Reducing false positive in entity matching based on image link graph

Abstract

Methods and systems are presented for performing comprehensive and accurate matching of a user account to one or more known entities based on an image link graph. An image associated with each known entity is retrieved from one or more online sources. A face is extracted from the image. An image link graph is generated for the entity based on attributes of the face in the image. When a user account is determined to be a potential match of an entity based on text-based attributes, an image associated with the account may be obtained. If the image matches any face in the image link graph, an action is performed on the user account based on the location of the matched face in the image link graph.

Description

Technical Field

[0001] The present specification relates generally to identity matching, and more particularly to a framework for reducing false positives in matching user accounts to one or more entities when processing electronic transactions according to various embodiments of the present disclosure. Background Art

[0002] Identity matching and verification are critical to organizations. For example, when a user registers a new user account with an organization, the organization can verify the user's identity to determine whether the user is associated with a known adverse entity (e.g., a known attacker, a known malicious user, etc.), or whether the user is associated with a known favorable entity (e.g., an entity associated with a large number of accounts, an important customer of the organization, etc.). Based on the verified identity of the user, the organization can apply different settings to the user account. For example, if the organization determines that the user is associated with a known adverse entity, the organization can apply additional restrictions to the user account (e.g., data access restrictions, feature access restrictions, etc.). On the other hand, if it is determined that the user is associated with a favorable entity of the organization, the organization can apply or provide additional features and / or functionality to the corresponding account.

[0003] Traditionally, the identity matching process is performed using text-based attributes (e.g., name, nationality, etc.) associated with known entities. There are many disadvantages to using this text-based approach to match users to entities. For example, since the values ​​corresponding to many text-based attributes (e.g., name, location, etc.) are not unique to each user, many users who are not associated with a known entity but have attribute values ​​similar to those of a known entity (e.g., similar names, etc.) may match the known entity, resulting in a high false positive rate. In addition, since malicious users typically operate in groups, different users associated with a known entity within a group may not be detected using this text-based approach. Faulty or incorrect detection may lead to many problems, including fraudulent transactions, data leaks, and cyber attacks. Therefore, there is a need to perform comprehensive and accurate identity detection of users based on one or more known entities. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Figure 1 is a block diagram illustrating an electronic transaction system according to an embodiment of the present disclosure;

[0005] Figure 2 An example data flow for generating an image link graph for an entity according to an embodiment of the present disclosure is shown;

[0006] Figure 3 An example data flow for verifying a user's identity according to an embodiment of the present disclosure is shown;

[0007] Figure 4 is a flow chart illustrating a process of using an image link graph to verify a user identity associated with a user account according to an embodiment of the present disclosure; and

[0008] Figure 5 is a block diagram of a system for implementing a device according to an embodiment of the present disclosure.

[0009] By referring to the detailed description below, the embodiments of the present disclosure and its advantages will be best understood. It should be understood that the same reference numerals are used to identify the same elements shown in one or more of the accompanying drawings, wherein what is shown herein is for the purpose of illustrating the embodiments of the present disclosure, not for the purpose of limiting it. DETAILED DESCRIPTION

[0010] The present disclosure describes a method and system for performing comprehensive and accurate matching of a user to one or more known entities based on an image link graph. As discussed herein, matching a user to one or more entities using text-based attributes may result in a high false positive rate. That is, many users may incorrectly match entities based on text-based attributes, which may result in many undesirable results. For example, an organization may have a list of known entities (e.g., known favorable entities, known unfavorable entities, etc.). The organization may access certain text-based attributes associated with known entities, such as name, nationality, age, etc. Each entity in the list of known entities may represent an individual or an organization.

[0011] In some embodiments, an organization's identity matching system may determine, based on text-based attributes, whether any user account for the organization is associated with any known entity. For example, the identity matching system may retrieve information associated with a user account (e.g., a user profile of the user account). The identity matching system may also identify user information within the user profile that corresponds to the text-based attributes, such as the user's name, the user's location, and the like. Based on the user information retrieved from the user profile and the information associated with a list of known entities, the identity matching system may determine whether the user account is associated with an entity in the list. For example, if the user profile indicates a name and location that corresponds to information of an entity in the list, the identity matching system may determine that the corresponding user account matches the entity (e.g., is associated with the entity).

[0012] However, because many people or organizations share the same text-based attributes as an entity (e.g., "John Smith," "Mary Lee," etc.), the identity matching system may identify a large number (e.g., above a threshold) of users who share the same text-based attributes as the entity, many of whom may not be associated with the entity. Therefore, if the organization applies account configurations (e.g., additional restrictions, features, and / or functions) to all matching user accounts, the user experience of users who are not associated with the entity but are matched with the entity may be affected.

[0013] In this regard, according to various embodiments of the present disclosure, after matching a user account with an entity using a text-based method, an identity matching system may verify that the user account is associated with the entity based on an image link graph. In some embodiments, the identity matching system may retrieve an image corresponding to the entity for each entity in a list of known entities. For example, the identity matching system may include a web crawler that searches the Internet for photos related to the entity. The content may include: news articles related to the entity posted on the Internet (e.g., news articles including the name of the entity), social media posts associated with the entity, or images tagged with the entity, etc. The identity matching system may retrieve the photos and store them in a data store.

[0014] In some embodiments, the identity matching system may use one or more facial recognition algorithms (e.g., neural networks based on the Visual Geometry Group (VGG), lightweight face (DeepFace) recognition, support vector machines, principal component analysis, linear discriminant analysis, kernel methods, trace transforms, etc.) to extract facial features of people appearing in the photo. The extracted facial features may include a plurality of parameters corresponding to different feature attributes. For example, the feature attributes may include the length and width of the face, the length of the nose, the ratio between the length of the face and the length of the nose, the width of the nose, the width of the lips, the size of the eyes, the size of the eyebrows, etc. In some embodiments, the parameters may include one or more vectors in a multidimensional space representing different facial features.

[0015] The identity matching system may also compare facial features between people appearing in different photos (e.g., different images) associated with the entity, so that the identity matching system can determine whether the photos include the same person or different people. In some embodiments, the identity matching system may use a deep learning convolutional neural network (CNN) to perform a comparison of facial features between people appearing in the photos. The deep learning CNN may indicate whether two faces appearing in the photos correspond to the same person. Using the output from the deep learning CNN, the identity matching system is able to identify people who appear repeatedly in different photos. For example, the identity matching system may assign an identifier to each person appearing in one or more photos associated with the entity. The identity matching system may then use the identifier to mark the (one or more) person in the photo. Since at least some of the photos may include multiple people, the identity matching system may identify which person appears in each photo and mark those people in the photo using the identifier. The identity matching system may also associate facial features extracted from the photos with corresponding identifiers, so that facial features of the same person extracted from different photos are associated with the same identifier. In some embodiments, the identity matching system may merge facial features extracted from different photos of the same person. For example, the identity matching system may calculate an average value of parameters corresponding to each feature attribute extracted from different images and store the average value as a profile of the corresponding identifier.

[0016] In some embodiments, the identity matching system can generate a graph (e.g., an image link graph) for an entity based on faces that appear in photos related to the entity. For example, the identity matching system can identify a specific person (also referred to as a "leader") that appears most frequently in photos related to the entity, and mark the corresponding identifier as most relevant to the entity. It is assumed that the person that appears most frequently in photos related to the entity is the integrator of the entity (e.g., when the entity is a person, the person is the entity, when the entity is a group / organization, the person is the leader of the entity, etc.). The identity matching system can place the identifier corresponding to the leader of the entity in the first layer of the graph.

[0017] The identity matching system can then identify other people who appear in the same photo(s) as the leader. Since these other people appear in the same photo(s) as the leader that is most associated with the entity, the identity matching system can determine that these other people may also be closely associated with the entity (e.g., friends / family of the entity, other employees of the entity, etc.). Instead of ignoring these other people, the identity matching system can place the identifiers of those people who appear in the same photo(s) as the leader in the second layer of the graph and link them to the identifier of the leader in the graph. The links between people in the graph represent the relationships between linked people in real life.

[0018] In some embodiments, the identity matching system can also assign a relevance score to each link in the graph to represent the level of relationship between the linked people in real life. For example, the identity matching system can determine the relevance score of the link between two people in the graph based on the frequency with which the two people appear together in the same photo, so that the more photos that include the two people together, the higher the relevance score. In some embodiments, the identity matching system can use the same technology to generate links between identifiers in the second layer. Using the methods disclosed herein to generate an image link graph, the identity matching system can access a more comprehensive view of entities for matching user accounts.

[0019] In some embodiments, the identity matching system can continue to build the image link graph using additional layers. For example, for each person in the second layer of the image link graph, the identity matching system can search for photos that include this person (e.g., photos related to the entity but not including the leader, images retrieved using reverse image search, etc.). The identity matching system can then identify other people who appear in the same photos as this person, and can link those other people in the image link graph to this person in the third layer of the image link graph. In some embodiments, the identity matching system can continue to add additional layers to the image link graph using the same techniques disclosed herein until a predetermined threshold (e.g., 5 layers, 10 layers, etc.) is reached.

[0020] After generating the image link graph for each entity in the list, the identity matching system can begin matching user accounts to the entities. For example, the identity matching system can first use text-based attributes to find potential matching user accounts for each entity. As discussed herein, matching user accounts to entities using a text-based approach can result in a high false positive rate (a false positive rate above a threshold). Therefore, if the number of user accounts that match an entity is determined to be above a threshold (the threshold can be dynamic, such as based on the type of user account, the type of entity associated with the account, the number of accounts, etc.) using a text-based approach, the identity matching system can use the image link graph to further analyze each potential match to verify whether each matching user account is indeed associated with the entity.

[0021] Additionally, image link graphs can be used to reduce false positives periodically (e.g., daily) after a scan run, rather than manually investigating all alerts. For example, facial features can be used to match an image of the person generating an alert to a link graph of the corresponding entity, and if the match is below a threshold level or there is no match at all, the alert can be automatically rejected.

[0022] In some embodiments, the identity matching system can access user profiles of matching user accounts that have been determined as potential matches for entities using text-based attributes. The identity matching system can retrieve a photo from the user profile. For example, when a user registers a user account with an organization, the organization can require the user to submit a copy (e.g., image) of an identification document (e.g., driver's license, passport, etc.). The identity matching system can extract a photo of the user from the file and store the photo in the user profile (e.g., using a deep learning CNN, etc.).

[0023] The identity matching system may compare the photo in the user profile to each person in the image link graph of the entity (e.g., using a deep learning CNN, etc.). For example, the identity matching system may also extract the user's facial features from the photo using one or more facial recognition algorithms, and may compare the user's facial features to the facial features associated with each person (e.g., each identifier) ​​in the image link graph. Based on the comparison between the facial features, the identity matching system may determine the probability that the user corresponds to each person associated with the entity (e.g., each person in the image link graph). In some embodiments, when the probability that the user corresponds to any person associated with the entity is above a threshold, the identity matching system may determine that the user matches the entity.

[0024] Based on determining that the user matches the entity, the identity matching system can apply additional configurations to the user account. For example, if the entity is a known adverse entity (e.g., an entity in a blacklist), the identity matching system can apply additional restrictions to the user account (e.g., data access restrictions, functional restrictions, etc.), or can even suspend or lock the user account. If the entity is a known favorable entity, the identity matching system can apply or provide additional features or functions to the user account (e.g., ensuring faster processing time, additional functions not provided to other user accounts, etc.). In some embodiments, the identity matching system can dynamically apply different configurations to the user account based on which person (e.g., a matched person) in the image link graph matches the user. For example, when the user of the user account corresponds to a person in the first layer of the image link graph (indicating that the user is an entity or a leader of the entity), the identity matching system can apply or provide a whole set of additional configurations to the user account. However, when the user of the user account corresponds to a person in the second layer of the image link graph (indicating that the user is not an entity or a leader of the entity, but someone closely associated with the entity), the identity matching system may apply or provide only part of the additional configuration (e.g., a subset of the additional configuration) to the user account (e.g., only some of the restrictions but not all, etc.). In some embodiments, the part of the additional configuration applied or provided to the user account may depend on which layer the matched person is located in the image link graph. In some embodiments, the higher the layer the matched person is located, the smaller the part of the additional configuration will be applied or provided to the user account.

[0025] In some embodiments, part of the additional configuration applied or provided to the user account may also depend on the relevance score(s) linking the matched person to the person in the first layer of the image link graph. That is, the more closely the matched person is related to the person in the first layer (i.e., the person most related to the entity), the larger portion of the additional configuration will be applied or provided to the user account. In some embodiments, when the matched person is located in the third (or higher) layer (i.e., the matched person is separated from the person in the first layer by two or more degrees), the identity matching system may assign different weights to different relevance scores based on the layers connected by the links associated with the relevance scores, and may calculate a merged score based on the weighted relevance scores. The identity matching system may then apply or provide configurations to the user account based on the merged score.

[0026] In some embodiments, the identity matching system can use the image link graph to analyze newly registered user accounts even without first matching the user account with any entity using a text-based method. It is known that malicious users (e.g., using a robot program (bot) or the like) have created multiple user accounts and may use virtual information to register user accounts. When asked to provide the user's identity document or image, the robot program may retrieve an image of a person (e.g., an image of a random person) from the Internet and may use the image to register the user account. In these scenarios, since the information provided by the malicious user to create an account is not information associated with the actual person associated with the account (e.g., a malicious user), the identity matching system cannot use text-based attributes to match the user account with any known entity. In some embodiments, the identity matching system can determine whether the photo used by the new user account matches any existing user account. When the identity matching system determines that the photo of the new user account matches the existing user account, the identity matching system can monitor the user data and activities associated with the new user account and the matching account. If any inconsistencies are detected between the two accounts (e.g., different names, different ages, transactions conducted through the two accounts are inconsistent with each other, etc.), the identity matching system can determine that the new user account may have been registered using fraudulent information and can perform one or more actions on the new user account (e.g., suspension, locking, etc.).

[0027] In some embodiments, the identity matching system may use an image link graph to detect whether a malicious operation is performed with an organization through a series of transactions using a user account. For the purpose of circumventing detection, a series of transactions may be performed as part of an overall malicious operation (e.g., a money laundering operation). Therefore, these malicious operations are generally difficult to detect. In one scenario, a malicious entity may use multiple user accounts to transfer funds with an organization through a series of transactions as part of an overall money laundering operation. For example, before withdrawing the funds, the funds may be transferred from a first account to a second account, then from the second account to a third account, and then from the third account to a fourth account. If the entire series of transactions is performed through the organization (e.g., transactions are performed with the organization through a user account), the organization detects malicious behavior by tracking transactions of different user accounts involved in the series of transactions. However, a malicious entity may attempt to circumvent detection by performing at least one transaction in a series of transactions outside an environment controlled by the organization (e.g., using accounts with different organizations, using cash transfers, etc.). For example, in a series of transactions, after transferring funds from a first account to a second account, the funds may be transferred to an external account (e.g., outside the organization) before transferring the funds back to a third account.

[0028] In some embodiments, when it is determined that a known malicious entity has conducted transactions (e.g., seed transactions) through a user account (e.g., the identity matching system can use the techniques disclosed herein to match the user account with the known malicious entity, etc.), the identity matching system can track downstream (and / or upstream) transactions from the user account of the known malicious entity. In some embodiments, the identity matching system can use an image link graph to identify other user accounts that are closely associated with the known malicious entity (e.g., user accounts of people determined to be closely associated with the entity, such as those in the image link graph associated with the entity), and can monitor transactions conducted through the identified user accounts. The identity matching system can monitor transactions conducted through the user account of the known malicious entity and the identified user accounts that are determined to be closely associated with the known malicious entity over a period of time (e.g., within an hour, within a day, etc.) through seed transactions, and can determine whether the transactions conducted by these accounts as a whole correspond to a pattern associated with malicious behavior (e.g., money laundering operations). If the transactions correspond to the pattern, the identity matching system can perform one or more actions (e.g., suspend, lock, etc.) on the user account.

[0029] In some embodiments, in addition to matching user accounts with different entities (e.g., favorable entities, unfavorable entities, etc.), the identity matching technology disclosed herein can also be used in other applications, such as authenticating users when accessing user accounts, linking user accounts between different virtual reality environments, etc. For example, someone other than the person who registered the user account may access the user account for different reasons (e.g., a child uses a parent's account to make a purchase, an employee uses an employer's account to make a purchase, etc.). Without sharing or creating new account credentials (e.g., sharing passwords, etc.), the identity matching system can use facial recognition technology to determine whether to grant or deny access to the account based on the captured photo of the requester. In one example, when a requester sends a request to access a user account (e.g., a request to make a payment through a user account, etc.), the identity matching system can prompt the requester for a photo of the requester for authentication purposes. The identity matching system can access an image link graph associated with the user account and attempt to match the requester's photo with a person in the graph. In some embodiments, when the requester cannot match the leader of the user account (e.g., a person in the first layer of the graph), the identity matching system can match the requester to another person in the graph. The identity matching system can then grant the requestor limited access to the user account based on the match with the person in the graph. In some embodiments, the amount of access to the user account can depend on the position of the matched person in the graph. For example, the closer the matched person is to the leader in the graph, the requestor can be provided with access to a greater portion of the user account (e.g., a greater payment limit, a greater portion of the functionality associated with the account, etc.).

[0030] In some embodiments, using identity matching techniques, the identity matching system can link different accounts across different platforms (e.g., different service providers, different virtual reality environments, etc.). For example, different accounts of a user can be linked together based on their relationships within an image link graph. Linking different user accounts across different platforms can enable resource sharing between different users (e.g., sharing virtual resources between different user accounts within one or more virtual reality environments, transferring virtual assets from one virtual environment to another virtual environment based on linking two accounts with two virtual environments, etc.).

[0031] Figure 1An electronic transaction system 100 that can implement an identity matching system according to one embodiment of the present disclosure is shown. The electronic transaction system 100 includes a service provider server 130, a user device 110, and servers 180 and 190 that can be communicatively coupled to each other via a network 160. In one embodiment, the network 160 can be implemented as a single network or a combination of multiple networks. For example, in various embodiments, the network 160 can include the Internet and / or one or more intranets, landline networks, wireless networks, and / or other appropriate types of communication networks. In another example, the network 160 can include a wireless telecommunications network (e.g., a cellular telephone network) suitable for communicating with other communication networks (e.g., the Internet, etc.).

[0032] In one embodiment, user device 110 may be used by user 140 to interact with service provider server 130 via network 160. For example, user 140 may log into a user account to access account services or conduct electronic transactions (e.g., fund transfer transactions, payment transactions, data access transactions, etc.) with service provider server 130. In various embodiments, user device 110 may be implemented using any suitable combination of hardware and / or software configured for wired and / or wireless communications via network 160. In various implementations, user device 110 may include at least one of a wireless cellular phone, a wearable computing device, a PC, a laptop computer, etc.

[0033] In one embodiment, the user device 110 includes a user interface (UI) application 112 (e.g., a web browser, a mobile payment application, etc.) that can be used by the user 140 to interact with the service provider server 130 via the network 160. In one implementation, the user interface application 112 includes a software program (e.g., a mobile application) that provides a graphical user interface (GUI) for the user 140 to interface and communicate with the service provider server 130 via the network 160. In another implementation, the user interface application 112 includes a browser module that provides a network interface for browsing information available on the network 160. For example, the user interface application 112 can be partially implemented as a web browser to view information available on the network 160. Thus, the user 140 can use the user interface application 112 to initiate an electronic transaction with the service provider server 130.

[0034] In various embodiments, the user device 110 may include other applications 116 that may be desirable in one or more embodiments of the present disclosure to provide additional features available to the user 140. In one example, such other applications 116 may include: a security application for implementing client security features, a programming client application for interfacing with an appropriate application programming interface (API) over the network 160, and / or various other types of well-known programs and / or software applications. In other examples, the other applications 116 may interface with the user interface application 112 to improve efficiency and convenience.

[0035] In one embodiment, the user device 110 may include at least one identifier 114, which may be implemented, for example, as an operating system registry entry, a cookie associated with the user interface application 112, an identifier associated with the hardware of the user device 110 (e.g., a media control access (MAC) address), or various other suitable identifiers. In various implementations, the identifier 114 may be communicated to the service provider server 130 via the network 160 along with the user login request, and the identifier 114 may be used by the service provider server 130 to associate the user with a particular user account (e.g., a particular profile).

[0036] In various implementations, user 140 may be able to input data and information into an input component (e.g., a keyboard) of user device 110. For example, user 140 may use the input component to interact with UI application 112 (e.g., add a new funding account, perform an electronic purchase with a merchant, provide information associated with a new funding account, initiate an electronic payment transaction with service provider server 130, apply for a financial product through service provider server 130, access data associated with service provider server 130, etc.).

[0037] Although Figure 1 Only one user device 110 is shown, but it is contemplated that multiple user devices associated with different users may each be connected to the service provider server 130 via the network 160 .

[0038] In various embodiments, each of servers 180 and 190 may be configured to host a website that provides content to devices (e.g., user device 110 and service provider server 130, etc.). In some embodiments, the content may be generated by an entity associated with the respective servers 180 and 190 (e.g., a news media organization that generates and publishes news articles, etc.). In some embodiments, the content may be generated and uploaded by different users. For example, the website may be a social media website that enables users to upload user-generated content (e.g., photos, articles, etc.) that can then be shared with other users.

[0039] Although Figure 1 Only two servers 180 and 190 are shown, but it is contemplated that multiple servers associated with different content hosting entities may each be connected to the user device 110 and the service provider server 130 via the network 160 .

[0040] In one embodiment, the service provider server 130 may be maintained by a transaction processing entity or online service provider that may provide processing for electronic transactions between a user 140 of the user device 110 and other users or merchants. As such, the service provider server 130 may include a service application 138 that may be adapted to interact with the user device 110 and / or servers 180 and 190 via the network 160 to facilitate electronic transactions (e.g., electronic payment transactions, data access transactions, etc.) between users and merchants provided by the service provider server 130. In one example, the service provider server 130 may be provided by a provider of a service provider in San Jose, California, USA. The company and / or one or more service entities or corresponding intermediaries may provide a plurality of point-of-sale devices at various locations to facilitate the transaction path between merchants and, for example, the service entity.

[0041] In some embodiments, the service applications 138 may include a payment processing application (not shown) for processing purchases and / or payments for electronic transactions between users and merchants or between any two entities. In one implementation, the payment processing application helps resolve electronic transactions through verification, delivery, and settlement. In this way, the payment processing application settles debts between users and merchants, wherein accounts can be directly and / or automatically debited and / or credited with monetary funds in a manner accepted by the banking industry.

[0042] The service provider server 130 may also include an interface server 134, which is configured to provide content (e.g., web content) to the user and interact with the user. For example, the interface server 134 may include a web server configured to provide web content in response to an HTTP request. In another example, the interface server 134 may include an application server configured to interact with a corresponding application (e.g., a service provider mobile application) installed on the user device 110 via one or more protocols (e.g., REST API, SOAP, etc.). In this way, the interface server 134 may include pre-generated electronic content prepared to be provided to the user. For example, the interface server 134 may store a login page and be configured to provide the login page to the user for logging into the user's user account to access various services provided by the service provider server 130. The interface server 134 may also include other electronic pages associated with different services (e.g., electronic transaction services, etc.) provided by the service provider server 130. Therefore, a user (e.g., user 140, etc.) may access a user account associated with the user and access various services provided by the service provider server 130 by generating an HTTP request directed to the service provider server 130.

[0043] In one embodiment, the service provider server 130 may be configured to maintain one or more user accounts and merchant accounts in an account database 136, each of which may be associated with a profile and may include account information associated with one or more individual users (e.g., user 140 associated with user device 110) and merchants. For example, the account information may include a photo associated with the user, a copy of an identification document, specific financial information of the user and merchant (e.g., one or more account numbers, passwords, credit card information, bank information, digital wallets used, or other types of financial information), transaction history, Internet Protocol (IP) addresses, and device information associated with the user account.

[0044] In one implementation, the user may have identity attributes stored for the service provider server 130, and the user may have a certificate for authenticating or verifying the identity to the service provider server 130. The user attributes may include personal information, bank information, and / or a source of funds. In various aspects, the user attributes may be passed to the service provider server 130 as part of a login, search, selection, purchase, and / or payment request, and the service provider server 130 may utilize the user attributes to associate the user with one or more specific user accounts maintained by the service provider server 130, and use the user attributes to determine the authenticity of the request from the user device.

[0045] In various embodiments, the service provider server 130 also includes an identity matching module 132 that implements the identity matching system as discussed herein. The identity matching module 132 can be configured to match the user account with one or more known entities known to the service provider server 130. For example, the identity matching module 132 can have information of a list of adverse entities that are known to be malicious to the service provider server 130 (e.g., people or organizations that have shown malicious behavior to the service provider server 130 in the past through various user accounts, etc.). The identity matching module 132 can also have information of a list of favorable entities that are favorable to the service provider server 130 (e.g., important personnel, celebrities, etc. of the organization associated with the service provider server 130). The information of each entity can include text-based attributes, such as the name of the entity, the nationality of the entity, and / or other information.

[0046] In some embodiments, identity matching module 132 may first use a text-based approach to match user accounts to known entities. For example, identity matching module 132 may retrieve information associated with each user account from account database 136. The information retrieved from account database 136 may include a user profile associated with each user account (e.g., Figure 2 ). Each user profile may include text-based data, such as name, nationality, age, and other information associated with the user who registered the user account. Identity matching module 132 may determine one or more potential matches between the user account and each known entity under the text-based approach. For example, when information associated with the user account corresponds to information associated with the entity, identity matching module 132 may determine that the user account is a potential match with the entity (e.g., the name associated with the user account is a match with the name of the entity, etc.). However, because some text-based attributes may be very common (e.g., common names, etc.), the text-based approach may produce user accounts that are potential matches with the entity but are not actually associated with the entity (e.g., a user with a name that is the same as the name of the entity).

[0047] Thus, in some embodiments, after determining potential matches for each entity, identity matching module 132 may use the image link graph to verify whether each matching user account is associated with the corresponding entity. Figure 2An example data flow for verifying an identity associated with a user account based on an image link graph according to various embodiments of the present disclosure is shown. In some embodiments, the identity matching module 132 can retrieve images (e.g., photos) related to each entity known to the service provider server 130 and store the images in a data storage (e.g., data storage 260). The service provider server 130 may know the entity based on malicious behavior that the service provider server 130 has performed in the past. The service provider server 130 may also know the entity based on the entity's transaction history (e.g., high transaction volume, etc.).

[0048] The identity matching module 132 may query different servers (e.g., servers 180 and 190) corresponding to different websites (e.g., news websites, social media platforms, etc.) for content related to each entity based on text-based attributes (e.g., the name of the entity). The identity matching module 132 may obtain content related to the entity (e.g., content 202 and 204), such as news articles, blogs, tweets, posts, etc., from the servers 180 and 190 based on the query. For example, a news article may mention the name of the entity, a blog / tweet / post may be published by the entity or include the name of the entity, etc. The identity matching module 132 may extract images including one or more persons from the content and store the images in the data storage 260.

[0049] In some embodiments, the identity matching module 132 may use one or more facial recognition algorithms (e.g., neural networks based on the visual geometry group (VGG), lightweight face recognition, support vector machines, principal component analysis, linear discriminant analysis, kernel methods, trace transformation, etc.) to extract facial features of people appearing in the photo. The extracted facial features may include a plurality of parameters corresponding to different feature attributes. For example, the feature attributes may include the length and width of the face, the length of the nose, the ratio between the length of the face and the length of the nose, the width of the nose, the width of the lips, the size of the eyes, the size of the eyebrows, etc. In some embodiments, the parameters may include one or more vectors representing different facial features (or facial attributes) in a multidimensional space.

[0050] The identity matching module 132 may also compare facial features between people appearing in different photos associated with the entity (e.g., using a deep learning CNN) so that the identity matching system can determine whether the photos include the same person or different people. The identity matching module 132 may assign an identifier to each person appearing in one or more photos associated with the entity. The identity matching module 132 may then mark the person(s) in the photo using the identifier. Since at least some of the photos may include multiple people, the identity matching module 132 may identify which person appears in each photo and mark those people in the photo using the identifier. The identity matching module 132 may also associate facial features extracted from the photo with corresponding identifiers, so that facial features of the same person extracted from different photos are associated with the same identifier. In some embodiments, the identity matching module 132 may merge facial features extracted from different images of the same person. For example, the identity matching module 132 may calculate an average value of parameters corresponding to each feature attribute extracted from different images, and store the average value as a profile of the corresponding identifier.

[0051] In this example, identity matching module 132 may identify seven different persons 212, 214, 216, 218, 220, 222, and 224 that appear in photos associated with the entity. Based on facial features extracted from the photos, identity matching module 132 may build a facial profile for each of person 212, person 214, person 216, person 218, person 220, person 222, and person 224. In some embodiments, identity matching module 132 may generate a graph 240 (e.g., an image link graph) for an entity based on persons that appear in photos associated with the entity. For example, identity matching module 132 may identify a particular person (referred to as a "leader") that appears most frequently in photos associated with the entity, and mark the corresponding identifier as being most relevant to the entity. It is assumed that the person that appears most frequently in photos associated with the entity is the entity's integration person (e.g., when the entity is a person, the person is the entity, when the entity is a group / organization, the person is the entity's leader, etc.). In this example, identity matching module 132 may determine that person 212 appears most frequently in photos associated with the entity and may infer that person 212 is the entity or a leader of the entity. Identity matching module 132 may place an identifier corresponding to person 212 in a first layer of the graph.

[0052] As shown, the identity matching module 132 may place the person 212 in the first layer of the graph or tree diagram 240. The identity matching module 132 may then identify other people who appear in the same (one or more) photos as the person 212. Since these other people appear in the same (one or more) photos as the leader, the identity matching module 132 may determine that these other people may also be closely associated with the entity (e.g., friends / family of the entity, other employees of the entity, etc.). In this example, the identity matching module 132 may determine that the people 214, 216, and 218 have appeared in the same photos as the person 212. The identity matching module 132 may then place the people 214, 216, and 218 in the second layer (layer 2) of the graph 240, and link each of them to the person 212 because the people 214, 216, and 218 appear in the same (one or more) photos. In some embodiments, the identity matching module 132 may also generate links between people in the second layer if the two people also appear in the same (one or more) photos.

[0053] In some embodiments, identity matching module 132 may also assign a relevance score to each link in the graph to represent the level of relationship between the linked persons in real life. For example, identity matching module 132 may determine the relevance score of a link between two persons in the graph based on how often the two persons appear together in the same photos, such that the greater the number of photos that include the two persons together, the higher the relevance score. For example, if the number of photos that include persons 212 and 214 is greater than the number of photos that include persons 212 and 216, identity matching module 132 may assign a higher relevance score to the link between persons 212 and 214 than to the link between persons 212 and 216.

[0054] In some embodiments, graph 240 may also be used by identity matching module 132 to determine offers (e.g., incentives such as discounts, rewards, etc.) to be provided to different users (via different user accounts). For example, if identity matching module 132 determines that a user account qualifies for certain incentives, identity matching module 132 may provide the incentives not only to the user account associated with the leader, but also to other user accounts associated with the person linked to the leader in graph 240 (or a portion of the incentive).

[0055] In some embodiments, identity matching module 132 may continue to build graph 240 using additional layers. To continue to build graph 240, for each of person 214, person 216, and person 218 in the second layer (layer 2) of graph 240, identity matching module 132 may search for photos that include the person and at least one other person. For example, identity matching module 132 may analyze the photos retrieved from servers 180 and 190 to determine photos that include the person from layer 2 in graph 240 and another person that is not yet in graph 240. In some embodiments, identity matching module 132 may perform a reverse image search to retrieve additional photos that include the person in layer 2 of graph 240. The identity matching system may then identify other people who appear in the same photos as the person in layer 2 of graph 240, and may link those other people in graph 240 to the person in a third layer (e.g., layer 3) of graph 240. For example, identity matching module 132 may determine that one or more photos include person 220 and person 214. Therefore, identity matching module 132 may place person 220 in layer 3 of graph 240, and may link person 220 to person 214 in the graph. Additionally, identity matching module 132 may determine that one or more photos include person 218 and person 222, and one or more photos include person 218 and person 224. Therefore, identity matching module 132 may place persons 222 and 224 in layer 3 of graph 240, and may link persons 222 and 224 to person 218 in the graph. In some embodiments, identity matching system may continue to add additional layers in graph 240 using the same techniques disclosed herein until a predetermined threshold (e.g., 5 layers, 10 layers, etc.) is reached.

[0056] After generating an image link graph (eg, graph 240 ) for each entity in the list, the identity matching module 132 may begin verifying whether a matching user account (matched using a text-based approach) is associated with the entity. Figure 3 An example data flow for verifying a matched user account according to various embodiments of the present disclosure is shown. To verify a matched user account, the identity matching module may access a user profile of the matched user account from the account database 136. The identity matching module 132 may retrieve a photo 272 from the user profile. For example, when a user registers a user account with a service provider server 130, the service provider server 130 may require the user to submit a copy (e.g., image) of an identification document (e.g., a driver's license, a passport, etc.). The identity matching module 132 may extract a photo 272 of the user from the file (e.g., using a deep learning CNN, etc.) and store the photo 272 in the user profile.

[0057] The identity matching module 132 can compare the photo 272 in the user profile with each person in the image link graph (e.g., figure 240) of the entity. In some embodiments, the identity matching module 132 can generate and train a deep learning CNN to determine whether the facial features extracted from two faces appearing in one or more photos are the same person or different people. In some embodiments, the deep learning CNN can be configured to generate a similarity score (e.g., a higher similarity score indicates that the two people in the photo are more similar). When the similarity score is above a threshold, the identity matching module 132 can determine that the two faces appearing in the photo are the same person. For example, the identity matching module 132 can also use one or more facial recognition algorithms to extract the user's facial features from the photo 272, and can compare the user's facial features with the facial features of each of the people 212, 214, 216, 218, 220, 222, and 224 associated with the image link graph. Based on the comparison between the facial features, the identity matching module 132 can determine the probability that the user corresponds to each person associated with the entity (e.g., each person in figure 240). In some embodiments, identity matching module 132 may determine that a user is associated with an entity when the probability that the user corresponds to any person in graph 240 is above a threshold. This threshold may also be dynamic and based on factors such as account type, organization type, etc. For example, a higher risk account or entity may require a higher threshold.

[0058] Based on determining that the user is associated with an entity, the identity matching system may apply additional configurations to the user account. For example, if the entity is a known adverse entity, the identity matching module 132 may apply additional restrictions to the user account (e.g., data access restrictions, functional restrictions, etc.), or may even suspend or lock the user account. If the entity is a known beneficial entity, the identity matching module 132 may apply or provide additional features or functionality to the user account (e.g., ensuring faster processing times, additional functionality not provided to other user accounts, etc.).

[0059] In some embodiments, the identity matching module 132 may dynamically apply different configurations to the user account based on which person (e.g., a matched person) in the graph 240 corresponds to the user of the user account. For example, when the user of the user account corresponds to the person 212 (leader) in the first layer of the graph 240 (indicating that the user is an entity or a leader of an entity), the identity matching module 132 may apply or provide a whole set of additional configurations to the user account. However, when the user of the user account corresponds to a person in the second layer of the graph 240 (indicating that the user is not an entity or a leader of an entity, but someone closely associated with the entity), the identity matching module 132 may apply or provide only a portion of the additional configurations (e.g., a subset of the additional configurations) to the user account (e.g., only some of the restrictions but not all, etc.). In some embodiments, the portion of the additional configurations applied or provided to the user account may depend on which layer in the graph 240 the person corresponding to the user of the user account is located. In some embodiments, the higher the layer in which the matched person is located, the smaller portion of the additional configurations will be applied or provided to the user account. For example, if it is determined that the user corresponds to person 214 located in layer 2 of diagram 240, a larger portion of additional configuration will be applied or provided to the user account, while if it is determined that the user corresponds to person 220 located in layer 3 of diagram 240, a smaller portion of additional configuration will be applied or provided to the user account.

[0060] In some embodiments, part of the additional configuration applied or provided to the user may also depend on the relevance score(s) linking the matched person (corresponding to the user's person) to the person 212 in the graph 240. That is, the more closely the matched person from the graph 240 is related to the person 212 (i.e., the person most related to the entity), the larger part of the additional configuration will be applied or provided to the user account. In some embodiments, when the matched person is located in the 3rd (or higher) layer (i.e., the matched person is separated from the person 212 by two or more degrees), the identity matching module 132 may assign different weights to different relevance scores based on the layers to which the links associated with the relevance scores are connected, and the merged score may be calculated based on the weighted relevance scores. For example, the identity matching module 132 may assign a first weight to a link connecting a person in the 2nd layer to a person 212 in the 1st layer. The identity matching module 132 may also assign a second weight to a link connecting a person in the 3rd layer to a person in the 2nd layer. In some embodiments, the second weight may be less than the first weight because the link connecting the person in layer 3 and the person in layer 2 is farther away from person 212 than the link connecting the person in layer 2 and person 212. After calculating the combined score, identity matching module 132 may determine a portion of the additional configuration to be applied to the user account, and then apply or provide the determined portion of the additional configuration to the user account.

[0061] In some embodiments, the identity matching module 132 can use the technology disclosed herein to analyze newly registered user accounts using image link graphs even without first matching the user account with any entity based on text-based attributes. Malicious users may sometimes use a robot program (e.g., an automatic computer program, etc.) to create multiple user accounts, and may register the user account with the service provider server 130 using virtual information. When asked to provide the user's identification document or image, the robot program may retrieve an image of a person (e.g., an image of a random person) from the Internet, and may use the image to register the user account. In these scenarios, because the information provided by the malicious user to create the account is not information associated with an actual person (e.g., the name used to register the account is not the real name of the malicious user), the identity matching module 132 cannot use text-based attributes to match the user account with any known entity. Therefore, in order for the identity matching module 132 to determine whether the user account is associated with a malicious entity (i.e., for malicious purposes), the identity matching module 132 can determine whether the user account is created using virtual information. This determination can be based on the fact that the photo used by the new user account corresponds to a person associated with an existing user account. Thus, identity matching module 132 may use the techniques disclosed herein to determine whether the photo used by the new user account matches any other user account. For example, identity matching module 132 may extract facial features from the photo used by the new user account and may compare these facial features to facial features associated with other existing user accounts (e.g., facial features extracted from photos of user profiles associated with existing user accounts).

[0062] When the identity matching module 132 determines that the photo of the new user account matches the person associated with the existing user account, the identity matching system can monitor the user information and activities associated with the new user account and the matched existing account. If any inconsistency is detected between the two accounts, the identity matching module 132 can determine that the new user account may be registered using fraudulent information and created to conduct malicious activities, and can perform one or more actions (e.g., suspension, locking, etc.) on the new user account. For example, when the text-based attributes (e.g., name, age, nationality, etc.) associated with the two accounts are different (even if the photos of the two accounts indicate that the two accounts are associated with the same person), the identity matching module 132 can detect the inconsistency between the two accounts. When transactions conducted through the two accounts exhibit abnormal behavior (e.g., when a transaction through the new account and another transaction through the matched account are conducted within a period of time (e.g., one hour, one day, etc.) but in two different locations), the identity matching module 132 can also detect inconsistencies.

[0063] In some embodiments, the identity matching module 132 can use the image link graph to detect whether a malicious operation is performed with the service provider server 130 through a series of transactions using a user account. For the purpose of circumventing detection, a series of transactions can be performed as part of an overall malicious operation (e.g., a money laundering operation). Therefore, these malicious operations are generally difficult to detect. In one case, as part of a malicious operation (e.g., a money laundering operation), a malicious entity may transfer funds with the service provider server 130 through a series of transactions using multiple user accounts. For example, before withdrawing the funds, the funds may be transferred from a first account to a second account, then from the second account to a third account, and then from the third account to a fourth account. If the entire series of transactions are performed with the service provider server 130 through a user account, the service provider server 130 can detect malicious behavior by tracking the transactions of different user accounts involved in the series of transactions. However, the malicious entity may attempt to circumvent detection by performing at least one transaction in a series of transactions outside the environment controlled by the service provider server 130 (e.g., using accounts with different organizations, using cash transfers, etc.). Thus, in a series of transactions, after transferring funds from a first account to a second account, the funds may be transferred to an external account (eg, outside the organization) before transferring the funds back to a third account.

[0064] In some embodiments, when a known malicious entity conducts transactions (e.g., seed transactions) through a user account (e.g., an identity matching system may match the user account to a known malicious entity (e.g., an account associated with person 212, etc.) using the techniques disclosed herein), identity matching module 132 may track downstream (and / or upstream) transactions from the user account of the known malicious entity. In some embodiments, identity matching module 132 may use an image link graph (e.g., graph 240) to identify other user accounts that are closely associated with the known malicious entity. For example, after building graph 240 for known malicious entities, identity matching module 132 may scan user accounts to identify one or more user accounts associated with each person in graph 240 (e.g., a photo associated with a user account corresponds to that person in graph 240). For example, identity matching module 132 may identify a user account associated with person 212, another user account associated with person 214, another user account associated with person 216, another user account associated with person 218, another user account associated with person 220, another user account associated with person 222, and another user account associated with person 224.

[0065] Identity matching module 132 may monitor transactions conducted through identified user accounts (e.g., user accounts associated with person 214, person 216, person 218, person 220, person 222, and person 224). The identity matching system may monitor transactions conducted through user accounts of known malicious entities and identified user accounts determined to be closely associated with known malicious entities over a period of time (e.g., within an hour, within a day, etc.) through seed transactions, and may determine whether the transactions conducted by these accounts as a whole correspond to a pattern associated with malicious behavior (e.g., a series of fund transfer transactions through these user accounts corresponding to money laundering operations). If the transactions correspond to the pattern, the identity matching system may perform one or more actions (e.g., suspend, lock, etc.) on these user accounts.

[0066] In some embodiments, based on the relationship between the user accounts (from diagram 240) determined by identity matching module 132 and the series of transactions detected, identity matching module 132 may improve the efficiency of future transactions. For example, if the series of transactions is detected to occur on a regular (e.g., periodic) basis, identity matching module 132 may automate the series of transactions. In some embodiments, to improve efficiency, identity matching module 132 may directly transfer funds from a first account (e.g., an account associated with person 212) to a last account (e.g., an account associated with person 224) without going through intermediary accounts (e.g., accounts associated with person 214, person 216, person 218, person 220, and person 222).

[0067] Figure 4 A process 400 for verifying an identity associated with a user account using an image link graph according to various embodiments of the present disclosure is shown. In some embodiments, at least a portion of the process 400 may be performed by the identity matching module 132. The process 400 begins by retrieving one or more images related to an entity from one or more online sources for the entity (at step 405). For example, the identity matching module 132 may include a list of known entities (e.g., favorable entities, unfavorable entities, etc.). For each entity, the identity matching module 132 may query a server (e.g., servers 180 and 190) for content related to the entity. The identity matching module 132 may extract an image from the content.

[0068] Then, process 400 extracts faces from one or more images (at step 410), and generates a graph linking faces together based on the attributes of the faces in the one or more images (at step 415). For example, identity matching module 132 may extract facial features from people appearing in the photos using one or more facial recognition techniques. Based on the extracted facial features, identity matching module 132 may identify the people in the photos, i.e., determine whether two faces from the photos are associated with the same person or different people. Identity matching module 132 may generate an image linking graph (e.g., graph 240) based on the faces appearing on the photos. For example, identity matching module 132 may place the most frequently appearing faces (e.g., leaders) in the photos in layer 1 of graph 240. Identity matching module 132 may then identify faces that appear in the same photos as the leaders, and place these faces in layer 2 of graph 240. Identity matching module 132 may continue to construct graph 240 in the same manner using the techniques disclosed herein.

[0069] Then, process 400 obtains an image associated with the user account (at step 420), and determines a degree of association between the user account and the entity based on a match of the image with a particular face in the graph (at step 425). For example, identity matching module 132 may retrieve a user profile associated with the user account from account database 136. From the user profile, identity matching module 132 may obtain an image of the user associated with the user account (e.g., an image extracted from the user's identification document, etc.). Identity matching module 132 may use one or more facial recognition techniques to extract facial features of the user's face appearing in the image, and may compare the user's facial features to the facial features of each person in graph 240, for example, using a deep learning CNN.

[0070] Based on the comparison, identity matching module 132 can determine whether the user corresponds to any person in graph 240, and can determine the degree of association between the user account and the entity based on which person in graph 240 corresponds to the user. For example, if the user corresponds to person 212 (leader) in layer 1 of graph 240, identity matching module 132 can determine that the user account is highly associated with the entity (e.g., 100% associated). If the user corresponds to any other person in graph 240, identity matching module 132 can determine that the user is associated with the entity to some extent. In some embodiments, identity matching module 132 can determine the level of association between the user account and the entity based on the location of the matched person in graph 240. For example, in graph 240, the closer the matched person is to the leader of the entity (e.g., leader 212), the higher the level of association between the user account and the entity can be determined. In some embodiments, identity matching module 132 can also use the relevance score assigned to the link to determine the level of association between the user account and the entity.

[0071] Then, process 400 performs an action on the user account based on the degree of association (at step 430). For example, if the user account corresponds to an entity, identity matching module 132 may determine a set of configurations to be applied to the user account. In some embodiments, if it is determined that the user account is highly associated with the entity (e.g., 100% associated), identity matching module 132 may apply the set of configurations (e.g., a set of restrictions, a set of additional features, etc.) to the user account. In some embodiments, identity matching module 132 may determine a portion of the configurations (e.g., a subset of the configurations) to be applied to the user account based on the level of association between the user account and the entity, such that if the user account has a higher degree of association with the entity, a larger portion of the configurations is applied or provided to the user account, while if the user account has a lower degree of association with the entity, a smaller portion of the configurations is applied to the user account.

[0072] Figure 5 1 is a block diagram of a computer system 500 suitable for implementing one or more embodiments of the present disclosure including a service provider server 130, a user device 110, and servers 180 and 190. In various implementations, the user device 110 may include a mobile cellular phone suitable for wireless communication, a personal computer (PC), a laptop computer, a wearable computing device, etc., and the service provider server 130 and each of the servers 180 and 190 may include a network computing device such as a server. Therefore, it should be understood that the devices 110, 130, 180, and 190 may be implemented as the computer system 500 in the following manner.

[0073] The computer system 500 includes a bus 512 or other communication mechanism for transmitting information data, signals and information between the various components of the computer system 500. The components include an input / output (I / O) component 504, which processes user (i.e., sender, receiver, service provider) actions (e.g., selecting keys from a keypad / keyboard, selecting one or more buttons or links, etc.) and sends corresponding signals to the bus 512. The I / O component 504 may also include output components, such as a display 502 and a cursor control 508 (e.g., a keyboard, a keypad, a mouse, etc.). The display 502 may be configured to present a login page for logging into a user account or a checkout page for purchasing items from a merchant. An optional audio input / output component 506 may also be included to allow a user to use voice to input information by converting audio signals. The audio I / O component 506 may allow a user to hear audio. A transceiver or network interface 520 sends and receives signals between the computer system 500 and other devices (e.g., another user device, a merchant server, or a service provider server) via a network 522. In one embodiment, the transmission is wireless, but other transmission media and methods are also suitable. Processor 514 can be a microcontroller, digital signal processor (DSP), or other processing component that processes these various signals, such as for display on computer system 500 or transmission to other devices via communication link 524. Processor 514 can also control the transmission of information (such as cookies or IP addresses) to other devices.

[0074] Components of computer system 500 also include system memory component 510 (e.g., RAM), static storage component 516 (e.g., ROM), and / or disk drive 518 (e.g., solid state drive, hard disk drive). Computer system 800 performs specific operations through processor 514 and other components by executing one or more instruction sequences contained in system memory component 510. For example, processor 514 can perform authentication functions described herein, for example, according to process 400.

[0075] Logic may be encoded in a computer readable medium, which may refer to any medium that participates in providing instructions to the processor 514 for execution. Such media may take many forms, including, but not limited to, non-volatile media, volatile media, and transmission media. In various implementations, non-volatile media include optical or magnetic disks, volatile media include dynamic memory (e.g., system memory component 510), and transmission media include coaxial cables, copper wire, and optical fibers, which include wires that include bus 512. In one embodiment, logic may be encoded in a non-transitory machine readable medium. In one example, the transmission medium may take the form of sound waves or light waves (e.g., those generated during radio wave, optical, and infrared data communications).

[0076] Some common forms of computer readable media include, for example, floppy disks, flexible disks, hard disks, magnetic tape, any other magnetic medium, CD-ROMs, any other optical medium, punch cards, paper tape, any other physical medium with a pattern of holes, RAM, PROM, EPROM, FLASH-EPROM, any other memory chip or cartridge, or any other medium from which a computer is suitable for reading.

[0077] In various embodiments of the present disclosure, execution of the instruction sequences to practice the present disclosure may be performed by a computer system 500. In various other embodiments of the present disclosure, multiple computer systems 500 coupled to a network (e.g., a LAN including telecommunications, mobile and cellular telephone networks, WLAN, PTSN, and / or various other wired or wireless networks) via a communication link 524 may execute the instruction sequences to practice the present disclosure in coordination with one another.

[0078] Where applicable, hardware, software, or a combination of hardware and software can be used to implement the various embodiments provided by the present disclosure. Moreover, where applicable, the various hardware components and / or software components set forth herein can be combined into composite components including software, hardware, and / or both without departing from the spirit of the present disclosure. Where applicable, the various hardware components and / or software components set forth herein can be divided into subcomponents including software, hardware, or both without departing from the scope of the present disclosure. In addition, where applicable, it can be expected that software components can be implemented as hardware components, and vice versa.

[0079] Software (e.g., program code and / or data) according to the present disclosure may be stored on one or more computer-readable media. It is also contemplated that the software identified herein may be implemented using one or more general or special-purpose computers and / or computer systems, networked and / or otherwise. Where applicable, the ordering of the various steps described herein may be changed, combined into composite steps, and / or divided into sub-steps to provide the features described herein.

[0080] The various features and steps described herein may be implemented as: a system comprising one or more memories storing the various information described herein and one or more processors coupled to the one or more memories and a network, wherein the one or more processors are operable to perform the steps described herein; a non-transitory machine-readable medium comprising a plurality of machine-readable instructions that, when executed by one or more processors, are suitable for causing the one or more processors to perform a method comprising the steps described herein; and a method performed by one or more devices such as a hardware processor, a user device, a server, and other devices described herein.

Claims

1. A system comprising: non-transitory memory; as well as One or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations, the operations comprising: retrieving one or more images associated with the entity from one or more online sources; detecting a plurality of faces within the one or more images; generating a graph linking the plurality of faces, wherein two faces are linked in the graph when the two faces appear in an image of the one or more images; determining, based on identity information of the user account, that the user account may be associated with the entity; obtaining an image associated with the user account; matching the image to a specific face in the image; and An action is performed on the user account based on the location of the particular face in the graph.

2. The system according to claim 1, wherein: The identity information includes the name of the person.

3. The system according to claim 1, wherein: The operations also include: A relevance score is assigned to each face in the image based on a frequency of occurrence of the face in the one or more images, wherein the relevance score represents a level of relevance between the corresponding face and the entity.

4. The system according to claim 1, wherein: The operations also include: identifying a first face representing the entity from among the plurality of faces in the graph; and The first face is assigned to a first position in the graph based on the first face representing the entity.

5. The system according to claim 4, wherein: The operations also include: The second face is assigned to a second position in the map based on a frequency with which the second face appears with the first face in the one or more images.

6. The system according to claim 4, wherein: The operations also include: The second face is assigned to a second position in the image based on the position of the second face relative to the first face in the one or more images.

7. The system according to claim 1, wherein: The plurality of faces are detected within the one or more images using one or more facial recognition techniques.

8. A method comprising: retrieving one or more images associated with the entity from one or more online sources; detecting, by one or more hardware processors, a plurality of persons within the one or more images; generating, by the one or more hardware processors, a graph linking the plurality of persons, wherein when two persons appear in an image of the one or more images, the two persons are linked in the graph; determining, by the one or more hardware processors, the user account associated with the entity based on text-based information of the user account; obtaining an image associated with the user account; matching the image to a specific person in the image; and An action is performed, by the one or more hardware processors, on the user account based on the location of the particular person in the graph.

9. The method according to claim 8, further comprising: The entity is determined to be associated with a bad actor based on one or more previous transactions processed through a second user account associated with the entity.

10. The method according to claim 9, wherein: The performing action includes applying a set of restrictions to the user account.

11. The method according to claim 8, further comprising: The entity is determined to be a favorable entity based on one or more previous transactions processed through a second user account associated with the entity.

12. The method according to claim 11, wherein: The performing action includes applying or providing a set of additional functions to the user account.

13. The method according to claim 8, wherein: The user account is a first user account, and wherein the method further comprises: determining a set of user accounts associated with other persons in the graph; monitoring transactions conducted through the first user account and the set of user accounts over a period of time; determining, based on the monitoring, that a series of transactions involving the first user account and the set of user accounts corresponds to a pattern; and In response to determining that the series of transactions corresponds to the pattern, one or more actions are performed on the set of user accounts based on the positions of the plurality of individuals within the graph.

14. The method according to claim 13, wherein: The one or more actions include suspending the set of user accounts.

15. A non-transitory machine-readable medium having machine-readable instructions stored thereon, the machine-readable instructions being executable to cause a machine to perform operations comprising: retrieving one or more images associated with the entity from one or more online sources; detecting a plurality of persons within the one or more images; generating a graph linking the plurality of persons, wherein when two persons appear in an image of the one or more images, the two persons are linked in the graph; determining that the identity information of the user account indicates a potential match with the entity; obtaining an image associated with the user account; matching the image to a specific person in the image; and An action is performed on the user account based on the location of the particular person in the graph.

16. The non-transitory machine-readable medium of claim 15, wherein: The identity information includes: the person's name and location.

17. The non-transitory machine-readable medium of claim 15, wherein: The operations also include: Each person in the graph is assigned a relevance score based on the frequency of appearance of the person in the one or more images, wherein the relevance score represents a level of relevance between the corresponding person and the entity.

18. The non-transitory machine-readable medium of claim 15, wherein: The operations also include: identifying a first person representing the entity from among the plurality of persons in the graph; and Based on the first person representing the entity, the first person is assigned to a first position in the graph.

19. The non-transitory machine-readable medium of claim 18, wherein: The operations also include: The second person is assigned to a second position in the image based on a frequency with which the second person appears with the first person in the one or more images.

20. The non-transitory machine-readable medium of claim 18, wherein: The operations also include: Based on the position of the second person relative to the first person in the one or more images, the second person is assigned to a second position in the image.

Images