A method of detecting a pattern of one of a fraudulent activity and a criminal activity by recording an object in a transaction database, the object comprising at least one suspicious transaction in a transaction database, the transaction database being coupled to processor search manager apparatus, the processor search manager apparatus comprising a processor and memory, the memory coupled to the transaction database, the method comprising
- testing by said processor of hypotheses representing a possible organizational structure of a criminal or fraudulent conspiracy, said transaction database comprising one of a similarity-based and a nearest neighbor search;
- and
- applying at least one model to results returned from the database in response to a query, the query requesting objects in said transaction database most similar to a target object, the queried objects, responsive to the query, being most similar to each other, the testing including testing at least one hypothesis and detecting the pattern of one of the fraudulent activity and the criminal activity;
- the pattern detection comprising a prediction of attributes including two of gender, marital status, occupation and age of an offender of the suspicious transaction and member of the criminal or fraudulent conspiracy.