Subgraph extraction and pattern mining in large graphs

Abstract

A method is disclosed. The method includes generating a graph with nodes and edges, inputting the node data for the nodes into a first scoring algorithm to obtain node scores, and inputting the edge data into a second scoring algorithm to obtain edge scores. The method also includes forming one or more subgraphs from the graph. Each subgraph is formed by: determining an initial node with a node score that exceeds a threshold, determining an initial set of edges connected to the initial node, determining a set of nodes connected to the initial set of edges, and determining additional edges and additional nodes extending from the set of nodes, until a predetermined number of the additional nodes and edges have edge scores and node scores that do not meet the threshold, thereby forming the subgraph.

Description

SUBGRAPH EXTRACTION AND PATTERN MINING IN LARGE GRAPHSCROSS-REFERENCE TO RELATED APPLICATIONS

[0001] None.BACKGROUND

[0002] Graphs provide a holistic view of the activities going on in the world of social interactions, financial transactions etc. Graphs can provide an insight into patterns involving unusual interactions between entities forming the graph. For example, graphs can be used to identify multiple users colluding to conduct a scam. This type of pattern identification is also impossible to detect in data that is in a tabular format.

[0003] Current methods look for frequently occurring or previously known patterns in a graph. However, such techniques may not reveal hidden patterns within the graph. Also, graphs are very hard to manage because of the requirement to fit the entire graph into one memory.

[0004] Embodiments of the disclosure address these and other problems, individually and collectively.SUMMARY

[0005] One embodiment of the invention includes a method comprising: generating a graph with nodes and edges; inputting node data for the nodes into a first scoring algorithm to obtain node scores; inputting edge data into a second scoring algorithm to obtain edge scores; and forming one or more subgraphs from the graph, each subgraph formed by: determining an initial node with a node score that exceeds a threshold, determining an initial set of edges connected to the initial node, determining a set of nodes connected to the initial set of edges, and determining additional edges and additional nodes extending from the set of nodes, until a predetermined number of the additional nodes and edges have edge scores and node scores that do not meet the threshold, thereby forming the subgraph.

[0006] Another embodiment of the invention can include a server computer comprising a processor, and a computer readable medium. The computer readable medium comprises code, executable by the processor, to perform operations comprising generating a graph with nodes and edges; inputting node data for the nodes into a first scoring algorithm to obtain node scores; inputting edge data into a second scoring algorithm to obtain edge scores; and forming one or more subgraphs from the graph, each subgraph formed by: determining an initial node with a node score that exceeds a threshold, determining an initial set of edges connected to the initial node, determining a set of nodes connected to the initial set of edges, and determining additional edges and additional nodes extending from the set of nodes, until a predetermined number of the additional nodes and edges have edge scores and node scores that do not meet the threshold, thereby forming the subgraph.

[0007] Further details regarding embodiments of the disclosure can be found in the Detailed Description and the Figures.BRIEF DESCRIPTION OF THE DRAWINGS

[0008] FIG. 1 shows a system diagram of a system according to an embodiment of the invention.

[0009] FIG. 2 shows a block diagram of an exemplary server computer according to embodiments.

[0010] FIG. 3 shows an information flow diagram of a method for extracting subgraphs from interaction data according to some embodiments.

[0011] FIG. 4 shows an exemplary graph with node scores and edge scores.

[0012] FIG. 5 shows a flowchart of a method for forming a subgraph from a graph.

[0013] FIG. 6 shows a diagram of a transaction processing system.TERMS

[0014] Prior to discussing embodiments of the disclosure, some terms can be described in further detail.

[0015] A “user” may include an individual. In some embodiments, a user may be associated with one or more personal accounts and / or mobile devices. The user may also be referred to as a cardholder, account holder, or consumer in some embodiments.

[0016] A “user device” may be a device that is operated by a user. Examples of user devices may include a mobile phone, a smart phone, a card, a personal digital assistant (PDA), a laptop computer, a desktop computer, a server computer, a vehicle such as an automobile, a thin-client device, a tablet PC, etc. Additionally, user devices may be any type of wearable technology device, such as a watch, earpiece, glasses, etc. The user device may include one or more processors capable of processing user input. The user device may also include one or more input sensors for receiving user input. As is known in the art, there are a variety of input sensors capable of detecting user input, such as accelerometers, cameras, microphones, etc. The user input obtained by the input sensors may be from a variety of data input types, including, but not limited to, audio data, visual data, or biometric data. The user device may comprise any electronic device that may be operated by a user, which may also provide remote communication capabilities to a network. Examples of remote communication capabilities include using a mobile phone (wireless) network, wireless data network (e.g., 3G, 4G or similar networks), Wi-Fi, Wi-Max, or any other communication medium that may provide access to a network such as the Internet or a private network.

[0017] An “access device” may be any suitable device for providing access to an external computer system. An access device may be in any suitable form. Some examples of access devices include point of sale (POS) devices, cellular phones, PDAs, personal computers (PCs), tablet PCs, hand-held specialized readers, set-top boxes, electronic cash registers (ECRs), automated teller machines (ATMs), virtual cash registers (VCRs), kiosks, security systems, access systems, Websites, and the like. An access device may use any suitable contact or contactless mode of operation to send or receive data from, or associated with, a portable communication device. In some embodiments, where an access device may comprise a POS terminal, any suitable POS terminal may be used and may include a reader, a processor, and a computer-readable medium. A reader may include any suitable contact or contactless mode of operation. For example, exemplary card readers can include radiofrequency (RF) antennas, optical scanners, bar code readers, or magnetic stripe readers to interact with a portable communication device.

[0018] An “interaction” may include a reciprocal action or influence. An interaction can include a communication, contact, or exchange between parties, devices, and / or entities. Example interactions include a transaction between two parties and a data exchange between two devices. In some embodiments, an interaction can include a user requesting access to secure data, a secure webpage, a secure location, and the like. In other embodiments, an interaction can include a payment transaction in which two devices can interact to facilitate a payment. An interaction can include a transaction interaction, a data transfer interaction, an access interaction, etc.

[0019] A “resource provider” may be an entity that can provide a resource such as goods, services, information, and / or access. Examples of resource providers includes merchants, data providers, transit agencies, governmental entities, venue and dwelling operators, etc. A “merchant” may typically be an entity that engages in transactions and can sell goods or services, or provide access to goods or services.

[0020] An “acquirer” may typically be a business entity (e.g., a commercial bank) that has a business relationship with a particular merchant or other entity. Some entities can perform both issuer and acquirer functions. Some embodiments may encompass such single entity issuer-acquirers. An acquirer may operate an acquirer computer, which can also be generically referred to as a “transport computer”.

[0021] A “credential” may be any suitable information that serves as reliable evidence of worth, ownership, identity, or authority. A credential may be a string of numbers, letters, or any other suitable characters, as well as any object or document that can serve as confirmation. Examples of credentials include value credentials, identification cards, certified documents, access cards, passcodes and other login information, etc.

[0022] A “user identifier” can include any piece of data that can identify a user. A user identifier can comprise any suitable alphanumeric string of characters. In some embodiments, the user identifier may be derived from user identifying information. Insome embodiments, a user identifier can include an account identifier associated with the user. For example, a user can be associated with an account, which has an account identifier, maintained by an authorizing entity computer.

[0023] A "computing device" may include any suitable device that can electronically process data. Examples of computing devices include desktop computers, mobile devices or mobile computing devices, television sets, etc.

[0024] A “server computer” may include a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. In one example, the server computer may be a database server coupled to a Web server. The server computer may be coupled to a database and may include any hardware, software, other logic, or combination of the preceding for servicing the requests from one or more client computers.

[0025] An “authorization request message” may be an electronic message that requests authorization for an interaction. In some embodiments, it is sent to a transaction processing computer and / or an issuer of a payment card to request authorization for a transaction. An authorization request message according to some embodiments may comply with International Organization for Standardization (ISO) 8583, which is a standard for systems that exchange electronic transaction information associated with a payment made by a user using a payment device or payment account. The authorization request message may include an issuer account identifier that may be associated with a payment device or payment account. An authorization request message may also comprise additional data elements corresponding to “identification information” including, by way of example only: a service code, a CW (card verification value), a dCW (dynamic card verification value), a PAN (primary account number or “account number”), a payment token, a user name, an expiration date, etc. An authorization request message may also comprise “transaction information,” such as any information associated with a current transaction, such as the transaction value, merchant identifier, merchant location, acquirer bank identification number (BIN), card acceptor ID, information identifying items beingpurchased, etc., as well as any other information that may be utilized in determining whether to identify and / or authorize a transaction.

[0026] An “authorization response message” may be a message that responds to an authorization request. In some cases, it may be an electronic message reply to an authorization request message generated by an issuing financial institution or a transaction processing computer. The authorization response message may include, by way of example only, one or more of the following status indicators: Approval -- transaction was approved; Decline -- transaction was not approved; or Call Center -- response pending more information, merchant must call the toll-free authorization phone number. The authorization response message may also include an authorization code, which may be a code that a credit card issuing bank returns in response to an authorization request message in an electronic message (either directly or through the transaction processing computer) to the merchant's access device (e.g., PCS equipment) that indicates approval of the transaction. The code may serve as proof of authorization.

[0027] An “authorizing entity” may be an entity that authorizes a request. Examples of an authorizing entity may be an issuer, a governmental agency, a document repository, an access administrator, etc. An authorizing entity may operate an authorizing entity computer. An “issuer” may refer to a business entity (e.g., a bank) that issues and optionally maintains an account for a user. An issuer may also issue payment credentials stored on a user device, such as a cellular telephone, smart card, tablet, or laptop to the consumer, or in some embodiments, a portable device.

[0028] A “machine learning model” may include an application of artificial intelligence that provides systems with the ability to automatically learn and improve from experience without explicitly being programmed. A machine learning model may include a set of software routines and parameters that can predict an output of a process (e.g., identification of an attacker of a computer network, authentication of a computer, a suitable recommendation based on a user search query, etc.) based on a “feature vector” or other input data. A structure of the software routines (e.g., number of subroutines and the relation between them) and / or the values of the parameters can be determined in a training process, which can use actual results of the processthat is being modeled, e.g., the identification of different classes of input data. Examples of machine learning models include support vector machines (SVM), models that classify data by establishing a gap or boundary between inputs of different classifications, as well as neural networks, which are collections of artificial “neurons” that perform functions by activating in response to inputs. In some embodiments, a neural network can include a convolutional neural network, a recurrent neural network, etc.

[0029] A “model database” may include a database that can store machine learning models. Machine learning models can be stored in a model database in a variety of forms, such as collections of parameters or other values defining the machine learning model. Models in a model database may be stored in association with keywords that communicate some aspect of the model. For example, a model used to evaluate news articles may be stored in a model database in association with the keywords “news,” “propaganda,” and “information.” An analysis computer can access a model database and retrieve models from the model database, modify models in the model database, delete models from the model database, or add new models to the model database.

[0030] A “feature vector” may include a set of measurable properties (or “features”) that represent some object or entity. A feature vector can include collections of data represented digitally in an array or vector structure. A feature vector can also include collections of data that can be represented as a mathematical vector, on which vector operations such as the scalar product can be performed. A feature vector can be determined or generated from input data. A feature vector can be used as the input into a machine learning model, such that the machine learning model produces some output or classification. The construction of a feature vector can be accomplished in a variety of ways, based on the nature of the input data. For example, for a machine learning classifier that classifies words as correctly spelled or incorrectly spelled, a feature vector corresponding to a word such as “LOVE” could be represented as the vector (12,15, 22, 5), corresponding to the alphabetical index of each letter in the input data word. For a more complex “input,” such as a human entity, an exemplary feature vector could include features such as the human's age, height, weight, a numerical representation of relative happiness, etc. Feature vectors can berepresented and stored electronically in a feature store. Further, a feature vector can be normalized, i.e., be made to have unit magnitude. As an example, the feature vector (12, 15, 22, 5) corresponding to “LOVE” could be normalized to approximately (0.40, 0.51 , 0.74, 0.17).

[0031] A “graph” can include a representation of data in a plane of distinct vertices connected by edges. The distinct vertices in a topological graph may be referred to as “nodes.” Each node may represent specific information for an event or may represent specific information for a profile of an entity or object. The nodes may be related to one another by a set of edges, E. An “edge” may be described as an unordered pair composed of two nodes as a subset of the graph G=(V, E), where is G is a graph comprising a set V of vertices (nodes) connected by a set of edges E. For example, a graph may represent a transaction network in which a node representing an account may be connected by edges to one or more nodes that are related to the transaction, such as nodes representing information of a device, a user, a transaction type, etc. An edge may be associated with a numerical value, referred to as a “weight,” that may be assigned to the pairwise connection between the two nodes. The edge weight may be identified as a strength of connectivity between two nodes and / or may be related to a cost or distance, as it often represents a quantity that is required to move from one node to the next. In some embodiments, a graph can be a dynamic graph, which may change over time. For example, nodes and / or edges may be added to and / or removed from the graph.

[0032] A “subgraph” or “sub-graph” can include a graph formed from a subset of elements of a larger graph. The elements may include vertices and connecting edges, and the subset may be a set of nodes and edges selected amongst the entire set of nodes and edges for the larger graph. For example, a plurality of subgraph can be formed by randomly sampling graph data, wherein each of the random samples can be a subgraph. Each subgraph can overlap another subgraph formed from the same larger graph.

[0033] The term “verification” and its derivatives may refer to a process that utilizes information to determine whether an underlying subject is valid under a given set of circumstances. Verification may include any comparison of information toensure some data or information is correct, valid, accurate, legitimate, and / or in good standing.

[0034] A “processor” may include a device that processes something. In some embodiments, a processor can include any suitable data computation device or devices. A processor may comprise one or more microprocessors working together to accomplish a desired function. The processor may include a CPU comprising at least one high-speed data processor adequate to execute program components for executing user and / or system -generated requests. The CPU may be a microprocessor such as AMD's Athlon, Duron and / or Opteron; IBM and / or Motorola's PowerPC; IBM's and Sony's Cell processor; Intel's Celeron, Itanium, Pentium, Xeon, and / or XScale; and / or the like processor(s).

[0035] A “memory” may be any suitable device or devices that can store electronic data. A suitable memory may comprise a non-transitory computer readable medium that stores instructions that can be executed by a processor to implement a desired method. Examples of memories may comprise one or more memory chips, disk drives, etc. Such memories may operate using any suitable electrical, optical, and / or magnetic mode of operation.DETAILED DESCRIPTION

[0036] Prior methods are directed towards extracting known patterns from graphs. However, in many cases the graphs, and patterns within the graph, may evolve as new interaction data becomes available. In case of evolving patterns or in absence of any pre-defined patterns, it can be difficult to extract any meaningful subgraph from a large graph. Embodiments propose novel methods for extracting abnormal patterns from a large graph.

[0037] Embodiments of the disclosure are directed towards methods and systems for subgraph extraction from dynamic graphs. Graphs may be used to represent interactions between nodes, where the interactions are defined by edges. The nodes can be entities such as people, machines, locations, etc. The interactions that define edges between the nodes can relate to communications between the nodes, interactions between the nodes, etc.

[0038] In embodiments of the invention, the graph can comprise hundreds of thousands or millions nodes and edges. The extracted subgraphs can comprise a much smaller number of nodes and edges. For example, in some embodiments, extracted subgraphs can include less than about 1000, 100, or 10 edges and nodes.

[0039] Characteristics of individual entities (nodes and edges) are described by their feature representations. These representations are trained to differentiate between normal and abnormal interactions. Embodiments of the invention use these representations to first single out the abnormal nodes and edges. Subgraphs can be grown from there to extract an anomalous subgraph based on characteristics of neighboring nodes and edges. This will also help in breaking down large graphs into smaller subgraphs that can be processed in parallel, thereby resulting in computational efficiencies. The subgraphs can also be processed more quickly, in a parallel fashion for efficient in-memory and distributed graph management.

[0040] Some embodiments can identify and extract anomalous patterns that may suggest fraudulent interactions. The patterns may be extracted in the form of subgraphs to enable efficient processing. In some embodiments, the subgraphs are input into different machine learning models to identify potentially anomalous behavior. Each machine learning model can process an individual subgraph instead of the much larger graph from which the subgraph is derived.

[0041] In specific embodiments, embodiments of the invention can evaluate a payment graph holistically and extract subgraphs (clusters) where suspicious activities are taking place. Transaction data is converted to a graph where nodes represent the accounts and edges represent the transactions. Each account and transaction will have a feature set that describes them. The aggregated information, which is a learned representation for the entity, is then condensed into a score for each node / edge that signifies its risk factor. Starting at a risky node, the neighboring nodes and edges can be marked based on a risk score threshold. Such marking will identify a subgraph associated with unusual behavior and anomalous patterns will be visible.

[0042] An embodiment of the inveniton can include a method. The method includes generating a graph with nodes and edges, inputting the node data for the nodes into a first scoring algorithm to obtain node scores, and inputting the edge datainto a second scoring algorithm to obtain edge scores. The method also includes forming one or more subgraphs from the graph. Each subgraph is formed by: determining an initial node with a node score that exceeds a threshold, determining an initial set of edges connected to the initial node, determining a set of nodes connected to the initial set of edges, and determining additional edges and additional nodes extending from the set of nodes, until a predetermined number of the additional nodes and edges have edge scores and node scores that do not meet the threshold, thereby forming the subgraph.

[0043] FIG. 1 shows a diagram of a system according to an embodiment. The system 100 can include a plurality of interaction data sources 102A, 102B, 102C in communication with a server computer 108. The server computer 108 can communicate with a plurality of data processing computers 104A, 104B, 104C. In FIG.1 , three interaction data sources and three data processing computers are shown for purposes of illustration, but embodiments are not limited to this.

[0044] The interaction data sources 102A, 102B, 102C can provide interaction data to the server computer 108 and can be in communication with it. Interaction data sources 102A, 102B, 102C could be, for example, authorizing entity computers (e.g., issuer computers), transport computers (e.g., acquirer computers), processing network computers (e.g., payment processing network computers), user devices (e.g., user mobile phones or laptop computers), computer nodes in a computer network, etc.

[0045] The server computer 108 can generate a graph using the interaction data from the interaction data sources 102A, 102B, 102C. Once the graph is generated, it can determine one or more subgraphs from the graph.

[0046] The plurality of data processing computers 104A, 104B, 104C can receive and then process subgraphs that are determined by the server computer 108. For example, each data processing computer 104 could have a separate machine learning algorithm (e.g., an artificial intelligence module). Each data processing computer 104 can receive a subgraph from the server computer 108 instead of the entire graph. Each data processing computer 104 can then predict the type of anomalous activity or behavior that is present in the subgraph. Because the entire graph is not processed by a single data processing computer, embodiments of theinvention can identify anomalous activity or behavior more quickly than conventional systems that would analyze an entire graph for anomalous activity or behavior.

[0047] Messages between at least the devices of the system in FIG. 1 can be transmitted using a secure communications protocols such as, but not limited to, File Transfer Protocol (FTP); HyperText Transfer Protocol (HTTP); Secure Hypertext Transfer Protocol (HTTPS), SSL, ISO (e.g., ISO 8583) and / or the like. The communications network may include any one and / or the combination of the following: a direct interconnection; the Internet; a Local Area Network (LAN); a Metropolitan Area Network (MAN); an Operating Missions as Nodes on the Internet (OMNI); a secured custom connection; a Wide Area Network (WAN); a wireless network (e.g., employing protocols such as, but not limited to a Wireless Application Protocol (WAP), l-mode, and / or the like); and / or the like. The communications network can use any suitable communications protocol to generate one or more secure communication channels. A communications channel may, in some instances, comprise a secure communication channel, which may be established in any known manner, such as through the use of mutual authentication and a session key, and establishment of a Secure Socket Layer (SSL) session.

[0048] FIG. 2 shows a block diagram of an exemplary server computer according to embodiments. The server computer 108 may comprise a processor 204 coupled to a memory 202, a network interface 206, and a computer readable medium 208. The computer readable medium can comprise a communication module 208A, a graph module 208B, a scoring module 208C, and a subgraph determination module 208D.

[0049] The memory 202 can be used to store data and code. The memory 202 may be coupled to the processor 204 internally or externally (e.g., cloud based data storage), and may comprise any combination of volatile and / or non-volatile memory, such as RAM, DRAM, ROM, flash, or any other suitable memory device. For example, the memory 202 can store interaction data, graphs, subgraphs, node scores, edge scores, etc.

[0050] The communication module 208A may comprise code or software, executable by the processor 204, for communicating with other devices. Thecommunication module 208A may be configured or programmed to perform some or all of the functionality associated with receiving, sending, and generating electronic messages for transmission. The communication module 208A, in conjunction with the processor 204, may receive information from the computer readable medium 208 and generate an electronic message in an appropriate data format in conformance with a transmission protocol so that the message may be sent to one or more entities. The electronic message may then be passed to the network interface 206 for transmission.

[0051] The graph module 208B may comprise code, executable by the processor 204, for generating a graph with nodes and edges. The graph may be generated from interaction data for a plurality of interactions. The graph module 208B may use data such as user credentials, account identifiers, and other interaction data to generate a graph. In one example, a graph may be generated to represent users and resource providers (or user devices and resource provider computers) as nodes, and represent their interactions as edges. The graph module 208B can also generate embeddings from the nodes and edges. For example, the a node may represent a merchant and can have raw features such as a merchant name, a merchant location, a number of daily transactions conducted by the merchant, etc. These raw features can be converted to an embedding, or a vector of raw features (raw features : xn(0), xe<°)).

[0052] The scoring module 208C may comprise code, executable by the processor 204, for determining node scores and edge scores. The scoring module 208C, in conjunction with the processor 204, may input node data into a first scoring algorithm to obtain node scores. Node data may comprise user credentials and account identifiers. The scoring module 208C, in conjunction with the processor 204, may also input edge data into a second scoring algorithm to obtain edge scores. Edge data may comprise interaction identifiers, values for the interactions, and dates and times of the interactions. In some embodiments, the scoring algorithims may be machine learning models trained on historical interaction data. In some embodiments, the scoring module 208C, in conjunction with the processor 204, may use scoring algorithms which output scores related to risk. For example, a node representing a high fraud risk account may be assigned a high score and a node representing a low fraud risk account may be assigned a low score.

[0053] The subgraph determination module 208D may comprise code, executable by the processor 204, for forming one or more subgraphs from a graph.

[0054] The computer readable medium 208 can comprise code, executable by the processor 204 to perform operations comprising: generating a graph with nodes and edges; inputting node data for the nodes into a first scoring algorithm to obtain node scores; inputting edge data into a second scoring algorithm to obtain edge scores; and forming one or more subgraphs from the graph, each subgraph formed by: determining an initial node with a node score that exceeds a threshold, determining an initial set of edges connected to the initial node, determining a set of nodes connected to the initial set of edges, and determining additional edges and additional nodes extending from the set of nodes, until a predetermined number of the additional nodes and edges have edge scores and node scores that do not meet the threshold, thereby forming the subgraph.

[0055] The network interface 206 may include an interface that can allow the server computer 108 to communicate with external computers. The network interface 206 may enable the server computer 108 to communicate data to and from another device (e.g., user devices, processing network computers, etc.). Some examples of the network interface 206 may include a modem, a physical network interface (such as an Ethernet card or other Network Interface Card (NIC)), a virtual network interface, a communications port, a Personal Computer Memory Card International Association (PCMCIA) slot and card, or the like. The wireless protocols enabled by the network interface 206 may include Wi-Fi™. Data transferred via the network interface 206 may be in the form of signals which may be electrical, electromagnetic, optical, or any other signal capable of being received by the external communications interface (collectively referred to as “electronic signals” or “electronic messages”). These electronic messages that may comprise data or instructions may be provided between the network interface 206 and other devices via a communications path or channel. As noted above, any suitable communication path or channel may be used such as, for instance, a wire or cable, fiber optics, a telephone line, a cellular link, a radio frequency (RF) link, a WAN or LAN network, the Internet, or any other suitable medium.

[0056] FIG. 3 shows an information flow diagram of a method 300 for extracting subgraphs from interaction data according to some embodiments. A server computer may receive a request to determine one or more subgraphs from interaction data 302. The request may be associated with interaction data 302, which may be data from recent and / or past interactions. In some embodiments, the interaction data 302 may comprise interaction identifiers (e.g., a transaction identifier), account identifiers (e.g., primary account numbers), user identifiers (e.g., names), values for interactions, times and dates of interactions, location of interactions, etc., for a plurality of interactions.

[0057] At step S320, a graph module 304 can use the interaction data 302 to generate a graph. In the graph, nodes can represent entities such as users and resource providers, while edges may represent interactions between the entities (e.g., a user conducting a payment transaction with a resource provider such as a merchant). The graph module 304 can update the graph over time as interaction data is collected from the interaction data sources.

[0058] In generating the graph, the graph module 304 may create node embeddings and edge embeddings from the data associated with the nodes and edges in the graph. If the server computer is adding to an existing graph, the server computer may further use historical interaction data to determine the embeddings. Each node embedding may be a vector representation of a node, and can comprise information associated with an individual user, service provider, or account. Similarly, each edge embedding may be a vector representation of an edge, and may comprise information associated with an interaction. For example, an edge can be a transaction between a merchant and a user, and features of the transaction can include the date and time of the transaction, the amount of the transaction, the parties to the transaction, the transaction velocity associated with the parties to the transaction, etc. Such features can be turned into vector. The feature vectors are passed through a graph based neural network which results in node and edge embeddings.

[0059] FIG. 4 shows an exemplary graph 450 resulting from interaction data for a plurality of interactions. The graph illustrates an interaction network comprising nodes X, Y, and Z for users. A node for a user may be connected to other nodes, which may represent service providers or other users that the user interacts with.Accordingly, edges may represent an interaction between nodes. For example, edge B may represent a transaction between X and Y.

[0060] Referring back to FIG. 3, after generating the graph, at steps S322-S324 the server computer can obtain node scores and edge scores for the nodes and edges in the graph. The server computer can input node data (e.g., node embeddings) into a first scoring algorithm 306 to obtain scores for each node, and input edge data (e.g., edge embeddings) into a second scoring algorithm 308 to obtain edge scores for the edges. As an example, for each node in the node data, the first scoring algorithm may output a score. The scoring algorithms may be fraud scoring algorithms or classifiers that can determine high scores to nodes and edges that are likely to be fraudulent and low scores if they are not likely to be fraudulent. In embodiments, the method for obtaining the node scores and edge scores may be model agnostic. The first and second scoring algorithms may use a tree based model, a deep learning model, a graph based model, or any suitable model that can determine node scores and edge scores.

[0061] To illustrate, FIG. 4 shows an exemplary graph 450 with node scores and edge scores. The nodes and edges may be associated with node scores and edge scores, as determined by the first and second scoring algorithms. User X may be associated with a node score of 98, User Y may be associated with a node score of 95, and User Z may be associated with a node score of 50. An interaction between User X and User Y may have an edge score of 98, and an interaction between User X and User Z may have an edge score of 75.

[0062] Referring back to FIG. 3, at step S326, the subgraph extractor 310 in the server computer can form one or more subgraphs from the graph. Each subgraph can include a subset of the nodes and edges from the graph. The subsets may be interconnected nodes, which may indicate interactions between users or accounts. Furthermore, different subgraphs may comprise overlapping nodes and edges (e.g., a node may belong to more than one subgraph). To form a subgraph, the server computer can determine an initial node (e.g., a node with the highest node score), and build the subgraph by including nodes and edges extending from the initial node thatmeet predefined rules (e.g., a score threshold, size limit). This process is described in further detail below.

[0063] FIG. 5 shows a flowchart of a method for forming a subgraph from a graph. A subgraph may be formed from a graph of interaction data in order to detect potentially fraudulent behavior.

[0064] In general, when forming a subgraph, one can assume a graph has N nodes and E edges. Let be the score of node ntand ptbe the score of edge et. Let pnbe a pre-decided node score threshold and pebe a pre-decided edge threshold. Steps to mark the (2-hop) anomalous subgraphs are: o Take a node n7- with Sj >= pnor take a node whose mean / median score of incoming / outgoing edges is >= pe. o Take all edges connected to the node from the above step (both incoming and outgoing). o From the set of neighboring nodes of n7, take the ones with score >= pnand all their edges.

[0065] Referring back to FIG. 5, at step S501 of method 500, interaction data for a plurality interactions may be received by a server computer as described above.

[0066] At step S503, the interaction data may be used to create a graph comprising nodes connected by edges. A node for may be created for a distinct information element. Then, the plotted nodes may be connected to one another via edges that represent the linkage between nodes. In some embodiments, the graph may illustrate a network of interactions between users and resource providers, where the nodes represent accounts of users and merchants, and the edges between them represent interactions (e.g., payment transactions).

[0067] At step S505, node scores and edge scores can be obtained for each node and edge in the graph. The node scores and edge scores may be obtained as described above with respect to FIG. 3. After scoring the nodes and edges, the graph with the scores is illustrated in the graph 450 in FIG. 4.

[0068] At step S507, to form a subgraph from the graph, an initial node with a node score that exceeds a threshold is determined. During the selection of an initial node, a node with the highest node score may be given the highest priority. The server computer may select the node with the highest node score to be the initial node of a first subgraph. The node with the second highest node score may be an initial node of a subsequent subgraph. In some embodiments, the initial node represents a potentially risky account. Thus, a subgraph of nodes and edges extending from the initial node can characterize the interactions involving the risky account.

[0069] For example, in FIG. 4, the graph 450 may start with a score threshold of 95, and the node associated with User X 401 may have the highest node score exceeding that score threshold. Accordingly, the node associated with User X 401 may be the initial node for a subgraph.

[0070] Referring back to FIG. 5, at step S509, an initial set of edges extending from the initial node may be determined, and added to the subgraph. The initial set of edges may comprise all of the edges that immediately extend from the initial node, which may be associated with all of the interactions involving the risky account represented by the initial node.

[0071] At step S511 , a set of nodes connected to the initial set of edges can be determined and added to the subgraph. The set of nodes may be the accounts with which the risky account has interacted with. After step S511 , the subgraph may comprise the initial node, the initial set of edges which extend from the initial node, and the set of nodes connected to the initial set of edges.

[0072] At step S513, additional edges and additional nodes extending from the set of nodes may be determined. The server computer may select additional edges and additional nodes that exceed the threshold and add them to the subgraph. For example, for each edge extending from the subgraph, the server computer can compare the edge score to the threshold. If the edge score exceeds the threshold, then the edge, and the node to which it extends, may be added to the subgraph.

[0073] At step S515, the server computer can determine if a predetermined number (e.g., three) of the additional nodes and additional edges extending from theset of nodes, and that are contiguous, have node scores and edge scores that do not meet the threshold.

[0074] If a predetermined number of the additional nodes and additional edges extending from the set of nodes and that are contiguous have node scores and edge scores that do not meet the threshold, then the growth of the subgraph can stop at that branch. This process can continue until no further branch of the subgraph grows.

[0075] Then, at step S517 the server computer may determine that the subgraph is complete and transmit it to a data processing computer for processing. In some embodiments, the subgraph may be subject to other size limitations which may cause the server computer to terminate the subgraph formation process before a predetermined number of the additional nodes and additional edges have node scores and edge scores that do not meet the threshold. A data processing computer can obtain a subgraph from the server computer and can use a machine learning model to classify it. For example, a machine learning model can classify a subgraph with suspicious nodes and edges as being associated with a money laundering scheme.

[0076] Otherwise, if the number of additional nodes and additional edges that have node scores and edge scores that do not meet the threshold is less than the predetermined number, the server computer may continue to determine additional edges and additional nodes extending from the set of nodes. For example, the method may return to step S513.

[0077] As an example, steps S507-S517 can be applied to the graph 450 of FIG. 4 to form subgraph 460. Graph 450 may represent the graph after the edge scores and node scores are obtained, as described in step S505 of method 500. The graph 450 may be associated with a score threshold 95. As described in steps S507- S511 , the server computer can determine an initial node with the highest node score, determine an initial set of edges (A,B,C,D), and a set of nodes connected to the initial set of edges (W,V,Y,Z) to form an initial subgraph 455.

[0078] It is noted that in some embodiments, the initial set of edges may comprise edges with edge scores below the threshold. For example, if there is an edge extending immediately from the initial node with an edge score below the threshold, itmay still be included in the subgraph. As shown, the initial subgraph 455 comprises node Z with a node score of 50 and edge A with an edge score of 75. Yet, node Z and edge A are still included in the subgraph because of their direct relationship with the high risk node X. This may help reveal anomalous behavior that was undetected by the scoring algorithms. For example, node Z may represent a fraudster that recently created an account. There may not be enough interaction data to conclude that node Z is fraudulent, or it may be that the majority of interactions conducted by node Z can be honest. Either of these cases can result in an initially low risk score for node Z.

[0079] The server computer can next determine additional nodes and additional edges extending from the set of nodes. The additional nodes may comprise nodes P, U, T, and S, and the additional edges may comprise edges E, F, G, and H. The server computer can compare the node scores of the additional nodes and the edge scores of the additional edges to the score threshold in order to determine which nodes and edges should be included in the subgraph. A contiguous set of edges and nodes of a predetermined number that all have scores below the score threshold may cause the growth of the subgraph to stop. In some embodiments, the predetermined number may be three. Once the server computer determines that there are three contiguous nodes and edges with scores below the score threshold that are connected (e.g., a node-edge-node group, or an edge-node-edge group, where the nodes / edges have scores below a threshold), then the addition of any further nodes and edges to those contiguous nodes and edges can be excluded from the subgraph.

[0080] To illustrate, although edge H has an edge score below the score threshold, edge H and node S to which it extends may be included in the subgraph because node S has a node score that exceeds the score threshold. Similarly, although edge F has a low edge score, edge F and node U may be added to the subgraph since node U has a high node score. Both edge G and the node T to which it extends exceed the score threshold, and therefore edge G and node T are added to the subgraph. However, the edge score of edge E (50), the node score of node P (40), and the edge score for edge EA (20) are connected and none of their scores exceed the score threshold (95), so the growth of the subgraph terminates at edge E. The server computer may determine if the additional nodes and additional edges that are connected together in a contiguous manner and that they have node scores and edgescores that do not meet the threshold is less than the predetermined number (e.g., three). If so, then the growth of the subgraph at those locatons can stop.

[0081] The next set of additional nodes may be nodes Q, M, N, and R, which are attached to a first set of additional edges J, L, K, and I, and a second set of additoinal edges JA, LA, KA, and IA (respectively). Since the continguous groups have at least three nodes / edges (e.g., J(50), Q(50), JA(40)) with scores below the threshold, the subgraph growth process stops at those groups (e.g., the node or egde closest to the subgraph). This can be the case even if the nodes or edges that are further away have high scores. For example, since edge I, node R, and node IA have scores below the threshold of 95, growth of the subgraph would stop at this branch, even if the node RA connected to edge IA has a score above the threshold. A contigous group of nodes and edges below the threshold can indicate that anomalous or suspect activity is no longer related to other more suspicous nodes and edges, thereby inherently defining the set of nodes and edges that may be involved in anomalous or suspect activity.

[0082] The server computer can finish forming the subgraph 460, and transmit the subgraph 460 (or the data for the nodes and the edges in the subgraph 460) to a data processing computer for processing. In some embodiments, the server computer can continue to extract additional subgraphs from the graph 450 using a different initial node. For example, in a subsequent subgraph, node S may be an initial node.

[0083] FIG. 6 shows a diagram of a transaction processing system 600. The transaction system 600 can produce transaction data, which is an example of the previously described interaction data. The transaction processing system 600 includes a user device 601 that is operated by a user 602. The user device can interact with an access device 604. The access device 604 is in communication with an authorizing entity computer 612 via a resource provider computer 606, a transport computer 608, and a processing network 610, which may incorporate the data processing computer as described above. A token service system (not shown) may be in communication with the processing network 610 (or may be incorporated within it). The processing network 610 may also incorporate the previously described server computer.

[0084] In a transaction conducted using the system 600, the user may use the user device 601 to interact with the access device 604. The access device may thengenerate and transmit an authorization request message to the processing network 610 via the resource provider computer 606 and transport computer 608. If the authorization request message contains a token such as a payment token, the processing network 610 may retrieve real credentials associated with the token from the token service system and may replace the token with the real credentials in the authorization request message. The authorization request message may then be forwarded to the authorizing entity computer 612 for an authorization decision.

[0085] After the authorizing entity computer 612 makes the authorization decision, it returns an authorization response back to the access device 604 via the processing network 610, the transport computer 608, and the resource provider computer 606. If desired, the processing network 610 may replace the real credentials in the authorization response message with a previously provided token. A clearing and settlement process may be subsequently performed.

[0086] The data produced by the system in FIG. 6 can be obtained by the processing network 610 during the authorizing, clearing, or settlement processes.

[0087] Embodiments of the disclosure have a number of technical advantages. As shown above, the methods according to embodiments of the invention can extract unusual patterns from evolving data in the form of subgraphs. Embodiments may be especially useful when patterns are unknown or evolve over time, as embodiments do not require a pre-defined pattern to form subgraphs. Moreover, by extracting extract small, interesting subgraphs from growing data, embodiments accommodate memory limitations and enable efficient processing methods (e.g., parallel processing). For example, data associated with nodes and edges that are contiguous and are not believed to be suspect or anomalous are not included in the subgraph. A data processing computer trying to classify the behavior of the nodes and edges in the subgraph does not need to process this data, thus significantly decreasing the amount of processing time compared to a situation where the entire graph is processed by the data processing computer. Further, patterns in the data may not be apparent when, for example, nodes or edges with low scores are interspersed with nodes and edges with high scores. Embodiments of the invention can accurately identify groups ofnodes and edges that may be anomalous, even though they may have nodes with low scores.

[0088] Although the steps in the flowcharts and process flows described above are illustrated or described in a specific order, it is understood that embodiments of the invention may include methods that have the steps in different orders. In addition, steps may be omitted or added and may still be within embodiments of the invention.

[0089] Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C, C++, C#, Objective-C, Swift, or scripting language such as Perl or Python using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer readable medium for storage and / or transmission, suitable media include random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a compact disk (CD) or DVD (digital versatile disk), flash memory, and the like. The computer readable medium may be any combination of such storage or transmission devices.

[0090] Such programs may also be encoded and transmitted using carrier signals adapted for transmission via wired, optical, and / or wireless networks conforming to a variety of protocols, including the Internet. As such, a computer readable medium according to an embodiment of the present invention may be created using a data signal encoded with such programs. Computer readable media encoded with the program code may be packaged with a compatible device or provided separately from other devices (e.g., via Internet download). Any such computer readable medium may reside on or within a single computer product (e.g., a hard drive, a CD, or an entire computer system), and may be present on or within different computer products within a system or network. A computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user.

[0091] The above description is illustrative and is not restrictive. Many variations of the invention will become apparent to those skilled in the art upon review of thedisclosure. The scope of the invention should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the pending claims along with their full scope or equivalents.

[0092] One or more features from any embodiment may be combined with one or more features of any other embodiment without departing from the scope of the invention.

[0093] As used herein, the use of "a," "an," or "the" is intended to mean "at least one," unless specifically indicated to the contrary.

Claims

WHAT IS CLAIMED IS:1 . A computer-implemented method comprising: generating a graph with nodes and edges; inputting node data for the nodes into a first scoring algorithm to obtain node scores; inputting edge data into a second scoring algorithm to obtain edge scores; and forming one or more subgraphs from the graph, each subgraph formed by: determining an initial node with a node score that exceeds a threshold, determining an initial set of edges connected to the initial node, determining a set of nodes connected to the initial set of edges, and determining additional edges and additional nodes extending from the set of nodes, until a predetermined number of the additional nodes and edges have edge scores and node scores that do not meet the threshold, thereby forming the subgraph.

2. The method of claim 1 , wherein the predetermined number is three.

3. The method of claim 1 , wherein the node data are node embeddings and the edge data are edge embeddings.

4. The method of claim 1 , wherein the one or more subgraphs are two or more subgraphs, wherein the two or more subgraphs are input into two or more respective machine learning models to classify the two or more subgraphs.

5. The method of claim 1 , wherein the nodes are associated with accounts and the edges are associated with interactions.

6. The method of claim 5, wherein the interactions are transactions.

7. The method of claim 5, wherein the one or more subgraphs are used to detect anomalous behavior.

8. The method of claim 1 , wherein nodes with the highest node scores are given priority to be the initial node.

9. The method of claim 1 , wherein the first scoring algorithm is a machine learning model.

10. The method of claim 1 , further comprising transmitting to one or more data processing computers the one or more subgraphs.

11. A server computer comprising: a processor; and a computer readable medium comprising code, executable by the processor for implementing a method comprising: generating a graph with nodes and edges; inputting node data for the nodes into a first scoring algorithm to obtain node scores; inputting edge data into a second scoring algorithm to obtain edge scores; and forming one or more subgraphs from the graph, each subgraph formed by: determining an initial node with a node score that exceeds a threshold, determining an initial set of edges connected to the initial node, determining a set of nodes connected to the initial set of edges, and determining additional edges and additional nodes extending from the set of nodes, until a predetermined number of the additional nodes and edges have edge scores and node scores that do not meet the threshold, thereby forming the subgraph.

12. The server computer of claim 11 , wherein the predetermined number is three.

13. The server computer of claim 11 , wherein the node data are node embeddings, and the edge data are edge embeddings.

14. The server computer of claim 11 , wherein the method further comprises transmitting to one or more data processing computers the one or more subgraphs.

15. The server computer of claim 11 , wherein the nodes are associated with accounts and the edges are associated with interactions.

16. The server computer of claim 15, wherein the one or more subgraphs are used to detect fraud.

17. The server computer of claim 15, wherein the interactions are transactions.

18. The server computer of claim 11 , wherein nodes with the highest node scores are given priority to be the initial node.

19. The server computer of claim 11 , wherein the one or more subgraphs are two or more subgraphs, wherein the two or more subgraphs are input into two or more respective machine learning models to classify the two or more subgraphs.

20. The server computer of claim 11 , wherein the first scoring algorithm is a machine learning model.

Images