Back to results
US 11,699,160 B2Granted
Method, use thereof, computer program product and system for fraud detection
OwnerTomá{hacek over (s)} Matyska, Omkar Kulkarni +8inventors
InventorsTomá{hacek over (s)} Matyska, Omkar Kulkarni, Tien Le, Barak Chizi, Vasileios Stathokostopoulos, Frans Thierens, Shahul Hameed, Bartel Puelinckx, Johan Thijs, Kevin Vanderspikken
Life of this patent
Estimating the term…
Abstract
The current invention pertains to a computer-implemented method, a method, a use thereof, a computer system and a computer program product for determining a potential for anomalous activity by a suspect user, particularly for detecting fraud and most particularly for detecting money laundering.
Claims20
A computer-implemented method for determining a potential for anomalous activity by a suspect user, comprising the steps of:
- a) receiving a plurality of user profiles at a processing unit, each of the user profiles associated with a user and comprising a plurality of transactions associated with the user, each of the transactions comprising a plurality of transaction attributes;
- b) calculating, using the processing unit, an anomaly score for each of the received user profiles to determine the potential for anomalous activity by the suspect user by means of an anomaly detection algorithm which is trained based on one or more of the transaction attributes of the transactions of the plurality of user profiles, wherein the trained anomaly detection algorithm is an unsupervised anomaly detection algorithm;
- characterized in that the method further comprises the steps of:
- c) determining a community structure for the received plurality of user profiles based at least in part on the transactions of the user profiles, wherein the determined community structure comprises a plurality of nodes interconnected via weighted edges, wherein each of the nodes represents an individual, entity, or organization associated with one of the user profiles, wherein the nodes are directly interconnected with each other based on relationships or exchanges in the community structure, wherein each of the nodes is associated with one of the user profiles and the calculated anomaly score for said user profile, wherein the weight of each of the edges interconnecting two or more of the nodes is at least based in part on a number of the transactions between the user profiles associated with the two or more of the nodes that are interconnected;
- d) calculating a network anomaly score for a user profile associated with the suspect user, wherein said user profile associated with the suspect user is part of the received plurality user profiles, wherein the network anomaly score for said user profile associated with the suspect user is based at least in part on the anomaly score calculated for one or more of the user profiles associated with the nodes in the determined community structure which are interconnected via the edge to the node of said user profile associated with the suspect user and the weight of each respective interconnecting edge;
- and
- e) calculating the potential for anomalous activity by the suspect user by combining the calculated anomaly score and the network anomaly score of the user profile associated to said suspect user.
4 more elements
A server for determining a potential for anomalous activity by the suspect user, configured for performing the computer-implemented method comprising the steps of:
- a) receiving a plurality of user profiles, each of the user profiles associated with a user and comprising a plurality of transactions associated with the user, each of the transactions comprising a plurality of transaction attributes;
- b) calculating, using a processing unit of the server, an anomaly score for each of the received user profiles to determine the potential for anomalous activity by the suspect user by means of an anomaly detection algorithm which is trained based on one or more of the transaction attributes of the transactions of the plurality of user profiles, wherein the trained anomaly detection algorithm is an unsupervised anomaly detection algorithm;
- characterized in that the method further comprises the steps of:
- c) determining a community structure for the received plurality of user profiles based at least in part on the transactions of the user profiles, wherein the determined community structure comprises a plurality of nodes interconnected via weighted edges, wherein each of the nodes represents an individual, entity, or organization associated with one of the user profiles, wherein the nodes are directly interconnected with each other based on relationships or exchanges in the community structure, wherein each of the nodes is associated with one of the user profiles and the calculated anomaly score for said user profile, wherein the weight of each of the edges interconnecting two or more of the nodes is at least based in part on a number of the transactions between the user profiles associated with the two or more of the nodes that are interconnected;
- d) calculating a network anomaly score for a user profile associated with the suspect user, wherein said user profile associated with the suspect user is part of the received plurality user profiles, wherein the network anomaly score for said user profile associated with the suspect user is based at least in part on the anomaly score calculated for one or more of the user profiles associated with the nodes in the determined community structure which are interconnected via the edge to the node of said user profile associated with the suspect user and the weight of each respective interconnecting edge;
- and
- e) calculating the potential for anomalous activity by the suspect user by combining the calculated anomaly score and the network anomaly score of the user profile associated to said suspect user.
4 more elements
A non-transitory computer program product for determining a potential for anomalous activity by the suspect user, comprising instructions which, when executed by a computer, cause the computer to carry out the computer-implemented method comprising the steps of:
- a) receiving a plurality of user profiles, each of the user profiles associated with a user and comprising a plurality of transactions associated with the user, each of the transactions comprising a plurality of transaction attributes;
- b) calculating, using a processing unit of the computer, an anomaly score for each of the received user profiles to determine the potential for anomalous activity by the suspect user by means of an anomaly detection algorithm which is trained based on one or more of the transaction attributes of the transactions of the plurality of user profiles, wherein the trained anomaly detection algorithm is an unsupervised anomaly detection algorithm;
- characterized in that the method further comprises the steps of:
- c) determining a community structure for the received plurality of user profiles based at least in part on the transactions of the user profiles, wherein the determined community structure comprises a plurality of nodes interconnected via weighted edges, wherein each of the nodes represents an individual, entity, or organization associated with one of the user profiles, wherein the nodes are directly interconnected with each other based on relationships or exchanges in the community structure, wherein each of the nodes is associated with one of the user profiles and the calculated anomaly score for said user profile, wherein the weight of each of the edges interconnecting two or more of the nodes is at least based in part on a number of the transactions between the user profiles associated with the two or more of the nodes that are interconnected;
- d) calculating a network anomaly score for a user profile associated with the suspect user, wherein said user profile associated with the suspect user is part of the received plurality user profiles, wherein the network anomaly score for said user profile associated with the suspect user is based at least in part on the anomaly score calculated for one or more of the user profiles associated with the nodes in the determined community structure which are interconnected via the edge to the node of said user profile associated with the suspect user and the weight of each respective interconnecting edge;
- and
- e) calculating the potential for anomalous activity by the suspect user by combining the calculated anomaly score and the network anomaly score of the user profile associated to said suspect user.
4 more elements
Dependencies are inferred from the claim text.