US-12621310-B2 - Event monitoring and response system and method

US12621310B2US 12621310 B2US12621310 B2US 12621310B2US-12621310-B2

Abstract

A method includes a processing computer querying a data store for plurality of network data since a last epoch of data. The processing computer can generate matrices based on the plurality of network data and then perform tensor factorization on the matrices, to obtain latent values in the network data. The processing computer can then determine that the latent values satisfy a predetermined criterion. The processing computer can input the latent values into a model associated with the signal, wherein the model generates output data. The processing computer can then generate an alert comprising the output data and then transmit the alert to a remote server computer.

Inventors

Theodore D. Harris
Craig O'Connell
Yue Li
Tatiana Korolevskaya
Nancy Switzer
Aoyu Chen

Assignees

VISA INTERNATIONAL SERVICE ASSOCIATION

Dates

Publication Date: 20260505
Application Date: 20190502

Claims (14)

1 . A method comprising: querying, by a processing computer, a data store for a plurality of network data in a first epoch; determining, by the processing computer, a presence of a signal in the plurality of network data based on comparing network data queried in the first epoch to network data obtained in a previous epoch; generating, by the processing computer, in response to successfully determining the presence of the signal, matrices based on the plurality of network data; performing, by the processing computer, tensor factorization on the matrices to obtain latent values in the plurality of network data; determining, by the processing computer, that the latent values satisfy a predetermined criterion; inputting, by the processing computer, the latent values into a first model, wherein the first model generates output data; generating, by the processing computer, an alert comprising the output data; determining, by the processing computer, a remote server computer of a plurality of remote server computers based on the output data; transmitting, by the processing computer, the alert to the remote server computer; receiving, by the processing computer from the remote server computer, an event request message comprising event data; determining, by the processing computer, a second model based on the latent values and the first model, and being associated with the event data; retrieving, by the processing computer, the second model from a database; running, by the processing computer, the second model on the event data to determine second output data; generating, by the processing computer, an event response message comprising the second output data; and transmitting, by the processing computer, the event response message to the remote server computer.
2 . The method of claim 1 , wherein the matrices are adjacency matrices, and wherein after performing tensor factorization, the method further comprises: determining, by the processing computer, whether or not the latent values are statistically relevant.
3 . The method of claim 1 , wherein the remote server computer performs additional processing based on the alert, and wherein the method further comprises: querying, by the processing computer, the data store for another plurality of network data since another epoch of data; generating, by the processing computer, another matrices based on the another plurality of network data; performing, by the processing computer, tensor factorization on the another matrices to obtain another set of latent values in the another plurality of network data; determining, by the processing computer, that the another set of latent values satisfy the predetermined criterion or another predetermined criterion; inputting, by the processing computer, the latent values into another model, wherein the another model generates another output data; generating, by the processing computer, a subsequent alert comprising the another output data; and transmitting, by the processing computer, the subsequent alert to the remote server computer.
4 . The method of claim 1 , wherein the output data is subsequent output data, and after querying and before generating the matrices, the method further comprises: determining, by the processing computer, current initial output data generated by one or more deep learners, wherein the one or more deep learners overfit the plurality of network data to determine the current initial output data, wherein the current initial output data comprises one or more community groups; comparing, by the processing computer, the current initial output data to previously determined output data, wherein the previously determined output data is determined in the last epoch and comprises previously determined community groups; and based on the comparing, determining, by the processing computer, a signal, wherein the generating the matrices is in response to the signal.
5 . The method of claim 1 further comprising: normalizing, by the processing computer, the latent values.
6 . The method of claim 1 , wherein the predetermined criterion is a threshold of statistical relevancy.
7 . The method of claim 1 further comprising: determining, by the processing computer, the first model of a plurality of models stored in the data store, wherein the first model is associated with at least a portion of the plurality of network data.
8 . A processing computer comprising: a processor; a memory device; and a computer-readable medium coupled to the processor, the computer-readable medium comprising code executable by the processor for implementing a method comprising: querying a data store for a plurality of network data in a first epoch; determining a presence of a signal in the plurality of network data based on comparing network data queried in the first epoch to network data obtained in a previous epoch; generating, in response to successfully determining the presence of the signal, matrices based on the plurality of network data; performing tensor factorization on the matrices to obtain latent values in the network data; determining that the latent values satisfy a predetermined criterion; inputting the latent values into a first model, wherein the first model generates output data; generating an alert comprising the output data; determining a remote server computer of a plurality of remote server computers based on the output data; transmitting the alert to the remote server computer, wherein the remote server computer performs additional processing based on the alert; receiving, by the processing computer from the remote server computer, an event request message comprising event data; determining, by the processing computer, a second model based on the latent values and the first model, and being associated with the event data; retrieving, by the processing computer, the second model from a database; running, by the processing computer, the second model on the event data to determine second output data; generating, by the processing computer, an event response message comprising the second output data; and transmitting, by the processing computer, the event response message to the remote server computer.
9 . The processing computer of claim 8 , wherein the matrices are adjacency matrices, and wherein after performing tensor factorization, the method further comprises: determining whether or not the latent values are statistically relevant.
10 . The processing computer of claim 8 , wherein the remote server computer performs additional processing based on the alert, and wherein the method further comprises: querying the data store for another plurality of network data since another epoch of data; generating another matrices based on the another plurality of network data; performing tensor factorization on the another matrices to obtain another set of latent values in the another plurality of network data; determining that the another set of latent values satisfy the predetermined criterion or another predetermined criterion; inputting the latent values into another model, wherein the another model generates another output data; generating a subsequent alert comprising the another output data; and transmitting the subsequent alert to the remote server computer.
11 . The processing computer of claim 8 , wherein the output data is subsequent output data, and after querying and before generating the matrices, the method further comprises: determining current initial output data generated by one or more deep learners, wherein the one or more deep learners overfit the plurality of network data to determine the current initial output data, wherein the current initial output data comprises one or more community groups; comparing the current initial output data to previously determined output data, wherein the previously determined output data is determined in the last epoch and comprises previously determined community groups; and based on the comparing, determining a signal, wherein the generating the matrices is in response to the signal.
12 . The processing computer of claim 8 , wherein the method further comprises: normalizing the latent values.
13 . The processing computer of claim 8 , wherein the predetermined criterion is a threshold of statistical relevancy.
14 . The processing computer of claim 8 , wherein the method further comprises: determining the first model of a plurality of models stored in the data store, wherein the first model is associated with at least a portion of the plurality of network data.

Description

CROSS-REFERENCES TO RELATED APPLICATIONS This application is a 371 National Stage of International Application No. PCT/US2019/030447, International Filing Date May 2, 2019, which claims the benefit of U.S. Provisional Application No. 62/665,889, filed May 2, 2018, which is are herein incorporated by reference in their entirety for all purposes. BACKGROUND A server computer can search through the incoming data using hard coded filters to determine if any signals are present in the data. As an illustration, a server computer can analyze incoming transaction data for transactions. The server computer can use a filter (e.g., a threshold) to determine if one or more parameters associated with one or more transactions meet the filter. If one or more parameters associated with the transactions meet the filter, then the server computer can issue an appropriate alert. For example, a server computer can analyze transaction data for a number of transactions using a static filter which flags potentially fraudulent activity when two or more high value (e.g., more than $500) transactions conducted using the same account occur within a 48 hour period at two merchants selling similar goods (e.g., two electronics stores). This particular filter can be used to identify abnormal and potentially fraudulent activity. While effective in some instances, static filters can be problematic, because static filters are relative inflexible. Because they are inflexible, they may fail to identify relevant, but subtle, trends in a data set. For example, the static filter which flags potentially fraudulent activity when two or more high value (e.g., more than $500) transactions conducted using the same account occur within a 48 hour period at two merchants selling similar goods may improperly identify legitimate transactions as being potentially fraudulent. For example, consider a non-fraudulent scenario where a merchant that sells expensive and popular dresses is having a sale, and the purchase of such dresses by consumers often results in those consumers buying expensive accessories at other merchants (such as merchants that sell expensive shoes). This scenario may satisfy the filter, but the identification of two such transactions as being potentially fraudulent would end up being a false positive, since the transactions would be legitimate. While one could hard code many filters to cover may different potential situations, it is often not practical to predict each and every situation that might occur with respect to a particular set of outcomes. Thus, improved analysis methods for monitoring events are needed. Embodiments of the invention address this problem and other problems individually and collectively. SUMMARY One embodiment of the invention is directed to a method comprising: querying, by a processing computer, a data store for a plurality of network data since a last epoch of data; generating, by the processing computer, matrices based on the plurality of network data; performing, by the processing computer, tensor factorization on the matrices to obtain latent values in the plurality of network data; determining, by the processing computer, that the latent values satisfy a predetermined criterion; inputting, by the processing computer, the latent values into a model, wherein the model generates output data; generating, by the processing computer, an alert comprising the output data; and transmitting, by the processing computer, the alert to a remote server computer. Another embodiment of the invention is directed to a processing computer comprising: a processor; a memory device; and a computer-readable medium coupled to the processor, the computer-readable medium comprising code executable by the processor for implementing a method comprising: querying a data store for a plurality of network data since a last epoch of data; generating matrices based on the plurality of network data; performing tensor factorization on the matrices to obtain latent values in the plurality of network data; determining that the latent values satisfy a predetermined criterion; inputting the latent values into a model, wherein the model generates output data; generating an alert comprising the output data; and transmitting the alert to a remote server computer. Another embodiment is directed to a method comprising: generating, by a remote server computer, an event request message comprising event data related to a user; transmitting, by the remote server computer, the event request message to a processing computer, wherein the processing computer determines a model associated with the event data, wherein the model is trained, in part, using latent values, runs the model on the event data to determine output data, and transmits an event response message comprising the output data to the remote server computer; receiving, by the remote server computer, the event response message; and performing, by the remote server computer, additional processing bas