Clustering data based on indications of financial malfeasance

A computer system to assist a human analyst in analyzing large amounts of electronic communications for malfeasance, comprising:

• one or more computer readable storage devices configured to store:
• one or more software modules including computer executable instructions, the one or more software modules including a cluster engine module and a workflow engine module;
• a plurality of clustering strategies;
• a plurality of transaction risk indicators;
• and
• a plurality of communication risk indicators;
• one or more cluster data sources configure to store:
• a plurality of electronic trade data items, each electronic trade data item associated with a trade of a financial instrument, properties, and property values, each electronic trade data item comprising a trader property associating a trader identifier of a trader executing the trade;
• and
• a plurality of electronic communication data items, each electronic communication data item associated with an electronic communication and one or more trader identifiers that sent or received the electronic communication;
• and and
• one or more hardware computer processors in communication with the one or more computer readable storage devices and the one or more cluster data sources, and configured to execute the one or more software modules in order to cause the one or more hardware computer processors to:
• designate, by the cluster engine module, one or more seeds by:
• accessing, from the one or more computer readable storage devices, the plurality of transaction risk indicators and at least one electronic trade data item of the plurality of electronic trade data items;
• comparing the plurality of transaction risk indicators to the at least one electronic trade data item and associated properties;
• based at least on the comparison and in response to determining the at least one electronic trade data item is related to at least one transaction risk indicator, designating the at least one electronic trade data item as a first seed;
• determining a subset of electronic communication data items from the plurality of electronic communication data items that are identifiable as likely side conversations, wherein determining the subset of electronic communication data items comprises identifying an electronic communication data item that has at least one less of a particular participant than a previous electronic communication associated with the electronic communication data item;
• searching the subset of electronic communication data items to identify an initial electronic communication data item, distinct from the at least one electronic trade data item, based at least on a communication risk indicator of the plurality of communication risk indicators and a sender or recipient of the initial electronic communication data item corresponding to a trader associated with the at least one electronic trade data item;
• and
• designating the initial electronic communication data item as a second seed;
• for each designated first and second seed:
• identify, by the cluster engine module, one or more first data items determined to be associated with the first seed based at least in part on a first clustering strategy of the plurality of clustering strategies, wherein the first clustering strategy queries the one or more cluster data sources to determine at least one of:
• a first trader identifier associated with the first seed of the at least one electronic trade data item, or an electronic communication data item of the plurality of electronic communication data items associated with a first trader corresponding to the first trader identifier;
• identify, by the cluster engine module, one or more second data items determined to be associated with the second seed based at least in part on a second clustering strategy of the plurality of clustering strategies, wherein the second clustering strategy queries the one or more cluster data sources to determine at least one of:
• a sender or recipient associated with the second seed of the initial electronic communication data item, an initial participant corresponding to at least one of the sender or recipient of the initial electronic communication data item, or an electronic trade data item of the plurality of electronic trade data items associated with the initial participant;
• generate, by the cluster engine module, a cluster based at least on the first and second seed, wherein generating the cluster comprises:
• adding the first and second seed to the cluster;
• adding the one or more first data items to the cluster;
• adding the one or more second data items to the cluster;
• storing the generated cluster in the one or more computer readable storage devices;
• and
• determine, by the cluster engine module, a score for the generated cluster, based at least on one or more scoring criterions;
• and
• cause presentation, by the workflow engine module, of at least one generated cluster and the determined score for the at least one generated cluster in a user interface of a client computing device.

A computer-implemented method to assist a human analyst in analyzing large amounts of electronic communications for malfeasance, comprising:

• by one or more computer processors configured to execute software modules comprising computer executable instructions:
• designating one or more seeds by:
• accessing a plurality of transaction risk indicators and at least one electronic trade data item from a plurality of electronic trade data items, each electronic trade data item associated with a trade of a financial instrument, properties, and property values, each electronic trade data item comprising a trader property associating a trader identifier of a trader executing the trade;
• comparing the plurality of transaction risk indicators to the at least one electronic trade data item and associated properties;
• based at least on the comparison and in response to determining the at least one electronic trade data item is related to at least one transaction risk indicator, designating the at least one electronic trade data item as a first seed;
• accessing, from one or more computer readable storage devices, a plurality of electronic communication data items, each electronic communication data item associated with an electronic communication and one or more trader identifiers that sent or received the electronic communication;
• determining a subset of electronic communication data items from the plurality of electronic communication data items that are identifiable as likely side conversations, wherein determining the subset of electronic communication data items comprises identifying an electronic communication data item that has at least one less of a particular participant than a previous electronic communication associated with the electronic communication data item;
• searching the subset of electronic communication data items to identify an initial electronic communication data item, distinct from the at least one electronic trade data item, based at least on a communication risk indicator of a plurality of communication risk indicators and a sender or recipient of the initial electronic communication data item corresponding to a trader associated with the at least one electronic trade data item;
• and
• designating the initial electronic communication data item as a second seed;
• for each designated first and second seed:
• identifying one or more first data items determined to be associated with the first seed based at least in part on a first clustering strategy of a plurality of clustering strategies, wherein the first clustering strategy queries one or more cluster data sources to determine at least one of:
• a first trader identifier associated with the first seed of the at least one electronic trade data item, or an electronic communication data item of the plurality of electronic communication data items associated with a first trader corresponding to the first trader identifier;
• identifying one or more second data items determined to be associated with the second seed based at least in part on a second clustering strategy of the plurality of clustering strategies, wherein the second clustering strategy queries the one or more cluster data sources to determine at least one of:
• a sender or recipient associated with the second seed of the initial electronic communication data item, an initial participant corresponding to at least one of the sender or recipient of the initial electronic communication data item, or an electronic trade data item of the plurality of electronic trade data items associated with the initial participant;
• generating a cluster based at least on the first and second seed, wherein generating the cluster comprises:
• adding the first and second seed to the cluster;
• adding the one or more first data items to the cluster;
• adding the one or more second data items to the cluster;
• storing the generated cluster in the one or more computer readable storage devices;
• and
• determining a score for the generated cluster, based at least on one or more scoring criterions;
• and
• causing presentation of at least one generated cluster and the determined score for the at least one generated cluster in a user interface of a client computing device.