Detecting money laundering activities using drift in a trained Siamese neural network

Patent metadata

Field	Value
Publication number	US-11880890-B2
Application number	US-202117170422-A
Country	US
Kind code	B2
Filing date	Feb 8, 2021
Priority date	Feb 8, 2021
Publication date	Jan 23, 2024
Grant date	Jan 23, 2024

Abstract

Siamese neural networks (SNN) are configured to detect differences between financial transactions for multiple financial institutions and transactions for a target party. A first neural network of the SNN tracks transactions (target transactions) for a particular customer or financial institution over time and provides a target output vector. Similarly, a second neural network of the SNN tracks transactions (baseline transactions) for all or a plurality of financial institutions (e.g., within a region) over the same period of time and provides a baseline output vector. The transactions for all or a plurality of financial institutions act as a baseline of transactions against which potentially fraudulent or money laundering activity may be compared. Because Siamese neural networks account for temporal changes based on the baseline of transactions, sudden changes in target transactions will only trigger an alarm if such changes (e.g., deviations or drifts) are relative to a baseline of transactions.

First claim

The invention claimed is:

1. A method for detecting anomalous financial activity, comprising:
obtaining a target vector from a first plurality of financial transactions for a target party;
obtaining a time-dependent baseline vector from a second plurality of financial transactions for a plurality of parties, wherein the first plurality of financial transactions in the target vector include financial transactions for a current time period as well as financial transactions for a plurality of L previous time periods, and the second plurality of financial transactions in the baseline vector include financial transactions for the current time period as well as financial transactions for the same plurality of L previous time periods;
training a Siamese neural network based on a plurality of sample transactions to detect differences between legitimate financial transactions and potentially money laundering financial transactions;
generating a first output vector using the target vector as input to a first network of the Siamese neural network;
generating a second output vector using the baseline vector as input to a second network of the Siamese neural network;
obtaining a vector distance between the first output vector and the second output vector; and
generating a drift score from the vector distance, the drift score indicative of how much the first plurality of financial transactions in the target vector vary from the second plurality of financial transactions in the baseline vector; and
providing an alarm message if the drift score indicates potential fraudulent or money laundering activity by the target party.

2. The method of claim 1 , wherein each for the first network and the second network is a bidirectional long short term memory (LSTM) recurrent neural network.

3. The method of claim 1 , wherein each of the first network and the second network are identical networks that are configured to use the same weights and parameters within and between layers of the first network and the second network.

4. The method of claim 1 , wherein each of the first network and the second network have a retained memory of n previous time steps which serve to generate the first output vector and the second output vector.

5. The method of claim 1 , further comprising:
selecting the plurality of parties to be similarly situated as the target party.

6. The method of claim 5 , wherein the plurality of parties and the target party are in at least one of: the same geographical region, the same business sector or industry, or the same demographic group.

7. The method of claim 1 , wherein the first plurality of financial transactions and the second plurality of financial transactions are selected to be within the same time period.

8. The method of claim 1 , wherein the first plurality of financial transactions and the second plurality of financial transactions are selected to be of a same transaction type.

9. The method of claim 1 , wherein the alarm message is provided only if the drift score and a plurality of immediately preceding drift scores for the same target party, in combination, indicate potential fraudulent or money laundering activity by the target party.

10. The method of claim 9 , wherein the alarm message is provided if two or more of the drift scores fall within a range associated with potential fraudulent or money laundering activity.

11. The method of claim 9 , wherein the drift score generated from the vector distance is based on the first plurality of financial transactions includes financial transactions for the current time period as well as financial transactions for the plurality of L previous time periods, and the plurality of immediately preceding drift scores for the same target party include the previous drift score comprising financial transactions for the previous time period as well as the financial transactions for L prior time periods.

12. The method of claim 1 , wherein the vector distance is normalized within a defined range to obtain the drift score.

13. A non-transitory computer-readable storage medium having instructions thereon, wherein the instructions, when executed by a processing circuit, cause the processing circuit to:
obtain a target vector from a first plurality of financial transactions for a target party;
obtain a time-dependent baseline vector from a second plurality of financial transactions for a plurality of parties, wherein the first plurality of financial transactions in the target vector include financial transactions for a current time period as well as financial transactions for a plurality of L previous time periods, and the second plurality of financial transactions in the baseline vector include financial transactions for the current time period as well as financial transactions for the same plurality of L previous time periods;
train a Siamese neural network based on a plurality of sample transactions to detect differences between legitimate financial transactions and potentially money laundering financial transactions;
generate a first output vector using the target vector as input to a first network of the Siamese neural network;
generate a second output vector using the baseline vector as input to a second network of the Siamese neural network;
obtain a vector distance between the first output vector and the second output vector;
generate a drift score from the vector distance, the drift score indicative of how much the first plurality of financial transactions in the target vector vary from the second plurality of financial transactions in the baseline vector; and
provide an alarm message if the drift score indicates potential fraudulent or money laundering activity by the target party.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the alarm message is provided only if the drift score and a plurality of immediately preceding drift scores for the same target party, in combination, indicate potential fraudulent or money laundering activity by the target party.

15. A server, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
a memory communicatively coupled to the at least one processor,
wherein the at least one processor is configured to:
obtain a target vector from a first plurality of financial transactions for a target party;
obtain a time-dependent baseline vector from a second plurality of financial transactions for a plurality of parties, wherein the first plurality of financial transactions in the target vector include financial transactions for a current time period as well as financial transactions for a plurality of L previous time periods, and the second plurality of financial transactions in the baseline vector include financial transactions for the current time period as well as financial transactions for the same plurality of L previous time periods;
train a Siamese neural network based on a plurality of sample transactions to detect differences between legitimate financial transactions and potentially money laundering financial transactions;
generate a first output vector using the target vector as input to a first network of the Siamese neural network;
generate a second output vector using the baseline vector as input to a second network of the Siamese neural network;
obtain a vector distance between the first output vector and the second output vector;
generate a drift score from the vector distance, the drift score indicative of how much the first plurality of financial transactions in the target vector vary from the second plurality of

Assignees

• Mastercard International Inc

Inventors

• Das Debasmita
• Syngal Sonali
• Saraswat Ankur
• Arora Garima
• Pant Nishant
• Katyal Yatin

Classifications

• G06N3/09

  Supervised learning · CPC title

• G06N3/0442

  characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] · CPC title

• G06Q40/12 Primary

  Accounting · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N3/049

  Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs · CPC title