Method, system and computer program

Abstract

To provide methods, systems and computer programs.SOLUTION: Aspects of the present disclosure relate to identifying and quantifying relationships between entities. Data sources can be queried to receive data regarding a party. Entities can be extracted from the data to receive a set of entities, where the party is a first entity of the set of entities. An ontological structure can be built that interrelates entities within the set of entities. An initial relationship strength between the first entity and a second entity can be determined based on co-occurrence between the first and second entities, where the second entity is a second party. A relationship score between the first and second entities can be calculated based on the initial relationship strength and at least one additional factor.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates generally to the field of data analysis, and more particularly to discovering and quantifying non-obvious relationships between entities in data. [Background technology]

[0002] There is a huge amount of unstructured data that can be utilized to derive valuable insights from it. Data analytics techniques attempt to interpret meaningful information from unstructured data. This is completed so that future decisions can be made based on information (e.g., patterns) extracted from the unstructured data. Summary of the Invention [Problem to be solved by the invention]

[0003] The present disclosure has been made in consideration of the above, and aims to provide a method, system, and computer program capable of identifying and quantifying relationships between entities. [Means for solving the problem]

[0004] Embodiments of the present disclosure include methods, computer programs, and systems for identifying and quantifying relationships between entities. A data source may be queried to receive data regarding a party. Entities may be extracted from the data to receive a set of entities, where the party is a first entity of the set of entities. An ontology structure may be constructed that correlates entities within the set of entities. An initial relationship strength between the first entity and a second entity may be determined based on co-occurrence between the first entity and the second entity, where the second entity is a second party. A relationship score between the first entity and the second entity may be calculated based on the initial relationship strength and at least one additional factor.

[0005] The above summary is not intended to describe each illustrated embodiment or every implementation of the present disclosure.

[0006] The drawings contained in this disclosure are incorporated in and constitute a part of the specification. They illustrate embodiments of the disclosure and, together with the description, serve to explain the principles of the disclosure. The drawings are only intended to illustrate exemplary embodiments and are not intended to limit the disclosure. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a block diagram illustrating an example computing environment in which the described embodiments of the present disclosure can be implemented. [Diagram 2] FIG. 2 is a block diagram illustrating a relationship discovery system according to an embodiment of the present disclosure. [Diagram 3] FIG. 3 is a flow diagram illustrating a method for identifying and quantifying relationships between a party and at least one counterparty according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a block diagram illustrating a cloud computing environment according to an embodiment of the present disclosure. [Diagram 5] FIG. 5 is a block diagram illustrating abstraction model layers according to an embodiment of the present disclosure. [Figure 6] FIG. 6 is a high-level block diagram illustrating an example computer system that can be used to implement one or more of the methods, tools and modules and any associated functionality described herein in accordance with an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] While the embodiments described herein are susceptible to various modifications and alternative forms, specifics of which have been shown by way of example in the drawings and will be described in detail. It is to be understood, however, that the particular embodiments described are not to be treated in a limiting sense. On the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope of the disclosure.

[0009] Aspects of the present disclosure relate generally to the field of data analysis, and more specifically to discovering and quantifying non-obvious relationships between entities in data. The present disclosure is not necessarily limited to such applications, although various aspects of the present disclosure may be appreciated through the discussion of various examples using this context.

[0010] There is a huge amount of unstructured data that can be utilized to derive valuable insights from it. Data analytics techniques attempt to interpret meaningful information from unstructured data. This is completed so that future decisions can be made based on information (e.g., patterns) extracted from the unstructured data.

[0011] Understanding relationships between entities in data can be important. Relationships describe how two or more entities (e.g., people, places, things, etc.) are connected. Discovering relationships between entities in data can be beneficial in areas such as natural language processing (e.g., semantics), health (e.g., mining health data for insights into diseases, symptoms, diagnoses and treatments, etc.), fraud detection, etc. As an example, understanding how a given party (a person or company) is related to other parties provides insight into whether the party is committing abusive behavior (e.g., fraud) with the help of one or more other parties.

[0012] Aspects of the disclosure relate to identifying and quantifying relationships between entities. A data source may be queried to receive data regarding a party. Entities may be extracted from the data to receive a set of entities, where the party is a first entity of the set of entities. An ontology structure may be constructed that correlates entities within the set of entities. An initial relationship strength between the first entity and a second entity may be determined based on co-occurrence between the first entity and the second entity, where the second entity is a second party. A relationship score between the first entity and the second entity may be calculated based on the initial relationship strength and at least one additional factor.

[0013] 1 is a block diagram illustrating an example computing environment 100 in which an example embodiment of the present disclosure can be implemented. The computing environment 100 includes a plurality of devices 105-1, 105-2, . . . 105-N (collectively referred to as devices 105), at least one server 135, and a network 150.

[0014] Consistent with various embodiments, the server 135 and the device 105 are computer systems. The device 105 and the server 135 each include one or more processors 115-1, 115-2...115-N (collectively referred to as processors 115) and 145, and one or more memories 120-1, 120-2...120-N (collectively referred to as memories 120) and 155. The device 105 and the server 135 may be configured to communicate with each other via internal or external network interfaces 110-1, 110-2...110-N (collectively referred to as network interfaces 110) and 140. The network interfaces 110 and 140 are, in some embodiments, modems or network interface cards. The device 105 or the server 135 or both may include a display or monitor. In addition, device 105 and / or server 135 may optionally include input devices (e.g., keyboard, mouse, scanner, video camera, or other input devices) and / or any commercially available or custom software (e.g., browser software, communications software, server software, natural language processing software, search engine and / or web crawler software, image processing software, etc.) Device 105 and / or server 135 may be a server, desktop, laptop, or handheld device.

[0015] The devices 105 and the server 135 may be remote from each other and may communicate over the network 150. In some embodiments, the server 135 may be a central hub from which the devices 105 establish a communication connection, such as in a client-server networking model. Alternatively, the server 135 and the devices 105 may be configured in any other suitable networking relationship (e.g., in a peer-to-peer (P2P) configuration or using any other network topology).

[0016] In some embodiments, the network 150 may be implemented using any number of suitable communication media. For example, the network 150 may be a wide area network (WAN), a local area network (LAN), the Internet, or an intranet. In certain embodiments, the device 105 and the server 135 may be local to each other and communicate via a suitable local communication medium. For example, the device 105 and the server 135 may communicate using a local area network (LAN), one or more hardwired connections, a wireless link or router, or an intranet. In some embodiments, the device 105 and the server 135 may be communicatively coupled using one or more networks or one or more local connections, or a combination thereof. For example, the first device 105-1 may be hardwired (e.g., connected by an Ethernet cable) to the server 135, while the second device 105-2 may communicate with the server 135 using the network 150 (e.g., over the Internet).

[0017] In some embodiments, network 150 is implemented within a cloud computing environment or with one or more cloud computing services. Consistent with various embodiments, a cloud computing environment may include a network-based distributed data processing system that provides one or more cloud computing services. Additionally, a cloud computing environment may include a large number of computers (e.g., hundreds or thousands of computers or more) located in one or more data centers and configured to share resources via network 150.

[0018] Server 135 includes relationship discovery application 160. Relationship discovery application 160 is configured to identify relationships between a given party and other entities within data (e.g., unstructured data) and then quantify the relationships between the party and other entities within the data (e.g., by calculating a relationship score).

[0019] The relationship discovery application 160 may be configured to first receive data related to a party. In an embodiment, receiving the data related to the party may include querying one or more sources (e.g., internet sources, databases, etc.) for data including the party. The data associated with the party may then be filtered, for example, to disambiguate related parties, to remove redundant documents, to remove irrelevant data, etc. Entity extraction (e.g., named entity recognition (NER)) may then be performed to extract entities (e.g., names, organizations, locations, quantities, time expressions, etc.) from the data associated with the party. A knowledge graph (e.g., an ontology structure) is then generated based on the extracted entities, where the knowledge graph depicts relationships (e.g., hierarchical and non-hierarchical) between the party and other entities (e.g., counterparties) extracted from the data.

[0020] In an embodiment, an initial relationship strength may be determined between the party and other entities in the data. For example, the initial relationship strength may be calculated based on the number of times the party co-occurs with the counterparty divided by the number of times the party co-occurs with other parties. The initial relationship strength for a given party and counterparty may be referred to as a togetherness index.

[0021] Thereafter, the relationship discovery application 160 may analyze additional factors that affect the relationship score (e.g., between a party and a counterparty). For example, a relationship timeline of the party and counterparty may be determined by analyzing the received data. This may include determining the period during which the party and counterparty have been related. For example, the time of initial co-occurrence, the length of co-occurrence, the gap in time during which co-occurrence does not occur, the recency of the co-occurrence, etc. may be determined.

[0022] In an embodiment, the relationship discovery application 160 may determine the reasons for the co-occurrence. For example, a classifier (e.g., a natural language processing (NLP)-based classifier, a machine learning (ML)-based classifier, etc.) may be used to classify one or more reasons for the co-occurrence for each co-occurrence instance based on an analysis of the received data. The reasons for the co-occurrence may affect the relationship score such that certain reasons for the co-occurrence have a greater impact on the calculated relationship score between a party and a counterparty. For example, a co-occurrence with the classification "scandal" may have a greater impact on calculating the relationship score compared to a co-occurrence with the classification "networking event."

[0023] Thereafter, the relationship discovery application 160 may determine the network surrounding the party and the counterparty. This provides an indication of the entities that bridge the party and the counterparty. Thus, even if the party and the counterparty are not directly related, an indirect relationship is identified based on the entities that the party and the counterparty have in common. For example, the network may suggest that the party and the counterparty are associated with similar locations or similar parties or both. This may further enhance the calculation of the relationship score.

[0024] The familiarity index, the timeline of co-occurrence, the reasons for co-occurrence, or the network surrounding the party and the counterparty, or a combination thereof, may be used to calculate the relationship score. In an embodiment, a normalized value indicating the relationship strength may be calculated for each factor, and the relationship score may be calculated by adding each factor multiplied by its respective weight. For example, the relationship score R may be calculated according to the formula R=f1×w1+f2×w2+f3×w3...+f n ×w n where f represents each factor, w represents each weight, and n represents the total number of factors. It should be noted that the factors listed above are merely exemplary, and any suitable type and / or number of factors used to calculate the relationship score may be implemented without departing from the spirit and scope of the present disclosure. Furthermore, the manner in which the relationship score is calculated (e.g., by adding several weighted factors) may vary and is not limited to what is described.

[0025] In some embodiments, the relationship score may represent a risk between a party and a counterparty. For example, the magnitude of the relationship score represents a risk that the party and the counterparty may be involved in fraudulent activities such as fraud. As an example, if a given party, Party A, and a counterparty, Party B, are involved in an insurance claim, the relationship discovery application 160 analyzes unstructured data associated with Party A and Party B. Even if the relationship between Party A and Party B is not self-evident, upon analyzing the received data (e.g., news, social media, internet resources, Securities and Exchange Commission (SEC) filings, etc.), the relationship discovery application 160 may be able to identify that Party A and Party B are indeed related. For example, based on the analysis of the data, it may be determined that Party A and Party B have co-occurred in the past, the reason for the co-occurrence is related to fraudulent activities, and further that Party A and Party B are involved in a network of related entities. As a result, a relationship score may be calculated based on the above factors and represents the risk that the parties may be involved in insurance claim fraud. In these embodiments, the weighting of the factors may be adjusted to more closely represent the risk associated with the parties, for example, co-occurrence reasons may be weighted relatively higher than other relationship score factors.

[0026] In embodiments, one or more actions may be issued based on the relationship score. In some embodiments, the relationship score may be added to a knowledge graph edge between the party and each associated entity. This may augment knowledge in the domain by identifying relational attributes of ontology structures that include the party of interest. Additionally, the calculated relationship score may be more accurate than those calculated by other means (e.g., based on NLP context or using ML algorithms) because the relationship score considers additional factors that other relationship strength quantifiers do not consider (e.g., timeline of co-occurrence, reasons for co-occurrence, networks involved).

[0027] In some embodiments, the relationship score may be compared to one or more thresholds, and one or more actions may be issued based on the comparison of the relationship score to the one or more thresholds. For example, in embodiments in which the relationship score represents risk, if the relationship score exceeds a threshold, the actions may include, for example, further investigating one or more entities, denying one or more transactions (e.g., insurance claims or deposit withdrawals), or contacting authorities responsible for preventing fraudulent activity, or a combination thereof.

[0028] It should be noted that although reference has been made to examples in which the relationship scores represent risk, the relationship scores may represent any suitable characteristic and are not limited to those described.

[0029] While this disclosure concerns the collection of personal data, it is noted that in an embodiment, users opt-in to the system. In doing so, they are informed of what data is collected and how it is used, that any personal data collected may be encrypted during use, that users may opt-out at any time, and that if they opt-out, any of their personal data will be deleted.

[0030] It should be noted that Figure 1 is intended to illustrate representative major components of an exemplary computing environment 100. In some embodiments, however, the individual components may have greater or less complexity than depicted in Figure 1, other components may be present other than or in addition to those shown in Figure 1, and the number, type and configuration of such components may vary.

[0031] Although Figure 1 depicts a computing environment 100 having a single server 135, a suitable computing environment for implementing embodiments of the present disclosure may include any number of servers. The various models, modules, systems and components illustrated in Figure 1 may exist across multiple servers and devices, if such is the case. For example, some embodiments may include two servers. The two servers may be communicatively coupled using any suitable communications connection (e.g., using a WAN, LAN, wired connection, intranet, or the Internet).

[0032] 2, a diagram illustrating a computing environment 200 in which an exemplary embodiment of the present disclosure may be implemented is shown. The computing environment 200 includes a data source 205, a relationship discovery system 210, and a device 255, which may be communicatively coupled using a network (e.g., network 150 of FIG. 1). It should be noted that while a single device 255 is shown, in an embodiment, the device 255 represents multiple devices, servers, or computing nodes, or a combination thereof. Additionally, the various models, modules, systems, and components shown in the relationship discovery system 210 may exist across multiple computing devices, if at all.

[0033] The relationship discovery system 210 may be configured to identify and quantify relationships between a party and one or more counterparties. The functionality of the relationship discovery system 210 may be the same as or substantially similar to the relationship discovery application 160 of FIG. 1. The relationship discovery system 210 includes a data receiving and filtering module 215, an entity extractor 220, and a relationship score determiner 225. The functionality of the data receiving and filtering module 215, the entity extractor 220, and the relationship score determiner 225 may be processor-executable instructions that may be executed by a dedicated or shared processor using received inputs.

[0034] The data receiving and filtering module 215 may be configured to receive data associated with one or more parties. In an embodiment, the data receiving and filtering module 215 may be configured to collect data from the data sources 205 in response to a user command (e.g., from the device 255) or a predefined trigger (e.g., an insurance claim submission, a user opt-in, etc.). The data receiving and filtering module 215 queries the data sources 205 to collect data about one or more parties, for example, by using the names of the one or more parties as an input query. In an embodiment, the queried parties are a party of interest and one or more potentially related counterparties. The data sources 205 then return all relevant data related to the queried parties. The data receiving and filtering module 215 is configured to filter the received data, for example, to disambiguate related parties (e.g., parties with similar names), to remove redundant documents, and to remove irrelevant data.

[0035] In an embodiment, the data receiving and filtering module 215 may be configured to preprocess the data, for example, by converting the data format (e.g., from PDF to plain text), by converting voice data to text (e.g., using a speech-to-text converter), by converting image data to text (e.g., using image recognition to extract terms from images), or by performing natural language processing techniques on the data, such as part-of-speech (POS) tagging, parsing, lemma processing, syntactic analysis, and semantic analysis, or a combination thereof.

[0036] Data sources 205 may include any suitable type of data, including text, image, audio, and video data. Additionally, data sources 205 may originate from any suitable source, including internet resources (e.g., social media data, GOOGLE®) and databases (e.g., relational databases such as IBM® DB2). Examples of data sources 205 include, but are not limited to, social media pages / posts, SEC documents, Wikipedia® entries, and news articles.

[0037] The data relating to the one or more parties is then passed to the entity extractor 220. The entity extractor 220 may be configured to extract entities from the data. An "entity" may be a person, an organization, a company, a place, a time expression, a monetary value, an amount, or any other suitable entity that is mapped to a corresponding label. In embodiments, the entity extractor 220 may be configured to perform Named Entity Recognition (NER). NER may be completed in any manner. In some embodiments, the entity extractor 220 may be configured to perform a neural network based NER algorithm. In these embodiments, a neural network may be trained to recognize entity types of entities present in the input data. In some embodiments, a rule-based NER process may be implemented. Such systems include IBM® SystemT and IBM® INFOSPHERE® Data Quality Framework (DQF). However, entities may be extracted from the data in any other suitable manner. For example, techniques for extracting concepts from data may be applied to extract entities. Such techniques include, but are not limited to, C-value / NC-value, contrast analysis, co-occurrence analysis, latent semantic analysis, clustering, syntactic analysis, subcategorization frames and the use of seed words.

[0038] Upon extracting the entities, the data is passed to a relationship score determiner 225 so that relationships between the entities can be identified and quantified. A knowledge graph (KG) builder 230 of the relationship score determiner 225 may be configured to build a knowledge graph that includes concepts / relationships surrounding the queried party or parties. Building the knowledge graph may include applying ontology learning techniques including categorizing concepts (e.g., receiving the entities extracted by the entity extractor 220), deriving concept hierarchies (using hierarchical clustering techniques), learning non-taxonomic relationships (using, e.g., association rule mining, term substitution, dependency analysis, lexicon syntactic pattern analysis, etc.), and discovering rules (using, e.g., inductive logic programming). The knowledge graph visually represents the relationships (hierarchical or non-hierarchical) between the extracted entities. However, in some embodiments, an ontology data structure may be constructed without the necessity of requiring the creation of a knowledge graph, without departing from the spirit and scope of the present disclosure.

[0039] The relationship strength determiner 235 may be configured to determine an initial relationship strength (familiarity index) between parties (e.g., classified as concepts) in the knowledge graph. Determining the initial relationship strength may be completed in any suitable manner. In some embodiments, the initial relationship strength is determined based on the number of times the first and second parties co-occurred divided by the number of times the first and second parties co-occurred with other entities. For example, if the first and second parties co-occur 10 times, but the first and second parties co-occur 100 times with other parties, the initial relationship strength may be calculated as 10 / 100 (e.g., 0.10, 10%). However, the initial relationship strength may be determined in any other suitable manner. For example, the initial relationship strength may be determined based on the number of times the first and second parties co-occur divided by the number of times the first party co-occurs with other entities, or based on the number of times the first and second parties co-occur divided by the number of times the second party co-occurs with other entities. Upon determining the initial relationship strength, additional factors that affect the relationship score calculated by relationship score determiner 225 may be determined.

[0040] The relationship timeline determiner 240 may be configured to determine the duration of co-occurrence between a party and an associated counterparty. This may include determining the start time of the co-occurrence, the frequency of the co-occurrence over time, time gaps during which co-occurrence has not occurred, and the most recent point in time of co-occurrence. The co-occurrence timing may be used to enhance the relationship score calculation, such that the recency, length, and frequency over time of the co-occurrence all affect the strength of the relationship between two given parties. In an embodiment, the relationship timeline determiner 240 may determine the timeline of co-occurrence based on the generated time representation (e.g., from the entity extractor 220) compared to the co-occurrence instances. For example, if a news article published on "October 21, 2015" includes a co-occurrence between a first and second party, then "October 21, 2015" may be included within the timeline of co-occurrence. This may be completed for each instance of co-occurrence. That is, each instance of co-occurrence may be directly associated with a time expression until a timeline of co-occurrences based on available data between parties and counterparties is generated.

[0041] The relationship reason determiner 245 may be configured to classify the reasons for co-occurrence between the party and the counterparty. This may include classifying the reasons for co-occurrence for each instance of co-occurrence. In an embodiment, classifying the reasons for co-occurrence may be completed based on the context surrounding the co-occurrence between the parties. For example, given the sentence "John met Thomas for dinner", the relationship reason determiner 245 may specify that the reason for co-occurrence is "dinner" for this instance of co-occurrence between John and Thomas. In an embodiment, a classifier, such as an NLP or ML-based classifier, may be configured to classify the reasons for co-occurrence between the two parties. The reasons for co-occurrence may affect the calculation of the relationship score, with some reasons for co-occurrence having a greater impact on the relationship score compared to others.

[0042] The network identifier 250 may be configured to identify networks surrounding the party and the counterparty. This may provide an indication as to the entities that bridge the party and the counterparty. Thus, even if the party and the counterparty are not directly related, an indirect relationship may be identified based on entities common to the party and the counterparty. For example, a network may indicate that the party and the counterparty are associated with similar locations or similar parties or both. In an embodiment, the network identifier 250 may identify a number of entities through which the party and the counterparty are related to each other. This may be used to enhance the relationship score calculation.

[0043] The relationship score determiner 225 may then be configured to convert each of the initial relationship strengths (e.g., familiarity index), relationship timeline, relationship reasons, and networks between the party and the counterparty into normalized factor values ​​for use in calculating the relationship score. For example, relationship score factor values ​​may be generated having values ​​between 0 and 1 for each of the relationship strengths, relationship timeline, relationship reasons, and networks. Each of the factors is then multiplied by its respective weight and added together to arrive at a final relationship score. For example, the relationship score R may be calculated according to the formula R=f1×w1+f2×w2+f3×w3...+f n ×w n where f represents each factor, w represents each weight, and n represents the total number of factors. It should be noted that the factors described above are merely exemplary, and any suitable type and / or number of factors used to calculate the relationship score may be implemented without departing from the spirit and scope of the present disclosure. Furthermore, the manner in which the relationship score is calculated (e.g., adding several weighted factors) may be varied and is not limited to what is described.

[0044] In an embodiment, the conversion of each factor to a normalized value and the weighting of the factors used to calculate the relationship score may be fine-tuned, for example using machine learning algorithms. That is, feedback may be received regarding the strength of the relationship between a given party and a counterparty, and the feedback may be compared to the relationship score calculated by the relationship score determiner 225. Based on the feedback as compared to the output relationship score, one or more algorithms used to normalize the factors to values ​​and / or assign weightings to each factor may be adjusted.

[0045] Machine learning algorithms that can be used to adjust the normalized values ​​for each factor and / or adjust the weights associated with each factor include, but are not limited to, decision tree learning, association rule learning, artificial neural networks, deep learning, inductive logic programming, support vector machines, clustering, Bayesian networks, reinforcement learning, representation learning, similarity / metric training, sparse dictionary learning, genetic algorithms, rule-based learning, or other machine learning techniques or combinations thereof.

[0046] For example, the machine learning algorithm may include one or more of the following exemplary techniques: K-Nearest Neighbor (KNN), Learning Vector Quantization (LVQ), Self-Organizing Map (SOM), logistic regression, Ordinary Least Squares Regression (OLSE), linear regression, stepwise regression, Multivariate Adaptive Regression Spline (MARS), Ridge Regression, Least Absolute Shrinkage and Selection Operator (LASSP), Elastic Net, Least-Angle Regression (LARS), probabilistic classifier, Naive Bayes classifier, binary classifier, linear classifier, hierarchical classifier, Canonical Correlation Analysis (CCA), Factor Analysis, Independent Component Analysis (ICA), Linear Discriminant Analysis (LDA), and the like. The present invention may utilize techniques such as Multi-dimensional Analysis (MDS), Multidimensional Scaling (MDS), Non-Negative Metric Factorization (NMF), Classification and Regression Tree (CART), Chi-squared Automatic Interaction Detection (CHAID), Expectation-Maximization algorithm (EM algorithm), Feed-Forward Neural Networks, Logic Learning Machines, Self-Organizing Maps, Single-Linkage Clustering, Fuzzy Clustering, Hierarchical Clustering, Boltzmann Machines, Convolutional Neural Networks, Recurrent Neural Networks, Hierarchical Temporal Memory (HTM) or other machine learning techniques or combinations thereof.

[0047] Upon calculating the relationship score, the relationship discovery system 210 transmits the relationship score to the device 255. The relationship score may then be used in any suitable manner. In some embodiments, the relationship score may be appended to (e.g., stored as an attribute of) the relational edge of the ontology structure between the party and counterparty for which the relationship score was calculated. This may augment knowledge in the ontology domain including parties and counterparties.

[0048] In some embodiments, the relationship score may represent characteristics related to an initial inquiry between a party and one or more counterparties. For example, if a relationship between two parties is examined due to a fraud inquiry, the relationship score may represent the risk that the two parties are related and may be involved in fraudulent activity. In these embodiments, if the relationship score exceeds a threshold, one or more actions may be issued to mitigate the fraudulent activity. For example, if the relationship score exceeds a threshold, the actions may include alerting authorities responsible for fraud mitigation, rejecting a transaction (e.g., an insurance claim) initiated by the party, or further investigating the party, or a combination thereof. However, any number of actions may be issued based on the perceived risk of the party.

[0049] As described herein, a "concept," an "entity," and a "party" may refer to the same idea. Although the different terms are used interchangeably, these terms are used in the context of the applied technology. A party may generally refer to at least one individual, such as a person, an organization, or a company. An entity may refer to a label for a party generated by a NER algorithm. A concept may refer to the name of an entity as presented in an ontology structure (e.g., a knowledge graph).

[0050] 3, a flow diagram illustrating an example method 300 for identifying and quantifying relationships between a party and at least one counterparty in accordance with an embodiment of the present disclosure is shown. One or more operations of method 300 may be completed by one or more computing devices (e.g., device 105, server 135, device 255, or relationship discovery system 210, or a combination thereof).

[0051] Method 300 begins at operation 305, where data is collected about one or more parties. The data is collected in the same or substantially similar manner as described with respect to relationship discovery application 160 of FIG. 1 or data receiving and filtering module 215 of FIG. 2. For example, data about the parties is collected based on user command or predefined conditions. In some embodiments, data may be collected by querying the names of the parties against internet resources or databases or both. Any suitable data may be received, including the data sources 205 described in connection with FIG. 2.

[0052] The data is then filtered, as indicated by operation 310. Filtering the data may include disambiguating names of related entities, sorting out irrelevant data, organizing the data, or sanitizing the data, or a combination thereof.

[0053] Entities are then extracted from the data, as indicated by operation 315. Entity extraction may be performed in the same or substantially similar manner as described with respect to entity extractor 220 of Figure 2. For example, a neural-based or rule-based NER algorithm may be applied to extract entities from the data.

[0054] An ontology structure is then generated and initial relationship strengths are determined between the party (first party) and one or more counterparties (second through nth parties). This is shown at operation 320. Generating the ontology structure may be completed in the same or substantially similar manner as described in connection with the knowledge graph (KG) builder 230 of FIG. 2. For example, ontology learning techniques may be applied to build a knowledge graph that correlates the party with other parties (entities) in the data. Determining the initial relationship strengths between the party and the counterparties may be completed in the same or substantially similar manner as described in connection with the relationship strength determiner 235 of FIG. 2. For example, determining the initial relationship strengths may be completed by dividing the number of co-occurrences of the first party and the second party by the total number of co-occurrences of the first and second parties with other parties.

[0055] A timeline of co-occurrence is then determined between the party and the counterparty. This is shown at operation 325. Determining the timeline of co-occurrence may be completed in the same or substantially similar manner as described in connection with the relationship timeline determiner 240 of FIG. 2. For example, the start time of the co-occurrence, the frequency of the co-occurrence over time, the time gap during which no co-occurrence occurs, and the time of the most recent co-occurrence may be determined at operation 325. The co-occurrence timing may be used to enhance the relationship score calculation such that the recency, length, and frequency over time of the co-occurrence all affect the strength of the relationship between two given parties. In an embodiment, the timeline of co-occurrence may be determined based on a derived time representation (e.g., obtained from the entity extractor 220) compared to the co-occurrence instances.

[0056] Reasons for co-occurrence are then determined between the party and the counterparty, as indicated at operation 330. Determining the reasons for co-occurrence may be completed in the same or substantially similar manner as described in connection with relationship reasons determiner 245 of Figure 2. For example, an NLP or ML-based classifier may be configured to determine the reason for co-occurrence at each instance of co-occurrence.

[0057] A network of entities associated with the party and the counterparty is then determined, as indicated by operation 335. Determining the network of entities associated with the party and the counterparty may be completed in the same or similar manner as described in connection with network identifier 250 of Figure 2. For example, a number of entities that relate the party to the counterparty are determined and a network is identified.

[0058] A relationship score is then calculated based on the initial relationship strength, the timeline of co-occurrence, the reason for co-occurrence, and the network. This is shown at operation 340. Calculating the relationship score may be completed in the same or substantially similar manner as described in connection with the relationship score determiner 225 of FIG. 2. For example, a normalized value may be generated for each factor (initial relationship strength, timeline of co-occurrence, reason for co-occurrence, and network), and the normalized values ​​of each factor may be weighted and added to arrive at the relationship score. Once the relationship score is calculated, the relationship score may be utilized in any manner. For example, the relationship score may be applied to the relational edges of the ontology to augment the knowledge surrounding the party. In some embodiments, the relationship score may represent characteristics related to an initial investigation of the party. For example, in a financial context, the relationship score may indicate a risk of fraud between the parties and may be trusted in approving or denying a transaction.

[0059] The above operations may be completed in any order and are not limited to the order described. Additionally, some, all, or none of the operations described above may be completed while remaining within the spirit and scope of the present disclosure.

[0060] Although this disclosure includes detailed descriptions of cloud computing, it should be understood that implementation of the teachings detailed herein is not limited to a cloud computing environment. Rather, embodiments of the present disclosure may be implemented in conjunction with any other type of computing environment now known or hereafter developed.

[0061] Cloud computing is a model of service delivery that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0062] The characteristics are as follows:

[0063] On-Demand Self-Service: Cloud consumers can unilaterally provision computing power, such as server time and network storage, as they need it automatically without the need for human interaction with the service provider.

[0064] Broadband Network Access: Capabilities are available over the network and accessed via standard mechanisms that facilitate use by heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, PDAs).

[0065] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where various physical and virtual resources are dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge of the exact location of the resources provided to them, but there is a sense of location independence in the sense that they can specify location at a higher level of abstraction (e.g. country, state, or data center).

[0066] Rapid Elasticity: Capacity can be rapidly and elastically, in some cases automatically, provisioned to quickly scale out and rapidly released to quickly scale in. To the consumer, the provisioned available capacity often appears externally unlimited, and any amount can be purchased at any time.

[0067] Measured Services: Cloud systems automatically control and optimize resource usage by utilizing metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, number of active users). Resource usage is monitored, controlled, and reported, providing transparency to both providers and consumers of the services being used.

[0068] The service model is as follows:

[0069] Software as a Service (SaaS): The capability offered to the consumer is to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying infrastructure, including networks, servers, operating systems, storage, or even individual application capabilities with the potential exception of limited user-specific application configuration settings.

[0070] Platform as a Service (PaaS): The capability offered to a consumer is to deploy consumer-created or acquired applications, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and possibly the configuration of the application hosting environment.

[0071] Infrastructure as a Service (IaaS): The capability provided to the consumer is to provide processing, storage, networking, and other basic computing resources onto which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0072] The deployment model is as follows:

[0073] Private Cloud: The cloud infrastructure is used exclusively for one organization. It may be managed by the organization or a third party and may be on-premise or off-premise.

[0074] Community Cloud: Cloud infrastructure is shared by several organizations to support a specific community with common concerns (e.g., mission, security requirements, policy and compliance considerations). It may be managed by the organization or a third party and may exist on-premise or off-premise.

[0075] Public Cloud: The cloud infrastructure is available to the general public or large industry entities and is owned by organizations that sell cloud services.

[0076] Hybrid Cloud: A cloud infrastructure is a blend of two or more clouds (private, community or public) that remain unique entities but are joined by standardized or proprietary technologies that allow data and application portability (e.g. cloud bursting for load balancing between clouds).

[0077] Cloud computing environments are service-oriented with an emphasis on statelessness, low coupling, modularity and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0078] Referring now to FIG. 4, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as, for example, a PDA or cell phone 54A (e.g., device 105), a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof, may communicate. The nodes 10 may communicate with each other. They may be physically or virtually grouped (not shown) in one or more networks, such as private, community, public, or hybrid clouds, as described above, or combinations thereof. This enables the cloud computing environment 50 to provide infrastructure, platform, or software, or combinations thereof, as a service, for which the cloud consumer does not need to maintain resources on a local computing device. The types of computing devices 54A-54N shown in FIG. 4 are for illustrative purposes only, and it will be understood that the computing node 10 and cloud computing environment 50 can communicate with any type of computerized device via any type of network, a network addressable connection (e.g., using a web browser), or both.

[0079] Now, referring to Figure 5, a set of functional abstraction layers provided by the cloud computing environment 50 (Figure 4) is shown. It is to be understood in advance that the components, layers and functions shown in Figure 5 are for illustrative purposes only, and the embodiments of the present disclosure are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0080] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes 61, servers based on RISC (Reduced Instruction Set Computing) architecture 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, the software components include network application server software 67 and database software 68.

[0081] The virtualization layer 70 provides an abstraction layer from which examples of virtualized entities such as virtualized servers 71, virtualized storage 72, virtualized networks including virtual private networks 73, virtualized applications and operating systems 74, and virtual clients 75 are provided.

[0082] In one example, the management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides tracking of costs as resources are utilized within the cloud computing environment and billing or invoicing for consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides allocation and management of cloud computing resources to meet required service levels. Service level agreement (SLA) planning and fulfillment 85 provides pre-allocation and procurement of cloud computing resources in anticipation of future demand in accordance with SLAs.

[0083] The Workload Layer 90 provides examples of functionality for which cloud computing environments are utilized. Examples of workloads and functions provided by this layer include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instructional delivery 93, data analytics processing 94, transaction processing 95, and relationship identification and quantification 96.

[0084] 6, there is shown a high-level block diagram of an example computer system 601 (e.g., device 105, server 135, device 255, relationship discovery system 210) that may be utilized in implementing (e.g., with one or more processor circuits or computer processors of a computer) one or more of the methods, tools and modules described herein and any associated functionality in accordance with an embodiment of the present disclosure. In some embodiments, the major components of computer system 601 may include one or more CPUs 602, a memory subsystem 604, a terminal interface 612, a storage interface 614, an I / O (input / output) device interface 616, and a network interface 618, all of which are communicatively coupled, directly or indirectly, for inter-component communication via a memory bus 603, an I / O bus 608, and an I / O bus interface unit 610.

[0085] Computer system 601 includes one or more general purpose programmable central processing units (CPUs) 602A, 602B, 602C, and 602D, collectively referred to herein as CPUs 602. In some embodiments, computer system 601 may include multiple processors typical of relatively large systems, however, in other embodiments, computer system 601 may alternatively be a single CPU system. Each CPU 602 executes instructions stored in memory subsystem 604 and may include one or more levels of on-board cache.

[0086] The system memory 604 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 622 or cache memory 624. The computer system 601 may also include other removable / non-removable volatile / non-volatile computer system storage media. By way of example, a storage system 626 is provided for reading from and writing to a non-portable, non-volatile magnetic medium, such as a "hard drive." Although not shown, a magnetic disk drive may be provided for reading from or writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), or an optical disk drive may be provided for reading from or writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical media. In addition, the memory 604 may include flash memory, such as, for example, a flash memory stick drive or a flash drive. Memory devices may be connected to the memory bus 603 by one or more data media interfaces. The memory 604 may include at least one program product having a set (at least one) of program modules configured to implement the functionality of various embodiments.

[0087] One or more programs / utilities 628, each having at least one set of program modules 630, may be stored in memory 604. The programs / utilities 628 may include a hypervisor (also referred to as a virtual machine monitor), one or more operating systems, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may include an implementation of a networking environment. The programs 628 and / or program modules 630 generally perform the functions or methodologies of the various embodiments.

[0088] 6 as a single bus structure providing a direct communication path between CPUs 602, memory subsystem 604, I / O bus interface 610, and memory bus 603 may in some embodiments include multiple different buses or communication paths, which may be arranged in any of a variety of configurations, such as point-to-point links in a hierarchical, star, or web configuration, multiple hierarchical buses, parallel and dual paths, or any other suitable type of configuration. Additionally, while I / O bus interface 610 and I / O bus 608 are shown as single respective units, computer system 601 may in some embodiments include multiple I / O bus interface units 610, multiple I / O buses 608, or both. Additionally, although multiple I / O interface units are shown separating I / O bus 606 from the various communication paths reaching the various I / O devices, in other embodiments some or all of the I / O devices may be directly connected to one or more system I / O buses.

[0089] In some embodiments, computer system 601 may be a multi-user mainframe computer system, a single-user system, or a server computer, or a similar device with little or no user interface, but which receives requests from other computer systems (clients). Further, in some embodiments, computer system 601 may be implemented as a desktop computer, a portable computer, a laptop or notebook computer, a tablet computer, a pocket computer, a telephone, a smartphone, a network switch or router, or any other suitable type of electronic device.

[0090] It should be noted that Figure 6 is intended to depict representative major components of an exemplary computer system 601. In some embodiments, however, the individual components may have more or less complexity than depicted in Figure 6, there may be other components other than or in addition to those depicted in Figure 6, and the number, type and configuration of such components may vary.

[0091] As described in more detail herein, some or all of the operations of some of the method embodiments described herein may be performed in an alternative order, or not performed at all. Further, multiple operations may occur simultaneously or as an internal part of a larger process.

[0092] The present disclosure may be a system, method, or computer program product, or any combination thereof. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to perform aspects of the present disclosure.

[0093] A computer readable storage medium may be a tangible device that holds and stores instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. Illustrative enumeration of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or ridge structures in grooves having instructions recorded thereon, and any suitable combination of the above. Computer-readable storage media, as used herein, is not to be construed as a transitory signal per se, such as an electric wave, a freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted through a wire.

[0094] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to each computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions to a computer readable storage medium within the respective computing / processing device for storage.

[0095] The computer readable program instructions for carrying out the operations of the present disclosure may be assembler instructions, instruction set architecture (ISA) instructions, machine language instructions, machine dependent instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including object oriented languages ​​such as Smalltalk®, C++ or the like, conventional procedural languages ​​such as the C programming language or similar programming languages. The computer readable program instructions may be executed as a stand-alone software package, entirely on the user's computer, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, the electrical circuitry may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to individualize the electrical circuitry, which may include, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), to perform aspects of the disclosure.

[0096] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, may be implemented by computer readable program instructions.

[0097] These computer readable program instructions can be provided to general purpose and special purpose computer processors or other programmable data processing apparatus to generate a machine such that the instructions, executed via the computer processor or other programmable data processing apparatus, create means for implementing the functions / acts specified in the block or blocks of the flowchart diagrams and / or blocks. These computer readable program instructions can also be stored on a computer readable storage medium capable of directing a computer, programmable data processing apparatus or other device or combination thereof to function in a particular manner, such that a computer readable storage medium having instructions stored thereon includes an article of manufacture including instructions that implement aspects of the functions / acts specified in the block or blocks of the flowchart diagrams and / or blocks.

[0098] The computer readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device and cause the computer, other programmable data processing apparatus, or other device to perform a series of operational steps to generate a computer implemented process such that the instructions executing on the computer, other programmable data processing apparatus, or other device implement aspects of the functions / actions identified in a block or blocks of the flowchart and / or blocks.

[0099] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block of the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a particular logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order depicted in the drawings. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in reverse order depending on the functionality involved. It should be noted that each block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by a special purpose hardware-based system that performs a particular function or action or implements a combination of special purpose hardware and computer instructions.

[0100] The terms used herein are for the purpose of describing particular embodiments only and are not intended to limit the various embodiments. As used herein, the singular forms "a", "an" and "the" are intended to include the plural unless the context clearly indicates otherwise. Furthermore, it should be understood that the terms "include" and / or "including", when used in this specification, specify the presence of stated features, integers, steps, operations, elements or components, or combinations thereof, and do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups or combinations thereof. In the description of exemplary embodiments of the various embodiments set forth above, reference has been made to the accompanying drawings, in which like numerals represent like elements, which form a part of this specification, and which are shown to illustrate specific exemplary embodiments in which the various embodiments may be practiced. These embodiments have been described in sufficient detail to enable one skilled in the art to practice the embodiments, but other embodiments may be used and logical, mechanical, electrical and other changes may be made without departing from the scope of the various embodiments. In the foregoing description, numerous specific details have been set forth in order to provide a thorough understanding of the various embodiments. However, various embodiments may be practiced without these specific details. In some other instances, well-known circuits, structures and techniques have not been described in detail so as not to obscure the embodiments.

[0101] As used in this specification, different instances of the word "embodiment" do not necessarily refer to the same embodiment, however they may. Any data and data structures shown or described in the specification are merely examples, and other embodiments may use different amounts of data, types of data, fields, numbers and types of fields, field names, numbers and types of rows, records, entries or organization of data. Additionally, any data may be combined with logic such that a separate data structure is not required. The foregoing detailed description is therefore not to be construed in a limiting sense.

[0102] The description of various embodiments of the present disclosure has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used in this specification are selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.

[0103] While the present disclosure has been described with reference to specific embodiments, it is anticipated that alterations and modifications thereof will become apparent to those skilled in the art. It is therefore intended that the following claims be interpreted as covering all such alterations and modifications as are within the true spirit and scope of the present disclosure. [Explanation of symbols]

[0104] 100...computing environment, 105...device, 110,140...network interface, 115,145...processor, 120,155...memory, 135...server, 160...relationship discovery application, 200...computing environment, 205...data source, 210...relationship discovery system, 255...device, 215...data receiving and filtering module, 220...entity extractor, 225...relationship score determiner, 230...knowledge graph (KG) builder, 235...relationship strength determiner, 240... Relationship timeline determiner, 245...Relationship reason determiner, 250...Network identifier, 300...Method, 60...Hardware and software layer, 61...Mainframe, 62, 63...Server, 64...Blade server, 65...Storage device, 66...Network and networking components, 67...Network application server software, 68...Database software, 70...Virtualization layer, 71...Virtualized server, 72...Virtualized storage, 73...Virtualized network, 74...Virtual Intelligent Applications and Operating Systems, 75…Virtual Clients, 80…Management Layer, 81…Resource Provisioning, 82…Metering and Pricing, 83…User Portal, 84…Service Level Management, 85…Service Level Agreement (SLA) Planning and Fulfillment, 90…Workload Layer, 91…Mapping and Navigation, 92…Software Development and Lifecycle Management, 93…Virtual Classroom Education Delivery, 94…Data Analytics Processing, 95…Transaction Processing , 96...Relationship identification and quantification, 601...Computer system, 602...CPU, 603...Memory bus, 604...Memory subsystem, 608...I / O bus, 610...I / O bus interface unit, 612...Terminal interface, 614...Storage interface, 616...I / O device interface, 618...Network interface, 622...RAM, 624...Cache memory, 626...Storage system, 628...Programs / utilities, 630...Program modules

Claims

1. Querying a data source and receiving data about the party; extracting entities from the data and receiving a set of entities, the party being a first entity in the set of entities; constructing an ontology structure that relates entities to one another within the set of entities; determining an initial relationship strength between the first entity and the second entity based on a co-occurrence between the first entity and the second entity, the second entity being a second party; and calculating a relationship score between the first entity and the second entity based on the initial relationship strength and at least one additional factor; A method comprising:

2. Prior to calculating the relationship score, the method further comprises: Determining a timeline of co-occurrence between the first entity and the second entity.

2. The method of claim 1, further comprising: wherein the relationship score is calculated based on the initial relationship strength and a timeline of the co-occurrence.

3. Prior to calculating the relationship score, the method further comprises: determining a set of reasons for the co-occurrence between the first entity and the second entity; The method of claim 1 or 2, further comprising: wherein the relationship score is calculated based on the initial relationship strength and the set of reasons for co-occurrence.

4. Prior to calculating the relationship score, the method further comprises: determining a network of entities of the set of entities related to the first entity and the second entity; The method of claim 1 , further comprising: a) calculating a relationship score based on the initial relationship strength and the entity's network.

5. The method of claim 1 , wherein the relationship score represents a risk of the party and the second party engaging in fraudulent activity.

6. The method further comprises: comparing the relationship score to a threshold; in response to the relationship score exceeding the threshold, rejecting a transaction initiated by the party; and The method of claim 5 , comprising:

7. The method of any one of claims 1 to 6, wherein the relationship score is added to the ontology structure as an attribute for the relationship between the first entity and the second entity.

8. one or more processors; one or more computer readable storage media storing program instructions; the program instructions, when executed by the one or more processors, are configured to cause the one or more processors to perform a method, the method comprising: Querying a data source and receiving data about the party; extracting entities from the data and receiving a set of entities, the party being a first entity in the set of entities; constructing an ontology structure that relates entities to one another within the set of entities; determining an initial relationship strength between the first entity and the second entity based on a co-occurrence between the first entity and the second entity, the second entity being a second party; and calculating a relationship score between the first entity and the second entity based on the initial relationship strength and at least one additional factor; Including, the system.

9. Prior to calculating the relationship score, the method performed by the one or more processors further comprises: Determining a timeline of co-occurrence between the first entity and the second entity.

9. The system of claim 8, further comprising: wherein the relationship score is calculated based on the initial relationship strength and a timeline of the co-occurrence.

10. Prior to calculating the relationship score, the method performed by the one or more processors further comprises: determining a set of reasons for the co-occurrence between the first entity and the second entity; The system of claim 8 or 9, further comprising: wherein the relationship score is calculated based on the initial relationship strength and the set of reasons for co-occurrence.

11. Prior to calculating the relationship score, the method performed by the one or more processors further comprises: determining a network of entities of the set of entities related to the first entity and the second entity; The system of any one of claims 8 to 10, further comprising: wherein the relationship score is calculated based on the initial relationship strength and the network of the entities.

12. The system of any one of claims 8 to 11, wherein the relationship score represents a risk of the party and the second party engaging in fraudulent activity.

13. The method executed by the one or more processors further comprises: comparing the relationship score to a threshold; in response to the relationship score exceeding the threshold, rejecting a transaction initiated by the party; and The system of claim 12 , comprising:

14. The system of any one of claims 8 to 13, wherein the relationship score is added to the ontology structure as an attribute for the relationship between the first entity and the second entity.

15. A computer program comprising: Querying a data source and receiving data about the party; extracting entities from the data and receiving a set of entities, the party being a first entity in the set of entities; constructing an ontology structure that relates entities to one another within the set of entities; determining an initial relationship strength between the first entity and the second entity based on a co-occurrence between the first entity and the second entity, the second entity being a second party; and calculating a relationship score between the first entity and the second entity based on the initial relationship strength and at least one additional factor; A computer program for executing the above.

16. causing the one or more processors, prior to calculating the relationship scores, Determining a timeline of co-occurrence between the first entity and the second entity.

16. The computer program product of claim 15, further comprising: a) calculating the relationship score based on the initial relationship strength and a timeline of the co-occurrences.

17. causing the one or more processors, prior to calculating the relationship scores, determining a set of reasons for the co-occurrence between the first entity and the second entity; and wherein the relationship score is calculated based on the initial relationship strength and the set of reasons for co-occurrence.

18. causing the one or more processors, prior to calculating the relationship scores, determining a network of entities of the set of entities related to the first entity and the second entity; wherein the relationship score is calculated based on the initial relationship strength and the network of entities.

19. The computer program product of claim 15, wherein the relationship score is added to the ontology structure as an attribute for the relationship between the first entity and the second entity.

20. The computer program of any one of claims 15 to 19, wherein the computer program is downloaded onto a computer readable storage medium from a distributed data processing system.

Images