System and methods for detecting fraudulent transactions

A computer system for detecting fraudulent transactions from a large plurality of transaction data, the computing system comprising:

• a network interface coupled to a data network, configured to
• provide a graphical user interface to an analyst for display on a remote analysis computer,
• store the large plurality of transaction data into a memory, and
• receive one or more packet flows comprising the large plurality of transaction data including a plurality of feature sets, each of the feature sets associated with an entity of a plurality of entities, wherein the large plurality of transaction data have not been previously confirmed as associated with any fraudulent transactions;
• a computer processor;
• and
• a non-transitory computer readable storage medium storing program instructions for execution by the computer processor in order to cause the computing system to
• group the plurality of entities into a group;
• and
• identify, via repeated filtering, a distinct potentially fraudulent transaction, wherein each repetition of the repeated filtering comprises
• identifying
• a subject entity from the group,
• a subject feature set associated with the subject entity from the plurality of feature sets,
• remaining entities, other than the subject entity, from the group, and
• remaining feature sets associated with the remaining entities from the plurality of feature sets,
• determining first Mahalanobis distances, each first Mahalanobis distance determined between the subject feature set and one of the remaining feature sets,
• based on the first Mahalanobis distances, selecting from the remaining feature sets a benchmark set, smaller than the remaining feature sets, satisfying a condition,
• determining a centroid of the benchmark set,
• determining an outlier value of the subject entity based on a second Mahalanobis distance between the subject feature set and the centroid,
• generating, as new data, a risk score based at least in part on the outlier value, the risk score indicating a likelihood the subject entity is associated with a potentially fraudulent transaction, and
• transmitting a dossier related to the subject entity over the data network via the network interface,
• wherein the risk score causes the dossier to transmit over the data network and display the risk score on the remote analysis computer when the risk score satisfies a threshold condition, the display allowing the analyst to positively determine whether the subject entity is associated with a fraudulent transaction.