Systems and methods for anomaly detection between interacting entities

Abstract

Disclosed are systems and methods that provide a novel framework for integrated assessment management of interacting entities. The framework provides "closed-loop" interactive capabilities that integrate with the electronic entities performing or conducting an electronic transaction so as to provide end-to-end (E2E) assessments of the electronic transaction. The disclosed framework can operate to ensure that real-time anomalous activities are accurately and contemporaneously detected, thereby preventing unsolicited and / or malicious activity from occurring via the real-time computational analysis of the transacting parties and their electronic interactions occurring therebetween. The framework provides improved security, efficiency and accuracy of electronic interactions and / or associated digital, electronic and / or real-world assets being shared, traded and / or created among interacting entities over a network.

Description

SYSTEMS AND METHODS FOR ANOMALY DETECTION BETWEEN INTERACTING ENTITIESCROSS-REFERENCE TO RELATED APPLICATION

[0001] This application claims priority and benefit of commonly owned, co-pending U.S. Patent Application No. 18 / 236,123, filed on August 21, 2023, entitled “SYSTEMS AND METHODS FOR ANOMALY DETECTION BETWEEN INTERACTING ENTITIES,” the contents of which are incorporated herein by reference in their entirety.FIELD OF THE DISCLOSURE

[0002] The present disclosure is generally related to an electronic transaction assessment system, and more particularly, to a decision intelligence (Dl)-based computerized framework for deterministically monitoring electronic interactions between contracting electronic entities, determining anomalous electronic activity in real-time, and executing remedial electronic actions.BACKGROUND

[0003] Conventional systems for ensuring the integrity of electronic transactions are tied to mechanisms for authenticating, authorizing and monitoring compliance of the transacting parties. These mechanisms, both individually and operating in collaboration with one another, however, are static in nature, in that their operational capabilities are tied to the transaction request and the transaction completion.SUMMARY OF THE DISCLOSURE

[0004] That is, conventional mechanisms for monitoring electronic transactions can check or discern whether a transaction is viable, proper, accurate and / or secure either before the transaction occurs or after its completion. This, however, leaves many holes in the manner in which such electronic transactions can be secured.

[0005] To that end, according to some embodiments, the disclosed systems and methods provide a novel computerized framework that addresses such shortcomings, among others, by provided a “closed-loop” interactive system that integrates with the electronic entities performing or conducting an electronic transaction so as to provide end-to-end (E2E) assessments of the transaction. As provided for herein, the frameworks’ thorough, real-time assessment of a transaction while it is occurring, in addition to its initial and conclusoryassessment and analysis, can ensure that the viability, veracity and accuracy of the transacting parties is maintained, thereby enabling a resultant accurate and secure electronic transaction.

[0006] Indeed, as evident from the discussion herein, the disclosed systems and methods can execute to provide the disclosed framework that can provide an improved electronic transaction environment, that accounts for security, accuracy and efficiency parameters respective to both the transacting entities and the transactions themselves. Accordingly, the disclosed framework can ensure that real-time anomalous activities are accurately detected, thereby preventing unsolicited and / or malicious activity from occurring via the real-time computational analysis of the transacting parties and their electronic interactions occurring therebetween.

[0007] According to some embodiments, a method is disclosed for a Dl-based computerized framework for deterministically monitoring electronic interactions between contracting electronic entities, determining anomalous electronic activity in real-time, and executing remedial electronic actions. In accordance with some embodiments, the present disclosure provides a non-transitory computer-readable storage medium for carrying out the above- mentioned technical steps of the framework’s functionality. The non-transitory computer- readable storage medium has tangibly stored thereon, or tangibly encoded thereon, computer readable instructions that when executed by a device cause at least one processor to perform a method for a Dl-based computerized framework for deterministically monitoring electronic interactions between contracting electronic entities, determining anomalous electronic activity in real-time, and executing remedial electronic actions.

[0008] In accordance with one or more embodiments, a system is provided that includes one or more processors and / or computing devices configured to provide functionality in accordance with such embodiments. In accordance with one or more embodiments, functionality is embodied in steps of a method performed by at least one computing device. In accordance with one or more embodiments, program code (or program logic) executed by a processor(s) of a computing device to implement functionality in accordance with one or more such embodiments is embodied in, by and / or on a non-transitory computer-readable medium.DESCRIPTIONS OF THE DRAWINGS

[0009] The features, and advantages of the disclosure will be apparent from the following description of embodiments as illustrated in the accompanying drawings, in which reference characters refer to the same parts throughout the various views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating principles of the disclosure:

[0010] FIG. 1 is a block diagram of an example configuration within which the systems and methods disclosed herein could be implemented according to some embodiments of the present disclosure;

[0011] FIG. 2 is a block diagram illustrating components of an exemplary system according to some embodiments of the present disclosure;

[0012] FIG 3 illustrates an exemplary data flow according to some embodiments of the present disclosure;

[0013] FIG. 4 illustrates an exemplary data flow according to some embodiments of the present disclosure;

[0014] FIG. 5 depicts an exemplary implementation of an architecture according to some embodiments of the present disclosure;

[0015] FIG. 6 depicts an exemplary implementation of an architecture according to some embodiments of the present disclosure; and

[0016] FIG. 7 is a block diagram illustrating a computing device showing an example of a client or server device used in various embodiments of the present disclosure.DETAILED DESCRIPTION

[0017] The present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, which form a part hereof, and which show, by way of non-limiting illustration, certain example embodiments. Subject matter may, however, be embodied in a variety of different forms and, therefore, covered or claimed subject matter is intended to be construed as not being limited to any example embodiments set forth herein; example embodiments are provided merely to be illustrative. Likewise, a reasonably broad scope for claimed or covered subject matter is intended. Among other things, for example, subject matter may be embodied as methods, devices, components, or systems. Accordingly, embodiments may, for example, take the form of hardware, software, firmware or any combination thereof (other than software per se). The following detailed description is, therefore, not intended to be taken in a limiting sense.

[0018] Throughout the specification and claims, terms may have nuanced meanings suggested or implied in context beyond an explicitly stated meaning. Likewise, the phrase “in one embodiment” as used herein does not necessarily refer to the same embodiment and the phrase “in another embodiment” as used herein does not necessarily refer to a different embodiment. It is intended, for example, that claimed subject matter include combinations of example embodiments in whole or in part.

[0019] In general, terminology may be understood at least in part from usage in context. For example, terms, such as “and”, “or”, or “and / or,” as used herein may include a variety of meanings that may depend at least in part upon the context in which such terms are used. Typically, “or” if used to associate a list, such as A, B or C, is intended to mean A, B, and C, here used in the inclusive sense, as well as A, B or C, here used in the exclusive sense. In addition, the term “one or more” as used herein, depending at least in part upon context, may be used to describe any feature, structure, or characteristic in a singular sense or may be used to describe combinations of features, structures or characteristics in a plural sense. Similarly, terms, such as “a,” “an,” or “the,” again, may be understood to convey a singular usage or to convey a plural usage, depending at least in part upon context. In addition, the term “based on” may be understood as not necessarily intended to convey an exclusive set of factors and may, instead, allow for existence of additional factors not necessarily expressly described, again, depending at least in part on context.

[0020] The present disclosure is described below with reference to block diagrams and operational illustrations of methods and devices. It is understood that each block of the block diagrams or operational illustrations, and combinations of blocks in the block diagrams or operational illustrations, can be implemented by means of analog or digital hardware and computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer to alter its function as detailed herein, a special purpose computer, ASIC, or other programmable data processing apparatus, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, implement the functions / acts specified in the block diagrams or operational block or blocks. In some alternate implementations, the functions / acts noted in the blocks can occur out of the order noted in the operational illustrations. For example, two blocks shown in succession can in fact be executed substantially concurrently or the blocks can sometimes be executed in the reverse order, depending upon the functionality / acts involved.

[0021] For the purposes of this disclosure a non-transitory computer readable medium (or computer-readable storage medium / media) stores computer data, which data can include computer program code (or computer-executable instructions) that is executable by a computer, in machine readable form. By way of example, and not limitation, a computer readable medium may include computer readable storage media, for tangible or fixed storage of data, or communication media for transient interpretation of code-containing signals. Computer readable storage media, as used herein, refers to physical or tangible storage (as opposed to signals) and includes without limitation volatile and non-volatile, removable and non-removable media implemented in any method or technology for the tangible storage of information such as computer-readable instructions, data structures, program modules or other data. Computer readable storage media includes, but is not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid state memory technology, optical storage, cloud storage, magnetic storage devices, or any other physical or material medium which can be used to tangibly store the desired information or data or instructions and which can be accessed by a computer or processor.

[0022] For the purposes of this disclosure the term “server” should be understood to refer to a service point which provides processing, database, and communication facilities. By way of example, and not limitation, the term “server” can refer to a single, physical processor with associated communications and data storage and database facilities, or it can refer to a networked or clustered complex of processors and associated network and storage devices, as well as operating software and one or more database systems and application software that support the services provided by the server. Cloud servers are examples.

[0023] For the purposes of this disclosure a “network” should be understood to refer to a network that may couple devices so that communications may be exchanged, such as between a server and a client device or other types of devices, including between wireless devices coupled via a wireless network, for example. A network may also include mass storage, such as network attached storage (NAS), a storage area network (SAN), a content delivery network (CDN) or other forms of computer or machine-readable media, for example. A network may include the Internet, one or more local area networks (LANs), one or more wide area networks (WANs), wire-line type connections, wireless type connections, cellular or any combination thereof. Likewise, sub-networks, which may employ differing architectures or may be compliant or compatible with differing protocols, may interoperate within a larger network.

[0024] For purposes of this disclosure, a “wireless network” should be understood to couple client devices with a network. A wireless network may employ stand-alone ad-hoc networks, mesh networks, Wireless LAN (WLAN) networks, cellular networks, or the like. A wireless network may further employ a plurality of network access technologies, including Wi-Fi, Long Term Evolution (LTE), WLAN, Wireless Router mesh, or 2nd, 3rd, 4thor 5thgeneration (2G, 3G, 4G or 5G) cellular technology, mobile edge computing (MEC), Bluetooth, 802.11b / g / n, or the like. Network access technologies may enable wide area coverage for devices, such as client devices with varying degrees of mobility, for example.

[0025] In short, a wireless network may include virtually any type of wireless communication mechanism by which signals may be communicated between devices, such as a client device or a computing device, between or within a network, or the like.

[0026] A computing device may be capable of sending or receiving signals, such as via a wired or wireless network, or may be capable of processing or storing signals, such as in memory as physical memory states, and may, therefore, operate as a server. Thus, devices capable of operating as a server may include, as examples, dedicated rack-mounted servers, desktop computers, laptop computers, set top boxes, integrated devices combining various features, such as two or more features of the foregoing devices, or the like.

[0027] For purposes of this disclosure, a client (or user, entity, subscriber or customer) device may include a computing device capable of sending or receiving signals, such as via a wired or a wireless network. A client device may, for example, include a desktop computer or a portable device, such as a cellular telephone, a smart phone, a display pager, a radio frequency (RF) device, an infrared (IR) device a Near Field Communication (NFC) device, a Personal Digital Assistant (PDA), a handheld computer, a tablet computer, a phablet, a laptop computer, a set top box, a wearable computer, smart watch, an integrated or distributed device combining various features, such as features of the forgoing devices, or the like.

[0028] A client device may vary in terms of capabilities or features. Claimed subject matter is intended to cover a wide range of potential variations, such as a web-enabled client device or previously mentioned devices may include a high-resolution screen (HD or 4K for example), one or more physical or virtual keyboards, mass storage, one or more accelerometers, one or more gyroscopes, global positioning system (GPS) or other location-identifying type capability, or a display with a high degree of functionality, such as a touch- sensitive color 2D or 3D display, for example.

[0029] Certain embodiments and principles will be discussed in more detail with reference to the figures. According to some embodiments, the disclosed framework can provide users or practicing entities with a real-time risk and anomaly detection platform, system and / or application that can proactively and interactively monitor electronic transactions as they are being initiated and performed. As discussed herein, in some embodiments, the disclosed framework can determine, extract, derive, predict or otherwise identify errors, risks and / or anomalies related to the transaction at various stages of the transactions’ E2E life cycle. Accordingly, real-time assessments can be generated and provided for display / output that canaccurately depict the integrity of the transaction, as well as the integrity of the transacting parties.

[0030] In some embodiments, as discussed infra, real-time notifications or alerts can be generated, which can enable interacting users, administrators, applications, and the like to view assessments of transaction activities and interact accordingly so as to identify the determined anomalies and act to remedy them in a seamless manner In some embodiments, such notifications can be, but are not limited to, determined risk statistics, interactive electronic messages, graphs, charts, executable actions to remedy the risk / anomaly, and the like, as discussed in more detail below. Thus, the notification can provide reasonings as to why and / or how an anomaly is occurring, as well as determine metrics related to such reasonings. For example, the notification can include information indicating why a transaction is, but not limited to, inaccurate, incomplete, missing, fraudulent, and the like, and / or whether an involved entity / user is acting maliciously.

[0031] By way of background, conventional systems cannot securely, accurately and efficiently handle the on-demand and personalized requests of the ever-increasing demand required to meet consumer needs. For example, manual re-entry of data from one system to another, along with taking shortcuts, can lead to data inconsistencies and ultimately unusable data and resubmission costs. Accordingly, conventional systems can fall victim to fundamental problems related to labor-intensive workflows, expensive manual processes, siloed data, multiple standards and / or compliance programs, lack of data transparency, poor E2E accuracy, poor value exchange through inaccurate, incomplete or incompatible data between companies, and the like.

[0032] Attempts at automation or interaction between interacting (e.g., trading) partners fails to resolve such shortcomings, and in fact, they have introduced a different set of problems. For example, to meet demand and / or the volume of activities of interacting entities, companies / entities are now constrained to the continuous implementation of new features, functions and / or modifications to their systems. Thus, for at least this reason, tightly coupled integration is not widely adopted and the industry remains largely analog.

[0033] Accordingly, the disclosed systems and methods provide a technological framework that enables disparate systems to be multi-directionally integrated for an E2E computerized solution that enables automation and process improvements to be realized for the creation and deployment of a real-time risk assessment and remedial system.

[0034] According to some embodiments, the disclosed framework can operate as middleware between transacting entities to ensure the proactive activity (e.g., initiation and / or onset of anelectronic transaction), as well as the reactive (e.g., real-time) activity are monitored, checked and cured of anomalous information and / or events. Thus, upstream and / or downstream activity can be tracked and analyzed, which can be based on learned transaction behavior, as discussed below, whereby the disclosed framework can automate the modification, prevention / halting and / or completion of a transaction in a secure and efficient manner.

[0035] According to some embodiments, as discussed in more detail below, the determined risks, anomalies and / or events, for which notification and remedial action can be triggered, can include, but are not limited to, deviations from previous patterns (e.g., times, locations, routes and parties involved in a trade, for example), comparison of transaction metrics (e g., weight, volumes, prices, origin, and the like), available and / or determined metrics and data related to engaged devices and / or associated loT devices, scan comparisons (e.g., digital twinning, for example, and / or other types of artificial intelligence / machine learning (AI / ML) algorithms, as discussed below), and / or other types of red flags related to criminal and / or malicious behavior, and the like, or some combination thereof.

[0036] With reference to FIG. 1, system 100 is depicted which includes user equipment (UE) 102 (e.g., a client device, as mentioned above and discussed below in relation to FIG. 7), system 110, network 104, cloud system 106, database 108 and assessment engine 200. It should be understood that while system 100 is depicted as including such components, it should not be construed as limiting, as one of ordinary skill in the art would readily understand that varying numbers of UEs, devices, users / parties, systems, cloud systems, databases and networks can be utilized; however, for purposes of explanation, system 100 is discussed in relation to the example depiction in FIG. 1.

[0037] According to some embodiments, UE 102 can be any type of device, such as, but not limited to, a mobile phone, tablet, laptop, Internet of Things (loT) device, autonomous machine, and any other device equipped with functionality for connecting to a network and performing computational activities for interacting with other devices. In some embodiments, UE 102 can be a device associated with an individual (or set of individuals) for which transaction monitoring services are being provided. In some embodiments, UE 102 may correspond to a device of a company (e.g., corporation, for example), entity and / or person for which electronic business activity is being conducted.

[0038] In some embodiments, a peripheral device may be connected to UE 102, and can be any type of peripheral device, such as, but not limited to, a wearable device (e.g., smart watch), printer, speaker, and the like. In some embodiments, a peripheral device can be any type of device that is connectable to UE 102 via any type of known or to be known pairing mechanism,including, but not limited to, Wi-Fi, Bluetooth™, Bluetooth Low Energy (BLE), NFC, and the like.

[0039] According to some embodiments, system 110 can correspond to any type of device (or UE, as discussed above), computer system, electronic platform, web portal, electronically hosted network resource, and the like, or some combination thereof. In some embodiments, for example, system 100 can correspond to a third party UE for which a user of UE 102 is electronically interacting with to conduct business. In some embodiments, system 100 can correspond to an entity associated with a set of electronic, digital and / or real-world assets for which electronic transactions are being effectuated.

[0040] In some embodiments, network 104 can be any type of network, such as, but not limited to, a wireless network, cellular network, the Internet, and the like (as discussed above). Network 104 facilitates connectivity of the components of system 100, as illustrated in FIG. 1.

[0041] According to some embodiments, cloud system 106 may be any type of cloud operating platform and / or network based system upon which applications, operations, and / or other forms of network resources may be located. For example, system 106 may be a service provider and / or network provider from where services and / or applications may be accessed, sourced or executed from. For example, system 106 can represent the cloud-based architecture associated with a proprietary system provider, which has associated network resources hosted on the internet or private network (e.g., network 104), which enables (via engine 200) the risk and transaction management and monitoring discussed herein.

[0042] In some embodiments, cloud system 106 may include a server(s) and / or a database of information which is accessible over network 104. In some embodiments, a database 108 of cloud system 106 may store a dataset of data and metadata associated with local and / or network information related to a user(s) of UE 102 / system 110 and the UE 102 / system 110, and the services and applications provided by cloud system 106 and / or assessment engine 200.

[0043] In some embodiments, for example, cloud system 106 can provide a private / proprietary management platform, whereby engine 200, discussed infra, corresponds to the novel functionality system 106 enables, hosts and provides to a network 104 and other devices / platforms operating thereon.

[0044] Turning to FIGs. 5 and 6, in some embodiments, the exemplary computer-based systems / platforms, the exemplary computer-based devices, and / or the exemplary computer- based components of the present disclosure may be specifically configured to operate in a cloud computing / architecture 106 such as, but not limiting to: infrastructure a service (laaS) 610, platform as a service (PaaS) 608, and / or software as a service (SaaS) 606 using a web browser,mobile app, thin client, terminal emulator or other endpoint 604. FIGs. 5 and 6 illustrate schematics of non-limiting implementations of the cloud computing / architecture(s) in which the exemplary computer-based systems for administrative customizations and control of network-hosted application program interfaces (APIs) of the present disclosure may be specifically configured to operate.

[0045] Turning back to FIG. 1, according to some embodiments, database 108 may correspond to a data storage for a platform (e.g., a network hosted platform, such as cloud system 106, as discussed supra) or a plurality of platforms. Database 108 may receive storage instructions / requests from, for example, engine 200 (and associated microservices), which may be in any type of known or to be known format, such as, for example, standard query language (SQL). According to some embodiments, database 108 may correspond to any type of known or to be known storage, for example, a memory or memory stack of a device, a distributed ledger of a distributed network (e.g., blockchain, for example), a look-up table (LUT), and / or any other type of secure data repository

[0046] Assessment engine 200, as discussed above and further below in more detail, can include components for the disclosed functionality. According to some embodiments, assessment engine 200 may be a special purpose machine or processor, and can be hosted by a device on network 104, within cloud system 106 and / or on UE 102. In some embodiments, engine 200 may be hosted by a server and / or set of servers associated with cloud system 106.

[0047] According to some embodiments, as discussed in more detail below, assessment engine 200 may be configured to implement and / or control a plurality of services and / or microservices, where each of the plurality of services / microservices are configured to execute a plurality of workflows associated with performing the disclosed risk and transaction management. Non-limiting embodiments of such workflows are provided below in relation to at least FIGs. 3-4.

[0048] According to some embodiments, as discussed above, assessment engine 200 may function as an application provided by cloud system 106. In some embodiments, engine 200 may function as an application installed on a server(s), network location and / or other type of network resource associated with cloud system 106. In some embodiments, engine 200 may function as an application installed and / or executing on UE 102. In some embodiments, such application may be a web-based application accessed by UE 102 and / or devices over network 104 from cloud system 106. In some embodiments, engine 200 may be configured and / or installed as an augmenting script, program or application (e.g., a plug-in or extension) to another application or program provided by cloud system 106 and / or executing on UE 102.

[0049] As illustrated in FIG. 2, according to some embodiments, assessment engine 200 includes collection module 202, determination module 204, monitoring module 206 and control module 208. It should be understood that the engine(s) and modules discussed herein are non-exhaustive, as additional or fewer engines and / or modules (or sub-modules) may be applicable to the embodiments of the systems and methods discussed. More detail of the operations, configurations and functionalities of engine 200 and each of its modules, and their role within embodiments of the present disclosure will be discussed below.

[0050] Turning to FIG. 3, Process 300 provides non-limiting example embodiments for the disclosed risk and transaction management framework.

[0051] According to some embodiments, Steps 302-306 of Process 300 can be performed by collection module 202 of assessment engine 200; and Steps 308-312 can be performed by determination module 204.

[0052] According to some embodiments, Process 300 begins with Step 302 where a set of entities participating in electronic transactions are identified. In some embodiments, for example, such entities can include, but are not limited to, users (e.g., traders), companies, businesses, platforms, exchanges, applications, and the like. In some embodiments, Step 302 can involve the identification of data / metadata related to such entities, including, but not limited to, identifier (ID), location, type of entity, types of transactions, types of platforms used for transactions, frequency of transacting, experience level of transacting, size, types of assets traded, account information, and the like, or some combination thereof.

[0053] In Step 304, engine 200 can monitor electronic transactions by and between the set of entities. Such monitoring can be in accordance with a criteria, which can correspond to, but not be limited to, a time, date, location, type of entity, type of transaction, and the like. In some embodiments, for example, such monitoring can be performed continuously for a time period and / or periodically (according to a threshold time iteration) for a time period. For example, electronic transactions between entity A and B can be continuously tracked for type Y transactions that involve assets ABC for a predetermined number of months (e.g., 6 months, for example).

[0054] Accordingly, in Step 306, based on the monitoring in Step 304, engine 200 can collect electronic transaction data. Such electronic transaction data can include information related to, but not limited to, ID of entity / user transacting with other entities / users, types of transactions, assets of transactions, volume / size of transactions, date, time, location, type of assets, and the like, or some combination thereof.

[0055] In some embodiments, the collected electronic transaction data in Step 306 can be stored in database 108 in association with an identifier (ID) of an entity (or entities), asset type, type of transaction, and the like, or some combination thereof

[0056] In Step 308, engine 200 can analyze the collected electronic transaction data. According to some embodiments, engine 200 can implement any type of known or to be known computational analysis technique, algorithm, mechanism or technology to analyze the collected electronic transaction data from Step 306.

[0057] In some embodiments, engine 200 may include a specific trained artificial intelligence / machine learning model (AI / ML), a particular machine learning model architecture, a particular machine learning model type (e.g., convolutional neural network (CNN), recurrent neural network (RNN), autoencoder, support vector machine (SVM), and the like), or any other suitable definition of a machine learning model or any suitable combination thereof.

[0058] In some embodiments, engine 200 may be configured to utilize one or more AI / ML techniques chosen from, but not limited to, computer vision, feature vector analysis, decision trees, boosting, support-vector machines, neural networks, nearest neighbor algorithms, Naive Bayes, bagging, random forests, logistic regression, and the like.

[0059] In some embodiments and, optionally, in combination of any embodiment described above or below, a neural network technique may be one of, without limitation, feedforward neural network, radial basis function network, recurrent neural network, convolutional network (e.g., U-net) or other suitable network. In some embodiments and, optionally, in combination of any embodiment described above or below, an implementation of Neural Network may be executed as follows: a. define Neural Network architecture / model, b. transfer the input data to the neural network model, c. train the model incrementally, d. determine the accuracy for a specific number of timesteps, e. apply the trained model to process the newly-received input data, f. optionally and in parallel, continue to train the trained model with a predetermined periodicity.

[0060] In some embodiments and, optionally, in combination of any embodiment described above or below, the trained neural network model may specify a neural network by at least a neural network topology, a series of activation functions, and connection weights. For example, the topology of a neural network may include a configuration of nodes of the neural network and connections between such nodes. In some embodiments and, optionally, in combination ofany embodiment described above or below, the trained neural network model may also be specified to include other parameters, including but not limited to, bias values / functions and / or aggregation functions. For example, an activation function of a node may be a step function, sine function, continuous or piecewise linear function, sigmoid function, hyperbolic tangent function, or other type of mathematical function that represents a threshold at which the node is activated. In some embodiments and, optionally, in combination of any embodiment described above or below, the aggregation function may be a mathematical function that combines (e.g., sum, product, and the like) input signals to the node. In some embodiments and, optionally, in combination of any embodiment described above or below, an output of the aggregation function may be used as input to the activation function. In some embodiments and, optionally, in combination of any embodiment described above or below, the bias may be a constant value or function that may be used by the aggregation function and / or the activation function to make the node more or less likely to be activated.

[0061] In Step 310, based on the analysis from Step 308, engine 200 can determine a set of patterns that corresponds to the set of entities (and / or in some embodiments, an asset ID, asset type and / or transaction type, for example). According to some embodiments, the determined patterns are based on the computational AI / ML analysis performed via engine 200, as discussed above.

[0062] In some embodiments, the set of patterns can correspond to, but are not limited to, types of entities, types of assets, types of activity / transactions, time, date, duration, platform for transacting, and the like, or some combination thereof.

[0063] In Step 312, engine 200 can store the determined set of patterns in database 108, in a similar manner as discussed above. According to some embodiments, Step 312 can involve creating a data structure associated with each determined pattern, whereby each data structure can be stored in a proper storage location associated with an associated user / entity ID, as discussed above.

[0064] In some embodiments, a pattern can comprise a set of events, which can correspond to, but not be limited to, the commencement of the transaction, intermediate stages of the transaction and conclusion of the transaction, upon which information related to compliance with rules / regulations can be identified, as well as information related to detected anomalies within each stage. In some embodiments, the data structure for a pattern can be relational, in that the events of a pattern can be sequentially ordered, and / or weighted so that the order corresponds to events with more, less or no anomalous / risk-based activity.

[0065] In some embodiments, the structure of the data structure for a pattern can enable a more computationally efficient (e.g., faster) search of the pattern to determine if later detected events correspond to the events of the pattern, as discussed below in relation to at least Steps 404-408 of Process 400 of FIG. 4.

[0066] In some embodiments, the data structures of patterns can be, but are not limited to, files, arrays, lists, binary, heaps, hashes, tables, trees, and the like, and / or any other type of known or to be known tangible, storable digital asset, item and / or object.

[0067] According to some embodiments, the electronic transaction data can be identified and analyzed in a raw format, whereby upon a determination of the pattern, the data can be compiled into refined data (e.g., a format capable of being stored in and read from database 108). Thus, in some embodiments, Step 312 (and / or Step 310) can involve the creation and / or modification (e.g., transformation) of the electronic transaction data into a storable format.

[0068] In some embodiments, as discussed below, each pattern (and corresponding data structure) can be modified based on further detected behavior, as discussed below in relation to Process 400 of FIG. 4.

[0069] Turning to FIG. 4, Process 400 provides non-limiting example embodiments for the deployment and / or implementation of the disclosed security management framework.

[0070] According to some embodiments, Steps 402 and 416 of Process 400 can be performed by monitoring module 206 of assessment engine 200; Step 404 can be performed by collection module 202; Steps 406-410 and 416-420 can be performed by determination module 204; and Steps 412-414 and 422-424 can be performed by control module 208.

[0071] According to some embodiments, Process 400 begins with Step 402 where engine 200 identifies a request for an electronic transaction between a set of entities (e.g., two companies, for example). As discussed herein, the electronic transaction can be configured as an executable file or set of instructions defined within an electronic data structure. Accordingly, the file and / or data structure In some embodiments, such request can correspond to a first stage or commencement / initiation of the electronic file or data structure (e.g., first stage of the transaction). In some embodiments, Step 402 can involve the identification of transaction information, in a similar manner as discussed above, which can include, but is not limited to, ID of the entities / users in the transaction, transaction type, asset information involved in the transaction (e.g., type and quantity of assets, for example), time, date, and the like.

[0072] In Step 404, based on the identified transaction data from Step 402, engine 200 can retrieve, extract, search for and identify, or otherwise identify a stored pattem(s). The storedpattern can correspond to transaction pattern information for the users of the transaction, for example, as discussed above.

[0073] In Step 406, engine 200 can analyze the information from the transaction request (e.g., the transaction information) based on the stored pattern information. According to some embodiments, such analysis can be performed via execution of the AI / ML models discussed above.

[0074] In Step 408, based on the analysis of Step 406, engine 200 can perform a determination as to whether an anomalous condition (or event) exists prior to execution of the electronic transaction. As discussed above, such determination can be based on and / or involve, inter alia, deviations from previous patterns (e.g., times, locations, routes and parties involved in a trade, for example), comparison of transaction metrics (e.g., weight, volumes, prices, origin, and the like), determined metrics and data related to engaged devices and / or associated loT devices, scan comparisons, and / or other types of red flags related to criminal and / or malicious behavior, and the like, or some combination thereof. Indeed, such determination can correspond to, in addition to the above determinations, whether the regulatory compliance applicable to the specific transaction is being properly adhered to (California Consumer Privacy Act (CCPA), General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), and the like).

[0075] According to some embodiments, when engine 200, in Step 408, determines that an anomalous condition / event within the transaction is present prior to commencement of the electronic transaction, processing can proceed from Step 408 to Step 410.

[0076] In Step 410, engine 200 can extract, determine, derive or otherwise identify the information related to the condition. Such condition information can correspond to and / or be based on the electronic transaction information from Step 402, in that the information includes data that relates to an error, anomaly or other form of mis-information or improper activity involved in the commencement of the transaction. For example, the number assets in the agreed upon contract are not being flagged or queued for a transfer; therefore, such error can be detected via the analysis of the participating entities workflow prior to the engagement / commencement of the transaction (e.g., as a first stage of the electronic transaction).

[0077] In Step 412, upon identifying the information related to the anomalous condition, as in Step 410, engine 200 can compile, generate and output a notification and store the information related to the anomalous condition. According to some embodiments, the notification can be configured as, but not limited to, text, audio, video, multi-media, and the like, or somecombination thereof. In some embodiments, for example, the notification can be configured as a statistical “score card” that indicates a level or risk (e.g., high, medium or low, for example). For example, a graphical output can be compiled that indicates a percentage of likelihood that the transaction includes at least one anomaly. In another example, the output of the notification can provide interactive interface (10s) that can indicate which components of the electronic transaction are deficient, whereby upon their display within a dashboard (or other form of user interface (UI)), detailed information about such components can be retrieved. This, therefore, enables the notification to be displayed, then subsequently modified and / or interacted with so as to provide the necessary parties opportunities to remedy the anomalous condition

[0078] In some embodiments, the score card can be leveraged to determine whether the electronic transaction can proceed. That is, levels of risk (e.g., high, medium or low) that correspond to threshold levels / ranges of anomalies, as discussed herein, may be identified and by-passed, thereby enabling specific stages of the transaction to continue despite an identified potential pitfail during a particular stage. For example, if an anomaly is identified as a “low risk” (e.g., a number of assets pegged for trade is off but only be a certain threshold percentage), then this can be identified, and the corresponding notification can be output; however, the transaction can continue because the anomaly determined may not be a type, value or component that could prevent completion of the transaction to a pre-agreed upon term / agreement.

[0079] Indeed, in some embodiments, a frequency, number or some combination thereof of particular types of anomalies (e.g., high, medium or low risk) may compound can cause certain stages to be halted, as discussed herein. For example, if one low risk anomaly is identified, this may still enable the stage / transaction to proceed; however, if n low risk anomalies are identified for the transaction, for a stage or subset of stages, with n being at or above a threshold number of anomalies, then the transaction may be halted and / or restarted, as discussed herein.

[0080] In some embodiments, the notification can be electronically communicated (e.g., as a message for display) to the entity involved in the electronic transaction that is responsible for the anomalous condition, can be communicated to both parties of the transaction, to a third party overseeing the transaction, and the like, or some combination thereof.

[0081] In some embodiments, the notification can include functionality that enables the anomalous condition to be corrected, which can involve a computer-generated suggestion that can modify the operations of the entity responsible for the anomalous condition. In some embodiments, as indicated in FIG. 4, via the line from Step 412 to Step 402, engine 200 can reprocess updates, corrections and / or modifications to the electronic transaction prior to itscommencement. As such, upon such updating, Steps 402-408 can be recursively performed to check whether such updates comply with the governing rules and / or requirements of the electronic transaction

[0082] In some embodiments, when engine 200 determines that no anomalous conditions are present (e.g., the terms of the transaction comply with regulatory terms and other term sheets, as well as the agreed upon assets are flagged for transfer, for example), engine 200 can proceed from Step 408 to Step 414.

[0083] In Step 414, engine 200 can proceed with the commencement of the electronic transaction. That is, upon the commencement (e g., first stage) being approved / satisfied (e g., via Step 408), the asset transfer and corresponding workflows defined by each entity according to the electronic transaction can begin. According to some embodiments, the corresponding subsequent stages of the electronic transaction (e.g., second stage, third stage,... n- stage, until the conclusory stage) can be monitored via the processing performed in Step 416. According to some embodiments, stages of the electronic transaction can correspond to workflows of each entity that are to be performed to comply with and perform the electronic transaction. For example, enable access to accounts, provide privileged documents, identify assets, enable inspection, provide electronic funds, begin processing and / or manufacture of assets, lock in particular prices at particular times, and the like, or some combination thereof (e.g., any type of transaction activity corresponding to digital, electronic and / or real-world assets).

[0084] Accordingly, in some embodiments, engine 200 can perform monitoring of each stage of the transaction in real-time as each stage progresses. As discussed above, such monitoring can be performed continuously and / or according to a predetermined time period or event within a particular stage (e.g., transfer of a number of assets, transfer of electronic funds, access to particular accounts, and the like).

[0085] In Step 418, engine 200 can (e.g., for each stage of the electronic transaction) analyze the activity of each entity involved in the electronic transaction (e.g., their workflow, for example), and determine whether an anomalous condition is detected, determined, predicted to arise, or otherwise be identified. Accordingly, engine 200 can perform Step 418 in a similar manner as discussed above at least in relation to Steps 404-408. For example, stored activity behavior for a particular entity, particular asset and / or particular stage of an electronic transaction can be analyzed via current / real-time activity of a respective stage via AI / ML model execution, as discussed supra.

[0086] Accordingly, in some embodiments, when an anomalous condition is identified, processing can proceed from Step 418 to Step 420, whereby information related to theanomalous condition can be identified. In Step 422, an output notification can be generated and the information related to the anomalous condition can be stored in database 108. Steps 420 and 422 can be performed in a similar manner as discussed above at least in relation to Steps 410 and 412. Moreover, processing can recursively proceed to Step 402. In some embodiments, the electronic transaction can be halted, such that the updated / modifications can be performed. In some embodiments, upon updating the transaction, Process 400 can be recursively performed to enable continued processing and monitoring from the stage where the anomalous activity was detected (as indicated via the loop-back from step 422 to Step 416. In some embodiments, based on a type of anomaly and / or type of transaction, the entirety of the transaction may be required to be re-performed (as indicated via the loop-back to Step 402 from Step 422).

[0087] According to some embodiments, upon the completion of the electronic transaction without detection of an anomalous condition, engine 200 can proceed from Step 418 to Step 424, such that an output notification is generated and displayed. The notification can involve an indication of completion of the transaction, and can be sent to each entity involved in the electronic transaction, a third party, a platform, published to a network location, and the like, or some combination thereof. In some embodiments, the notification can function similar to the notification discussed above in relation to Step 412.

[0088] According to some embodiments, information related to the steps in Process 400 (e.g., the determinations in Steps 408 and 418, identified information in Steps 410 and 420, and the information related to the electronic transaction from Steps 402 and 416) can be stored in database 108, as discussed above. In some embodiments, such information can be utilized to store and / or update patterns of activity in a similar manner as discussed in relation to Process 300 of FIG. 3, supra.

[0089] According to some embodiments, an entity, set of entities, type of transaction, type of asset, and the like, or some combination thereof, can have a dedicated engine 200 model so that the assessment protocols applied to an electronic transaction can be specific to the events and patterns learned and detected for that type of electronic transaction.

[0090] FIG. 7 is a schematic diagram illustrating a client device showing an example embodiment of a client device that may be used within the present disclosure. Client device 700 may include many more or less components than those shown in FIG. 7. However, the components shown are sufficient to disclose an illustrative embodiment for implementing the present disclosure. Client device 700 may represent, for example, UE 102 discussed above at least in relation to FIG. 1.

[0091] As shown in the figure, in some embodiments, Client device 700 includes a processing unit (CPU) 722 in communication with a mass memory 730 via a bus 724. Client device 700 also includes a power supply 726, one or more network interfaces 750, an audio interface 752, a display 754, a keypad 756, an illuminator 758, an input / output interface 760, a haptic interface 762, an optional global positioning systems (GPS) receiver 764 and a camera(s) or other optical, thermal or electromagnetic sensors 766. Device 700 can include one camera / sensor 766, or a plurality of cameras / sensors 766, as understood by those of skill in the art. Power supply 726 provides power to Client device 700.

[0092] Client device 700 may optionally communicate with a base station (not shown), or directly with another computing device. In some embodiments, network interface 750 is sometimes known as a transceiver, transceiving device, or network interface card (NIC).

[0093] Audio interface 752 is arranged to produce and receive audio signals such as the sound of a human voice in some embodiments. Display 754 may be a liquid crystal display (LCD), gas plasma, light emitting diode (LED), or any other type of display used with a computing device. Display 754 may also include a touch sensitive screen arranged to receive input from an object such as a stylus or a digit from a human hand.

[0094] Keypad 756 may include any input device arranged to receive input from a user. Illuminator 758 may provide a status indication and / or provide light.

[0095] Client device 700 also includes input / output interface 760 for communicating with external. Input / output interface 760 can utilize one or more communication technologies, such as USB, infrared, Bluetooth™, or the like in some embodiments. Haptic interface 762 is arranged to provide tactile feedback to a user of the client device.

[0096] Optional GPS transceiver 764 can determine the physical coordinates of Client device 700 on the surface of the Earth, which typically outputs a location as latitude and longitude values. GPS transceiver 764 can also employ other geo-positioning mechanisms, including, but not limited to, triangulation, assisted GPS (AGPS), E-OTD, CI, SAI, ETA, BSS or the like, to further determine the physical location of client device 700 on the surface of the Earth. In one embodiment, however, Client device 700 may through other components, provide other information that may be employed to determine a physical location of the device, including for example, a MAC address, Internet Protocol (IP) address, or the like.

[0097] Mass memory 730 includes a RAM 732, a ROM 734, and other storage means. Mass memory 730 illustrates another example of computer storage media for storage of information such as computer readable instructions, data structures, program modules or other data. Mass memory 730 stores a basic input / output system (“BIOS”) 740 for controlling low-leveloperation of Client device 700. The mass memory also stores an operating system 741 for controlling the operation of Client device 700.

[0098] Memory 730 further includes one or more data stores, which can be utilized by Client device 700 to store, among other things, applications 742 and / or other information or data. For example, data stores may be employed to store information that describes various capabilities of Client device 700. The information may then be provided to another device based on any of a variety of events, including being sent as part of a header (e.g., index fde of the HLS stream) during a communication, sent upon request, or the like. At least a portion of the capability information may also be stored on a disk drive or other storage medium (not shown) within Client device 700.

[0099] Applications 742 may include computer executable instructions which, when executed by Client device 700, transmit, receive, and / or otherwise process audio, video, images, and enable telecommunication with a server and / or another user of another client device. Applications 742 may further include a client that is configured to send, to receive, and / or to otherwise process gaming, goods / services and / or other forms of data, messages and content hosted and provided by the platform associated with engine 200 and its affiliates.

[0100] As used herein, the terms “computer engine” and “engine” identify at least one software component and / or a combination of at least one software component and at least one hardware component which are designed / programmed / configured to manage / control other software and / or hardware components (such as the libraries, software development kits (SDKs), objects, and the like).

[0101] Examples of hardware elements may include processors, microprocessors, circuits, circuit elements (e g., transistors, resistors, capacitors, inductors, and so forth), integrated circuits, application specific integrated circuits (ASIC), programmable logic devices (PLD), digital signal processors (DSP), field programmable gate array (FPGA), logic gates, registers, semiconductor device, chips, microchips, chip sets, and so forth. In some embodiments, the one or more processors may be implemented as a Complex Instruction Set Computer (CISC) or Reduced Instruction Set Computer (RISC) processors; x86 instruction set compatible processors, multi-core, or any other microprocessor or central processing unit (CPU). In various implementations, the one or more processors may be dual-core processor(s), dual-core mobile processor(s), and so forth.

[0102] Computer-related systems, computer systems, and systems, as used herein, include any combination of hardware and software. Examples of software may include software components, programs, applications, operating system software, middleware, firmware,software modules, routines, subroutines, functions, methods, procedures, software interfaces, application program interfaces (API), instruction sets, computer code, computer code segments, words, values, symbols, or any combination thereof Determining whether an embodiment is implemented using hardware elements and / or software elements may vary in accordance with any number of factors, such as desired computational rate, power levels, heat tolerances, processing cycle budget, input data rates, output data rates, memory resources, data bus speeds and other design or performance constraints.

[0103] For the purposes of this disclosure a module is a software, hardware, or firmware (or combinations thereof) system, process or functionality, or component thereof, that performs or facilitates the processes, features, and / or functions described herein (with or without human interaction or augmentation). A module can include sub-modules. Software components of a module may be stored on a computer readable medium for execution by a processor. Modules may be integral to one or more servers, or be loaded and executed by one or more servers. One or more modules may be grouped into an engine or an application.

[0104] One or more aspects of at least one embodiment may be implemented by representative instructions stored on a machine-readable medium which represents various logic within the processor, which when read by a machine causes the machine to fabricate logic to perform the techniques described herein. Such representations, known as “IP cores,” may be stored on a tangible, machine readable medium and supplied to various customers or manufacturing facilities to load into the fabrication machines that make the logic or processor. Of note, various embodiments described herein may, of course, be implemented using any appropriate hardware and / or computing software languages (e.g., C++, Objective-C, Swift, Java, JavaScript, Python, Perl, QT, and the like).

[0105] For example, exemplary software specifically programmed in accordance with one or more principles of the present disclosure may be downloadable from a network, for example, a website, as a stand-alone product or as an add-in package for installation in an existing software application. For example, exemplary software specifically programmed in accordance with one or more principles of the present disclosure may also be available as a client-server software application, or as a web-enabled software application. For example, exemplary software specifically programmed in accordance with one or more principles of the present disclosure may also be embodied as a software package installed on a hardware device.

[0106] For the purposes of this disclosure the term “user”, “subscriber” “consumer” or “customer” should be understood to refer to a user of an application or applications as described herein and / or a consumer of data supplied by a data provider. By way of example, and notlimitation, the term “user” or “subscriber” can refer to a person who receives data provided by the data or service provider over the Internet in a browser session, or can refer to an automated software application which receives the data and stores or processes the data. Those skilled in the art will recognize that the methods and systems of the present disclosure may be implemented in many manners and as such are not to be limited by the foregoing exemplary embodiments and examples. In other words, functional elements being performed by single or multiple components, in various combinations of hardware and software or firmware, and individual functions, may be distributed among software applications at either the client level or server level or both. In this regard, any number of the features of the different embodiments described herein may be combined into single or multiple embodiments, and alternate embodiments having fewer than, or more than, all of the features described herein are possible.

[0107] Functionality may also be, in whole or in part, distributed among multiple components, in manners now known or to become known. Thus, myriad software / hardware / firmware combinations are possible in achieving the functions, features, interfaces and preferences described herein. Moreover, the scope of the present disclosure covers conventionally known manners for carrying out the described features and functions and interfaces, as well as those variations and modifications that may be made to the hardware or software or firmware components described herein as would be understood by those skilled in the art now and hereafter.

[0108] Furthermore, the embodiments of methods presented and described as flowcharts in this disclosure are provided by way of example in order to provide a more complete understanding of the technology. The disclosed methods are not limited to the operations and logical flow presented herein. Alternative embodiments are contemplated in which the order of the various operations is altered and in which sub-operations described as being part of a larger operation are performed independently.

[0109] While various embodiments have been described for purposes of this disclosure, such embodiments should not be deemed to limit the teaching of this disclosure to those embodiments. Various changes and modifications may be made to the elements and operations described above to obtain a result that remains within the scope of the systems and processes described in this disclosure.

Claims

CLAIMSWhat is claimed is:

1. A method comprising: identifying, by a device, information related to an electronic data structure corresponding to interactions between at least two entities, the information corresponding to assets related to each entity and a transfer of respective assets among the entities, the electronic data structure comprising a set of stages required to be performed prior to completion of the interactions; analyzing, by the device, for each stage of the set of stages, the information based on a stored pattern of activity related to at least one of the entities; determining, by the device, based on the analysis, that a stage of the electronic data structure comprises activity related to an anomalous condition, the anomalous condition corresponding to an inaccuracy or risk of the stage that prevents the completion of the interactions between the entities, the inaccuracy or risk being a deviation from the stored pattern; communicating, by the device, an electronic notification to at least one of the entities, the notification comprising information indicating the anomalous condition and comprising functionality for remedying the activity related to the anomalous condition.

2. The method of claim 1, further comprising: receiving, in response to the notification, updated information related to the anomalous condition; and updating the electronic data structure based on the updated information.

3. The method of claim 2, wherein the activity of the stage of the electronic data structure is re-performed in accordance with the updated information included in the updated electronic data structure.

4. The method of claim 1, further comprising: determining, based on the analysis, that the activity of a stage of the set of stages is accurately being performed; andcontinuing to a next stage upon the completion based on the accurate determination of a preceding stage.

5. The method of claim 1, wherein the analysis of the electronic data structure and the determination based on the analysis is performed in real-time in accordance activity of each stage.

6. The method of claim 1, further comprising: analyzing a set of interactions associated with at least one of the entities; determining, based on the analysis of the set of interactions, a set of patterns; and storing the determined set of patterns, wherein the stored pattern of activity is retrieved from the stored determined set of patterns.

7. The method of claim 1, wherein the stored pattern of activity comprises information related to interaction activity related to at least one of an entity type, entity identifier (ID), asset type, transaction type, time, date and location.

8. The method of claim 1, wherein the analysis of the information based on the stored pattern of activity is based on the device executing at least one of an artificial intelligence (Al) and machine learning (ML) algorithm.

9. The method of claim 1, wherein the assets corresponds to at least one of digital assets, electronic assets and real-world assets.

10. The method of claim 1, wherein each entity corresponds to at least one of a person and company.

11. A device comprising: a processor configured to: identify information related to an electronic data structure corresponding to interactions between at least two entities, the information corresponding to assets related to each entity and a transfer of respective assets among the entities, the electronic data structure comprising a set of stages required to be performed prior to completion of the interactions;analyze, for each stage of the set of stages, the information based on a stored pattern of activity related to at least one of the entities; determine, by the device, based on the analysis, that a stage of the electronic data structure comprises activity related to an anomalous condition, the anomalous condition corresponding to an inaccuracy or risk of the stage that prevents the completion of the interactions between the entities, the inaccuracy or risk being a deviation from the stored pattern; communicate, by the device, an electronic notification to at least one of the entities, the notification comprising information indicating the anomalous condition and comprising functionality for remedying the activity related to the anomalous condition.

12. The device of claim 11 , wherein the processor is further configured to: receive, in response to the notification, updated information related to the anomalous condition; and update the electronic data structure based on the updated information, wherein the activity of the stage of the electronic data structure is re-performed in accordance with the updated information included in the updated electronic data structure.

13. The device of claim 11, wherein the processor is further configured to: determine, based on the analysis, that the activity of a stage of the set of stages is accurately being performed; and continue to a next stage upon the completion based on the accurate determination of a preceding stage.

14. The device of claim 11, wherein the analysis of the electronic data structure and the determination based on the analysis is performed in real-time in accordance activity of each stage.

15. The device of claim 11, wherein the processor is further configured to: analyze a set of interactions associated with at least one of the entities; determine, based on the analysis of the set of interactions, a set of patterns; and store the determined set of patterns, wherein the stored pattern of activity is retrieved from the stored determined set of patterns.

16. A non-transitory computer-readable storage medium tangibly encoded with computer-executable instructions that when executed by a device, perform a method comprising: identifying, by the device, information related to an electronic data structure corresponding to interactions between at least two entities, the information corresponding to assets related to each entity and a transfer of respective assets among the entities, the electronic data structure comprising a set of stages required to be performed prior to completion of the interactions; analyzing, by the device, for each stage of the set of stages, the information based on a stored pattern of activity related to at least one of the entities; determining, by the device, based on the analysis, that a stage of the electronic data structure comprises activity related to an anomalous condition, the anomalous condition corresponding to an inaccuracy or risk of the stage that prevents the completion of the interactions between the entities, the inaccuracy or risk being a deviation from the stored pattern; communicating, by the device, an electronic notification to at least one of the entities, the notification comprising information indicating the anomalous condition and comprising functionality for remedying the activity related to the anomalous condition.

17. The non-transitory computer-readable storage medium of claim 16, further comprising: receiving, in response to the notification, updated information related to the anomalous condition; and updating the electronic data structure based on the updated information, wherein the activity of the stage of the electronic data structure is re-performed in accordance with the updated information included in the updated electronic data structure.

18. The non-transitory computer-readable storage medium of claim 16, further comprising: determining, based on the analysis, that the activity of a stage of the set of stages is accurately being performed; and continuing to a next stage upon the completion based on the accurate determination of a preceding stage.

19. The non-transitory computer-readable storage medium of claim 16, wherein the analysis of the electronic data structure and the determination based on the analysis is performed in real-time in accordance activity of each stage.

20. The non-transitory computer-readable storage medium of claim 16, further comprising: analyzing a set of interactions associated with at least one of the entities; determining, based on the analysis of the set of interactions, a set of patterns; and storing the determined set of patterns, wherein the stored pattern of activity is retrieved from the stored determined set of patterns.

Images