Advanced Learning System for Detection and Prevention of Money Laundering

Patent metadata

Field	Value
Publication number	US-2017270534-A1
Application number	US-201615074977-A
Country	US
Kind code	A1
Filing date	Mar 18, 2016
Priority date	Mar 18, 2016
Publication date	Sep 21, 2017
Grant date	—

Abstract

An automated system for detecting risky entity behavior using an efficient frequent behavior-sorted list is disclosed. From these lists, fingerprints and distance measures can be constructed to enable comparison to known risky entities. The lists also facilitate efficient linking of entities to each other, such that risk information propagates through entity associations. These behavior sorted lists, in combination with other profiling techniques, which efficiently summarize information about the entity within a data store, can be used to create threat scores. These threat scores may be applied within the context of anti-money laundering (AML) and retail banking fraud detection systems. A particular instantiation of these scores elaborated here is the AML Threat Score, which is trained to identify behavior for a banking customer that is suspicious and indicates high likelihood of money laundering activity.

First claim

What is claimed is:

1 . A method comprising:
creating, by one or more computer processors, one or more profiles for an entity of interest, each profile being formed as a data structure that captures statistics of the entity's behavior without storing a record of past activity of the entity, each profile further comprising a plurality of behavior sorted lists and recursive features, each behavior sorted list being formed of a tuple of entries, each entry having a key, a weight, and a payload that represent a frequently-observed behavior of the entity, the recursive features being configured to summarize the frequently-observed behavior of each profile; storing, by the one or more computer processors, the one or more profiles in a data store; for each input data record associated with the entity of interest, retrieving, by the one or more computer processors, one or more relevant profiles from the data store and updating the one or more relevant profiles to recursively compute summary statistics of behavior of the entity by adding or updating an observed behavior represented by the input data record to at least one of the plurality of behavior sorted lists with a full weight while decaying the weights of existing observed behaviors; comparing, by the one or more computer processors, the elements between at least two of the plurality of behavior sorted lists to generate a numerical value representing a consistency between entries in the behavior sorted list of the entity and that of other entities including risky entities and those associated behavior sorted list entries; executing, by the one or more computer processors, one or more distance models to the plurality of behavior sorted lists to determine a variation of the consistency between the entries in the at least two behavior sorted lists according to the numerical value; and generating, by the one or more computer processors, an anti-money laundering threat score utilizing self-calibrating outlier models based on entity recursively summarized profile behavior, recurrences in an entities behavior sorted list, and based on the variation of matches on behavior sorted lists of risk entities, the anti-money laundering threat score representing a threat risk that the entity of interest is engaged in money laundering.

2 . The method in accordance with claim 1 , wherein the payload of at least one entry of the one or more profiles includes recursive features.

3 . The method in accordance with claim 1 , where in the payload of at least one entry of the one or more profiles include archetype distributions, derived archetype profile features, and soft clustering misalignment scores.

4 . The method in accordance with claim 1 , wherein the input data record is a transaction performed by the entity of interest.

5 . The method in accordance with claim 1 , wherein storing the one or more profiles in a data store further comprises storing the one or more profiles as an account on a server that is part of a cloud-based network of servers.

6 . The method in accordance with claim 5 , wherein the method further comprises linking, by the one or more computer processors, two or more accounts from the cloud-based network of servers. Wherein the risk level associated with the linkage of accounts is reflected using the threat scores across the linked list of accounts.

7 . The method in accordance with claim 1 , further comprising:
determining, by the one or more computer processors, a degradation of a set of anti-money laundering threat scores; and based on the degradation and using one or more auto-retraining mechanisms executed by the one or more processors, retraining the one or more outlier detection models.

8 . The method in accordance with claim 1 , further comprising generating, by the one or more computer processors, a set of global profiles representing a population of entities of interest.

9 . A non-transitory computer program product storing instructions that, when executed by at least one programmable processor, cause the at least one programmable processor to perform operations comprising:
creating, by one or more computer processors, one or more profiles for an entity of interest, each profile being formed as a data structure that captures statistics of the entity's behavior without storing a record of past activity of the entity, each profile further comprising a plurality of behavior sorted lists and recursive features, each behavior sorted list being formed of a tuple of entries, each entry having a key, a weight, and a payload that represent a frequently-observed behavior of the entity, the recursive features being configured to summarize the frequently-observed behavior of each profile; storing, by the one or more computer processors, the one or more profiles in a data store; for each input data record associated with the entity of interest, retrieving, by the one or more computer processors, one or more relevant profiles from the data store and updating the one or more relevant profiles to recursively compute summary statistics of behavior of the entity by adding or updating an observed behavior represented by the input data record to at least one of the plurality of behavior sorted lists with a full weight while decaying the weights of existing observed behaviors; comparing, by the one or more computer processors, the elements between at least two of the plurality of behavior sorted lists to generate a numerical value representing a consistency between entries in the behavior sorted list of the entity and that of other entities including risky entities and those associated behavior sorted list entries; executing, by the one or more computer processors, one or more distance models to the plurality of behavior sorted lists to determine a variation of the consistency between the entries in the at least two behavior sorted lists according to the numerical value; and generating, by the one or more computer processors, an anti-money laundering threat score utilizing self-calibrating outlier models based on entity recursively summarized profile behavior, recurrences in an entities behavior sorted list, and based on the variation of matches on behavior sorted lists of risk entities, the anti-money laundering threat score representing a threat risk that the entity of interest is engaged in money laundering.

10 . The non-transitory computer program product in accordance with claim 9 , wherein the payload of at least one entry of the one or more profiles includes recursive features.

11 . The non-transitory computer program product in accordance with claim 9 , where in the payload of at least one entry of the one or more profiles include archetype distributions, derived archetype profile features, and soft clustering misalignment scores.

12 . The non-transitory computer program product in accordance with claim 9 , wherein the input data record is a transaction performed by the entity of interest.

13 . The non-transitory computer program product in accordance with claim 9 , wherein storing the one or more profiles in a data store further comprises storing the one or more profiles as an account on a server that is part of a cloud-based network of servers.

14 . The non-transitory computer program product in accordance with claim 13 , wherein the operations further comprise linking, by the one or more computer processors, two or more accounts from the cloud-based network of servers. Wherein the risk level associated with the linkage of accounts is reflected using the threat scores across the linked list of accounts.

15 . The non-transitory computer program

Assignees

• Fair Isaac Corp

Inventors

• Zoldi Scott Michael
• Murray Joseph F

Classifications

• G06Q50/26

  Government or public services (business processes related to the transportation industry G06Q50/40) · CPC title

• G06N99/005

  Physics · mapped topic

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title

• H04L67/306

  User profiles · CPC title

• G06Q30/018 Primary

  Certifying business or products · CPC title