System, method, and computer program product for dynamic peer group analysis of systematic changes in large scale data

A system comprising at least one processor programmed or configured to:

• receive data associated with a plurality of entities, wherein the data comprises a static characteristic of each entity of the plurality of entities, a dynamic characteristic of each entity of the plurality of entities, and a risk score of each entity of the plurality of entities, and wherein the risk score of each entity of the plurality of entities indicates a probability of an anomaly occurring with regard to a behavior of that entity;
• generate a relational graph based on the static characteristic of each entity of the plurality of entities, the relational graph comprising a plurality of nodes and a plurality of edges, wherein each node represents an entity of the plurality of entities, and wherein each edge is associated with a static characteristic that is shared between two nodes of the plurality of nodes connected by that edge;
• select a target entity from the plurality of entities by selecting a target node from the plurality of nodes on the relational graph, wherein the target node represents the target entity, and wherein the target entity comprises a first static characteristic;
• determine a peer group of the target entity based on the relational graph and the first static characteristic, wherein the peer group comprises a subset of the plurality of nodes, and wherein the subset of the plurality of nodes represent a subset of the plurality of entities that share the first static characteristic with the target entity;
• calculate an average of the risk scores of the peer group and a standard deviation of the risk scores of the peer group;
• determine whether a systematic change in the behavior in the peer group has occurred based on the average of the risk scores of the peer group and the standard deviation of the risk scores of the peer group, wherein, when determining whether a systematic change in the behavior in the peer group has occurred, the at least one processor is programmed or configured to:
• generate a ratio of the average of the risk scores of the peer group to the standard deviation of the risk scores of the peer group;
• determine whether the ratio satisfies a threshold value;
• and
• determine that a systematic change in the behavior in the peer group has occurred based on the ratio satisfying the threshold value;
• determine whether a change in behavior of the target entity is a false anomaly or a true anomaly based on determining that a systematic change in the behavior in the peer group has occurred;
• and
• perform an action based on determining whether the change in behavior of the target entity is a false anomaly or a true anomaly.

A computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to:

• receive data associated with a plurality of entities, wherein the data comprises a static characteristic of each entity of the plurality of entities, a dynamic characteristic of each entity of the plurality of entities, and a risk score of each entity of the plurality of entities, and wherein the risk score of each entity of the plurality of entities indicates a probability of an anomaly occurring with regard to a behavior of that entity;
• generate a relational graph based on the static characteristic of each entity of the plurality of entities, the relational graph comprising a plurality of nodes and a plurality of edges, wherein each node represents an entity of the plurality of entities, and wherein each edge is associated with a static characteristic that is shared between two nodes of the plurality of nodes connected by that edge;
• select a target entity from the plurality of entities by selecting a target node from the plurality of nodes on the relational graph, wherein the target node represents the target entity, and wherein the target entity comprises a first static characteristic;
• determine a peer group of the target entity based on the relational graph and the first static characteristic, wherein the peer group comprises a subset of the plurality of nodes, and wherein the subset of the plurality of nodes represent a subset of the plurality of entities that share the first static characteristic with the target entity;
• calculate an average of the risk scores of the peer group and a standard deviation of the risk scores of the peer group;
• determine whether a systematic change in the behavior in the peer group has occurred based on the average of the risk scores of the peer group and the standard deviation of the risk scores of the peer group, wherein the instructions that cause the at least one processor to determine whether a systematic change in the behavior in the peer group has occurred cause the at least one processor to:
• generate a ratio of the average of the risk scores of the peer group to the standard deviation of the risk scores of the peer group;
• determine whether the ratio satisfies a threshold value;
• and
• determine that a systematic change in the behavior in the peer group has occurred based on the ratio satisfying the threshold value;
• determine whether a change in behavior of the target entity is a false anomaly or a true anomaly based on determining that a systematic change in the behavior in the peer group has occurred;
• and
• perform an action based on determining whether the change in behavior of the target entity is a false anomaly or a true anomaly.