Scalable pipeline for flagging interesting transaction groups

Abstract

A computer-implemented method for determining an interestingness value is provided. The computer-implemented method comprises conditioning first raw transaction data based on transaction attributes to generate time‑window indexed transaction combinations with first transaction size parameters, filtering the time‑window indexed transaction combinations to retain filtered time‑window indexed transaction combinations with second transaction size parameters, generating a first time series from the second transaction size parameters, determining a statistical significance and a horizontal contrast based on the first time series, determining a vertical contrast based on the first time series and a second time series, and determining the interestingness value based on the statistical significance, the horizontal contrast, and the vertical contrast. A pipeline system for determining an interestingness value is also provided.

Description

TITLESCALABLE PIPELINE FOR FLAGGING INTERESTING TRANSACTION GROUPSCROSS-REFERENCE TO RELATED APPLICATION

[0001] This application claims the benefit of and priority under 35 U.S.C. § 119(e) to U.S. Provisional Application Serial No. 63 / 531,177 filed August 7, 2023, entitled “SCALABLE PIPELINE FOR FLAGGING INTERESTING TRANSACTION GROUPS,” the contents of which is hereby incorporated by reference in its entirety herein.TECHNICAL FIELD

[0002] The present disclosure is generally related to identifying outliers and, more particularly, is directed to techniques for identifying interesting behavior in transaction data.BACKGROUND

[0003] Payment processing networks may make adjustments to operations and / or offer various types products and services based on recent occurrences of transactions and various attributes thereof, such as frequency and volume of cross border transactions related to a certain merchant. Understanding the temporal behavior of transactions and / or any relationships between various transaction types can help payment network systems in identifying interesting behavior in groups transactions, which may then be incorporated into adjustments in payment network processing. However, currently available methods for determining interestingness values from raw transaction data may not be easily scalable, thereby increasing computational time and costs when processing large scale transaction data available from a payment processing network. Accordingly, there exists a need for alternative methods and devices for determining interesting transaction behavior. The present disclosure provides various solutions that employ a scalable framework for determining an interestingness value from raw transaction data.SUMMARY

[0004] In various aspects, a computer-implemented method for determining an interestingness value is disclosed. In some aspects, the computer-implemented method includes conditioning first raw transaction data based on transaction attributes to generate time-window indexed transaction combinations with first transaction size parameters; filtering time-window indexed transaction combinations based on the first transaction size parameters to retain filtered time-window indexed transaction combinations with second transaction size parameters; generating a first time series from the second transaction size parameters; determining a statistical significance of the second transaction size parameterswithin the first time series; determining a horizontal contrast; determining a vertical contrast; and determining the interestingness value based on the statistical significance, the horizontal contrast, and the vertical contrast. In some aspects, the horizontal contrast represents a historical behavior of the second transaction size parameters in the first time series. In some aspects, the vertical contrast represents a comparative behavior of the second transaction size parameters in the first time series and third transaction size parameters associated with a second time series that are based on second raw transaction data.BRIEF DESCRIPTION OF THE DRAWINGS

[0005] In the description, for purposes of explanation and not limitation, specific details are set forth, such as particular aspects, procedures, techniques, etc. to provide a thorough understanding of the present technology. However, it will be apparent to one skilled in the art that the present technology may be practiced in other aspects that depart from these specific details.

[0006] The accompanying drawings, where like reference numerals refer to identical or functionally similar elements throughout the separate views, together with the detailed description below, are incorporated in and form part of the specification, and serve to further illustrate aspects of concepts that include the claimed disclosure and explain various principles and advantages of those aspects.

[0007] The apparatuses, systems, and methods disclosed herein have been represented where appropriate by conventional symbols in the drawings, showing only those specific details that are pertinent to understanding the various aspects of the present disclosure so as not to obscure the disclosure with details that will be readily apparent to those of ordinary skill in the art having the benefit of the description herein.

[0008] FIG. 1 illustrates a payment network environment according to at least one aspect of the present disclosure.

[0009] FIG. 2 is a logic flow diagram of a computer-implemented method for determining an interestingness value, in accordance with at least one aspect of the present disclosure.

[0010] FIG. 3 is an example of a graphical representation of a time series according to at least one aspect of the present disclosure.

[0011] FIGs. 4-6 illustrate temporal behaviors of a time series according to at least one aspect of the present disclosure.

[0012] FIG. 7 illustrates an example of a feature matrix for transaction combinationbased clustering according to at least one aspect of the present disclosure.

[0013] FIGs. 8-9 provide graphical assessments of interestingness results of the Examples according to at least one aspect of the present disclosure.

[0014] FIG. 10 is a block diagram of a computer apparatus with data processing subsystems or components, according to at least one aspect of the present disclosure.

[0015] FIG. 11 is a diagrammatic representation of an example system that includes a host machine within which a set of instructions to perform any one or more of the methodologies discussed herein may be executed, according to at least one aspect of the present disclosure.

[0016] Corresponding reference characters indicate corresponding parts throughout the several views. The exemplifications set out herein illustrate various aspects of the present disclosure, in one form, and such exemplifications are not to be construed as limiting the scope of the disclosure in any manner.DESCRIPTION

[0017] The following disclosure may provide exemplary systems, devices, and methods for conducting a financial transaction and related activities. Although reference may be made to such financial transactions in the examples provided below, aspects are not so limited. That is, the systems, methods, and apparatuses may be utilized for any suitable purpose.

[0018] Transaction data obtained from payment processing networks, such as VisaNet, are highly complex and / or large in scale. For example, a transaction data set obtained from a payment processing network may include raw transaction data, such as transaction attributes, transaction time, transaction amount, and / or transaction count, for billions of transactions. As described hereinabove, conventional time-series analysis methods may not be easily implemented for raw transaction data due to the complexity and scale of transaction data. For example, brute force algorithms may provide accurate results at the cost of extremely long run times, especially when incorporating computationally complex conventional clustering methods such as Symbolic Aggregate Approximation, Dynamic Time Warping, and / or Discrete Fourier Transform. This is especially problematic when abnormalities in current and / or recent transaction activity, such as fraudulent activity or transaction processing errors, necessitates a rapid decision for implementing a short-term or temporary change in the payment processing network to maintain network operation and / or security. Thus, conventional methods for time series analysis may not provide the speedand / or accuracy required to determine interestingness in transaction data in an efficient manner.

[0019] The present disclosure provides various solutions that employ a scalable data pipeline for determining an interestingness in raw transaction data. For example, in various aspects, the present disclosure provides a computer-implemented method for determining an interestingness value with a series of data processing steps including conditioning and filtering data. Additionally, the present disclosure provides a scalable pipeline system to generate interestingness values from raw transaction data and use them in an efficient manner. Thus, various methods and systems of the present disclosure are used to overcome issues related to speed and cost when analyzing transaction data while provide accurate results.

[0020] As used herein, the term “system” may refer to one or more computing devices or combinations of computing devices (e.g., processors, servers, client devices, software applications, components of such, and / or the like).

[0021] An “issuer” can include a payment account issuer. The payment account (which may be associated with one or more payment devices) may refer to any suitable payment account (e.g. credit card account, a checking account, a savings account, a merchant account assigned to a consumer, or a prepaid account), an employment account, an identification account, an enrollment account (e.g. a student account), etc.

[0022] As used herein, a “user” may include an individual or a user that may be associated with one or more personal accounts and / or consumer devices. The user may also be referred to as a cardholder, account holder, or consumer.

[0023] The terms “client device” and “user device” refer to any electronic device that is configured to communicate with one or more servers or remote devices and / or systems. A client device or a user device may include a mobile device, a network-enabled appliance (e.g., a network-enabled television, refrigerator, thermostat, and / or the like), a computer, a POS system, and / or any other device or system capable of communicating with a network. A client device may further include a desktop computer, laptop computer, mobile computer (e.g., smartphone), a wearable computer (e.g., a watch, pair of glasses, lens, clothing, and / or the like), a cellular phone, a network-enabled appliance (e.g., a network-enabled television, refrigerator, thermostat, and / or the like), a point of sale (POS) system, and / or any other device, system, and / or software application configured to communicate with a remote device or system.

[0024] As used herein, the term “merchant” may refer to one or more individuals or entities (e.g., operators of retail businesses that provide goods and / or services, and / or access to goods and / or services, to a user (e.g., a customer, a consumer, a customer of the merchant, and / or the like) based on a transaction (e.g., a payment transaction)). As used herein “merchant system” may refer to one or more computer systems operated by or on behalf of a merchant, such as a server computer executing one or more software applications.

[0025] A “payment network” may refer to an electronic payment system used to accept, transmit, or process transactions made by payment devices for money, goods, or services. The payment network may transfer information and funds among issuers, acquirers, merchants, and payment device users.

[0026] As used herein, the term “communication” and “communicate” may refer to the reception, receipt, transmission, transfer, provision, and / or the like of information (e.g., data, signals, messages, instructions, calls, commands, and / or the like). A communication may use a direct or indirect connection and may be wired and / or wireless in nature. As an example, for one unit (e.g., a device, a system, a component of a device or system, combinations thereof, and / or the like) to communicate with another unit means that the one unit is able to directly or indirectly receive information from and / or transmit information to the other unit. The one unit may communicate with the other unit even though the information may be modified, processed, relayed, and / or routed between the one unit and the other unit. In one example, a first unit may communicate with a second unit even though the first unit receives information and does not communicate information to the second unit. For example, a first unit may be in communication with a second unit even though the first unit passively receives data and does not actively transmit data to the second unit. As another example, a first unit may communicate with a second unit if an intermediary unit (e.g., a third unit located between the first unit and the second unit) receives information from the first unit, processes the information received from the first unit to produce processed information, and communicates the processed information to the second unit. In some non-limiting embodiments, a message may refer to a packet (e.g., a data packet, a network packet, and / or the like) that includes data. It will be appreciated that numerous other arrangements are possible.

[0027] A “communication channel” may refer to any suitable path for communication between two or more entities. Suitable communications channels may be present directly between two entities such as a payment processing network and a merchant or issuer computer, or may include a number of different entities. Any suitable communicationsprotocols may be used for generating a communications channel. A communication channel may in some instances comprise a “secure communication channel” or a “tunnel,” either of which may be established in any known manner, including the use of mutual authentication and a session key and establishment of a secure communications session. However, any method of creating a secure communication channel may be used, and communication channels may be wired or wireless, as well as long-range, short-range, or medium-range. By establishing a secure channel, sensitive information related to a payment device (such as account number, CVV values, expiration dates, etc.) may be securely transmitted between the two entities to facilitate a transaction.

[0028] An “interface” may include any software module configured to process communications. For example, an interface may be configured to receive, process, and respond to a particular entity in a particular communication format. Further, a computer, device, and / or system may include any number of interfaces depending on the functionality and capabilities of the computer, device, and / or system. In some embodiments, an interface may include an application programming interface (API) or other communication format or protocol that may be provided to third parties or to a particular entity to allow for communication with a device. Additionally, an interface may be designed based on functionality, a designated entity configured to communicate with, or any other variable. For example, an interface may be configured to allow for a system to field a particular request or may be configured to allow a particular entity to communicate with the system.

[0029] An “application” or “application program interface” (API) refers to computer code or other data sorted on a computer-readable medium that may be executed by a processor to facilitate the interaction between software components, such as a client-side front-end and / or server-side back-end for receiving data from the client. An “interface” refers to a generated display, such as one or more graphical user interfaces (GUIs) with which a user may interact, either directly or indirectly (e.g., through a keyboard, mouse, touchscreen, etc.).

[0030] As used herein, the term “server” may include one or more computing devices which can be individual, stand-alone machines located at the same or different locations, may be owned or operated by the same or different entities, and may further be one or more clusters of distributed computers or “virtual” machines housed within a datacenter. It should be understood and appreciated by a person of skill in the art that functions performed by one “server” can be spread across multiple disparate computing devices for various reasons. As used herein, a “server” is intended to refer to all such scenarios and should not be construed or limited to one specific configuration. Further, a server as described herein may, but neednot, reside at (or be operated by) a merchant, a payment network, a financial institution, a healthcare provider, a social media provider, a government agency, or agents of any of the aforementioned entities. The term “server” may also refer to or include one or more processors or computers, storage devices, or similar computer arrangements that are operated by or facilitate communication and processing for multiple parties in a network environment, such as the Internet, although it will be appreciated that communication may be facilitated over one or more public or private network environments and that various other arrangements are possible. Further, multiple computers, e.g., servers, or other computerized devices, e.g., point-of-sale devices, directly or indirectly communicating in the network environment may constitute a “system,” such as a merchant's point-of-sale system. Reference to “a server” or “a processor,” as used herein, may refer to a previously-recited server and / or processor that is recited as performing a previous step or function, a different server and / or processor, and / or a combination of servers and / or processors. For example, as used in the specification and the claims, a first server and / or a first processor that is recited as performing a first step or function may refer to the same or different server and / or a processor recited as performing a second step or function.

[0031] As used herein, the term “account identifier” may refer to one or more types of identifiers associated with an account (e.g., a unique identifier of an account, an account number, a PAN, a card number, a payment card number, a token, and / or the like) of a user. In some non-limiting embodiments, an issuer may provide an account identifier (e.g., a PAN, a token, a globally unique identifier (GIIID), a universally unique identifier (UIIID), and / or the like) to a user that uniquely identifies one or more accounts associated with that user. In some non-limiting embodiments, an account identifier may be embodied on a payment device (e.g., a portable financial instrument, a payment card, a credit card, a debit card, and / or the like) and / or may be electronic information communicated to the user that the user may use for electronic payment transactions. In some non-limiting embodiments, an account identifier may be an original account identifier, where the original account identifier was provided to a user at the creation of the account associated with the account identifier. In some non-limiting embodiments, the account identifier may be an account identifier (e.g., a supplemental account identifier) that is provided to a user after the original account identifier was provided to the user. For example, if the original account identifier is forgotten by the user, stolen from the user, and / or the like, a supplemental account identifier may be provided to the user. In some non-limiting embodiments, an account identifier may be directly or indirectly associated with an issuer such that an account identifier may be a token that maps to a PAN or other type of identifier. Account identifiers may be alphanumeric, any combination of characters and / or symbols, and / or the like.

[0032] FIG. 1 illustrates a payment network environment 100 with which a pipeline system 1000 can interface to determine an interestingness value in transaction data, according to at least one non-limiting aspect of the present disclosure. The payment network environment 100 depicts, for example, a payment network server 102, one or more issuer systems 104n and one or more acquirer systems 106n. Each of the issuer systems 104n may be associated with a respective issuer. Likewise, each of the acquirer systems 106n may be associated with a respective acquirer. The payment network server 102 is in communication with each of the issuer systems 104n and acquirer systems 106n.

[0033] The payment network environment 100 can be an international environment. For example, the issuer systems 104n may not be located in, or otherwise associated with, the same country as the acquirer systems 106n. Further, each of the issuer systems 104n and / or each of the acquirer systems 106n may be independently located in different countries and / or jurisdictions. Thus, the transaction data stored by the payment network server 102 may include cross-border transactions. In various examples, each of the issuer systems 104n and each of the acquirer systems 106n may be identified by an identification number and / or a region code, such as, for example, a country code. While FIG. 1 depicts a single payment network server 102 connected to 3 issuer systems 104n and 3 acquirer systems 106n for illustrative purposes, a payment network environment 100 according to the present disclosure is not limited to the illustrated example and can include any number of issuer systems number of systems 104n and acquirer systems 106n and / or issuers and acquirers associated therewith, in communication with the payment network server, which itself may comprise a delocalized network of systems.

[0034] The payment network server 102 may locally store data associated with transactions, such as transactions associated with any of the issuer systems 104n and / or any of the acquirer systems 106n occurring within the payment network environment 100. As illustrated in FIG. 1, the pipeline system 1000 is effectively connected to the payment network server 102 such that it may access the transaction data stored by the payment network server 102. Additionally and / or alternatively, the payment network server 102 may store data on a remote server accessible by the pipeline system 1000 via a dedicated communication channel and / or a dedicated session, for example. The transaction data associated with the issuer systems 104n and / or the acquirer systems 106n may include data representing the account identifiers associated with user and / or merchant devices, which may have initiated or otherwise participated in a transaction, transaction amount, and date and / or time of transaction among other transaction attributes. The transaction data stored by the payment network server 102 can include rows of raw transaction data with each rowcomprising transaction attributes associated with an individual transaction.

[0035] While FIG. 1 illustrates an example of a payment network environment where a payment network server 102 communicates with issuer systems and acquirer systems, other configurations are contemplated by the present disclosure. For example, in other implementations, the payment network server 102 may also store transaction data received from user devices such as peer to peer transaction data or transaction data where a transaction request may not necessarily require an issuer system and / or acquirer system.

[0036] In various examples, the pipeline system 1000 of FIG. 1 includes data preprocessing and computing nodes for determining an interestingness value from raw transaction data. For example, the pipeline system 1000 can include a first node for indexing raw transaction data obtained from the payment network server 102, a second node for grouping the raw transaction data according to the indexing and generating time window files according to the groups, a third node for filtering low sample count data from each of the time window files, a fourth node for recombining the time window files to generate an analyzable time series file, a fifth node for identifying large temporal changes within the data of the time-series file and ranking data subsets within the time series file, and a sixth node for performing computation heavy clustering analysis using rankings provided by the fifth node. Each of the nodes depends on an output from a previous node, the size and / or form of each output appropriately conditioned for the subsequent operation. Thus, the functions of the pipeline system 1000 and the organization thereof ensures that the size and / or form of the raw transaction data does not have any detrimental effects on the performance of the pipeline system 1000. Furthermore, the outputs from the nodes may be cached and / or stored in a computer-readable medium so that they may be used and or referenced later on. Thus, any method executed on the pipeline system 1000 can be paused and / or resumed at any node therein, and outputs from any of the nodes may be references later to serve as a basis for any future analysis.

[0037] FIG. 2 is a logic flow diagram of a computer-implemented method 200 for determining an interestingness value, in accordance with at least one aspect of the present disclosure. An interestingness value can be associated with a transaction or transaction combination and can serve as a metric for differentiating one transaction or transaction combination as an outlier or anomaly in a general population of transactions. The method 200 can be executed by the pipeline system 1000 described above with respect to FIG. 1. To better describe various aspects of the method 200, an illustrative example of the inputs received and outputs generated by the pipeline system 1000 in the method 200 are discussed below. The method 200 is not limited to these example inputs and outputs.

[0038] As used herein, the term “transaction combination” may refer to a group of transactions which share one or more transaction attributes, such as, for example, Bank Identification Number (BIN), bank or issuer country, type of payment device, brand of payment device, transaction region, acceptance device and / or channel, currency code, e- commerce indicator, network token transaction type, payment processor, and / or merchant. In some non-limiting embodiments, transaction combinations sharing primary transaction attributes, but also having one or more secondary transaction attributes distinct between the transaction combinations, may be subsets of an aggregated transaction combination defined by one or more of the primary shared transaction attributes.

[0039] The method 200 includes conditioning 210 raw transaction data 201 based on transaction attributes to generate time-window indexed transaction combinations 202 with first transaction size parameters 203. The raw transaction data 201 can be transaction data retrieved from the payment network server 102 by the first node of the pipeline system 1000. Thus, the raw transaction data 201 may contain rows of transaction data with each row comprising transaction attributes associated with an individual transaction as described hereinabove. In some examples, the raw transaction data 201 can be a subset of a larger set of raw transaction data retrieved from the payment network server 102 including second raw transaction data, third raw transaction data, and so on. In some examples, time-window indexed transaction combinations 202 may be generated based on a predetermined type and / or quantity of transaction attributes. For example, conditioning 210 raw transaction data 201 may be based on a maximum of four transaction attribute categories including country, merchant, acceptance channel, and type of payment device.

[0040] As used herein, the term “time-window” may refer to a discrete-time representative of a continuous-time interval occurring within a range of continuous-time, such that the range of continuous-time may be represented by a series or sequence of timewindows. In some non-limiting embodiments, quantitative continuous-time data spanning a time range, such as raw transaction data containing transaction values or transaction counts, may be represented as discrete data by grouping, aggregating, and / or binning the continuous-time data according to a predetermine interval into a number of grouped data points corresponding to the number of time-windows spanning the original time range. Additionally, a reference made to a specific time-window may also refer to various data points occurring within the specific time-window.

[0041] As used herein, the term “time-window indexed transaction combination” refers to a group of transactions which share one or more transaction attributes, which occur within a common time-interval, and which are grouped, assigned and / or indexed to a specific time-window. Multiple time-window indexed transaction combinations may be indexed to a single time- window.

[0042] In various examples, conditioning 210 raw transaction data 201 can include determining, by the first node of the pipeline system 1000, a number of time-windows based on the range of time spanned by the raw transaction data 201. For example, if the raw transaction data 201 spans a time range of one year, the raw transaction data 201 can be indexed by date of transaction resulting in 365 possible time-windows. The duration of a time-window may be chosen as desired based on density of raw transaction data 201 with respect to time, the range of time spanned by the raw transaction data 201 , and / or computational resources available in the pipeline system 1000.

[0043] In various examples, generating time-window indexed transaction combinations 202 includes aggregating raw transaction data 201 , which have one or more transaction attributes in common and which occur within a given time window, into groups and, for each of the time-window indexed transaction combinations 202, generating a single row of grouped data representative of the one or more transaction attributes shared by the grouped first raw transaction data 201. In some examples, the first transaction size parameters 203 generated with the time-window indexed transaction combinations 202 are based on an aggregation, by the second node of the pipeline system 1000, of one type of quantifying metric associated with the grouped raw transaction data 201. The first transaction size parameters 203 can include a collection of parameters including aggregated transaction amounts and / or transaction counts and, in some examples, may separately include aggregated cross-border transaction amounts and / or cross-border transaction counts. The first transaction size parameters 203 can be included in the rows of grouped data described above, and may be included as one or more separate columns.

[0044] As used herein, the term “transaction size parameter” (sometimes referred to hereinafter as a “TSP”) may refer to an aggregation of quantitative continuous-time data associated with a group of transactions associated with a time-window indexed transaction combination. Thus, any given transaction size parameter according to the present disclosure may be uniquely associated with a single time-window indexed transaction combination. However, this does not preclude multiple transaction size parameters from having the same values or being associated with the same time-window, or a single timewindow indexed transaction combination from being associated with multiple transaction size parameters.

[0045] In some examples, the raw transaction data 201 can be indexed to identifiersrepresentative of time-window position in a chronological sequence, such as, for example, integers ranging from 0 to 364 based on a time-window duration of 1 day to represent one year. In other implementations, the identifiers may be alphabetic, numeric, or alphanumeric, such as an identifier based on hexadecimal numbers. The identifiers may be appended by the first node of the pipeline system 1000 to raw transaction data 201 containing rows of transaction data and in some instances, may be appended as a new column. In certain examples, conditioning 210 the raw transaction data 201 includes generating a new file for each time-window containing a time-window indexed transaction combination 202.

[0046] Further to the above, the transaction data retrieved from the payment network server 102 can include one or more other types of raw transaction data including data from transactions having a variety of transaction attributes which may not be commonly shared among the transaction population captured by time-window indexed transaction combinations 202. Thus, conditioning 210 the raw transaction data 201 can further include generating one or more other time-window indexed transaction combinations 202n from other raw transaction data 201 n which do not share a set, or subset, of transaction attributes with time-window indexed transaction combinations 202. These one or more other timewindow indexed transaction combinations 202n and time-window indexed transaction combinations 202 may be indexed to the same time-windows which may form a new dataset. For example, where conditioning 210 the raw transaction data 201 includes generating a new file for each time-window containing a time-window indexed transaction combination 202, any given new file associated with a specific time-window may also include one or more other time-window indexed transaction combinations 202n, and first transaction size parameters 203n associated therewith, indexed to the specific time-window. Thus, the conditioning 210 may generate, for each time-window, a new time-window file containing rows of grouped data pertaining to different transaction combinations, including time-window indexed transaction combination 202 and 202n, each of which are indexed to the same timewindow. Furthermore, multiple time-window files may be generated in parallel. For example, the second node of the pipeline system may include multiple processing units which can operate on subsets of a common dataset simultaneously.

[0047] As used herein, the term “time series” may refer to any series of data points indexed, listed, graphed, or otherwise arranged in time-order, such as, for example, a series of time-window indexed transaction size combinations arranged in chronological order and spanning multiple time-windows. In some non-limiting embodiments, the term “overarching time series” may refer to a time series including all of the time-windows spanned by the raw data. In some non-limiting embodiments, the term “partial time series” may refer to timeseries generated from an overarching time series, which begin and / or end at points different from the first and last time-windows of the overarching time series and / or otherwise exclude one or more time-windows from the overarching time series.

[0048] As used herein, the term “final time-window” may refer to the last time-window in which any raw data occurs or, when used in reference to a specific time-series, the last timewindow in the specific time-series.

[0049] As used herein, the term “target time-window” may refer to a time-window containing data which is being evaluated by an algorithm to produce an output which also incorporates data from past time-windows preceding the target time-window and / or other data occurring within the target time-window. Thus, the target time-window is current with respect to the algorithm or, in some instances, a specific iteration during execution of an algorithm such as a recursive or iterative algorithm. In some non-limiting embodiments, a target time-window may be a final time-window of a time series which is a portion of an overarching time series or a final time-window of the overarching time-series itself. In some non-limiting embodiments, an interestingness value can be calculated for a time series based on a target time-window therein.

[0050] Still referring to FIG. 2, the method 200 includes filtering 220 the time-window indexed transaction combinations 202 based on the first transaction size parameters 203 to retain filtered time-window indexed transaction combinations 204 with second transaction size parameters 205. Since the filtered time-window indexed transaction combinations 204 are derived from the time-window indexed transaction combinations 202, the second transaction size parameters 205 are a subset of the first transaction size parameters 203. In examples including one or more other time-window indexed transaction combinations 202n in addition to time-window indexed transaction combinations 202, filtering 220 can further include filtering the one or more other time-window indexed transaction combinations 202n based on first transaction size parameters 203n to retain third transaction size parameters 205n. In some examples, filtering 220 the time-window indexed transaction combinations 202 includes removing one or more rows of grouped data from each of the time-window files generated during the conditioning 210 of the raw transaction data 201.

[0051] The filtering 220 can be executed by the third node of the pipeline system 1000 based on first transaction size parameters 203 of time-window indexed transaction combinations 202 indexed to time-windows preceding a target time-window and the target time-window itself. Likewise, the retained filtered time-window indexed transaction combinations 204 are indexed to the time-windows preceding a target time-window and thetarget time-window. In various examples, the target time-window is the final time-window in the raw transaction data 201.

[0052] In various examples, filtering 220 the time-window indexed transaction combinations 202 is based on the first transaction size parameters 203 satisfying a predetermined minimum threshold value required for qualifying a time-window indexed transaction combination 202 of a target time-window as a candidate for an interesting group. In some examples, filtering 220 can be based on aggregating first transaction size parameters 203 associated with a specific set of transaction attributes in the time windows leading up to the target time-window and comparing the aggregated first transaction size parameters 203 to the predetermined minimum threshold value. For example, in a dataset including billions of cross-border transactions, a total number of cross-border transactions associated with credit card based transactions at a specific food chain leading up to a target window can be excluded due to not meeting or exceeding a threshold of 1000 total transactions, which may not meet the minimum criteria for quantifying interesting behaviors. Thus, in some aspects, restricting any subsequent calculations for interestingness values to using the retained filtered time-window indexed transaction combinations 204 and the second transaction size parameters 205 associated therewith can avoid wasting computation time and / or resources on time-window indexed transaction combinations with less valuable data.

[0053] Still referring to FIG. 2, the method 200 includes generating 230 a first time series 206 from second transaction size parameters 205. In various examples, a first time series 206 includes a subset of the second transaction size parameters 205 associated with one quantifying metric and a common set of transaction attributes. Thus, a first time series 206 is composed of one type of transaction size parameters corresponds to one transaction combination. In some examples, the first time series 206 is generated, by the fourth node of the pipeline system 1000, from all of the separate time-window files generated by the conditioning 210 as an overarching time-series.

[0054] Now referring to FIGs. 2-3, more than one time series may also be generated. For example, other time series 206n may be generated based on third transaction size parameters 205n and / or second transaction parameters 205 associated with other quantifying metrics, in addition to the first time series 206, to form an array of time series. For example, FIG. 3 illustrates an example of a time series in graphical form according to at least one aspect of the present disclosure. FIG. 3 depicts second transaction size parameters 205 plotted for a first time series 206 associated with a first transaction combination, and additionally third transaction parameters 205n plotted for 6 other timeseries 206n, each spanning 17 time-windows indexed from 0 to 16. The target time-window in FIG. 3 is the final time-window. The time series 206 and / or an array including time series 206 and 206n may be outputted as a single file to the fifth node of the pipeline system 1000 for further analysis. In certain examples, portions of a time series 206 and / or 206n may be evaluated with the method 200 based on using a past time-window preceding a final timewindow as a target time-window.

[0055] Other configurations of the method 200 are contemplated by the present disclosure. For example, in some implementations, the method 200 may skip the filtering 220 and proceed to generating 230 a time series for each transaction combination contained in multiple time-window files generated during the conditioning 210 and subsequently outputting a time-series array as a single file.

[0056] Now referring back to FIG. 2, the method 200 includes determining 240 a statistical significance w of the second transaction size parameters 205 within the first time series 206. In various examples, the statistical significance w may be based on a maximum, a mean, or a minimum value of the second transaction size parameter 205 within the first time series 206. In some examples, determining 240 the statistical significance w is based on a subset of the second transaction size parameters 205 within the first time series 206. For example, the subset of the second transaction size parameters 205 can include second transaction size parameters 205 (TSP in equations below) associated with a target timewindow t and a number n of the time windows preceding the target time window t, and the statistical significance w can be determined, by the fifth node of the pipeline system 1000, according to one of the equations: w = log10(max(TSP(t), TSP(t - 1), ..., TSP(t - n))')' w = logw(mean(TSP(t), TSP(t — 1), ..., TSP(t — n))); or w = log10(mm(TSP(t), TSP(t - 1), ..., TSP(t - n) ).

[0057] In the illustrative example above, the predetermined number n of the time windows is a hyperparameter chosen before determining 240 the statistical significance. The inventors of the present disclosure have found through empirical studies that determining 240 the statistical significance w based on a maximum or a mean value with the twelve time-windows (n = 12) immediately preceding the target time-window t in the time series 206 provides effective results in most time-series based on datasets collected from real-world transaction data. However, n may be adjusted in small increments to accommodate other ranges of time-windows.

[0058] Now referring to FIGs. 2 and 4-6, the method 200 includes determining 250 a horizontal contrast Ahrepresenting a historical behavior of the second transaction size parameters 205 in the time series 206. The horizontal contrast Ahcan provide an indicator of how drastically time series 206 changes, in regard to values of second transaction size parameters 205 and / or rate of change thereof, between a target time-window t and the timewindows preceding the target time-window. For example, the horizontal contrast Ahcan be determined, by the fifth node of the pipeline system 1000, based on a product of the rate of change and an absolute change according to the equations:Ah= Rate of Change x Absolute Changewhere t is a time-window index of the target time-window, s is a number of the past time-windows preceding the target time-window in the first time series 206, 8(t) is a difference between second transaction size parameters 205 associated with target time-window t and a preceding time-window t - 1, p is a mean value and a is a standard deviation; andwhere % is a hyperparameter which represents a number of the past time-windows preceding the target time-window in the first time series, chosen before determining 250 the horizontal contrast Ah. The rate of change captures a dynamic behavior of the target time-window t based on a global comparison thereof with second transaction size parameters 205 of all of the time-windows in the first time series 206, while the absolute change captures a more local behavioral change. Thus, s and x as described herein are independent of each other. In various examples, the number of the past time-windows used x to determine absolute change is less than the s number of the past time-windows preceding the target time-window in the first time series 206 as described above in the rate of change equation.

[0059] Determining 250 a horizontal contrast Ahbased on the above equations can reveal interesting patterns as illustrated in FIGs. 4-6 which depict examples of time-series 206, each ending with a target time-window. FIG. 4 depicts a sudden appearance of a transaction size parameter in a target time-window. FIG. 5 depicts a sudden increase in value of transaction size parameters in a target time-window. FIG. 6 depicts a sudden drop in value of transaction size parameters in a target time-window.

[0060] In various examples of the method 200 as described hereinabove, the statisticalsignificance w and horizontal contrast Ahcan be determined for other time-series 206n with the same hyperparameters chosen for time series 206 as described hereinabove. Each pair of statistical significance w and horizontal contrast Ahcan be multiplied and the resulting products can be ordered from greatest to least in value. The inventors of the present disclosure have determined that in some instances, the product of a statistical significance w and horizontal contrast Ahmay serve as an interestingness value when an outlier may be determined based on sharp changes in transaction size parameter alone and this order can provide an interestingness ranking of the evaluated time series. An upper ranking number of time series, chosen based on a predetermined hyperparameter, may then be regarded as the most interesting transaction groups, such as, for example, the time series having the top 5000 Ah■ w values. Adjusting this predetermined hyperparameter to increase the number of time series included in the upper ranking group can provide more comprehensive results which may then allow deeper analysis. However, this adjustment may also result in more redundancy and noise in the results. In some examples, determining 250 a horizontal contrast Ahincludes generating, by the fifth node of the pipeline system 1000, a new file comprising the upper ranking number of time series, and corresponding statistical significance w and horizontal contrast Ahparameters.

[0061] However, in other instances, these sharp changes may be somewhat widespread throughout the data such as in holiday periods where an uptick in overall economic activity is expected. In order to address these issues, the present inventors have determined that a third parameter, namely a vertical contrast term Av, for capturing an absence of sharp changes in time series should also be incorporated into an interestingness value to avoid solely relying on detectable sharp changes which may not always be a reliable indicator of interesting behavior in the context of financial transactions.

[0062] Now referring back to FIGs. 2-3, the method 200 can include determining 260 a vertical contrast Avrepresenting a comparative behavior of the second transaction size parameters 205 in the time series 206 and other transaction size parameters of one or more comparable time series. The vertical contrast Avcan be determined by the sixth node of the pipeline system 1000. In various examples, the time series 206 and comparable time series are the topmost ranking number of time series based on the statistical significance w and horizontal contrast Ahas described above. Thus, in some aspects, determining the statistical significance w and horizontal contrast Ahserves as a filter to minimize the search space traversed when determining 260 a vertical contrast Avwhich generally requires more computational resources than the previously discussed portions of the method 200. Accordingly, the method 200 is more scalable and computationally efficient than exhaustivebrute-force methods which would iteratively perform each of the described steps for all of the data present in the raw transaction data 201. In certain examples, the one or more comparable time series are a subset of other time series 206n.

[0063] The time series 206 and the comparable time series, or the transaction combinations associated therewith, should be able to be grouped into a cluster based on having one or more similar qualities, such as time-series behavior and / or transaction attribute qualities, which are not present, or differ substantially, from other time series not included in the cluster. With respect to time-series behavior, rates of changes of transaction size parameters therein may be compared. For example, as discussed in greater detail below, a time series which is comparable to the time series 206 may be identified by having a binary representation which is similar to a binary representation of the time series 206. In various examples, determining 260 a vertical contrast Avcan include determining a first binary representation of the time series 260 and identifying a comparable time series based on having a second binary representation comparable to the first binary representation. In some examples, a second binary representation comparable to the first binary representation can be based on a match of 100% of the terms in the first binary representation and the second binary representation. In certain examples, the first binary representation and the second binary representation may be downsampled as described in greater detail below.

[0064] Binary representations of time series according to the present disclosure may be determined based on the nature of transitions in transaction size parameter from one timewindow to the next. More specifically, a rise in transaction size parameter may be assigned a value of 1 while a drop or no change would be indicated by a 0 value. For example, a binary representation of a time series having a set of transaction size parameters[1,5, 3, 3, 6, 2] would be [1,0, 0,1,0], In some examples, the first binary representation can be determined based on a downsampled version of the time series 206. A downsampled version of a time series can be based on non-overlapping moving averages of transaction size parameters in a time series may be calculated. For example, a time series having a set of transaction size parameters [1, 5, 3, 3, 6, 2, 8, 4, 5, 10] can be downsampled to [3, 3, 4, 6, 7.5] based on a moving average unit width of 2 data points and a binary representation determined therefrom would be [0,1, 1,1], The binary representations may be stored in a hash table as they are determined. The number of matches between two given time series to be considered comparable and the moving average unit width are predetermined hyperparameters. In the context of binary representations, using a downsampled version of a time series may help to smooth out peaks and characterize more general trends betweentwo time series. In certain examples, the comparable time series comprises at least one of time series 206n. In some aspects, determining 260 a vertical contrast Avbased on comparing binary representations of time series can provide a faster and simpler method of clustering time series 206 with other time series than conventional clustering methods without clustering performance.

[0065] When time series 206 and one or more comparable time-series are to be grouped into a cluster based on transaction combination based clustering, the transaction attribute categories are generally divided into two groups, a first group A of transaction attribute categories wherein the transaction attributes vary greatly, and a second group B of transaction attribute categories wherein transaction attributes are less diverse, and clustering may be performed using the transaction attribute categories of first group A. For example, when conditioning 210 raw transaction data 201 is based on four transaction attribute categories including country, merchant, acceptance channel, and type of payment device, the first group A of transaction attribute categories would include country and merchant if the raw transaction occurred in hundreds of different countries and / or merchants, and the second group B of transaction attribute categories would include acceptance channel and type of payment device if most of the raw transaction data 201 was representative of credit-card and debit-card based transactions accepted online or via a point of sale (“POS”) system. For illustrative purposes, the following discussion will be based on clustering about the country category.

[0066] Now referring to FIG. 7, a feature matrix 262 for transaction combination based clustering is provided, in accordance with at least one non-limiting aspect of the present disclosure. In various examples, transaction combination based clustering relies on raw transaction data 201 to generate a high dimensional feature matrix 262 for each country and cluster the countries by computing a similarity metric between matrices. Generating a high dimensional feature matrix 262 includes defining the features in group A except for “country” as dependent features spanning a number of time-windows. In the illustrative example, there is only one dependent feature, “merchant" which will serve as one dimension of the matrix as 10 different merchant categories, illustrated in FIG. 7 as the horizontal axis 262a, taken across 8 time-windows, illustrated in FIG. 7 as vertical axis 262b. Additionally, a separate feature matrix 262 will be generated for each of the transaction attribute categories in the second group B. Thus, for each country listed in the raw transaction data 201, four separate 8 x 10 matrices will be generated where each row i of the 8 x 10 matrix serves as one window and each column j serves as one merchant category.

[0067] The entry at tth row and jth column, illustrated in FIG. 7 as a color codeaccording to legend 262c, is the ratio of an aggregated transaction size parameter associated the merchant category j at time-window i to the transaction size parameter associated with all of the merchant categories at time-window i such that the sum of every row sum is one.

[0068] In various examples, computing a similarity metric between matrices involves determining a distance, or vector norm, between matrices such as by computing a Frobenius Norm for each pair of countries based on the second group B. For example, each country in a pair of countries has four feature matrices based on the second group B containing four separate transaction attributes, namely credit card, debit card, online channel, and POS channel, and thus four separate Frobenius Norms can be computed for each pair of countries. The computed Frobenius Norms are summed thereafter to produce a similarity distance between the two countries. A similarity metric can be computed for each remaining pair of countries in a similar manner as described above.

[0069] The above method for computing a similarity metric works well in the illustrative examples since the number of countries and merchant categories in current payment network datasets is limited to, respectively, about 250 and 23. However, the inventors of the present disclosure have determined that performing a larger number of pair-wise distance calculations will be inefficient. To address this problem, the inventors of the present disclosure have developed a novel hashing technique to quickly group countries by introducing a pool of Gaussian distributed random matrices. More specifically, the novel hashing technique includes generating k random matrices whose row sum is one, where k is a relatively small number varying with the size of the input dataset. The average distance from each country’s feature matrix to these k matrices is computed thereafter. The resulting distance range [0,1] is divided into multiple buckets, and the countries whose average similarity distance to the random matrices fall in the same bucket are regarded as comparable. Using this method of clustering, the run time can be reduced from quadratic to linear.

[0070] The above clustering methods can be executed with the transaction combination of time series 206 to identify comparable transaction attributes. The comparable transaction attributes can then be used to determine comparable transaction combinations and thus, comparable time-series to time series 206. In various examples, a pair of transaction combinations is deemed comparable if each of the transaction attributes thereof in first group A fall within the same cluster and each of the transaction attributes thereof in group B are common to both transaction combinations. In the illustrative example above where the 4 transaction attribute categories include country, merchant, accept and channel, and type ofpayment device, if USA and Canada belong to the same country cluster, and Singapore Air and United Airlines belong to the same merchant cluster, then a pair of transaction combinations having transaction attributes (USA, Singapore Air, online, credit card) and (Canada, United Airlines, online, credit card) are comparable.

[0071] While other transaction based clustering methods can be used, such as unsupervised machine learning algorithms including k-means clustering based on opensource metadata, they may be problematic due to the objective nature of feature selection from metadata, high costs of data preprocessing to clean up the data, and / or unreliable access to external data. Thus, in some aspects, the clustering methods based on feature matrix 262 of the present disclosure can provide advantages over other methods relying on external data and / or unsupervised machine learning.

[0072] Now referring back to FIG. 2, in various examples, the vertical contrast Avis based on a first rate of change associated with the second transaction size parameters 205 and a second rate of change associated with the transaction size parameters of the comparable time series. In some examples, the vertical contrast Avis based on a first rate of change associated with the second transaction size parameters 205 and one or more other rates of change associated with third transaction size parameters 205n of one or more other time series 206n. In certain examples, the vertical contrast is based on distances between a rates of change of transaction size parameters 205 and third transaction size parameters 205n determined with:wherein Avis the vertical contrast, rcis the first rate of change associated with the second transaction size parameters 205, rCi, - , rCnis the one or more other rates of change associated with the third transaction size parameters 205n and p is a mean.

[0073] The rate of change in the above equation is similar in many respects to other rate of changes described elsewherein the present disclosure. In various examples, the rate of change r for a given time series is based on:where TSP( ) is a transaction size parameter of a target time-window of a time series, TSP(t - 1), ... , TSP(t - m) are transaction size parameters of m past time-windows preceding the target time-window, and p is a mean. The number of m past time-windowsmay be all of the time windows preceding the target time-window.

[0074] Still referring to FIG. 2, the method 200 includes determining 270 the interestingness value based on the statistical significance, the horizontal contrast, and the vertical contrast. In various examples, the interestingness value of a time series 206 is a product of a vertical contrast Avfor time series 206 multiplied with the statistical significance w and horizontal contrast Ahfor time series 206 to determine a final interestingness value thereof, where a greater value is indicative of more interesting behavior.

[0075] The method 200 as described hereinabove may be iterated for other time series 206n and interestingness values may be ranked and / or compared to determine the most interesting group of transactions out of the evaluated time series. In some examples, determining 270 the interestingness value includes determining, by the sixth node of the pipeline system 1000, interestingness values for an the upper ranking number of time series based on statistical significance w and horizontal contrast Ahparameters. In certain examples, the interestingness values are determined with a previously outputted filed comprising the upper ranking number of time series, and corresponding statistical significance w and horizontal contrast Ahparameters. In one example, the method 200 outputs the top 1000 interestingness values and transaction data associated therewith as a file which may be referenced and / or appended with future results.

[0076] The advantages provided by the pipeline system 1000 and the method 200 performed therewith are illustrated in the following comparison of the inventive method 200 and a conventional brute force determination of interestingness values which performs calculations based on the entirety of each time series for every time series. In the following examples, a raw transaction dataset with nearly 1 billion transaction records (about 145 gigabytes) was indexed to time-windows in about 2.65 hours and time-window files generated therefrom in about 0.95 hours. The relatively short time required for generating the multiple time-window files can be attributed to the use of multi-processing.

[0077] Table 1 below illustrates the difference in time in seconds required to evaluate interestingness values in the raw transaction dataset between brute force methods, a pipeline method according to the present disclosure based on time-series clustering, and a pipeline method according to the present disclosure based on transaction attribute clustering.

[0078] Table 1: Comparison of run time between brute force and inventive pipeline methods

[0079] The greatest increases in efficiency when using the systems and methods according to the present disclosure can be observed when calculating Ah• w and Av• Ah• w, particularly Av, due to the lack of hyperparameters decreasing the population of time-window indexed combinations required in calcuations and the lack of any ranking and / or filtering based on Ah• w which resulted in performing about 1 million computationally intensive Avcalculations while the pipeline based methods reduced the search space to about 5000 transaction combinations prior to executing the computationally intensive Avcalculations. The total run times for each method are summarized in Table 2 below.

[0080] Table 2 : Comparison of total run times between inventive and comparative methods

[0081] The accuracy of the example pipeline based methods was assessed with a recall value which represents the number of true interesting combinations divided by the number of interesting combinations found by our filtering pipeline. The recall values are plotted with respect to a number of transactions groups having k highest interestingness value in FIG. 8 (time series clustering) and FIG. 9 (transaction attribute clustering). The true interesting combinations refer to the interesting combinations determined with the brute force algorithm.

[0082] For each of the three patterns of interesting combinations, recall values were plotted for k in the range of [0, 1000], For the sudden-appearance pattern, the recall value is almost 1, which indicates that interesting transaction combinations following this pattern can be found with nearly perfect accuracy. For sudden-jump and sudden-drop patterns, it turns out as k increases from zero, recall values increase and eventually plateau at larger k values. With respect to the sudden-appearance patterns, recall values are only available for small k values because the number of transaction combinations corresponding to this pattern was limited to about 70 combinations having no historical transaction record butsuddenly occurring in the target window. The recall value for the time-series-based filtering pipeline approached a value of about 0.8, which was much higher than the recall value of about 0.4 observed in the attribute-based filtering pipeline.

[0083] The results disclosed in the above examples demonstrate the reasonably high accuracy of the devices and methods disclosed in the present disclosure, regardless of the type of clustering method employed. Accordingly, the devices and methods according to the present disclosure can provide insights into interesting behavior of transactions in substantially shortened times over conventional methods while providing sufficiently accurate results.

[0084] FIG. 10 is a block diagram of a computer apparatus 3000 comprising data processing subsystems or components, according to at least one non-limiting aspect of the present disclosure. The subsystems shown in FIG. 10 are interconnected via a system bus 3010. Additional subsystems such as a printer 3018, keyboard 3026, fixed disk 3028 (or other memory comprising computer readable media), monitor 3022, which is coupled to a display adapter 3020, and others are shown. Peripherals and input / output (I / O) devices, which couple to an I / O controller 3012 (which can be a processor or other suitable controller), can be connected to the computer system by any number of means known in the art, such as a serial port 3024. For example, the serial port 3024 or external interface 3030 can be used to connect the computer apparatus to a wide area network such as the Internet, a mouse input device, or a scanner. The interconnection via system bus allows the central processor 3016 to communicate with each subsystem and to control the execution of instructions from system memory 3014 or the fixed disk 3028, as well as the exchange of information between subsystems. The system memory 3014 and / or the fixed disk 3028 may embody a computer readable medium.

[0085] FIG. 11 is a diagrammatic representation of an example computing system 4000 that includes a host machine 4002 within which a set of instructions to generate any one or more of the systems, models, and modules described herein and / or to perform any one or more of the methodologies described herein, according to at least one aspect of the present disclosure. In various aspects, the host machine 4002 operates as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the host machine 4002 may operate in the capacity of a server or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The host machine 4002 may be a computer or computing device, a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a cellular telephone, a portable music player (e.g., a portable hard drive audio device such asan Moving Picture Experts Group Audio Layer 3 (MP3) player), a web appliance, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while only a single machine is illustrated, the term “machine” shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0086] The example system 4000 includes the host machine 4002, running a host operating system (OS) 4004 on a processor or multiple processor(s) / processor core(s) 4006 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), and various memory nodes 4008. The host OS 4004 may include a hypervisor 4010 which is able to control the functions and / or communicate with a virtual machine (“VM”) 4012 running on machine readable media. The VM 4012 also may include a virtual CPU or vCPU 4014. The memory nodes 4008 may be linked or pinned to virtual memory nodes or vNodes 4016. When the memory node 4008 is linked or pinned to a corresponding vNode 4016, then data may be mapped directly from the memory nodes 4008 to the corresponding vNode 4016.

[0087] All the various components shown in host machine 4002 may be connected with and to each other, or communicate to each other via a bus (not shown) or via other coupling or communication channels or mechanisms. The host machine 4002 may further include a video display, audio device or other peripherals 4018 (e.g., a liquid crystal display (LCD), alpha-numeric input device(s) including, e.g., a keyboard, a cursor control device, e.g., a mouse, a voice recognition or biometric verification unit, an external drive, a signal generation device, e.g., a speaker,) a persistent storage device 4020 (also referred to as disk drive unit), and a network interface device 4022. The host machine 4002 may further include a data encryption module (not shown) to encrypt data. The components provided in the host machine 4002 are those typically found in computer systems that may be suitable for use with aspects of the present disclosure and are intended to represent a broad category of such computer components that are known in the art. Thus, the system 4000 can be a server, minicomputer, mainframe computer, or any other computer system. The computer may also include different bus configurations, networked platforms, multiprocessor platforms, and the like. Various operating systems may be used including UNIX, LINUX, WINDOWS, QNX ANDROID, IOS, CHROME, TIZEN, and other suitable operating systems.

[0088] The disk drive unit 4024 also may be a Solid-state Drive (SSD), a hard disk drive (HDD) or other includes a computer or machine-readable medium on which is stored one or more sets of instructions and data structures (e.g., data / instructions 4026) embodying or utilizing any one or more of the methodologies or functions described herein. Thedata / instructions 4026 also may reside, completely or at least partially, within the main memory node 4008 and / or within the processor(s) 4006 during execution thereof by the host machine 4002. The data / instructions 4026 may further be transmitted or received over a network 4028 via the network interface device 4022 utilizing any one of several well-known transfer protocols (e.g., Hyper Text Transfer Protocol (HTTP)).

[0089] The processor(s) 4006 and memory nodes 4008 also may comprise machine- readable media. The term "computer-readable medium" or “machine-readable medium” should be taken to include a single medium or multiple medium (e.g., a centralized or distributed database and / or associated caches and servers) that store the one or more sets of instructions. The term "computer-readable medium" shall also be taken to include any medium that is capable of storing, encoding, or carrying a set of instructions for execution by the host machine 4002 and that causes the host machine 4002 to perform any one or more of the methodologies of the present application, or that is capable of storing, encoding, or carrying data structures utilized by or associated with such a set of instructions. The term ’’computer-readable medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical and magnetic media, and carrier wave signals. Such media may also include, without limitation, hard disks, floppy disks, flash memory cards, digital video disks, random access memory (RAM), read only memory (ROM), and the like. The example aspects described herein may be implemented in an operating environment comprising software installed on a computer, in hardware, or in a combination of software and hardware.

[0090] One skilled in the art will recognize that Internet service may be configured to provide Internet access to one or more computing devices that are coupled to the Internet service, and that the computing devices may include one or more processors, buses, memory devices, display devices, input / output devices, and the like. Furthermore, those skilled in the art may appreciate that the Internet service may be coupled to one or more databases, repositories, servers, and the like, which may be utilized to implement any of the various aspects of the disclosure as described herein.

[0091] The computer program instructions also may be loaded onto a computer, a server, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0092] Suitable networks may include or interface with any one or more of, for instance, a local intranet, a PAN (Personal Area Network), a LAN (Local Area Network), a WAN (Wide Area Network), a MAN (Metropolitan Area Network), a virtual private network (VPN), a storage area network (SAN), a frame relay connection, an Advanced Intelligent Network (AIN) connection, a synchronous optical network (SONET) connection, a digital T1 , T3, E1 or E3 line, Digital Data Service (DDS) connection, DSL (Digital Subscriber Line) connection, an Ethernet connection, an ISDN (Integrated Services Digital Network) line, a dial-up port such as a V.90, V.34 or V.34bis analog modem connection, a cable modem, an ATM (Asynchronous Transfer Mode) connection, or an FDDI (Fiber Distributed Data Interface) or CDDI (Copper Distributed Data Interface) connection. Furthermore, communications may also include links to any of a variety of wireless networks, including WAP (Wireless Application Protocol), GPRS (General Packet Radio Service), GSM (Global System for Mobile Communication), CDMA (Code Division Multiple Access) or TDMA (Time Division Multiple Access), cellular phone networks, GPS (Global Positioning System), CDPD (cellular digital packet data), RIM (Research in Motion, Limited) duplex paging network, Bluetooth radio, or an IEEE 802.11 -based radio frequency network. The network 4028 can further include or interface with any one or more of an RS-232 serial connection, an IEEE-1394 (Firewire) connection, a Fiber Channel connection, an IrDA (infrared) port, a SCSI (Small Computer Systems Interface) connection, a USB (Universal Serial Bus) connection or other wired or wireless, digital or analog interface or connection, mesh or Digi® networking.

[0093] In general, a cloud-based computing environment is a resource that typically combines the computational power of a large grouping of processors (such as within web servers) and / or that combines the storage capacity of a large grouping of computer memories or storage devices. Systems that provide cloud-based resources may be utilized exclusively by their owners or such systems may be accessible to outside users who deploy applications within the computing infrastructure to obtain the benefit of large computational or storage resources.

[0094] The cloud is formed, for example, by a network of web servers that comprise a plurality of computing devices, such as the host machine 4002, with each server 4030 (or at least a plurality thereof) providing processor and / or storage resources. These servers manage workloads provided by multiple users (e.g., cloud resource customers or other users). Typically, each user places workload demands upon the cloud that vary in real-time, sometimes dramatically. The nature and extent of these variations typically depends on the type of business associated with the user.

[0095] It is noteworthy that any hardware platform suitable for performing the processing described herein is suitable for use with the technology. The terms “computer-readablestorage medium” and “computer-readable storage media” as used herein refer to any medium or media that participate in providing instructions to a CPU for execution. Such media can take many forms, including, but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media include, for example, optical or magnetic disks, such as a fixed disk. Volatile media include dynamic memory, such as system RAM. Transmission media include coaxial cables, copper wire and fiber optics, among others, including the wires that comprise one aspect of a bus. Transmission media can also take the form of acoustic or light waves, such as those generated during radio frequency (RF) and infrared (IR) data communications. Common forms of computer-readable media include, for example, a flexible disk, a hard disk, magnetic tape, any other magnetic medium, a CD-ROM disk, digital video disk (DVD), any other optical medium, any other physical medium with patterns of marks or holes, a RAM, a PROM, an EPROM, an EEPROM, a FLASH EPROM, any other memory chip or data exchange adapter, a carrier wave, or any other medium from which a computer can read.

[0096] Various forms of computer-readable media may be involved in carrying one or more sequences of one or more instructions to a CPU for execution. A bus carries the data to system RAM, from which a CPU retrieves and executes the instructions. The instructions received by system RAM can optionally be stored on a fixed disk either before or after execution by a CPU.

[0097] Computer program code for carrying out operations for aspects of the present technology may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++, or the like and conventional procedural programming languages, such as the "C" programming language, Go, Python, or other programming languages, including assembly languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0098] Examples of the devices, systems, and methods according to various aspects of the present disclosure are provided below in the following numbered clauses. An aspect of any of the devices(s), method(s) and / or system(s) may include any one or more than one, and any combination of, the numbered clauses described below.

[0099] Clause 1 - A computer-implemented method for determining an interestingnessvalue, the computer-implemented method comprising conditioning first raw transaction data based on transaction attributes to generate time-window indexed transaction combinations with first transaction size parameters, filtering the time-window indexed transaction combinations based on the first transaction size parameters to retain filtered time-window indexed transaction combinations with second transaction size parameters, and generating a first time series from the second transaction size parameters, wherein the first time series includes the second transaction size parameters. The computer-implemented method further comprises determining a statistical significance of the second transaction size parameters within the first time series, determining a horizontal contrast representing a historical behavior of the second transaction size parameters in the first time series, determining a vertical contrast representing a comparative behavior of the second transaction size parameters in the first time series and third transaction size parameters associated with a second time series that are based on second raw transaction data, and determining the interestingness value based on the statistical significance, the horizontal contrast, and the vertical contrast.

[0100] Clause 2 - The computer-implemented method of clause 1 , wherein the conditioning comprises generating a data set. The data set comprises data rows corresponding to the time-window indexed transaction combinations.

[0101] Clause 3 - The computer-implemented method of clause 2, wherein the conditioning comprises generating a new file comprising the data set.

[0102] Clause 4 - The computer-implemented method of any one of clauses 1-3, wherein the conditioning further comprises aggregating the time-window indexed transaction combinations into groups based on time-window index.

[0103] Clause 5 - The computer-implemented method of clause 4, wherein the groups are written into output files.

[0104] Clause 6 - The computer-implemented method of any one of clauses 1-5, wherein the first transaction size parameters comprise at least one of transaction count or transaction amount.

[0105] Clause 7 - The computer-implemented method of any one of clauses 1-6, wherein the second transaction size parameters are a subset of the first transaction size parameters.

[0106] Clause 8 - The computer-implemented method of clause 7, wherein filtering the time-window indexed transaction combinations is based on the first transaction size parameters satisfying a minimum threshold value.

[0107] Clause 9 - The computer-implemented method of any one of clauses 1-8, wherein the second transaction size parameters within the first time series are associated with a common set of transaction attributes.

[0108] Clause 10 - The computer-implemented method of any one of clauses 1-9, wherein the interestingness value is determined for a target time-window, wherein the first time series spans the target time-window and past time-windows preceding the target time-window.

[0109] Clause 11 - The computer-implemented method of clause 10, wherein determining the statistical significance is based on a subset of the second transaction size parameters associated with the target time-window and the past time-windows.

[0110] Clause 12 - The computer-implemented method of clause 11 , wherein the statistical significance is based on a maximum value, a mean value, or a minimum value of the subset of the second transaction size parameters.

[0111] Clause 13 - The computer-implemented method of any one of clauses 10-12, wherein determining the historical behavior comprises at least one of determining a rate of change in the second transaction size parameters of the first time series or determining an absolute change in the second transaction size parameters of the first time series.

[0112] Clause 14 - The computer-implemented method of clause 13, wherein determining the historical behavior comprises determining the rate of change and the absolute change in the second transaction size parameters of the first time series.

[0113] Clause 15 - The computer-implemented method of any one of clauses 13-14, wherein determining the rate of change is based on:wherein t is a time-window index of the target time-window, s is a number of the past time-windows preceding the target time-window in the first time series, 8(t) is a difference between second transaction size parameters of time-window t and a preceding time-window t - 1, p is a mean; and a is a standard deviation.

[0114] Clause 16 - The computer-implemented method of any one of clauses 13-15, wherein determining the absolute change is based on:wherein t is a time-window index of the target time-window, % is a number of the past time-windows preceding the target time-window in the first time series, TS(t) is a second transaction size parameter of time-window t, and p is a mean.

[0115] Clause 17 - The computer-implemented method of any one of clauses 1-16, wherein the vertical contrast is based on a first rate of change and a second rate of change. The first rate of change is associated with the second transaction size parameters and the second rate of change associated with the third transaction size parameters.

[0116] Clause 18 - The computer-implemented method of clause 17, wherein the vertical contrast is based on:wherein Avis the vertical contrast, rcis the first rate of change associated with the second transaction size parameters, rC1is the second rate of change associated with the third transaction size parameters, and p is a mean.

[0117] Clause 19 - The computer-implemented method of any one of clauses 1-18, further comprising determining a first binary representation of the first time series, and identifying the second time series based on having a second binary representation comparable to the first binary representation.

[0118] Clause 20 - The computer-implemented method of clause 19, wherein the first binary representation is determined based on a downsampled version of the first time series.

[0119] Further, it is understood that any one or more of the following-described forms, expressions of forms, examples, can be combined with any one or more of the other following-described forms, expressions of forms, and examples.

[0120] While several forms have been illustrated and described, it is not the intention of Applicant to restrict or limit the scope of the appended claims to such detail. Numerous modifications, variations, changes, substitutions, combinations, and equivalents to those forms may be implemented and will occur to those skilled in the art without departing from the scope of the present disclosure. Moreover, the structure of each element associated with the described forms can be alternatively described as a means for providing the function performed by the element. Also, where materials are disclosed for certain components, other materials may be used. It is therefore to be understood that the foregoing description and the appended claims are intended to cover all such modifications, combinations, and variations as falling within the scope of the disclosed forms. The appended claims are intended to cover all such modifications, variations, changes, substitutions, modifications, andequivalents.

[0121] As used herein, a “server” may include one or more computing devices which can be individual, stand-alone machines located at the same or different locations, may be owned or operated by the same or different entities, and may further be one or more clusters of distributed computers or “virtual” machines housed within a datacenter. It should be understood and appreciated by a person of skill in the art that functions performed by one “server” can be spread across multiple disparate computing devices for various reasons. As used herein, a “server” is intended to refer to all such scenarios and should not be construed or limited to one specific configuration. Further, a server as described herein may, but need not, reside at (or be operated by) a merchant, a payment network, a financial institution, a healthcare provider, a social media provider, a government agency, or agents of any of the aforementioned entities. The term “server” may also refer to or include one or more processors or computers, storage devices, or similar computer arrangements that are operated by or facilitate communication and processing for multiple parties in a network environment, such as the Internet, although it will be appreciated that communication may be facilitated over one or more public or private network environments and that various other arrangements are possible. Further, multiple computers, e.g., servers, or other computerized devices, e.g., point-of-sale devices, directly or indirectly communicating in the network environment may constitute a “system,” such as a merchant's point-of-sale system. Reference to “a server” or “a processor,” as used herein, may refer to a previously recited server and / or processor that is recited as performing a previous step or function, a different server and / or processor, and / or a combination of servers and / or processors. For example, as used in the specification and the claims, a first server and / or a first processor that is recited as performing a first step or function may refer to the same or different server and / or a processor recited as performing a second step or function.

[0122] The term “system” may refer to one or more computing devices or combinations of computing devices (e.g., processors, servers, client devices, software applications, modules, components of such, and / or the like). For example, a system may include a plurality of computing devices that include software applications, where the plurality of computing devices are connected via a network.

[0123] As used herein, a “server computer” may describe a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. The server computer may be associated with an entity such as a payment processing network, a wallet provider, a merchant, an authentication cloud, an acquirer or an issuer. In one example, the server computer may be a database server coupled to a Web server. The server computer may be coupled to adatabase and may include any hardware, software, other logic, or combination of the preceding for servicing the requests from one or more client computers. The server computer may comprise one or more computational apparatuses and may use any of a variety of computing structures, arrangements, and compilations for servicing the requests from one or more client computers. In some embodiments or aspects, the server computer may provide and / or support payment network cloud service.

[0124] Reference to “a device,” “a server,” “a processor,” and / or the like, as used herein, may refer to a previously recited device, server, or processor that is recited as performing a previous step or function, a different server or processor, and / or a combination of servers and / or processors. For example, as used in the specification and the claims, a first server or a first processor that is recited as performing a first step or a first function may refer to the same or different server or the same or different processor recited as performing a second step or a second function.

[0125] One or more components may be referred to herein as “configured to,” “configurable to,” “operable / operative to,” “adapted / adaptable,” “able to,” “conformable / conformed to,” etc. Those skilled in the art will recognize that “configured to” can generally encompass active-state components and / or inactive-state components and / or standby-state components, unless context requires otherwise.

[0126] Those skilled in the art will recognize that, in general, terms used herein, and especially in the appended claims (e.g., bodies of the appended claims) are generally intended as “open” terms (e.g., the term “including” should be interpreted as “including but not limited to,” the term “having” should be interpreted as “having at least,” the term “includes” should be interpreted as “includes but is not limited to,” etc.). It will be further understood by those within the art that if a specific number of an introduced claim recitation is intended, such an intent will be explicitly recited in the claim, and in the absence of such recitation no such intent is present. For example, as an aid to understanding, the following appended claims may contain usage of the introductory phrases “at least one” and “one or more” to introduce claim recitations. However, the use of such phrases should not be construed to imply that the introduction of a claim recitation by the indefinite articles “a” or “an” limits any particular claim containing such introduced claim recitation to claims containing only one such recitation, even when the same claim includes the introductory phrases “one or more” or “at least one” and indefinite articles such as “a” or “an” (e.g., “a” and / or “an” should typically be interpreted to mean “at least one” or “one or more”); the same holds true for the use of definite articles used to introduce claim recitations.

[0127] The term “substantially”, “about”, or “approximately” as used in the presentdisclosure, unless otherwise specified, means an acceptable error for a particular value as determined by one of ordinary skill in the art, which depends in part on how the value is measured or determined. In certain aspects, the term “substantially”, “about”, or “approximately” means within 1, 2, 3, or 4 standard deviations. In certain aspects, the term “substantially”, “about”, or “approximately” means within 50%, 20%, 15%, 10%, 9%, 8%, 7%, 6%, 5%, 4%, 3%, 2%, 1%, 0.5%, or 0.05% of a given value or range.

[0128] In addition, even if a specific number of an introduced claim recitation is explicitly recited, those skilled in the art will recognize that such recitation should typically be interpreted to mean at least the recited number (e.g., the bare recitation of “two recitations,” without other modifiers, typically means at least two recitations, or two or more recitations). Furthermore, in those instances where a convention analogous to “at least one of A, B, and C, etc.” is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., “a system having at least one of A, B, and C” would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and / or A, B, and C together, etc.). In those instances where a convention analogous to “at least one of A, B, or C, etc.” is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., “a system having at least one of A, B, or C” would include but not be limited to systems that have A alone, B alone, C alone, A and B together, A and C together, B and C together, and / or A, B, and C together, etc.). It will be further understood by those within the art that typically a disjunctive word and / or phrase presenting two or more alternative terms, whether in the description, claims, or drawings, should be understood to contemplate the possibilities of including one of the terms, either of the terms, or both terms unless context dictates otherwise. For example, the phrase “A or B” will be typically understood to include the possibilities of “A” or “B” or “A and B.”

[0129] With respect to the appended claims, those skilled in the art will appreciate that recited operations therein may generally be performed in any order. Also, although various operational flow diagrams are presented in a sequence(s), it should be understood that the various operations may be performed in other orders than those which are illustrated, or may be performed concurrently. Examples of such alternate orderings may include overlapping, interleaved, interrupted, reordered, incremental, preparatory, supplemental, simultaneous, reverse, or other variant orderings, unless context dictates otherwise. Furthermore, terms like “responsive to,” “related to,” or other past-tense adjectives are generally not intended to exclude such variants, unless context dictates otherwise.

[0130] It is worthy to note that any reference to “one aspect,” “an aspect,” “an exemplification,” “one exemplification,” and the like means that a particular feature, structure,or characteristic described in connection with the aspect is included in at least one aspect. Thus, appearances of the phrases “in one aspect,” “in an aspect,” “in an exemplification,” and “in one exemplification” in various places throughout the specification are not necessarily all referring to the same aspect. Furthermore, the particular features, structures or characteristics may be combined in any suitable manner in one or more aspects.

[0131] As used herein, the singular form of “a”, “an”, and “the” include the plural references unless the context clearly dictates otherwise.

[0132] Any patent application, patent, non-patent publication, or other disclosure material referred to in this specification and / or listed in any Application Data Sheet is incorporated by reference herein, to the extent that the incorporated materials is not inconsistent herewith. As such, and to the extent necessary, the disclosure as explicitly set forth herein supersedes any conflicting material incorporated herein by reference. Any material, or portion thereof, that is said to be incorporated by reference herein, but which conflicts with existing definitions, statements, or other disclosure material set forth herein will only be incorporated to the extent that no conflict arises between that incorporated material and the existing disclosure material.

[0133] In summary, numerous benefits have been described which result from employing the concepts described herein. The foregoing description of the one or more forms has been presented for purposes of illustration and description. It is not intended to be exhaustive or limiting to the precise form disclosed. Modifications or variations are possible in light of the above teachings. The one or more forms were chosen and described in order to illustrate principles and practical application to thereby enable one of ordinary skill in the art to utilize the various forms and with various modifications as are suited to the particular use contemplated. It is intended that the claims submitted herewith define the overall scope.

Claims

CLAIMSWhat is claimed is:

1. A computer-implemented method for determining an interestingness value, the computer-implemented method comprising: conditioning first raw transaction data based on transaction attributes to generate time-window indexed transaction combinations with first transaction size parameters; filtering the time-window indexed transaction combinations based on the first transaction size parameters to retain filtered time-window indexed transaction combinations with second transaction size parameters; generating a first time series from the second transaction size parameters, wherein the first time series includes the second transaction size parameters; determining a statistical significance of the second transaction size parameters within the first time series; determining a horizontal contrast representing a historical behavior of the second transaction size parameters in the first time series; determining a vertical contrast representing a comparative behavior of the second transaction size parameters in the first time series and third transaction size parameters associated with a second time series that are based on second raw transaction data; and determining the interestingness value based on the statistical significance, the horizontal contrast, and the vertical contrast.

2. The computer-implemented method of claim 1, wherein the conditioning comprises generating a data set, wherein the data set comprises data rows corresponding to the time-window indexed transaction combinations.

3. The computer-implemented method of claim 2, wherein the conditioning comprises generating a new file comprising the data set.

4. The computer-implemented method of claim 1, wherein the conditioning further comprises aggregating the time-window indexed transaction combinations into groups based on time-window index.

5. The computer-implemented method of claim 4, wherein the groups are written into output files.

6. The computer-implemented method of claim 1, wherein the first transaction size parameters comprise at least one of transaction count or transaction amount.

7. The computer-implemented method of claim 1, wherein the second transaction size parameters are a subset of the first transaction size parameters.

8. The computer-implemented method of claim 7, wherein filtering the time-window indexed transaction combinations is based on the first transaction size parameters satisfying a minimum threshold value.

9. The computer-implemented method of claim 1, wherein the second transaction size parameters within the first time series are associated with a common set of transaction attributes.

10. The computer-implemented method of claim 1, wherein the interestingness value is determined for a target time-window, wherein the first time series spans the target time-window and past time-windows preceding the target time-window.

11. The computer-implemented method of claim 10, wherein determining the statistical significance is based on a subset of the second transaction size parameters associated with the target time-window and the past time-windows.

12. The computer-implemented method of claim 11, wherein the statistical significance is based on a maximum value, a mean value, or a minimum value of the subset of the second transaction size parameters.

13. The computer-implemented method of claim 10, wherein determining the historical behavior comprises at least one of determining a rate of change in the second transactionsize parameters of the first time series or determining an absolute change in the second transaction size parameters of the first time series.

14. The computer-implemented method of claim 13, wherein determining the historical behavior comprises determining the rate of change and the absolute change in the second transaction size parameters of the first time series.

15. The computer-implemented method of claim 13, wherein determining the rate of change is based on:wherein: t is a time-window index of the target time-window; s is a number of the past time-windows preceding the target time-window in the first time series;8(t) is a difference between second transaction size parameters of time-window t and a preceding time-window t - 1;|i is a mean; and o- is a standard deviation.

16. The computer-implemented method of claim 13, wherein determining the absolute change is based on:wherein: t is a time-window index of the target time-window; x is a number of the past time-windows preceding the target time-window in the first time series;TS(t) is a second transaction size parameter of time-window t; and|i is a mean.

17. The computer-implemented method of claim 1, wherein the vertical contrast is based on: a first rate of change associated with the second transaction size parameters; and a second rate of change associated with the third transaction size parameters.

18. The computer-implemented method of claim 17, wherein the vertical contrast is based on:wherein:Avis the vertical contrast; rcis the first rate of change associated with the second transaction size parameters; rC1is the second rate of change associated with the third transaction size parameters; and|i is a mean.

19. The computer-implemented method of claim 1, further comprising: determining a first binary representation of the first time series; and identifying the second time series based on having a second binary representation comparable to the first binary representation.

20. The computer-implemented method of claim 19, wherein the first binary representation is determined based on a downsampled version of the first time series.

Images