Method for identifying anomalous transactions using machine learning
AssigneeGoogle Inc.
InventorRamesh Natarajan
Life of this patent
Estimating the term…
Abstract
The present disclosure provides various transformations to be used in analysis of a large number of transactions to detect anomalies that would indicate potential fraudulent or criminal activity. Such transformations may be applied, for example, using a machine learning system. According to some examples, each of various transformations may be used to detect a particular type of behavioral anomaly. When multiple disparate transformations are considered together by the machine learning system, anomalous activity related to potential fraudulent or criminal activity can be detected more frequently and with greater accuracy.
Claims20
A system for detecting anomalous activity related to potential fraud or criminal activity among a plurality of transactions, comprising:
- memory;
- and one or more processors in communication with the memory, the one or more processors configured to:
- retrieve the plurality of transactions from a sliding time window;
- review the plurality of transactions in one or more data structures identifying the transactions;
- identify one or more sets of potentially related transactions occurring within the sliding time window;
- receive, via a graphical user interface, a parameter related to one or more transformations;
- generate, based on application of a machine learning model to the one or more sets of potentially related transactions and using the received parameter, results of the one or more various transformations;
- identify potentially anomalous activity corresponding to the one or more sets of potentially related transactions;
- flag the identified potentially anomalous activity using one or more perceptible indicia;
- and output a table containing the results of the one or more various transformations for display via the graphical user interface.
A method of detecting anomalous activity related to potential fraud or criminal activity among a plurality of transactions, comprising:
- retrieve the plurality of transactions from a sliding time window;
- reviewing, with one or more processors, data structures identifying the plurality of transactions;
- identifying, with the one or more processors, one or more sets of potentially related transactions occurring within the sliding time window;
- in a graphical user interface, receiving one or more parameters related to a number of various transformations;
- generating, with the one or more processors based on application of a machine learning model, results of the number of various transformations using the one or more parameters and applied to the identified one or more sets of potentially related transactions;
- identifying, with the one or more processors, potentially anomalous activity corresponding to the one or more sets of potentially related transactions;
- generating a table and flagging, with the one or more processors, the identified potentially anomalous activity using one or more perceptible indicia;
- and
- outputting the table for display via the graphical user interface.
A non-transitory computer-readable medium storing instructions executable by one or more processors for performing a method of detecting anomalous activity related to potential fraud or criminal activity among a plurality of transactions, comprising:
- retrieving the plurality of transactions a sliding time window;
- reviewing data structures identifying the plurality of transactions;
- identifying one or more sets of potentially related transactions occurring within the sliding time window;
- providing a graphical user interface and receiving from a user, parameters related to various transformations;
- generating, based on application of a machine learning model, results of the various transformations using the received parameters and applied to the identified one or more sets of potentially related transactions;
- and
- identifying, based on the results, potentially anomalous activity corresponding to the one or more sets of potentially related transactions
- producing a table and flagging, with the one or more processors, the identified potentially anomalous activity using one or more perceptible indicia;
- and
- displaying the table to user in the graphical user interface.
Dependencies are inferred from the claim text.