# US 2021/0241279 A1 · Automatic fraud detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0241279 A1 - Document ID: US20210241279A1 - Status: Published application - Kind: A1 - Application number: 16/782,790 - Filed: 2020-02-05 - Published: 2021-08-05 - Earliest claimed: 2020-02-05 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Willie R. Patten, Jr.; Eugene I. Kelton - Web page: https://patentgrep.com/patent/US20210241279A1 ## CPC - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - G06F 16/211: {Schema design and management} - G06F 17/15: Correlation function computation {including computation of convolution operations (arithmetic circuits for sum of products per se, e.g. multiply-accumulators G06F7/5443; digital filters, e.g. FIR, IIR, adaptive filters H03H17/00)} - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06N 3/04: Architecture, e.g. interconnection topology - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/09: Supervised learning - G06N 3/126: Evolutionary algorithms, e.g. genetic algorithms or genetic programming - G06N 3/006: based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO] - G06N 3/045: Combinations of networks - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 20/20: Ensemble learning - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Embodiments provide a computer implemented method, including: ingesting, by the processor, a data file including financial transaction data; generating, by the processor, a schema from the financial transaction data; identifying, by the processor, a data type of each data field in the schema; performing, by the processor, feature selection to select a plurality of data fields from the schema; performing, by the processor, data sampling to select candidate rows of the schema based on the selected data fields; clustering, by the processor, the sampled data to different categories; selecting, by the processor, a set of analytical models for risk prediction, wherein each analytical model corresponds to a data type of each selected data field, and each analytical model generates a risk score; and generating, by the processor, a single risk score indicating the fraud risk by combining all the risk scores generated by the set of analytical models. ## Claims ### Claim 1 A computer implemented method, in a data processing system comprising a processor and a memory comprising instructions which are executed by the processor to cause the processor to implement an automatic fraud detection system for identifying a fraud risk, the method comprising: ingesting, by the processor, a data file including financial transaction data; generating, by the processor, a schema from the financial transaction data; identifying, by the processor, a data type of each data field in the schema; performing, by the processor, feature selection to select a plurality of data fields from the schema; performing, by the processor, data sampling to select candidate rows of the schema based on the selected data fields; clustering, by the processor, the sampled data into different categories; selecting, by the processor, a set of analytical models for risk prediction, wherein each analytical model corresponds to a data type of each selected data field, and each analytical model generates a risk score; and generating, by the processor, a single risk score indicating the fraud risk by combining all the risk scores generated by the set of analytical models. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein the data file is a spreadsheet, and the schema is generated based on a plurality of column names of the spreadsheet. ### Claim 3 (depends on 1) The method as recited in claim 1, wherein a data type of timestamp corresponds to a chronological analytical model; a data type of string corresponds to an unstructured data analytical model; a data type of Uniform Resource Locator (URL) corresponds to Domain Name System (DNS) validation analytical model; a data type of an address corresponds to a geospatial analytical model; a data type of a person's name corresponds to identity resolution analytical model; and a data type of an account identifier corresponds to an account takeover detection analytical model. ### Claim 4 (depends on 1) The method as recited in claim 1, further comprising: performing, by the processor, data correlation to identify the plurality of data fields correlated to each other; and selecting, by the processor, the plurality of data fields correlated to each other. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the data sampling is stratified sampling. ### Claim 6 (depends on 1) The method as recited in claim 1, further comprising: clustering, by the processor, the sampled data to different categories through a hierarchical clustering approach. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein the set of analytical models are selected from a common set of machine learning models including: a regression and classification tree; a dimensionality reduction model; a classical feedforward neural network; a bagging ensemble; a boosting ensemble; an quantum-inspired evolutionary algorithm, a particle-swarm optimization; Morse-Smale clustering, a Mapper algorithm, etc.; a gradient-based optimization model; a network metrics model; a convolution and pooling layer in a deep learning architecture; and a Bayesian network. ### Claim 8 A computer program product for automatic fraud detection, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to: ingest a data file including financial transaction data; generate a schema from the financial transaction data; identify a data type of each data field in the schema; perform feature selection to select a plurality of data fields from the schema; perform data sampling to select candidate rows of the schema based on the selected data fields; cluster the sampled data into different categories; select a set of analytical models for risk prediction, wherein each analytical model corresponds to a data type of each selected data field, and each analytical model generates a risk score; and generate a single risk score indicating the fraud risk by combining all the risk scores generated by the set of analytical models. ### Claim 9 (depends on 8) The computer program product as recited in claim 8, wherein the data file is a spreadsheet, and the schema is generated based on a plurality of column names of the spreadsheet. ### Claim 10 (depends on 8) The computer program product as recited in claim 8, wherein a data type of timestamp corresponds to a chronological analytical model; a data type of a numerical number corresponds to a monetary analytical model; a data type of Uniform Resource Locator (URL) corresponds to Domain Name System (DNS) validation analytical model; a data type of an address corresponds to a geospatial analytical model; a data type of a person's name corresponds to identity resolution analytical model; and a data type of an account identifier corresponds to an account takeover detection analytical model. ### Claim 11 (depends on 8) The computer program product as recited in claim 8, wherein the processor is further caused to perform data correlation to identify the plurality of data fields correlated to each other; and select the plurality of data fields correlated to each other. ### Claim 12 (depends on 8) The computer program product as recited in claim 8, wherein the data sampling is stratified sampling. ### Claim 13 (depends on 8) The computer program product as recited in claim 8, wherein the processor is further caused to cluster the sampled data to different categories through a hierarchical clustering approach. ### Claim 14 (depends on 8) The computer program product as recited in claim 8, wherein the set of analytical models are selected from a common set of machine learning models including: a regression and classification tree; a dimensionality reduction model; a classical feedforward neural network; a bagging ensemble; a boosting ensemble; an quantum-inspired evolutionary algorithm, a particle-swarm optimization; Morse-Smale clustering, a Mapper algorithm, etc.; a gradient-based optimization model; a network metrics model; a convolution and pooling layer in a deep learning architecture; and a Bayesian network. ### Claim 15 A system for identifying a fraud risk, comprising: a processor configured to: ingest a data file including financial transaction data; generate a schema from the financial transaction data; identify a data type of each data field in the schema; perform feature selection to select a plurality of data fields from the schema; perform data sampling to select candidate rows of the schema based on the selected data fields; cluster the sampled data into different categories; select a set of analytical models for risk prediction, wherein each analytical model corresponds to a data type of each selected data field, and each analytical model generates a risk score; and generate a single risk score indicating the fraud risk by combining all the risk scores generated by the set of analytical models. ### Claim 16 (depends on 15) The system as recited in claim 15, wherein the data file is a spreadsheet, and the schema is generated based on a plurality of column names of the spreadsheet. ### Claim 17 (depends on 15) The system as recited in claim 15, wherein a data type of time stamp corresponds to a chronological analytical model; a data type of string corresponds to an unstructured data analytical model; a data type of Uniform Resource Locator (URL) corresponds to Domain Name System (DNS) validation analytical model; a data type of an address corresponds to a geospatial analytical model; a data type of a person's name corresponds to identity resolution analytical model; and a data type of an account identifier corresponds to an account takeover detection analytical model. ### Claim 18 (depends on 15) The system as recited in claim 15, wherein the processor is further configured to perform data correlation to identify the plurality of data fields correlated to each other; and select the plurality of data fields correlated to each other. ### Claim 19 (depends on 15) The system as recited in claim 15, wherein the data sampling is stratified sampling. ### Claim 20 (depends on 15) The system as recited in claim 15, wherein the set of analytical models are selected from a common set of machine learning models including: a regression and classification tree; a dimensionality reduction model; a classical feedforward neural network; a bagging ensemble; a boosting ensemble; an quantum-inspired evolutionary algorithm, a particle-swarm optimization; Morse-Smale clustering, a Mapper algorithm, etc.; a gradient-based optimization model; a network metrics model; a convolution and pooling layer in a deep learning architecture; and a Bayesian network.