Coalition network identification using iterative process

A computing device comprising:

• a processor;
• and
• memory comprising processor-executable instructions that when executed by the processor cause performance of operations, the operations comprising:
• identifying a first plurality of sets of event information associated with a first plurality of events, wherein:
• the first plurality of events is associated with a first plurality of entities corresponding to a first entity type and a second plurality of entities corresponding to a second entity type;
• a first set of event information of the first plurality of sets of event information is associated with a first event of the first plurality of events;
• and
• the first set of event information is indicative of:
• a first entity, of the first plurality of entities, associated with the first event;
• and
• a second entity, of the second plurality of entities, associated with the first event;
• analyzing the first plurality of sets of event information to identify a first set of entities, of the first plurality of entities, that are related to the second entity, wherein the first set of entities comprises the first entity;
• analyzing the first plurality of sets of event information to identify a second set of entities, of the second plurality of entities, that are related to the first set of entities;
• analyzing the first plurality of sets of event information to identify a third set of entities, of the first plurality of entities, that are related to the second set of entities;
• performing multiple iterations of at least one of:
• analyzing the first plurality of sets of event information to identify a first output set of entities, of the second plurality of entities, that are related to a first input set of entities;
• or
• analyzing the first plurality of sets of event information to identify a second output set of entities, of the first plurality of entities, that are related to the first output set of entities, wherein:
• for an initial iteration of the multiple iterations, the first input set of entities corresponds to the third set of entities;
• for an iteration, of the multiple iterations, following the initial iteration, the first input set of entities corresponds to the second output set of entities identified in a preceding iteration of the multiple iterations;
• and
• the multiple iterations are performed until at least one of:
• a difference between the first output set of entities identified in a first iteration of the multiple iterations and the first output set of entities identified in a second iteration of the multiple iterations does not exceed a first threshold difference;
• or
• a difference between the second output set of entities identified in a third iteration of the multiple iterations and the second output set of entities identified in a fourth iteration of the multiple iterations does not exceed a second threshold difference;
• and
• identifying a coalition network associated with fraudulent activity based upon one or more first entities identified in at least one of the first iteration, the second iteration, the third iteration or the fourth iteration.

A non-transitory machine readable medium having stored thereon processor-executable instructions that when executed cause performance of operations, the operations comprising:

• identifying a first plurality of sets of event information associated with a first plurality of events, wherein:
• the first plurality of events is associated with a first plurality of entities corresponding to a first entity type and a second plurality of entities corresponding to a second entity type;
• a first set of event information of the first plurality of sets of event information is associated with a first event of the first plurality of events;
• and
• the first set of event information is indicative of:
• a first entity, of the first plurality of entities, associated with the first event;
• and
• a second entity, of the second plurality of entities, associated with the first event;
• generating, based upon the first plurality of sets of event information, a first network profile associated with the first plurality of entities and the second plurality of entities, wherein the first network profile is indicative of one or more first sets of event metrics associated with the second entity and a first set of entities comprising the first entity, wherein:
• the first plurality of entities comprises the first set of entities;
• and
• a first set of event metrics of the one or more first sets of event metrics corresponds to a measure of events associated with the first entity and the second entity;
• analyzing the first network profile to identify the first set of entities, of the first plurality of entities, that are related to the second entity;
• analyzing the first network profile to identify a second set of entities, of the second plurality of entities, that are related to the first set of entities;
• analyzing the first network profile to identify a third set of entities, of the first plurality of entities, that are related to the second set of entities;
• performing multiple iterations of at least one of:
• analyzing the first network profile to identify a first output set of entities, of the second plurality of entities, that are related to a first input set of entities;
• or
• analyzing the first network profile to identify a second output set of entities, of the first plurality of entities, that are related to the first output set of entities, wherein:
• for an initial iteration of the multiple iterations, the first input set of entities corresponds to the third set of entities;
• for an iteration, of the multiple iterations, following the initial iteration, the first input set of entities corresponds to the second output set of entities identified in a preceding iteration of the multiple iterations;
• and
• the multiple iterations are performed until at least one of:
• a difference between the first output set of entities identified in a first iteration of the multiple iterations and the first output set of entities identified in a second iteration of the multiple iterations does not exceed a first threshold difference;
• or
• a difference between the second output set of entities identified in a third iteration of the multiple iterations and the second output set of entities identified in a fourth iteration of the multiple iterations does not exceed a second threshold difference;
• and
• identifying a coalition network associated with fraudulent activity based upon one or more first entities identified in at least one of the first iteration, the second iteration, the third iteration or the fourth iteration.