# US 12,118,557 B2 · Method, system, and computer program product for detecting group activities in a network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,118,557 B2
- Document ID: US12118557B2
- Status: Granted
- Kind: B2
- Application number: 17/137,524
- Filed: 2020-12-30
- Published: 2021-07-08
- Granted: 2024-10-15
- Earliest claimed: 2020-01-06
- Assignees: Visa International Service Association
- Applicants: Visa International Service Association
- Inventors: Liang Wang; Junpeng Wang; Chiranjeet Chetia; Shi Cao; Harishkumar Sundarji Majithiya; Roshni Ann Samuel; Minghua Xu; Wei Zhang; Hao Yang
- Web page: https://patentgrep.com/patent/US12118557B2

## CPC

- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Provided is a method for detecting group activities in a network. The method may include receiving interaction data associated with a plurality of interactions. For each account identifier associated with at least one interaction, a value may be determined for each of a first set of categories, and a vector may be generated based on the value for each category. The length of each vector may be determined. At least one relational graph may be generated based on the interaction data. Each relational graph may be associated with a respective category of a second set of categories. At least one cluster of nodes may be determined based on the relational graph(s). A score for each cluster may be determined based on the length of the vector associated with the account identifier of each node of the cluster of nodes. A system and computer program product are also disclosed.

## Claims

### Claim 1

A computer-implemented method for detecting group activities in a network based on unsupervised machine learning techniques, comprising:
receiving, by a transaction service provider system, interaction data associated with a plurality of interactions, the interaction data for each interaction of the plurality of interactions including account identifier data associated with at least one account identifier, the at least one account identifier comprising a payment token mapped to a primary account number (PAN);
storing, by the transaction service provider system, the interaction data for each interaction of the plurality of interactions in a distributed storage system;
receiving, by a data attributes extraction system, the interaction data for each interaction of the plurality of interactions from the distributed storage system;
for each account identifier associated with at least one interaction of the plurality of interactions, determining, by the data attributes extraction system, a value for each category of a first set of categories based on the interaction data;
for each account identifier associated with at least one interaction of the plurality of interactions, generating, by the data attributes extraction system, a vector for each account identifier associated with at least one interaction of the plurality of interactions based on inputting the value for each category of the first set of categories into at least one machine learning model, wherein the at least one machine learning model provides the vector for each account identifier associated with at least one interaction of the plurality of interactions as an output;
determining, by the data attributes extraction system, a length of each vector based on the value for each category of the first set of categories of a respective vector, wherein the length of each vector is associated with a risk score;
generating, by a relational graphing system, at least one relational graph based on the interaction data received from the data attributes extraction system, each relational graph associated with a respective category of a second set of categories, each relational graph comprising a plurality of nodes and a plurality of edges, the plurality of nodes comprising a node for each account identifier associated with at least one interaction of the plurality of interactions, the plurality of edges comprising an edge connecting each respective node of the plurality of nodes with each other node of the plurality of nodes having a same value of the respective category as the respective node;
determining, by a suspicious group activity indicator system, at least one cluster of nodes based on the at least one relational graph received from the relational graphing system using an unsupervised cluster detection technique;
determining, by the suspicious group activity indicator system, a score for each cluster of the at least one cluster using an unsupervised machine learning score risk assessment model based on the length of the vector associated with the account identifier of each node of the cluster of nodes;
updating, by the suspicious group activity indicator system, the unsupervised machine learning score risk assessment model in real time without pre-training the unsupervised machine learning score risk assessment model to provide an updated model;
outputting, by the suspicious group activity indicator system, score data for each cluster of the at least one cluster based on the updated model;
denying, by the transaction service provider system, at least one further interaction based on the score data from the suspicious group activity indicator system for one or more clusters of the at least one cluster; and
opening, by at least one of the transaction service provider system or a continuous real time transaction monitoring system, a case investigation based on the score for one or more clusters of the at least one cluster.

### Claim 2 (depends on 1)

The method of claim 1, wherein the plurality of interactions comprises a plurality of payment transactions, and wherein the account identifier data for each payment transaction of the plurality of payment transactions comprises at least one of a primary account number (PAN), a payment token, or any combination thereof.

### Claim 3 (depends on 1)

The method of claim 1, wherein the at least one relational graph comprises a plurality of relational graphs, the method further comprising:
combining, by the relational graphing system, the plurality of relational graphs to form a combined graph, the combined graph comprising the plurality of nodes and a plurality of weighted edges, the plurality of edges comprising a weighted edge corresponding to each edge of the plurality of edges of all of the plurality of relational graphs, a weight of each respective weighted edge based on a number of the plurality of relational graphs having at least one edge of the plurality of edges thereof corresponding to the respective weighted edge.

### Claim 4 (depends on 3)

The method of claim 3, wherein determining the at least one cluster of nodes comprises determining the at least one cluster of nodes based on the combined graph, and
wherein determining the score comprises determining a weighted score for each cluster of the at least one cluster based on the length of the vector associated with the account identifier of each respective node of the cluster of nodes and the weight of the weighted edges connected to each respective node of the cluster of nodes, wherein the score comprises the weighted score.

### Claim 5 (depends on 4)

The method of claim 4, wherein the weighted score comprises at least one of a weighted average based on the length of the vector associated with the account identifier of each respective node of the cluster of nodes and the weight of the weighted edges connected to each respective node of the cluster of nodes, a multiplication product based on the length of the vector associated with the account identifier of each respective node of the cluster of nodes and the weight of the weighted edges connected to each respective node of the cluster of nodes, or any combination thereof.

### Claim 6 (depends on 1)

The method of claim 1, wherein a first subset of the first set of categories comprises a second subset of the second set of categories.

### Claim 7 (depends on 1)

The method of claim 1, wherein the at least one account identifier comprises a first account identifier associated with a sender and a second account identifier associated with a receiver.

### Claim 8 (depends on 7)

The method of claim 7, wherein the second set of categories comprises a sender category, and wherein the at least one relational graph comprises a sender relational graph, the plurality of edges of the sender relational graph comprising the edge connecting each respective node of the plurality of nodes with each other node of the plurality of nodes having the first account identifier associated with the sender of at least one interaction associated with the other node matching the first account identifier associated with the sender of at least one interaction associated with the respective node.

### Claim 9 (depends on 7)

The method of claim 7, wherein the second set of categories comprises a receiver category, and wherein the at least one relational graph comprises a receiver relational graph, the plurality of edges of the receiver relational graph comprising the edge connecting each respective node of the plurality of nodes with each other node of the plurality of nodes having the second account identifier associated with the receiver of at least one interaction associated with the other node matching the second account identifier associated with the receiver of at least one interaction associated with the respective node.

### Claim 10 (depends on 1)

The method of claim 1, wherein the unsupervised cluster detection technique comprises at least one of a community detection algorithm, a random walk algorithm, or any combination thereof.

### Claim 11 (depends on 1)

The method of claim 1, further comprising at least one of:
communicating, by at least one of the transaction service provider system or the continuous real time transaction monitoring system, at least one notification based on the score;
displaying, by at least one of the transaction service provider system or the continuous real time transaction monitoring system, a graphical user interface based on the score; or
any combination thereof.

### Claim 12

A system for detecting group activities in a network based on unsupervised machine learning techniques, comprising:
a transaction service provider system
configured to:
receive interaction data associated with a plurality of interactions, the interaction data for each interaction of the plurality of interactions including account identifier data associated with at least one account identifier, the at least one account identifier comprising a payment token mapped to a primary account number (PAN);
store the interaction data for each interaction of the plurality of interactions in a distributed storage system;
a data attributes extraction system configured to:
receive the interaction data for each interaction of the plurality of interactions from the distributed storage system;
for each account identifier associated with at least one interaction of the plurality of interactions, determine a value for each category of a first set of categories based on the interaction data;
for each account identifier associated with at least one interaction of the plurality of interactions, generate a vector for each account identifier associated with at least one interaction of the plurality of interactions based on inputting the value for each category of the first set of categories into at least one machine learning model, wherein the at least one machine learning model provides the vector for each account identifier associated with at least one interaction of the plurality of interactions as an output;
determine a length of each vector based on the value for each category of the first set of categories of a respective vector, wherein the length of each vector is associated with a risk score;
a relational graphing system configured to:
generate at least one relational graph based on the interaction data received from the data attributes extraction system, each relational graph associated with a respective category of a second set of categories, each relational graph comprising a plurality of nodes and a plurality of edges, the plurality of nodes comprising a node for each account identifier associated with at least one interaction of the plurality of interactions, the plurality of edges comprising an edge connecting each respective node of the plurality of nodes with each other node of the plurality of nodes having a same value of the respective category as the respective node;
a suspicious group activity indicator system configured to:
determine at least one cluster of nodes based on the at least one relational graph received from the relational graphing system using an unsupervised cluster detection technique;
determine a score for each cluster of the at least one cluster using an unsupervised machine learning score risk assessment model based on the length of the vector associated with the account identifier of each node of the cluster of nodes;
update the unsupervised machine learning score risk assessment model in real time without pre-training the unsupervised machine learning score risk assessment model to provide an updated model;
output score data for each cluster of the at least one cluster based on the updated model;
wherein the transaction service provider system is further configured to:
deny at least one further interaction based on the score data from the suspicious group activity indicator system for one or more clusters of the at least one cluster; and
wherein at least one of the transaction service provider system or a continuous real time transaction monitoring system is further configured to:
open a case investigation based on the score for one or more clusters of the at least one cluster.

### Claim 13 (depends on 12)

The system of claim 12, wherein the plurality of interactions comprises a plurality of payment transactions, and wherein the account identifier data for each payment transaction of the plurality of payment transactions comprises at least one of a primary account number (PAN), a payment token, or any combination thereof.

### Claim 14 (depends on 12)

The system of claim 12, wherein the at least one relational graph comprises a plurality of relational graphs, and wherein the relational graphing system is further configured to:
combine the plurality of relational graphs to form a combined graph, the combined graph comprising the plurality of nodes and a plurality of weighted edges, the plurality of edges comprising a weighted edge corresponding to each edge of the plurality of edges of all of the plurality of relational graphs, a weight of each respective weighted edge based on a number of the plurality of relational graphs having at least one edge of the plurality of edges thereof corresponding to the respective weighted edge.

### Claim 15 (depends on 14)

The system of claim 14, wherein determining the at least one cluster of nodes comprises determining the at least one cluster of nodes based on the combined graph, and
wherein determining the score comprises determining a weighted score for each cluster of the at least one cluster based on the length of the vector associated with the account identifier of each respective node of the cluster of nodes and the weight of the weighted edges connected to each respective node of the cluster of nodes, wherein the score comprises the weighted score.

### Claim 16 (depends on 15)

The system of claim 15, wherein the weighted score comprises at least one of a weighted average based on the length of the vector associated with the account identifier of each respective node of the cluster of nodes and the weight of the weighted edges connected to each respective node of the cluster of nodes, a multiplication product based on the length of the vector associated with the account identifier of each respective node of the cluster of nodes and the weight of the weighted edges connected to each respective node of the cluster of nodes, or any combination thereof.

### Claim 17 (depends on 12)

The system of claim 12, wherein a first subset of the first set of categories comprises a second subset of the second set of categories.

### Claim 18 (depends on 12)

The system of claim 12, wherein the at least one account identifier comprises a first account identifier associated with a sender and a second account identifier associated with a receiver.

### Claim 19 (depends on 12)

The system of claim 12, wherein at least one of the transaction service provider system or the continuous real time transaction monitoring system is further configured to:
communicate at least one notification based on the score;
display a graphical user interface based on the score; or
any combination thereof.

### Claim 20

A computer program product for detecting group activities in a network based on unsupervised machine learning techniques, the computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to:
receive, by a transaction service provider system, interaction data associated with a plurality of interactions, the interaction data for each interaction of the plurality of interactions including account identifier data associated with at least one account identifier, the at least one account identifier comprising a payment token mapped to a primary account number (PAN);
store, by the transaction service provider system, the interaction data for each interaction of the plurality of interactions in a distributed storage system;
receive, by a data attributes extraction system, the interaction data for each interaction of the plurality of interactions from the distributed storage system;
for each account identifier associated with at least one interaction of the plurality of interactions, determine, by the data attributes extraction system, a value for each category of a first set of categories based on the interaction data;
for each account identifier associated with at least one interaction of the plurality of interactions, generate, by the data attributes extraction system, a vector for each account identifier associated with at least one interaction of the plurality of interactions based on inputting the value for each category of the first set of categories into at least one machine learning model, wherein the at least one machine learning model provides the vector for each account identifier associated with at least one interaction of the plurality of interactions as an output;
determine, by the data attributes extraction system, a length of each vector based on the value for each category of the first set of categories of a respective vector, wherein the length of each vector is associated with a risk score;
generate, by a relational graphing system, at least one relational graph based on the interaction data received from the data attributes extraction system, each relational graph associated with a respective category of a second set of categories, each relational graph comprising a plurality of nodes and a plurality of edges, the plurality of nodes comprising a node for each account identifier associated with at least one interaction of the plurality of interactions, the plurality of edges comprising an edge connecting each respective node of the plurality of nodes with each other node of the plurality of nodes having a same value of the respective category as the respective node;
determine, by a suspicious group activity indicator system, at least one cluster of nodes based on the at least one relational graph received from the relational graphing system using an unsupervised cluster detection technique;
determine, by the suspicious group activity indicator system, a score for each cluster of the at least one cluster using an unsupervised machine learning score risk assessment model based on the length of the vector associated with the account identifier of each node of the cluster of nodes;
update, by the suspicious group activity indicator system, the unsupervised machine learning model score risk assessment model in real time without pre-training the unsupervised machine learning score risk assessment model to provide an updated model;
output, by the suspicious group activity indicator system, score data for each cluster of the at least one cluster based on the updated model;
deny, by the transaction service provider system, at least one further interaction based on the score data from the suspicious group activity indicator system for one or more clusters of the at least one cluster; and
open, by at least one of the transaction service provider system or a continuous real time transaction monitoring system, a case investigation based on the score for one or more clusters of the at least one cluster.