# US 2025/0094989 A1 · Cross-Cluster Transaction Risk Assessment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2025/0094989 A1
- Document ID: US20250094989A1
- Status: Published application
- Kind: A1
- Application number: 18/470,196
- Filed: 2023-09-19
- Published: 2025-03-20
- Earliest claimed: 2023-09-19
- Assignees: Oracle International Corporation
- Applicants: Oracle International Corporation
- Inventors: Venkatakrishnan Gopalakrishnan; Jan Sterba; Diego Ceferino Torres Dho; May Bich Nhi Lam
- Web page: https://patentgrep.com/patent/US20250094989A1

## CPC

- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- G06Q 20/389: {Keeping log of transactions for guaranteeing non-repudiation of a transaction}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Techniques for providing cross-cluster transaction risk assessment are disclosed herein. In one embodiment, the system: obtains customer transaction data including a number of transaction details; clusters the customer transaction data into clusters of transactions; calculates a centroid for each cluster of transactions, corresponding to a mean value within the corresponding cluster; determines, for each transaction, a relationship score indicating the distance of the transaction from the centroid of its cluster; clusters transactions across multiple customers within a posting period to determine a centroid for each customer; calculates a risk score for each transaction by evaluating the transaction's relationship scores against the centroid of the corresponding cluster and the centroids of the other clusters; assigns a risk flag to transactions having risk scores exceeding one or more predefined risk thresholds; and presents one or more notifications of the transactions with risk flags to one or more client devices associated with users.

## Claims

### Claim 1

A method comprising:
obtaining customer transaction data comprising a plurality of transaction details;
clustering the customer transaction data into clusters of transactions based on the transaction details;
calculating a centroid for each cluster of transactions, the centroid representing a transaction corresponding to a mean value within the corresponding cluster;
determining, for each transaction, a relationship score indicating the distance of the transaction from the centroid of its cluster;
clustering transactions across multiple customers within a posting period to determine a centroid for each of the customers;
calculating a risk score for each transaction by evaluating the transaction's relationship scores against the centroid of the corresponding cluster and the centroids of the other clusters;
assigning a risk flag to transactions having risk scores exceeding one or more predefined risk thresholds; and
presenting one or more notifications of the transactions with risk flags to one or more client devices associated with users.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
normalizing a transaction value for each of the transactions within each cluster.

### Claim 3 (depends on 2)

The method of claim 2, wherein the risk score for each transaction is normalized based on the normalized transaction value for the transaction.

### Claim 4 (depends on 3)

The method of claim 3, wherein normalizing the risk score includes applying a logarithmic transformation to accentuate variations in risk scores.

### Claim 5 (depends on 2)

The method of claim 2, wherein normalizing the transaction values is performed using a standardized scaling technique.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
identifying the posting period for the transactions, the posting period reflecting a time frame for assessing the risk.

### Claim 7 (depends on 1)

The method of claim 1, wherein the customer transaction data comprises transaction attributes, the transaction attributes comprising one or more of: transaction amount, transaction date, transaction type, and customer identity.

### Claim 8 (depends on 1)

The method of claim 1, wherein clustering the customer transaction data further comprises applying a distance-based clustering algorithm.

### Claim 9 (depends on 1)

The method of claim 1, wherein calculating a centroid for each cluster includes determining a statistical mean of transaction attributes within the corresponding cluster.

### Claim 10 (depends on 1)

The method of claim 1, wherein the relationship score for each transaction is calculated using a mathematical formula that considers the transaction's distance from the centroid and the variation within the cluster.

### Claim 11 (depends on 1)

The method of claim 1, wherein clustering transactions across multiple customers further comprises grouping transactions based on customer attributes selected from the group consisting of industry type, transaction volume, and transaction frequency.

### Claim 12 (depends on 1)

The method of claim 1, wherein calculating the risk score involves applying a weighted combination of the transaction's relationship scores relative to its cluster and the centroids of the other clusters.

### Claim 13

A system comprising:
at least one device including a hardware processor;
the system being configured to perform operations comprising:
obtaining customer transaction data comprising a plurality of transaction details;
clustering the customer transaction data into clusters of transactions based on the transaction details;
calculating a centroid for each cluster of transactions, the centroid representing a transaction corresponding to a mean value within the corresponding cluster;
determining, for each transaction, a relationship score indicating the distance of the transaction from the centroid of its cluster;
clustering transactions across multiple customers within a posting period to determine a centroid for each of the customers;
calculating a risk score for each transaction by evaluating the transaction's relationship scores against the centroid of the corresponding cluster and the centroids of the other clusters;
assigning a risk flag to transactions having risk scores exceeding one or more predefined risk thresholds; and
presenting one or more notifications of the transactions with risk flags to one or more client devices associated with users.

### Claim 14 (depends on 12)

The system of claim 12, wherein the predefined risk thresholds are determined based on user-defined criteria tailored to specific industry types.

### Claim 15 (depends on 12)

The system of claim 12, wherein the system is further configured to perform an operation comprising:
prioritizing risk flags based on a ranking of transactions' risk scores.

### Claim 16 (depends on 12)

The system of claim 12, wherein presenting the one or more notifications includes delivering visual representations of one or more of: risk scores of transactions, clusters of transactions, and centroids of the clusters.

### Claim 17 (depends on 12)

The system of claim 12, wherein the system is further configured to perform an operation comprising:
utilizing historical transaction data to establish baseline risk scores for comparison with current transactions.

### Claim 18 (depends on 12)

The system of claim 12, wherein assigning a risk flag comprises labeling transactions with categories of risk levels based on predefined score ranges.

### Claim 19 (depends on 12)

The system of claim 12, wherein the system is further configured to perform an operation comprising:
presenting, to at least a subset of the client devices, a user interface that facilitates manual review of the flagged transactions.

### Claim 20 (depends on 12)

The system of claim 12, wherein clustering transactions across multiple customers comprises refining one or more of the clusters using customer-specific attributes and transaction histories.

### Claim 21

A non-transitory computer-readable medium containing instructions comprising:
obtaining customer transaction data comprising a plurality of transaction details;
clustering the customer transaction data into clusters of transactions based on the transaction details;
calculating a centroid for each cluster of transactions, the centroid representing a transaction corresponding to a mean value within the corresponding cluster;
determining, for each transaction, a relationship score indicating the distance of the transaction from the centroid of its cluster;
clustering transactions across multiple customers within a posting period to determine a centroid for each of the customers;
calculating a risk score for each transaction by evaluating the transaction's relationship scores against the centroid of the corresponding cluster and the centroids of the other clusters;
assigning a risk flag to transactions having risk scores exceeding one or more predefined risk thresholds; and
presenting one or more notifications of the transactions with risk flags to one or more client devices associated with users.