Patent Application
20220198471
Data analysis is a process for obtaining raw data and converting it into information useful for informing conclusions or supporting decision-making. Typical data analysis steps include collecting data, organizing data, manipulating data, and summarizing data. Oftentimes, data analysis is performed automatically by computer systems on datasets that are too large and complex for analysis by a human. In some scenarios, it is desirable to apply data analysis to graph data to support decision-making based on the graph data. Data analysis of graph data can be challenging, particularly in the context of automated data analysis of large amounts of data. This is the case as automated data analysis of graph data requires novel techniques able to efficiently explore the graph to extract meaningful information under real-world computation and time constraints. Thus, it would be beneficial to develop techniques directed toward robust and efficient characterization of graph data in support of decision-making.
Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings.
The invention can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the invention. Unless stated otherwise, a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task. As used herein, the term ‘processor’ refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions.
A detailed description of one or more embodiments of the invention is provided below along with accompanying figures that illustrate the principles of the invention. The invention is described in connection with such embodiments, but the invention is not limited to any embodiment. The scope of the invention is limited only by the claims and the invention encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the invention. These details are provided for the purpose of example and the invention may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the invention is not unnecessarily obscured.
Graph traversal for measurement of fraudulent nodes is disclosed. A graph of nodes and edges is received. An identification of a starting node in the graph is received. Traversal walks on the graph from the starting node are automatically performed, wherein performing each of the traversal walks includes traversing to a randomly selected next node until any of one or more stopping criteria is met. One or more processors are used to determine one or more metrics based on the traversal walks. At least a portion of the one or more metrics is used to predict an illicit activity or entity.
In some embodiments, graph 100 is analyzed to aid detection of money laundering or other forms of fraud. Money laundering is a financial crime that involves the illegal process of obtaining money from criminal activities, such as drug or human trafficking, and making it appear legitimate. In a money laundering (or other fraud) context, in some embodiments, graph 100 represents a transaction network. In other embodiments, graph 100 represents an entity network.
In a transaction network scenario, nodes in graph 100 represent individual transactions and edges connect transactions that share common entities. Examples of transactions include a sale, a purchase, or another type of exchange or interaction. Examples of entities include a person, a business, a governmental group, an account, etc. Entities can take on various roles (e.g., as merchants, clients, etc.). In various embodiments, because connecting all transactions that share common entities results in very dense graphs, transactions are only connected if they occur in a specified time-window (e.g., only connect two transactions if they occurred within a 24-hour period). In addition, in some embodiments and as illustrated in
In an entity network scenario, nodes in graph 100 represent entities, such as merchants or clients, and edges connect entities that appear in the same transaction. When the same two entities are parties to multiple transactions (e.g., a person making several purchases at a certain retail store), the information of all the transactions may be aggregated into a single edge, and information about the individual transactions (e.g., number of transactions, average amount, maximum amount etc.) may be included in the features of the respective edge. Entity networks can be directed, as illustrated in
In some embodiments, each node in graph 100 is categorized as either “legitimate”, “illicit”, or “unknown”. For example, in graph 100, node type 102, node type 104, and node type 106 can correspond to the “legitimate”, “illicit”, and “unknown” categories, respectively. It is also possible for there to be only two types of nodes: “legitimate” and “illicit”, such as in scenarios in which ground truth labels are available for all nodes or in scenarios in which it is possible to determine or estimate labels for all nodes. In some embodiments, the determination as to whether a node (corresponding to a transaction or an entity) is legitimate or illicit is based on a category of the entity associated with the node. For example, a transaction node can be categorized as legitimate if the entity making the transaction associated with the node falls within a legitimate category. For example, within a cryptocurrency context, examples of legitimate categories may include exchanges, wallet providers, miners, and financial service providers. Examples of illicit categories may include scams, malware, terrorist organizations, and Ponzi schemes. An entity node can similarly be categorized as legitimate or illicit based on the above categories. In some embodiments, in a transaction graph scenario, the determination as to whether a node is legitimate or illicit is based on the label of the entities associated with that node. Stated alternatively, the data may include labels for the edges instead of the nodes. Mapping the labels from edges to nodes can be accomplished by marking a node as illicit if it is connected by at least one illicit edge. For example, within a banking context, two transactions that are using the same illicit entity (e.g., an illicit payment card, device, etc.) can be represented as two nodes connected by an illicit edge, and can therefore both be categorized as illicit. In various embodiments, illicit connections are utilized (e.g., whether a transaction partner is connected to an illicit actor, such as someone associated with money laundering in the past or other criminal activity) to aid detection of money laundering or other fraud.
In various embodiments, as described in further detail herein, a distance from a specified node (corresponding to a transaction or entity of interest) to an illicit node is measured to predict a likelihood of money laundering or other fraud associated with the specified node. In various embodiments, the specified node is selected as a starting node from which traversal walks of a graph are performed. In various embodiments, each traversal walk starts from the selected starting node and proceeds to a next directly connected node selected at random, continuing until an illicit node is reached or no more steps are possible or another stopping criteria is reached. These traversals are referred to as random walks. An example of a random walk for graph 100 would be (assuming node 118 is the starting node) the ordered sequence of nodes: node 118, node 116, node 114, and node 108 (node 108 being a stopping point because it is an illicit node). In various embodiments, a number of steps to reach the illicit node is recorded (e.g., three steps for the above random walk from node 118 to node 108). In various embodiments, this process is repeated to generate a distribution over the number of steps of traversals upon which various statistics such as means, standard deviations, quantiles, etc. can be computed and extracted as features to be utilized to aid money laundering or other fraud detection. These graph-extracted features may be utilized in conjunction with other features associated with a transaction or entity that is being analyzed for money laundering, other fraud, etc. Such a framework is described in more detail in
A random walk process is computationally beneficial and efficient because it is typically not possible to explore every single connection in a graph, particularly for large and/or dense graphs. A random walk process allows for efficient sampling of all available paths. Furthermore, as described in further detail herein, stopping criteria can be applied to further promote computational efficiency. Random walks can be performed regardless of whether an underlying graph is transaction-based (a transaction network) or entity-based (an entity network). In the money laundering application context, transaction data is oftentimes collected and then analyzed offline (not in real time) because a real-time decision is not required in this context.
In various embodiments, graph data 202 is comprised of transaction data in graph form. Graph 100 of
In the example illustrated, graph analysis component 204 receives graph data 202. In various embodiments, graph analysis component 204 performs random walks for a given transaction graph and derives various metrics based on the random walks.
In various embodiments, a random walker module (e.g., random walker module 302 of
In various embodiments, the output of the feature extraction module is graph features 206. Graph features 206 can include various features associated with random walk size. Stated alternatively, graph features 206 can include various metrics based on traversal walks and related to distance between seed nodes and found illicit nodes. These metrics are described in further detail below (e.g., see
Machine learning model 208 determines output 212 based on graph features 206 and input 210. For a given transaction, in various embodiments, output 212 includes a binary (yes or no) determination (e.g., 0 or 1 result) as to whether the given transaction is associated with money laundering or other fraud. Forms of fraud other than money laundering include account takeover, account-opening fraud, identity theft, and so forth. It is also possible for output 212 to take the form of a score (e.g., indicating a probability of money laundering or other fraud). Output 212 can also include an analysis of various features utilized by machine learning model 208 that contributed to a money laundering or other fraud prediction by machine learning model 208 (e.g., indicating which features contributed most to the prediction). Graph features 206 may also be utilized by a graph visualization tool that also displays output 212 to a human analyst. Visualization of graph features 206 can provide the human analyst with more information with which to review the given transaction or entity. Machine learning model 208 is a model that is built based on sample data (training data) in order to make its predictions or decisions without being explicitly programmed to do so. Various architectures are possible for machine learning model 208. In some embodiments, machine learning model 208 is a random forest model. It is also possible for machine learning model 208 to utilize a neural network or other types of architectures.
In various embodiments, random walker module 302 performs traversal walks on a received graph (e.g., graph 100 of
In various embodiments, during a random walk, to select a next node after a current node, random walker module 302 selects a node uniformly at random from the eligible neighbors of the current node. In the ‘all backwards scenario’ described above, random walker module 302 selects a node uniformly at random from the incoming neighbors of the current node. Because edges only connect older transactions to newer transactions, there is always an end node in any random walk, which means that random walker module 302 will not be stuck in an endless loop. In the ‘seed backwards scenario’ described above, random walker module 302 selects a node uniformly at random from all neighbors (incoming and outgoing) of the current node, provided that they are older than the seed node s and have not yet been selected in the current random walk, again avoiding endless loops. For a given state of a random walk XiS=(s=x1, x2, . . . , xn), the random walk stops and returns XiS as the final random walk if a stopping criterion is met. In some embodiments, the random walk stops if at least one of the following criteria is met: 1) xn is a known illicit node (corresponding to a known illicit transaction or entity) or 2) the set of eligible nodes to select from is empty (for example, in the ‘all backwards scenario’ described above, such a scenario occurs when a given node has no incoming neighbors and, consequently, random walker module 302 has no possible moves). In addition, in some embodiments, the random walk also stops if a maximum walk size (an adjustable parameter) has been reached. The maximum walk size parameter is useful to avoid being stuck in large walks and, thus, reduces computation time, particularly when performing many random walks for each seed. After a node is selected, if no stopping criteria is met, then random walker module 302 randomly picks a next node to add to XiS and the random walk continues.
The number of successful random walks parameter (e.g., supplied as a user input) sets a desired number of random walks ending in an illicit node from each seed node s E S. Unsuccessful random walks are possible because, as discussed above, random walker module 302 may encounter a node with no eligible neighbors and finish traversing a graph without reaching an illicit node. In various embodiments, to ensure the number of desired successful random walks is reached, random walker module 302 performs as many random walks as needed. As described below, a feature (metric) that can be extracted is the fraction of successful random walks from the total number of random walks needed to reach the number of successful random walks. This is also indicative of the number of unsuccessful random walks, which may be informative. In some scenarios, some nodes in a graph might have no paths to any illicit node. Thus, it is impossible to obtain successful random walks for those nodes. To avoid this problem, random walker module 302 can first determine which nodes can actually reach an illicit node. One way to do this is to invert the direction of the graph and use a descendant search algorithm for directed acyclic graphs to return all nodes reachable from a source node s in the graph G. Afterwards, the reachable nodes can be inspected to determine if at least one of them is illicit. This can be done for all nodes in a graph, and only those that can reach an illicit node are allowed to be seed nodes.
In various embodiments, feature extraction module 304 extracts features (also referred to as metrics) based on random walks performed by random walker module 302. In various embodiments, feature extraction module 304 receives a list of random walks for each seed node and returns a data frame of features, corresponding to the transaction or entity associated with the seed node, summarizing the random walks. Examples of features that can be obtained are: 1) minimum size of the random walks (min); 2) maximum size of the random walks (max); 3) mean size of the random walks (mean); 4) standard deviation of the random walks sizes (std); 5) median size of the random walks (median); 6) first quartile of the random walks sizes (q25); 7) third quartile of the random walks sizes (q75); 8) fraction of successful random walks from all the random walks performed (hit rate, i.e., percentage of random walks that ended in an illicit node); and 9) number of distinct illicit nodes in the random walks (illicit) as well as the number of legitimate nodes. For example, from a specified seed node, if 100 random walks are performed and 30 reached an illicit node, the hit rate would be 30%. Among those 100 walks, a minimum walk size to reach an illicit node, a maximum walk size to reach an illicit node, corresponding mean, standard deviation, median, quartiles, and number of illicit nodes found would also be computable. It is also possible to report which nodes have no possible path to an illicit node. Features 1) through 7) can be considered distance metrics because they are based on measuring the number of steps to reach an illicit node from the seed node.
In some scenarios, nodes are labeled with scores indicating likelihoods of being illicit (instead of binary legitimate or illicit classifications). In these scenarios, these likelihood scores can be added up during random walks, and a cumulative score for each random walk can be recorded. Minimum score, maximum score, mean score, standard deviation, median score, first quartile, and third quartile metrics can be computed based on likelihood scores. Nodes with scores above a specified threshold (indicating a specified likelihood of being illicit) can be used as stopping points for random walks, or a stopping criterion can be used where a stopping point occurs when the accumulated scores of all nodes in the current random walk exceed a specific threshold. This allows the hit rate and number of distinct illicit nodes metrics to be calculated in the same way as described above.
In some embodiments, labeling module 306 supplies node labels to random walker module 302. This can occur when node labels are missing from a graph that random walker module 302 receives. In some embodiments, nodes of node type 106 in
At 402, a graph of nodes and edges is received. An example of a type of graph that may be received is graph 100 of
At 404, an identification of a starting node in the graph is received. The starting node is also referred to as a seed node. In some embodiments, the identification of the starting node is provided by a user. The starting node can be a node that the user desires a prediction as to whether it is legitimate or illicit. In various embodiments, the starting node is one of a plurality of starting nodes provided. Stated alternatively, a set of seed nodes may be provided, from which one seed node at a time is utilized. In some embodiments, the identification of the starting node is received by random walker module 302 of
At 406, traversal walks on the graph from the starting node are automatically performed. Beginning from the starting node, subsequent nodes are selected automatically and randomly without user input. In various embodiments, performing each of the traversal walks includes traversing to a randomly selected next node until any of one or more stopping criteria is met. Examples of stopping criteria include: 1) reaching a node labeled as illicit; 2) not being able to traverse to any more nodes; and 3) reaching a maximum walk size. In various embodiments, for each successful walk (random walk that ends in reaching an illicit node), the path of the random walk in the form of a list of nodes traversed is generated. In some embodiments, the traversal walks are performed by random walker module 302 of
At 408, one or more metrics are determined based on the traversal walks. In some embodiments, each traversal walk is encoded as a sequence of nodes. The length of the sequence of nodes (the number of nodes in the sequence) corresponds to a distance between the starting node and an ending node, which can be considered a size of a random walk. In various embodiments, successful walks (random walks that reach an illicit node) are compiled into a distribution of successful walks to compute various metrics associated with traversal walk size, such as maximum size, minimum size, average size, size standard deviation, size quartiles, and median size. Successful walks can also be analyzed to determine how many distinct illicit nodes were found (unsuccessful walks would not be needed because they would not include illicit nodes). In various embodiments, unsuccessful walks (random walks that do not reach an illicit node) are used to compute metrics such as fraction of successful walks (out of a total number of walks), ratio of successful to unsuccessful walks, etc. In some embodiments, the one or more metrics are determined by feature extraction module 304 of
At 410, at least a portion of the one or more metrics are used to predict an illicit activity or entity. In some embodiments, the one or more metrics are transmitted to a machine learning model (e.g., machine learning model 208 of
At 502, a node is received. In some embodiments, the node is one of multiple nodes received by random walker module 302 of
At 504, it is determined whether the node is missing a label. If at 504 it is determined that the node is not labeled, at 506, a label for the node is generated using a machine learning model (e.g., a neural network model as discussed with respect to labeling module 306 of
At 508, it is determined whether there are more nodes to analyze. If at 508 it is determined that there are more nodes to analyze, at 502, another node is received in order to determine whether that node is labeled. If at 508 it is determined that there are no more nodes to analyze, then no further action is taken.
At 602, a node is arrived at and a list of nodes is updated. The node may be a starting node of a sequence of nodes, an ending node in the sequence of nodes, or an intermediate node in a path of nodes from the starting node to the ending node. The list of nodes is a running sequence of nodes beginning with the starting node. The list of nodes is updated to include the node that is arrived at, and the list of nodes is continually updated until after the ending node is reached. The ending node is reached if at least one stopping criterion is met.
At 604, it is determined whether at least one stopping criterion is met. An example of a stopping criterion is the node that is arrived at being an illicit node. Another example of a stopping criterion is the node that is arrived at being a terminal node (that is not an illicit node) that has no eligible neighboring nodes. If at 604 it is determined that no stopping criterion has been met, at 606, a neighboring node to traverse to is randomly selected. In various embodiments, the random selection is uniform in the sense that each eligible neighboring node has an equal probability of being selected. The neighboring node that is randomly selected then becomes the next arrival node at 602. The list of nodes is updated to reflect the addition of the randomly selected neighboring node to the sequence of nodes from the starting node to the ending node.
If at 604 it is determined that a stopping criterion has been met, at 608, the list of nodes is provided. Meeting the stopping criterion causes the traversal walk to terminate. In some embodiments, the list of nodes, which describes the sequence of nodes visited in the traversal walk, is transmitted to feature extraction module 304 of
In the example shown, computer system 700 includes various subsystems as described below. Computer system 700 includes at least one microprocessor subsystem (also referred to as a processor or a central processing unit (CPU)) 702. Computer system 700 can be physical or virtual (e.g., a virtual machine). For example, processor 702 can be implemented by a single-chip processor or by multiple processors. In some embodiments, processor 702 is a general-purpose digital processor that controls the operation of computer system 700. Using instructions retrieved from memory 710, processor 702 controls the reception and manipulation of input data, and the output and display of data on output devices (e.g., display 718).
Processor 702 is coupled bi-directionally with memory 710, which can include a first primary storage, typically a random-access memory (RAM), and a second primary storage area, typically a read-only memory (ROM). As is well known in the art, primary storage can be used as a general storage area and as scratch-pad memory, and can also be used to store input data and processed data. Primary storage can also store programming instructions and data, in the form of data objects and text objects, in addition to other data and instructions for processes operating on processor 702. Also, as is well known in the art, primary storage typically includes basic operating instructions, program code, data, and objects used by processor 702 to perform its functions (e.g., programmed instructions). For example, memory 710 can include any suitable computer-readable storage media, described below, depending on whether, for example, data access needs to be bi-directional or uni-directional. For example, processor 702 can also directly and very rapidly retrieve and store frequently needed data in a cache memory (not shown).
Persistent memory 712 (e.g., a removable mass storage device) provides additional data storage capacity for computer system 700, and is coupled either bi-directionally (read/write) or uni-directionally (read only) to processor 702. For example, persistent memory 712 can also include computer-readable media such as magnetic tape, flash memory, PC-CARDS, portable mass storage devices, holographic storage devices, and other storage devices. A fixed mass storage 720 can also, for example, provide additional data storage capacity. The most common example of fixed mass storage 720 is a hard disk drive. Persistent memory 712 and fixed mass storage 720 generally store additional programming instructions, data, and the like that typically are not in active use by the processor 702. It will be appreciated that the information retained within persistent memory 712 and fixed mass storage 720 can be incorporated, if needed, in standard fashion as part of memory 710 (e.g., RAM) as virtual memory.
In addition to providing processor 702 access to storage subsystems, bus 714 can also be used to provide access to other subsystems and devices. As shown, these can include a display monitor 718, a network interface 716, a keyboard 704, and a pointing device 706, as well as an auxiliary input/output device interface, a sound card, speakers, and other subsystems as needed. For example, pointing device 706 can be a mouse, stylus, track ball, or tablet, and is useful for interacting with a graphical user interface.
Network interface 716 allows processor 702 to be coupled to another computer, computer network, or telecommunications network using a network connection as shown. For example, through network interface 716, processor 702 can receive information (e.g., data objects or program instructions) from another network or output information to another network in the course of performing method/process steps. Information, often represented as a sequence of instructions to be executed on a processor, can be received from and outputted to another network. An interface card or similar device and appropriate software implemented by (e.g., executed/performed on) processor 702 can be used to connect computer system 700 to an external network and transfer data according to standard protocols. Processes can be executed on processor 702, or can be performed across a network such as the Internet, intranet networks, or local area networks, in conjunction with a remote processor that shares a portion of the processing. Additional mass storage devices (not shown) can also be connected to processor 702 through network interface 716.
An auxiliary I/O device interface (not shown) can be used in conjunction with computer system 700. The auxiliary I/O device interface can include general and customized interfaces that allow processor 702 to send and, more typically, receive data from other devices such as microphones, touch-sensitive displays, transducer card readers, tape readers, voice or handwriting recognizers, biometrics readers, cameras, portable mass storage devices, and other computers.
In addition, various embodiments disclosed herein further relate to computer storage products with a computer readable medium that includes program code for performing various computer-implemented operations. The computer-readable medium is any data storage device that can store data which can thereafter be read by a computer system. Examples of computer-readable media include, but are not limited to, all the media mentioned above: magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROM disks; magneto-optical media such as optical disks; and specially configured hardware devices such as application-specific integrated circuits (ASICs), programmable logic devices (PLDs), and ROM and RAM devices. Examples of program code include both machine code, as produced, for example, by a compiler, or files containing higher level code (e.g., script) that can be executed using an interpreter.
The computer system shown in
Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.
| Number | Date | Country | Kind |
|---|---|---|---|
| 117636 | Dec 2021 | PT | national |
This application claims priority to U.S. Provisional Patent Application No. 63/127,941 entitled DISTANCE TO FRAUDULENT NODES IN DATASETS filed Dec. 18, 2020, which is incorporated herein by reference for all purposes. This application claims priority to Portugal Provisional Patent Application No. 117636 entitled GRAPH TRAVERSAL FOR MEASUREMENT OF FRAUDULENT NODES filed Dec. 14, 2021, which is incorporated herein by reference for all purposes.
| Number | Date | Country | |
|---|---|---|---|
| 63127941 | Dec 2020 | US |
