applications of this method include anti-money laundering (where the entities can be customers and accounts, as described extensively below), retail banking fraud detection, network security, and general anomaly detection.
Claims30
A method to be performed by a computer processor, the computer processor forming at least part of a computer system, the method comprising:
- maintaining one or more profiles in a data store for a plurality of entities of interest, at least one of the one or more profiles being formed as a data structure that, instead of containing a set of profile records of past activities of an entity, captures statistics of one or more behaviors of the entity associated with the profile, the data structure further including demographic information associated with the entity and an updated estimate of associated recursive transaction activity variables which drive a soft clustering of the entity to enable real-time detection of suspicious transactions,
- the soft clustering involving migration of the entity over time from a first soft cluster of archetypes to a second soft cluster of archetypes, and one or more models being generated based on the captured statistics of one or more behaviors of the plurality of entities, the one or more models being used by the computer processor for predicting a behavior of a new entity of interest;
- assigning the plurality of entities of interest to hard segments of a segmentation scheme;
- and
- assigning one or more of the plurality of entities of interest to a set of archetypes, the set of archetypes being an archetype distribution and generated based on entity transaction behavior information and entity demographic information in the generated one or more models, at least one archetype of the set of archetypes indicating at least one behavior characteristic that the entities assigned to that archetype have in common.
2 more elements
A system comprising:
- at least one programmable processor;
- and
- a machine-readable medium storing instructions that, when executed by the at least one processor, cause the at least one programmable processor to perform operations comprising:
- maintaining one or more profiles in a data store for a plurality of entities of interest, at least one of the one or more profiles being formed as a data structure that, instead of containing a set of profile records of past activities of an entity, captures statistics of one or more behaviors of the entity associated with the profile, the data structure further including demographic information associated with the entity and an updated estimate of associated recursive transaction activity variables which drive a soft clustering of the plurality of entities to enable real-time detection of suspicious transactions,
- one or more models being generated based on the captured statistics of one or more behaviors of the plurality of entities, the one or more models being used by the computer processor for predicting a behavior of a new entity of interest;
- assigning the plurality of entities of interest to hard segments of a segmentation scheme;
- and,
- assigning individual ones of the plurality of entities of interest to a set of archetypes, the set of archetypes being an archetype distribution and generated based on the generated one or more models, at least one archetype of the set of archetypes indicating at least one behavior characteristic that the entities assigned to that archetype have in common.
5 more elements
A computer program product comprising a non-transitory machine-readable medium storing instructions that, when executed by at least one programmable processor, cause the at least one programmable processor to perform operations comprising:
- maintaining one or more profiles in a data store for a plurality of entities of interest, at least one of the one or more profiles being formed as a data structure that, instead of containing a set of profile records of past activities of an entity, captures statistics of one or more behaviors of the entity associated with the profile, the data structure further including demographic information associated with the entity and an updated estimate of associated recursive transaction activity variables which drive a soft clustering of the plurality of entities to enable real-time detection of suspicious transactions,
- one or more models being generated based on the captured statistics of one or more behaviors of the plurality of entities, the one or more models being used by the computer processor for predicting a behavior of a new entity of interest;
- assigning the plurality of entities of interest to hard segments of a segmentation scheme;
- assigning one or more of the plurality of entities of interest to a set of archetypes, the set of archetypes being an archetype distribution and generated based on entity transaction behavior information and entity demographic information in the generated one or more models, at least one archetype of the set of archetypes indicating at least one behavior characteristic that the entities assigned to that archetype have in common;
- identifying a transaction performed by a first entity of the plurality of entities of interest, wherein the at least one behavior characteristic of the first entity produces an archetype distribution to which the first entity is assigned;
- determining a variation over time between the archetype distribution to which the first entity is assigned and a distance from the set of archetypes soft clusters associated with other entities in the hard segmentation to which the first entity is assigned;
- generating a soft clustering misalignment score based on the determined variation, the soft clustering misalignment score indicating the degree of variation between the archetype distribution to which the first entity is assigned and the set of archetypes soft clusters associated with the other entities in the hard segmentation to which the first entity is assigned;
- and
- generating a report, in response to determining that the first entity has a soft cluster misalignment score that exceed one or more thresholds, the report indicating that the first entity is to be reassigned to a different hard segment or that the entity has migrated over time from a first soft cluster of archetypes to a second soft cluster of archetypes;
- the report further indicating that the first entity exhibits outlier behavior, wherein archetype mixture distributions represents a set of behaviors for the plurality of entities of interest within one or more segmentations.
7 more elements
Dependencies are inferred from the claim text.