Fraud detection using graph databases

Patent metadata

Field	Value
Publication number	US-2021218760-A1
Application number	US-202016944932-A
Country	US
Kind code	A1
Filing date	Jul 31, 2020
Priority date	Jan 10, 2020
Publication date	Jul 15, 2021
Grant date	—

Abstract

Aspects discussed herein relate to the storage of data in graph databases and detecting fraudulent behavior in the stored data. Fraud detection systems may use graph databases to store data, allowing for querying the graph database to obtain data using a variety of graph semantics such as nodes, edges, and properties. Graph databases in accordance with embodiments of the invention may include account nodes and attribute nodes, where nodes of the same type are not directly linked to each other. When a particular node is updated, an updated node may be created with a higher version number than the existing node. Each node may include an indication of the node being associated with fraudulent activity. Fraud indicators may be calculated based on the relationships between the nodes and fraud indicators for the nodes.

First claim

What is claimed is:

1 . A computer-implemented method for fraud detection, comprising:
obtaining account data comprising an account number; determining a corresponding account node having an account number corresponding to the account number, the corresponding account node being stored in a fraud detection database comprising a set of account nodes, a set of attribute nodes, and a set of edge data, each edge in the set of edge data identifying an account node in the set of account nodes, an attribute node in the set of attribute nodes, and a label corresponding to the value in the attribute node; generating a revised account node comprising a unique identifier, the account number, a suspicious account identifier, and version data indicating that the revised account node is a later version of the corresponding account node; generating revised edge data based on the edges linking the revised account node to an attribute node in the set of attribute nodes; inserting the revised account node into the fraud detection database; inserting the revised edge data, wherein each edge in the revised edge data links the revised account node to each attribute node indicated in the revised edge data; calculating a fraud score for the revised account node, the fraud score being calculated based on the revised edge data and each attribute node indicated in the revised edge data; and setting, based on the fraud score, a suspicious account indicator for the revised account node such that the revised account node is indicated as a suspicious account.

2 . The computer-implemented method of claim 1 , further comprising preprocessing an attribute node in the set of attribute nodes to format the value of the attribute node in a standardized format based on the label indicated in the edge linking the attribute node to an account node.

3 . The computer-implemented method of claim 1 , further comprising:
identifying an abbreviated keyword in an attribute node; and updating the value of the attribute node to replace the abbreviated keyword with a standardized keyword determined based on the label indicated in the edge linking the attribute node to an account node.

4 . The computer-implemented method of claim 1 , further comprising encrypting the value for each attribute node based on a random string and a hashing algorithm.

5 . The computer-implemented method of claim 4 , further comprising:
regenerating the random string on a predetermined schedule; and encrypting the value for each attribute node based on the regenerated random string and the hashing algorithm on the predetermined schedule.

6 . The computer-implemented method of claim 1 , further comprising:
determining a whitelist comprising a set of values occurring in the set of attribute nodes; and deleting, from the fraud detection database, attributes nodes having a value corresponding to the set of values in the whitelist.

7 . The computer-implemented method of claim 6 , further comprising determining the set of values in the whitelist based on a number of times the value occurs in an attribute node in the set of attribute nodes.

8 . The computer-implemented method of claim 6 , further comprising determining the set of values in the whitelist based on a set of default values corresponding to a particular label associated with one or more edges in the set of edge data.

9 . The computer-implemented method of claim 1 , further comprising querying the fraud detection database by:
obtaining an account identifier; mapping the account identifier to an account number; obtaining a related query node associated with the account number; determining a current account node based on the account nodes linked to the related query node, wherein the current account node comprises the account node linked to the related query node and having version data indicating the current account node is the latest version; determining a set of related attribute nodes based on a set of attribute notes linked to the current account node; and generating a query result based on the current account node and the set of related attribute nodes.

10 . The computer-implemented method of claim 1 , wherein the fraud detection database comprises:
a set of account nodes, each account node in the set of account nodes comprising a unique identifier, an account number, version data, and a suspicious account indicator indicating if the account node corresponds to a suspicious account; a set of attribute nodes, each attribute node in the set of attribute nodes comprising a value; a set of edge data, each edge in the set of edge data linking an account node to an attribute node and comprising a label corresponding to the value in the attribute node and an edge weight; a set of query nodes, each query node in the set of query nodes comprising an account number from the set of account nodes; and a set of query edge data, each query edge in the set of query edge data linking a query node to the account node having the account number corresponding to the account number in the linked query node.

11 . A non-transitory machine-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform steps comprising:
obtaining account data comprising an account number; determining a corresponding account node having an account number corresponding to the account number, the corresponding account node being stored in a fraud detection database comprising a set of account nodes, a set of attribute nodes, and a set of edge data, each edge in the set of edge data identifying an account node in the set of account nodes, an attribute node in the set of attribute nodes, and a label corresponding to the value in the attribute node; generating a revised account node comprising a unique identifier, the account number, a suspicious account identifier, and version data indicating that the revised account node is a later version of the corresponding account node; generating revised edge data based on the edges linking the revised account node to an attribute node in the set of attribute nodes; inserting the revised account node into the fraud detection database; inserting the revised edge data, wherein each edge in the revised edge data links the revised account node to each attribute node indicated in the revised edge data; calculating a fraud score for the revised account node, the fraud score being calculated based on the revised edge data and the each attribute node indicated in the revised edge data; and setting, based on the fraud score, a suspicious account indicator for the revised account node such that the revised account node is indicated as a suspicious account.

12 . The non-transitory machine-readable medium of claim 11 , wherein the instructions, when executed by one or more processors, further cause the one or more processors to perform steps comprising preprocessing an attribute node in the set of attribute nodes to format the value of the attribute node in a standardized format based on the label indicated in the edge linking the attribute node to an account node.

13 . The non-transitory machine-readable medium of claim 11 , wherein the instructions, when executed by one or more processors, further cause the one or more processors to perform steps comprising:
obtaining whitelist data comprising a set of whitelist values; and for each attribute node in the fraud detection database having a value corresponding to a whitelist value in the whitelist data, setting an edge weight of each edge linking the attribute node to an account node to zero.

Assignees

• Capital One Services Llc

Inventors

• Lee Jonathan Shek Wing
• Harihara Vidhyasagar Mahadevan
• Indyarta Michelle
• Zou Tian
• Frensch Steve

Classifications

• G06Q20/4016

  involving fraud or risk level assessment in transaction processing · CPC title

• G06Q20/3827

  Use of message hashing · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06F16/9024 Primary

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F16/245

  Query processing · CPC title