US-12626259-B2 - Machine learning creation and usage of cluster visualizations

US12626259B2US 12626259 B2US12626259 B2US 12626259B2US-12626259-B2

Abstract

Methods and systems for network analysis, modeling, and visualization of electronic data involve using a machine learning algorithm for generating, in a relationship visualization aspect of a graphical user interface, a visualization consisting at least in part of a plurality of icons, each icon representing an interacting entity, and activating a visualization consisting at least in part of an element disposed between each of a plurality of pairs of the plurality of icons representing interactions between the users. The machine learning algorithm identifies communities of users based on created models of each interacting user. The machine learning algorithm displays the visualization based on predictions of how the display will be acknowledged by a viewer. The machine learning algorithm makes predictions of how an interacting user and the community will evolve over time.

Inventors

Paola Gittino
William George Cormier
Steve Thomas Dayton
Miriam Silver

Assignees

Citigroup Technology, Inc.

Dates

Publication Date: 20260512
Application Date: 20240826

Claims (20)

1 . A method, comprising: accessing a plurality of network models for a plurality of interacting users of an institution, each network model generated based on variables of interactions of each user; generating, using the plurality of network models, a visualization in a graphical user interface comprising encoded data attributes of each of the plurality of interacting users relating to user risk level, user history of reports to authorities, user type, or user interactions for interacting users having both direct and indirect connections to one another and the interacting users both with and without histories of anomalous interactions displayed as visual nodes; inputting, into a machine learning algorithm, network analysis variables to obtain a level of local clustering based on the network analysis variables, wherein the machine learning algorithm is trained to determine the level of the local clustering based on patterns, connections, correlations, or trends within the network analysis variables; determining, using the machine learning algorithm, at least one community of a plurality of communities of icons within a plurality of pairs of icons having or exceeding a predetermined level of the local clustering indicative of a suspicious activity based on the level of the local clustering; and updating, within the visualization, a size of the at least one community of the plurality of communities of icons based on a risk level of associated risk determined based on the level of the local clustering.
2 . The method of claim 1 , wherein at least one member of each of the plurality of communities of icons represents a first interacting user reported to a governmental authority for suspected unlawful activity.
3 . The method of claim 1 , further comprising encapsulating a corresponding visualization of each of the plurality of communities of icons, wherein at least one member of each of the plurality of communities is determined based on predictions of the machine learning algorithm of a type of visualization that will be likely to be recognized by a human observer.
4 . The method of claim 1 , further comprising predicting, by the machine learning algorithm, a change in actions of members of the users in each of the plurality of communities of icons based on similarities of corresponding network models of each interacting user to user histories of other users of the institution.
5 . The method of claim 1 , wherein the icons associated with a corresponding network model of each interacting user varies based on a suspected level of fraudulent activity of each respective interacting user.
6 . The method of claim 5 , further comprising predicting, by the machine learning algorithm, a change in actions of a particular community of the plurality of communities of icons based on similarities of each network model of each interacting user of the particular community to user histories of other users of the institution.
7 . The method of claim 1 , further comprising receiving new encoded data comprising at least in part of encoded interaction data attributes of each of the plurality of interacting users of the institution.
8 . The method of claim 7 , wherein the encoded interaction data attributes further comprise corresponding encoded interaction data attributes of each of the plurality of interacting users of a financial institution related to an interaction history for a pre-defined period of time.
9 . The method of claim 1 , further comprising receiving new encoded data comprising encoded interaction data attributes of each of the plurality of interacting users related to a plurality of interactions between interacting users represented by each of said plurality of pairs of icons.
10 . The method of claim 1 , wherein an interaction is one of a secure data request, an insurance claim, a secure location access request, or a financial transaction.
11 . The method of claim 1 , wherein the network analysis variables comprise a ratio of links connecting the plurality of pairs to at least one member of each of the plurality of communities of icons representing an interacting user having a history of the anomalous interactions to a maximum possible number of links connecting between the plurality of pairs of icons.
12 . A system, comprising: one or more processors utilizing a machine learning algorithm, memory coupled to the one or more processors and configured for storing instructions, which, when executed by the one or more processors, causes the one or more processors to perform operations comprising; accessing a plurality of network models for a plurality of interacting users of an institution, each network model generated based on interactions of each user; generating, using the plurality of network models, a visualization in a graphical user interface comprising encoded data attributes of each of the plurality of interacting users; inputting, into the machine learning algorithm, network analysis variables to obtain a level of local clustering based on the network analysis variables, wherein the machine learning algorithm is trained to determine the level of the local clustering based on patterns, connections, correlations, or trends within the network analysis variables; determining, using the machine learning algorithm, at least one community of a plurality of communities of icons within a plurality of pairs of icons having or exceeding a predetermined level of the local clustering indicative of a suspicious activity based on the level of the local clustering; and updating, within the visualization, a size of the at least one community of the plurality of communities of icons based on a risk level of associated risk determined based on the level of the local clustering.
13 . The system of claim 12 , wherein each network model is generated based on variables of the interactions of each user comprising each of density, size, average degree, average path length, and a clustering coefficient.
14 . The system of claim 12 , wherein the interactions comprise encoded interaction data elements representing an aggregated value of a plurality of interactions between interacting users, a total transaction amount and a count for the plurality of interactions, and an average time lag between the interactions.
15 . The system of claim 12 , wherein a link connecting each of the plurality of pairs of a plurality of icons representing the interactions between interacting users further comprises an indicator of a direction of flow of interaction requests.
16 . The system of claim 12 , wherein a link indicates a transaction amount and a count of transactions between transacting entities is associated with a size indicating the transaction amount and the count of the transactions between transacting customers of the institution.
17 . The system of claim 16 , wherein links connecting the plurality of pairs are visualized with an appearance indicating a level of risk of unlawful activity associated with each interaction.
18 . One or more non-transitory, computer-readable media having instructions recorded thereon, that when executed by one or more processors cause the one or more processors to perform operations comprising: accessing a plurality of network models for a plurality of interacting users of an institution, each network model generated based on interactions of each user; generating, using the plurality of network models, a visualization in a graphical user interface comprising encoded data attributes of each of the plurality of interacting users; inputting, into a machine learning algorithm, network analysis variables to obtain a level of local clustering based on the network analysis variables, wherein the machine learning algorithm is trained to determine the level of the local clustering based on patterns, connections, correlations, or trends within the network analysis variables; determining, using the machine learning algorithm, at least one community of a plurality of communities of icons within a plurality of pairs of icons having or exceeding a predetermined level of the local clustering indicative of a suspicious activity based on the level of the local clustering; and updating, within the visualization, a size of the at least one community of the plurality of communities of icons based on a risk level of associated risk determined based on the level of the local clustering.
19 . The one or more non-transitory, computer-readable media of claim 18 , wherein a link connecting each of the plurality of pairs of a plurality of icons representing the interactions between interacting users further comprises an indicator of a direction of flow of interaction requests.
20 . The one or more non-transitory, computer-readable media of claim 18 , wherein a link having an appearance indicating a transaction amount and a count of transactions between transacting entities is associated with a size indicating the transaction amount and the count of the transactions between transacting customers of the institution.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS This application is a continuation of U.S. patent application Ser. No. 18/379,405, filed Oct. 12, 2023 (now U.S. Pat. No. 12,147,986 issued Nov. 19, 2024), which is a continuation-in-part of U.S. patent application Ser. No. 14/707,852, filed May 8, 2015, which claims priority to U.S. Provisional Application No. 62/079,110 filed Nov. 13, 2014. The content of the foregoing application is incorporated herein in its entirety by reference. FIELD OF THE INVENTION The present invention relates generally to the field of network analysis, modeling, and visualization, and more particularly to methods and systems for using machine learning for analyzing, modeling, and generating in a graphical user interface a visualization of electronic data related to fraudulent activities. BACKGROUND OF THE INVENTION Current approaches to fraudulent interaction detection may involve monitoring individuals and their interactions to detect anomalous behavior. Such approaches may include, for example, rule-based monitoring and peer group comparison. Rule-based monitoring may involve the use of scenarios and thresholds to monitor the behavior of users, and peer group comparison may involve comparing an individual's behavior to that of the individual's peer group. These current methods may rely, for example, on aggregated transactional attributes at the user or account level to create an ‘alert’ in the system. Such current methods may focus, for example, on user access to secure data. In such methods, the cumulative activity over a certain period of time may be used to determine whether users are changing security levels more frequently or at a higher rate than is considered normal. In another example, such current methods may focus on monetary instrument activity. In such methods, a static set of rules may be run on the cumulative activity over a certain period of time to determine whether values are considered inside the norm or deviate from what is considered typical banking usage specific to a particular customer or account type. After a set of static rules is run and alerts are created, analysts may be assigned to investigate the alerted activity and to determine whether or not the alerts represent a concern. Current investigation procedures require only that the research extends to parties present in alerted transactions, and no research is conducted on entities with whom such parties interact. In other words, current investigation procedures extend only one level deep, such as to an account, the account owner, and interactions with the account. Thus, under current procedures, analysts are never presented with information about other direct or indirect connections that the entities of interest may have, and whether those connections are suspicious. Accordingly, relationships between such entities may be hidden from analysts because the ‘larger picture’ is not available in current investigation procedures. The resulting undetected anomalous connectivity patterns may represent a significant threat to the institution. There is a present need for a solution that resolves all of the foregoing issues and provides, for example, improved methods and systems for analysis, modeling, and graphical user interface visualizations of electronic data related to behavior that may be likely to be associated, for example, with fraudulent activity. SUMMARY OF THE INVENTION Embodiments of the invention employ computer hardware and software, including, without limitation, one or more processors coupled to memory and non-transitory computer-readable storage media with one or more executable programs stored thereon which instruct the processors to perform the analyzing, modeling, and generating of visualizations of electronic data described herein. Such embodiments provide methods and systems for using machine learning processes to provide graphical user interface visualizations that may involve, for example, generating, by one or more processors coupled to memory, in a relationship visualization aspect of a graphical user interface, a visualization consisting at least in part of a plurality of icons, each icon representing a transacting entity; activating, by the one or more processors, in the relationship visualization aspect of the graphical user interface, a visualization consisting at least in part of an element disposed between each of a plurality of pairs of said plurality of icons representing transactions between transacting entities; and encapsulating, by the one or more processors, in the relationship visualization aspect of the graphical user interface, a visualization of at least one community of icons consisting of at least a portion of said plurality of pairs of icons, at least one member of said community of icons representing a transacting entity having a history of anomalous transactions. In aspects of embodiments of the invention, the at least one member of the community of icons representing a t