Access control using identity delineation

Abstract

Techniques may include generating a graph data structure from transaction data by: accessing transaction data that includes identifiers; processing the transaction data to obtain a set of identifiers from at least one transaction; and creating the graph having a set of nodes and edges, where each node represents the identifier and each edge connects two identifiers from the same transaction. In addition, the techniques may include processing the graph to merge entity labels by: processing nodes with a common entity label to determine a dominant name for the common entity label, where the dominant name is a most frequent name from the common entity label's nodes; and processing the graph to identify entity labels that share a common dominant name; and merging the entity labels that share the common dominant name. The techniques may include performing an operation with the graph.

Description

PATENTAttorney Docket No. 096923-1516360ACCESS CONTROL USING IDENTITY DELINEATIONCROSS-REFERENCES TO RELATED APPLICATIONS

[0001] This application claims the benefit of U.S. Provisional Application No. 63 / 687,544, filed August 27, 2024, entitled “Access Control Using Identity' Delineation,” the disclosure of which is incorporated by reference in its entirety and for all purposes.TECHNICAL FIELD

[0002] The present disclosure relates generally to access control and, more particularly (although not necessarily exclusively), to access control using identity' delineation.BACKGROUND

[0003] Access control can involve determining whether an entity is authorized to perform an operation. For example, a website that authenticates a username and password before providing access to an email inbox is performing access control. Some access control techniques can use behavior to authenticate entities and authorize operations. However, it may be difficult to distinguish between normal and fraudulent behavior in some circumstances. For example, a credit card holder may use different information across transactions, and it may be challenging to determine whether a transaction is fraudulent or a normal variation in the credit holder’s behavior.BRIEF SUMMARY

[0004] A system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, w hen executed by data processing apparatus, cause the apparatus to perform the actions.

[0005] Techniques may include generating a graph data structure from transaction data by: accessing transaction data that includes identifiers; processing the transaction data to obtain a set of identifiers from at least one transaction; and creating the graph having a set of nodes and edges, where each node represents the identifier and each edge connects two identifiers from the same transaction. In addition, the techniques may include processing the graph to merge entity labels by: processing nodes with a common entity label to determine a dominant name for the common entity label, where the dominant name is a most frequent name fromPATENTAttorney Docket No. 096923-1516360 the common entity label's nodes; and processing the graph to identify entity labels that share a common dominant name; and merging the entity labels that share the common dominant name. The techniques may include performing an operation with the graph.

[0006] The techniques can be implemented as methods, devices, systems of devices, and / or non-transitory computer readable mediums storing instructions that, when executed by one or more processors, perform the operations of the techniques.BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Various embodiments in accordance with the present disclosure will be described with reference to the drawings, in which:

[0008] FIG. 1 shows an example of a graph data structure for a single transaction according to at least one embodiment.

[0009] FIG. 2 show s a graph data structure that represents two transactions according to at least one embodiment.

[0010] FIG. 3 shows a graph data structure that has undergone a deduplication procedure according to at least one embodiment.

[0011] FIGs. 4-6 show simplified diagrams of label propagation according to at least one embodiment.

[0012] FIG. 7 show s a graph data structure with a candidate merge pair according to at least one embodiment.

[0013] FIG. 8 is a schematic diagram of a graph system according to at least one embodiment;

[0014] FIG. 9 is a block diagram illustrating an example method for access control with identity7delineation according to at least one embodiment; and

[0015] FIG. 10 illustrates an example computing device that may implement the methods disclosed herein.DETAILED DESCRIPTION

[0016] In the following description, various embodiments will be described. For purposes of explanation, specific configurations and details are set forth in order to provide a thorough understanding of the embodiments. However, it will also be apparent to one skilled in the artPATENTAttorney Docket No. 096923-1516360 that the embodiments may be practiced without the specific details. Furthermore, well-known features may be omitted or simplified in order not to obscure the embodiment being described.

[0017] Certain aspects and examples of the present disclosure relate to access control using identity7delineation. Access control can refer to techniques to determine whether to authorize or deny operations with regard to a resource. For example, access control techniques can be used to determine whether to authorize or deny a credit card transaction. The identity of an entity that is requesting an operation can be an important factor in whether the operation should be authorized. A credit card transaction from a card holder should be approved in most circumstances, but it can be challenging to determine whether the credit card holder actually initiated the transaction. For example, a bad actor may use the credit card holder’s information to initiate a fraudulent transaction.

[0018] Access control techniques may use identity delineation to distinguish between authorized and fraudulent operations. Identity delineation can refer to techniques for attributing a transaction to an entity'. Data may be collected with each transaction, and this data can include identifiers that can be used to infer an identity. For example, when a transaction contains a phone number and an email address, in most cases (e.g., non-fraudulent transactions) can be used to infer the existence of a user who uses both that phone number and email address.

[0019] A challenge w ith identity delineation is that an association between individuals or organizations (e.g., entities) and identifiers can vary across transactions. Entities can have a non-unique association with an identifier, and for example, a single individual may legitimately use multiple names (e.g., maiden name, married name, nickname, middle name, shortened name, etc.). In addition, an identifier can have non-unique associations with entities. For example, multiple entities may legitimately share a single address or name. Entities w ith the same identifier may share any degree of relationship, from the very close relationship between cohabitating spouses, to no meaningful relationship whatsoever in the case of tw o unrelated people who share the same name. Accordingly, it can be difficult to distinguish normal variations in an entity ’s behavior from fraudulent activity. For example, an online credit card purchase with a new shipping address could indicate fraud or that the card holder has moved.PATENTAttorney Docket No. 096923-1516360

[0020] Transaction data can be used to create a graph data structure that can be used for identity delineation. Each node in the graph data structure can represent a unique identifier from the transaction data, and edges can connect identifiers that share a transaction. The identifiers can include mailing information (e.g., a name and mailing address), email addresses, phone numbers, device identifiers (e.g., a token created from a web browser cookie), and payment identifiers (e.g., a token created from payment information such as a credit card number). The nodes in the graph can be assigned entity labels, and an entity can be represented by a subgraph of connected nodes that all share a single entity label.

[0021] Techniques are described for creating a graph data structure and for creating subgraphs that represent entities. These techniques may include performing operations on nodes and subgraphs to assign or update entity labels. These techniques can result in a graph data structure that can be used to control access to an interactive computing environment. A subgraph can be created for a target entity, and the subgraph can be used to determine whether to control access to the interactive computing environment. For example, in response to determining that an entity attempting to access the interactive computing environment is associated with historical fraudulent interactions, a computing device can determine to challenge or deny access of the entity to the interactive computing environment.

[0022] In some examples, the graph data structure can include a first set of nodes, a second set of nodes, and a set of connections. The first set of nodes (e.g., the subgraph for a target entity) can include nodes representing identity information about an entity, the second set of nodes can include nodes representing historical, or real-time or substantially contemporaneous, interactions associated with the entity, and the set of connections may connect one or more nodes of the first set of nodes or one or more nodes of the second set of nodes to the one or more nodes of the first set of nodes or to the one or more nodes of the second set of nodes, or any combination thereof. Additionally, the graph data structure may be generated to be provided via a graphical user interface to facilitate visualization of the underlying data of the graph data structure. For example, the graph data structure may be displayed on a graphical user interface that can include a set of interactive elements such as buttons, links, drop-down menus, and the like. Each interactive element of the set of interactive elements may represent a different identity data point of the entity, a different interaction associated with the entity, other suitable data about the entity, or a combination thereof. Additionally, each interactive element of the set of interactive elements may bePATENTAttorney Docket No. 096923-1516360 configured to, upon selection by a user of the graphical user interface, display previously non-displayed information about a corresponding identity data point of the entity, previously non-displayed information about a corresponding interaction associated with the entity, etc.

[0023] In some examples, the graphical user interface may efficiently provide the graph data structure in an interactive computing environment. The graphical user interface may provide the graph data structure in a visually efficient way such that an entity using the graphical user interface is not overwhelmed by excessive information displayed on the graphical user interface. Additionally, the graphical user interface may provide potential access to all information included in the graph data structure, for example via the set of interactive elements. For example, the graphical user interface may explicitly display a subset of information included in the graph data structure and may embed the remaining information in the set of interactive elements. The entity may interact with one or more interactive elements of the set of interactive elements to cause the graphical user interface to display the requested information. Thus, the graphical user interface can provide the graph data structure in a visually efficient manner without losing information associated with the graph data structure.

[0024] In some examples, such as examples in which the graph data structure can be used to control access to an interactive computing environment, the interactive computing environment can be provided by a client computing system. The client computing system can be, or can be associated with, a provider entity, an organization, or the like that may provide software as a service, infrastructure as a service, and other suitable services accessible by a user computing system that can be used by the entity, which may be or include a user of the graphical user interface. In some examples, the interactive computing environment can include the graphical user interface or any other suitable user interface. The entity can use the client computing device to request access to a particular user interface that can be used to request sen ices or other suitable computing resources from the data sources. For example, the entity can request a financial loan, cloud computing storage resources, or any other suitable services or computing resources from the data sources via the interactive computing environment. In other examples, the interactive computing environment can include one or more websites or sub-pages thereof. For example, the interactive computing environment can include a secure website provided by the data sources. The secure website can include cloud computing storage or other resources, and the data sources can control access of the targetPATENTAttorney Docket No. 096923-1516360 entity to the secure website via the entity profile and, optionally, other suitable security techniques such as multi-factor authentication, usemame / password combinations, etc.

[0025] Certain aspects described herein, which can include generating the graph data structure, generating the graphical user interface for providing the graph data structure, and the like, can improve the technical fields of user interfaces, access control for a computing environment, and the like. For instance, by using the graph data structure, a risk assessment computing system may provide legitimate access to the interactive computing environment using fewer computing resources compared to other risk assessment systems. For example, the graph data structure can be determined using fewer data points received about the entity and using inferences illustrated by the graph data structure. Accordingly, the risk assessment computing system improves the access control for computing environment by reducing memory usage, processing time, network bandwidth consumption, response time, and the like with respect to controlling access to the interactive computing environment using the graph data structure. Additionally , the graphical user interface that is configured to display the graph data structure may be or include one or more improvements to graphical user interfaces. For example, the graphical user interface may provide contextual information, such as temporal data or metadata about the underlying data of the graph data structure, via the graph data structure, may specifically arrange the underlying data of the graph data structure to facilitate previously unknown inferences about the underlying data, and the like. Thus, the graphical user interface improves the functioning of a computing device by the specific arrangement and function of interactive elements of the graph data structure displayed via the graphical user interface.

[0026] Some or all of the process (or any other processes described herein, or variations, and / or combinations thereof) may be performed under the control of one or more computer systems configured with executable instructions and may be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) executing collectively on one or more processors, by hardware or combinations thereof. The code may be stored on a computer-readable storage medium, for example, in the form of a computer program comprising a plurality of instructions executable by one or more processors. The computer-readable storage medium may be non-transitory.

[0027] FIG. 1 shows an example of a graph data structure 100 for a single transaction according to at least one embodiment. The graph data structure can be constructed by linkingPATENTAttorney Docket No. 096923-1516360 each pair of identifiers that are mutually present in at least one transaction. The identifiers for transaction 101 include an email address 103, a phone number 105, a name and address (e.g.. mailing information 107), a device identifier 109, and a payment identifier 111. The nodes in the graph data structure can represent identifiers and edges can connect nodes that represent identifiers that were present in the same transaction. Node 102 can represent the email address 103, node 104 can represent the phone number 105. node 106 can represent the mailing information 107, node 108 can represent the device identifier 109, and node 110 can represent the payment identifier 111. The nodes can be connected by edges. Edge 112 can connect node 106 and node 110, and edge 114 can connect node 104 and node 108. In some embodiments, the edges can be weighted based on a number of transactions that were shared by the connected nodes. An entity can be represented in the graph data structure as a cluster of nodes connected by edges (e.g., a subgraph).

[0028] Since individuals often legitimately use multiple identity elements of the same type (e.g., have a work and personal email) or may change identity elements over time (e.g., name or address changes), the identifiers associated with each transaction from a single an individual may not be identical, but are typically overlapping. Additionally, in some rare cases, an individual (e.g., an entity) may “borrow” an identity element from another individual (e.g., use another individual’s device or payment method to complete a purchase), so connections sometimes occur between subgraphs that represent distinct entities. However, in most cases the graph data structure includes tightly connected subgraphs (e.g., subgraphs with highly weighted edges) that correspond to an entity’s identifiers, with some loose connections to subgraphs for related entities (e.g., members of the same household).

[0029] FIG. 2 shows a graph data structure 200 that represents two transactions according to at least one embodiment. The identifiers for transaction 201 can be the same as the identifiers for transaction 101 and, the identifiers include an email address 203. a phone number 205, a name and address (e.g., mailing information 207), a device identifier 209, and a payment identifier 211. These identifiers are represented by nodes and node 202 can represent the email address 203, node 204 can represent the phone number 205, node 206 can represent the mailing information 207, node 208 can represent the device identifier 209, and node 210 can represent the payment identifier 211.

[0030] Graph data structure 200 can include information from transaction 213 in addition to the information from transaction 201. Some of the identifiers from transaction 213 canPATENTAttorney Docket No. 096923-1516360 overlap with the identifiers from transaction 201. For example, phone number 215 can be the same as phone number 205 and device identifier 217 can be the same as device identifier 209. Transactions may have different numbers of identifiers and transaction 201 includes an email address 203, but transaction 213 does not include an email address. Instead, the record for transaction 213 includes a null field 219 instead of an email address.

[0031] The identifiers can vary between transactions and transaction 213 includes identifiers that are different from the identifiers in transaction 201. Identifiers may vary because behavior varies between transactions. For example, a different payment method was used in each transaction and the payment identifier 221 from transaction 213 is different from the payment identifier 211 from transaction 201. Identifiers may vary because information was entered differently in each transaction. For example, mailing information 207 from transaction 201 includes the name “Kount Sales,” but mailing information 223 includes the name “Kount Tech Sales.”

[0032] Nodes can be added for identifiers that are present in a new transaction. For example, node 214 can be added for payment identifier 221 and node 216 can be added for mailing information 223. Nodes may not be created for identifiers that were present in a transaction that is already represented by the graph data structure. For example, phone number 215 is the same as phone number 205, and the identifiers are represented by node 204. Device identifier 217 is the same as device identifier 209, and these identifiers are represented by node 208.

[0033] Edges can connect nodes for identifiers that were present in the same transaction. The edges in graph data structure 200 can be weighted based on the number of transactions that include the connected node identifiers. For example, edge 214 can connect node 208 and node 204 which represent identifiers that are present in both transaction 201 and transaction 213. Edge 212 can connect node 206 and node 210 and the identifiers that are represented by these nodes are present in transaction 201 but not in transaction 213. Accordingly, the weight for edge 214 is higher than the weight for edge 212.

[0034] Some nodes in a graph data structure can be connected to too many other nodes in the graph to provide useful inferences. The large number of transactions can happen for any number of reasons: For example, the node can be a “default value” given by the merchant when the field is not provided by the end customer (e.g., Email: “NOEMAIL@BUSINESS.COM”). In another example, anode may represent an identifierPATENTAttorney Docket No. 096923-1516360 that is commonly used in a fraud attack, and the identifier can be associated with many identifiers which are not related to each other (e.g., "Phone number: 1234567890”). A threshold number of edges for a node may be used to exclude these nodes. For example, a node and all connecting edges can be excluded if the node has 500 or more connections to other nodes in the graph.

[0035] Different versions of the same identifier may commonly occur in the data. The variations may be the result of typos, aliases, and differences in standardization. A node deduplication procedure can be performed to merge nodes that represent normal variations of the same identifier.

[0036] FIG. 3 shows a graph data structure 300 that has undergone a deduplication procedure according to at least one embodiment. The deduplication procedure can include operations to merge nodes that represent candidate identifier pairs. Candidate identifier pairs may have the same identifier ty pe and have a shared neighbor in the graph data structure. In other words, a candidate identifier pair must both have independently been seen in transactions with at least one common identifier. The identifier types include email address, phone number, mailing information, device identifier, and payment identifier. A node with an email address identifier type can be an email node. A node with a phone number identifier type can be a phone node. A node with a mailing information identifier ty pe can be a mailing node. A node can be a device node if the node’s identifier ty pe is a device identifier. A node can be a payment node if the node's identifier type is a payment identifier.

[0037] In FIG. 3. we see that transaction 301 includes mailing information 302 and transaction 303 includes mailing information 305. Both mailing information 302:"A:KOUNT SALES|1005 W MAIN ST||BOISE|ID|US” and mailing information 305: “A: KOUNT TECH SALES| 1005 W MAINST||BOISE|ID|US” have both been seen with the phone number “P:8669192167” (e.g., phone number 306 from transaction 301 and phone number 307 from transaction 303). This mutual co-occurrence in transactions 301 and 303 qualifies identifiers 302 and 305 as candidates for potential de-duplication. Mailing information 302 corresponds to mailing information 207 from FIG. 2, and mailing information 305 corresponds to mailing information 223 from FIG. 2. In FIG. 2, mailing information 207 is represented by node 206 and mailing information 223 is represented by node 216. The text strings in mailing information 302 and 305 can be compared (e.g., with a Levenstein-distance basedPATENTAttorney Docket No. 096923-1516360 comparison) and identifiers 302 and 305 can be identified as duplicates (e.g., because the distance between them falls below a predetermined threshold).

[0038] Identifiers 302 and 305 are identified as similar, and the two identifiers can be represented in graph data structure 300 by a single node. Node 308 can be a node that represents both identifier 302 and identifier 305. Node 310 can represent the phone numbers 306 and 307, and node 310 can be connected to node 308 by an edge 311. Mailing information can include both a name and an address. For mailing information, both the name and the address components are deconvolved and processed separately. Mailing information nodes may only be deduplicated when both the pairs of names and addresses are identified as similar.

[0039] In some embodiments, more than two pairs of identifiers can be combined in a single node. For example, a first pair of mailing information (e.g.. Al and A2) can be associated with a first phone number (e.g., Pl) and a second pair of mailing information (e.g., A2, and A3) can be associated with a second phone number (e.g., P2). The two different pairs of mailing information can be combined in a single node and the edges to the phone numbers can be weighted based on the number of transactions that include each set of mailing information.

[0040] FIGs. 4-6 show simplified diagrams of label propagation according to at least one embodiment. Many transactions include certain identifier ty pes, and, for example, many entities have a primary email address and phone number, which are associated with most of their digital transactions. A college student may order goods to their dorm or home address throughout the year, but the student likely uses the same email address for most of these orders. Label propagation can be performed to identify subgraphs for an entity, and the stability of certain identifier ty pes can mean that these identifier ty pes are a good starting point for label propagation. In most cases, all the transactions and associated identity elements with a particular email address can be rightly associated to a single entity.

[0041] Turning now to FIG. 4 in greater detail, FIG. 4 shows the graph data structure 400 which is identical to the graph data structure 300. To initialize the labeling, the nodes for identifiers which have co-occurred in a transaction with an email address (i.e., are present in the same transaction as an email address) can receive a pre-label of the hash of that email address. For example, nodes 402-410 are present in a transaction with the email address that is associated with node 402, and a hash of the email address 412 can be used as a label forPATENTAttorney Docket No. 096923-1516360 nodes 402-410. In the case of multiple email associations, the most common co-occurrence (most mutual transactions or highest edge weight in the identity graph) is chosen. In the case of a tie, one email address can be chosen at random. In addition or alternatively, other criteria could be employed such as selecting the most recently seen co-occurrence as the primary e- mail address to add a temporal dependence or a combination of multiple criteria.

[0042] Nodes which have never co-occurred in a transaction with an email address can be assigned a label based on another identifier. For example, a label based on a phone number may be assigned to nodes if the node’s identifier is not present in any transaction with an email address. Node 414 includes a payment identifier that is not present in a transaction with an email address. However, node 414 is present in a transaction with a phone number, and label 416. which is a hash of a phone number, can be assigned to node 414. The following identifier hierarchy can be used to assign labels to nodes: 1) Email, 2) Phone Number, 3) Mailing Information, 4) Payment Identifier, and 5) Device Identifier. A node can be initialized with a label that is derived from the identifier that is highest in this hierarchy (e.g., the identifier from the node’s transaction data that is highest in the hierarchy).

[0043] Turning now to FIG. 5 in greater detail, label propagation can be performed on the initialized nodes with the initial labels. To perform label propagation, a node is selected, and the node’s label is evaluated based on neighboring nodes’ labels. A node can be connected to its neighbors by edges. The label propagation algorithm can be performed iteratively in parallel, and a node can receive an updated label based on the label of its neighbors from the previous iteration. For example, the neighbors for node 502 have all been assigned label 504. and node 502 is likely to receive label 504 in the next iteration of the label propagation algorithm. In this iteration, node 506 is connected to node 502, and node 502 “votes” for node 506 to receive the current label for node 502 (e.g., label 508). However, the remaining neighbors for node 506 have label 504, and the label for node 506 is unlikely to change. The vote for each neighboring node may depend on the weight for an edge connecting the nodes.

[0044] Turning now to FIG. 6 in greater detail, the labels (e.g., entity labels) have been updated in graph data structure 600. Node 602 was assigned label 604 before the voting procedure. After the voting procedure, all nodes in graph data structure 600 have been assigned label 606 and graph data structure 600 can be a subgraph of a larger graph data structure. A group of nodes that are all assigned the same label can be a subgraph, and the subgraph may correspond to an entity. The voting procedure may be improved by introducingPATENTAttorney Docket No. 096923-1516360 random noise during voting. For example, the label for one or more of the neighboring nodes may be changed randomly during voting. The probability of changing the label for a neighbor may decrease with each iteration of the voting procedure so that the procedure can converge to final labels for the nodes.

[0045] A cluster of nodes with a single entity label can be a delineated identity for an entity. However, there are cases where two or more delineated identities should belong to a single entity. Two clusters of nodes may potentially correspond to a single entity if there is at least one edge between a node of a first cluster (e.g., a node with the first cluster’s label) and a node of a second cluster (e.g., a node with a second cluster’s label. Two clusters that are linked by at least one edge can be a candidate merge pair.

[0046] A candidate merge pair can be merged using each entity’s dominant name(s). The dominant name(s) of an entity is determined by collecting all the names from billing addresses for each entity and deduplicating to get a set of names for entities. The deduplicating process can merge semantically similar names and nicknames (e.g., (Michael, Mike, Micky) -> {Michael}). The dominant name for a candidate merge pair is compared and the pair of clusters can be merged if the dominant names are the same. In addition to this, a merge pair is also merged if one of the clusters does not include a name.

[0047] FIG. 7 shows a graph data structure 700 with a candidate merge pair according to at least one embodiment. Candidate entity 702 is associated with a first entity label, and the candidate entity' includes nodes 704-712. Each of nodes 704-712 can be assigned the first entity label. Candidate entity 714 includes nodes 716-724 and each node is associated with a second entity label. The dominant name for each candidate entity can be compared to determine whether to merge the entities. In a first example, the dominant name for candidate entity 702 is John Paul Smith, and the dominant name for candidate entity 714 is J.P. Smith. John Paul Smith and J.P. Smith are sufficiently similar, and the addresses are identical, so the candidate entities are merged into a new entity. Merging the candidate entities can mean assigning the same entity label to each node in the merged entity. The assigned label can be the first entity' label, the second entity label or a third entity label. In a second example, the dominant name for candidate entity 702 is John Paul Guttenberg and the dominant name for candidate entity 714 is J.P. Smith. The dominant names are not sufficiently similar in the second example, and the two candidate entities may not be merged in this second example.PATENTAttorney Docket No. 096923-1516360

[0048] There are circumstances where a graph data structure more accurately represents customer behavior if candidate entities are not merged. For example, there may be cases when an entity subgraph becomes too large to practically represent one entity. This may occur where, for example, a local church or small business might be associated with several entities that share identifiers (e g., a single address, credit card, email domain, and / or device). For example, candidate entities may not be merged together if the number of candidate entities is above a threshold. For example, if more than four entities are identified for merging, we may split the group of more than four entities into smaller groups. For example, each candidate entity with a degree greater than 1 may be merged with all neighboring candidate entities with a degree of 1. In this case, degree refers to the number of candidate entities that are to be merged. For example, a candidate entity with a degree of 2 is to be merged with two candidate entities. In some embodiments, candidate entities may not be merged if the number of merged entities is above a threshold.

[0049] FIG. 8 is a schematic diagram of an example computer architecture for the Graph System 800, including a plurality of engines that may perform functions in accordance with at least one embodiment. The engines may be software engines, hardware engines, or a combination thereof. If the engines are software engines, the engines can be embodied on a computer readable medium and processed by a processor in any of the computer systems described herein. It should be noted that any engine or data store described herein, may, in some embodiments, be a service responsible for providing functionality corresponding to the engine described below. The engines 802 may be execute as part of the Graph System 800, or the engines 802 may exist as separate engines or services external to the Graph System 800. In some embodiments, the engines 802 may be executed by the same or different computing devices, as a service, as an application, or the like.

[0050] In the embodiment shown in the FIG. 8, data stores such as transaction data 803 and graph store 805 are shown, although data can be maintained, derived, or otherwise accessed from various data stores, either remote or local to the Graph System 800, to achieve the functions described herein. The Graph System 800, as shown in FIG. 8, includes various engines such as an ingestion engine 810. a management engine 820, an interface engine 830, and a graph engine 840. Some functions of the engines 810-840 are described below. However, for the benefit of the reader, a brief, non-limiting description of each of the engines is provided in the following paragraphs. In accordance with at least one embodiment, aPATENTAttorney Docket No. 096923-1516360 process generating and reporting event data is provided. Graph System 800 can be used to perform any of the operations described with reference to FIGs. 1-7.

[0051] In at least one embodiment, the Graph System 800 includes the ingestion engine 810. Generally, the ingestion engine 810 may be utilized to receive any suitable information with respect to any example provided herein. By way of example, the ingestion engine 810 may be configured to receive data about transactions from data sources 855. The transactions can include credit card transactions, debit card transactions, automated clearing house payments, or any other kind of payment or bank transfer. Each transaction instance in the transaction data can include one or more identifiers. If necessary, the transactions may be stored as transaction data 803 and accessed by the ingestion engine 810. The transaction data can be received over a network such as the internet. The transactions can be requested periodically, and, in various embodiments, the ingestion engine 810 may request transactions daily, every other day, weekly, or monthly. In some embodiments, the data sources 855 can publish transactions to the ingestion engine 810.

[0052] The ingestion engine 810 may ingest the data logs by cleaning, processing, or otherwise transforming the transaction data 803. Ingesting the transaction data 803 can include removing duplicate data, changing data from one format to another (e.g., changing a date from mm / dd / yyyy to yyyy-mm-dd), completing incomplete data entries, correcting corrupted data entries, removing unnecessary' data, anonymizing data, or otherwise making the transaction data 803 suitable for use by the other engines 802.

[0053] In at least one embodiment, the Graph System 800 includes the management engine 820. Generally, the management engine 820 may be utilized to organize and associate the ingested transaction data 803. For example, the management engine 820 can sort the sort, sample, or transform the transaction data 803. For example, the management engine 820 can sample transaction data 803, calculate statistics that represent transaction data 803, and / or create visualizations that represent transaction data 803. The management engine can compare data to one or more thresholds.

[0054] In at least one embodiment, the Graph System 800 includes the interface engine 830. Generally, the interface engine 830 may be utilized to generate interfaces such as graphical user interfaces, provide the interfaces to client device(s) 850 (e.g., to client software or in a browser), provide output to the interfaces, and receive input from the interfaces. The interface engine 830 can be used to provide notifications to one or more client devices and toPATENTAttorney Docket No. 096923-1516360 generally perform one or more operations with respect to the event data in Graph System 800. A graphical user interface can be generated to present notifications to one or more client device(s) 850. For example, the interface engine 830 can generate an interface to present transaction data 803 and a classification for the transaction data to client device(s) 850. For example, the interface may present information about a transaction instance that is potentially fraudulent, and input to the interface can confirm or deny that the transaction is fraudulent. Input to the interface can be used to set any of the thresholds that are described in the present disclosure.

[0055] In at least one embodiment, the Graph System 800 includes the graph engine 840. Generally, the graph engine 840 can be used to generate a graph data structure. The graph engine 840 can process the transaction data 803 to obtain identifiers, and the graph engine can create nodes for the identifiers. The graph engine 840 can connect the nodes by edges and the graph engine 840 may calculate weights and assign the weights to the edges. For example, the weight for an edge can be based on the number of transactions that include the two identifiers that are connected by the edge. Entity labels can be assigned to the nodes in the graph data structure by the graph engine 840. For example, the graph engine 840 can initialize the nodes with entity labels, and the graph engine 840 can update the entity labels based on the labels for neighboring nodes. The graph engine 840 can merge nodes, split nodes, or create new nodes. The graph engine 840 can include a risk prediction model that is configured to generate a risk indicator for a target entity. The target entity can be input to the risk prediction model as a subgraph. The target entity can be provided to the risk prediction model with the graph data structure.

[0056] A client device 850 can include any computing device or other communication device operated by a user or entity such as a consumer or a customer. The client device 850 can include one or more computing devices such as laptops, smartphones, and other personal computing devices. A client device 850 can include executable instructions stored in one or more non-transitory computer-readable media. The client device 850 can additionally include one or more processing devices configured to execute program code to perform various operations. In various examples, the client device 850 can allow a user to access certain online services or other suitable products, services, or computing resources from data sources 855, to engage in mobile commerce or other interactions with the client device(s) 850, to obtain controlled access to electronic content, such as the interactive computing environment 860, hosted by one or more of the data sources 855, etc.PATENTAttorney Docket No. 096923-1516360

[0057] The entity can use the client device 850 to engage in an electronic interaction with the data sources 855 via the interactive computing environment 860. The graph system 800 can receive a request, for example from a client device 850, to access the interactive computing environment 860 and can use data, such as the graph data structure or any suitable scores determined therefrom, to determine whether to provide access, to challenge the request, to deny the request, etc. An electronic interaction between the client device 850 and the data sources 855 can include, for example, the client device 850 being used to request a financial loan, to request online computing resources, or other suitable sendees or products from the data sources 855, etc. An electronic interaction between the client device 850 and the data sources 855 can also include, for example, one or more queries for a set of sensitive or otherwise controlled data, accessing online confidential services provided via the interactive computing environment 860, submitting an online credit card application or other digital application to the data sources 855 via the interactive computing environment 860, operating an electronic tool within the interactive computing environment 860 (e.g., a content-modification feature, an application-processing feature, etc.), etc.

[0058] In some aspects, an interactive computing environment 860 implemented through the data sources 855 can be used to provide access to various online functions. As a simplified example, a user interface or other interactive computing environment 860 provided by the data sources 855 can include electronic functions for requesting computing resources, online storage resources, network resources, database resources, or other types of resources. In another example, a website or other interactive computing environment 860 provided by the data sources 855 can include electronic functions for obtaining one or more financial services, such as an asset report, management tools, credit card application and transaction management workflows, electronic fund transfers, etc.

[0059] A client device 850 can be used to request access to the interactive computing environment 860 provided by the data sources 855. The data sources 855 can submit a request, for example in response to a request made by the client device 850 to access the interactive computing environment 860, for risk assessment to the graph engine 840 and can selectively grant or deny access to various electronic functions based on risk assessment performed by the graph engine 840. Based on the request, the graph engine 840 can generate a subgraph for an entity that submitted the request via the client device 850. Based on the subgraph, or any suitable score or inference determined therefrom, generated by the graphPATENTAttorney Docket No. 096923-1516360 system 800, or any part thereof can determine whether to grant the access request of the client device 850 to certain features of the interactive computing environment 860.

[0060] FIG. 9 is a block diagram illustrating an example method 900 for identity delineation, in accordance with at least one embodiment. A non -transitory computer-readable storage medium may store computer-executable instructions that, when executed by at least one processor, cause at least one computer to perform instructions comprising the operations of the method 900. It should be appreciated that the operations of the method 900 may be performed in any suitable order, not necessarily the order depicted in FIG. 9. Further, the method 900 may include additional, or fewer operations than those depicted in FIG. 9. The operations of method 900 may be performed by any suitable portion of the Graph System 92 of FIG. 1. In some embodiments, method 900 may be executed by components of the Graph System 800 of FIG. 8. In some embodiments, method 900 may be executed by components of Computing Device 1000 of FIG. 10.

[0061] At block 902, transaction data can be accessed. Each transaction in the transaction data can comprise one or more identifiers. The transaction data can be accessed from an external system.

[0062] At block 904. the transaction data can be processed to obtain identifiers. The obtained identifiers can be identifiers that are included in the transaction data for at least one transaction. Identifiers can include email addresses, mailing information, phone numbers, device identifiers, and payment identifiers. The identifiers may be unique identifiers in some embodiments.

[0063] At block 906. the graph data structure can be created. The graph data structure can comprise edges that are connected by nodes, and creating the graph data structure can include creating the nodes and connecting the nodes by edges. The graph data structure can be created at regular intervals, and, for example, the graph may be created from transaction data daily, weekly, monthly, quarterly, and yearly.

[0064] Each node can represent one or more identifiers. Each node can only represent a single type of identifier in some embodiments. The identifier types include email address, phone number, mailing information, device identifier, and payment identifier. A node with an email address identifier type can be an email node. A node with a phone number identifier type can be a phone node. A node with a mailing information identifier type can be a mailingPATENTAttorney Docket No. 096923-1516360 node. A node can be a device node if the node’s identifier ty pe is a device identifier. A node can be a payment node if the node’s identifier type is a payment identifier. Each edge can connect two identifiers that are included in the same transaction. An edge can be weighted based on the number of times the connected nodes were present in transaction information for the same transaction.

[0065] Creating the graph data structure can include removing high degree nodes. A high degree node can be a node that is connected to too many other nodes. The number of edges for each node can be compared to a threshold number of edges, and a node may be a high degree node if the number of edges for the node is above the threshold. Removing the high degree node can include removing the node and any edges that are connected to the node. Removing the high degree node can include splitting the high degree node into two or more different nodes.

[0066] Creating the graph data structure can include node deduplication. Duplicate node pairs can be merged during node deduplication, and a duplicate node pair can be two nodes that are connected to a common node. The identifiers for each node of the duplicate node pair can be compared to determine whether the identifiers are similar. A similarity metric can be generated from the comparison and the nodes may be merged if the similarity metric is greater than a similarity threshold. For example, the similarity' metric can be a probability or score that represents the likelihood that the two identifiers refer to the same entity. The similarity metric can be between 0.0 and 1.0.

[0067] Creating the graph data structure can include initializing entity labels for the nodes. For example, the nodes can be initialized with an identifier that is derived from email address that is present in the transaction data for a transaction that was used to generate the node. The initialized label for a node can be updated based on the entity labels for the nodes neighbors (e.g., other nodes that are connected to the updated node by edges). For example, the entity labels for neighboring nodes can be counted and the node can be updated to include the most common entity label from the neighboring nodes. In some embodiments, the weight for each edge can be used to determine the most common entity label for neighboring nodes.

[0068] The following identifier hierarchy can be used to initialize the nodes with labels: 1) Email, 2) Phone Number, 3) Mailing Information, 4) Payment Identifier, and 5) Device Identifier. A node can be initialized with a label that is derived from the identifier that is highest in this hierarchy (e.g., the identifier from the node’s transaction data that is highest inPATENTAttorney Docket No. 096923-1516360 the hierarchy). For example, if the node's transaction data does not include an email address, then the node can be initialized with an identifier that is derived from a phone number that was present in the transaction data for a transaction that was used to generate the node. If the node’s transaction data does not include an email address or a phone number, then the node can be initialized with an identifier that is derived from mailing information that was present in the transaction data for a transaction that was used to generate the node. If the node’s transaction data does not include an email address, a phone number, or mailing information, then the node can be initialized with an identifier that is derived from a payment identifier that was present in the transaction data for a transaction that was used to generate the node. If the node's transaction data does not include an email address, a phone number, mailing information, or a payment identifier, then the node can be initialized with an identifier that is derived from a device identifier that was present in the transaction data for a transaction that was used to generate the node.

[0069] At block 908, nodes with a common entity label can be processed to obtain a dominant entity name for the common entity label. The nodes can be mailing nodes. The identifier for a mailing node can be mailing information, and mailing information can include a name and an address. A dominant name can be a name that is most frequently found in mailing nodes that are associated with a common entity label. An entity label can be assigned to one or more nodes in the graph data structure. A set of nodes in the graph data structure that have the same entity label can be a subgraph, and a subgraph can correspond to an entity. A subgraph may include all nodes in the graph that have the same entity label.

[0070] At block 910, the graph data structure can be processed to identify entity labels that share a dominant name. Identifying an entity label can include identi tying each node in the graph data structure that has the entity label.

[0071] At block 912, the entity labels that share a common dominant name can be merged. Merging the entity labels can mean changing the entity label for nodes. For example, merging two entity7labels can include identify ing a group of nodes where each node in the group has either of the two entity labels and assigning a single entity label to each node in the group. The assigned label can be the first entity label, the second entity label, or a third entity’ label.

[0072] A dominant name for an entity label can be a most frequent name from the mailing nodes in the graph data structure that have the entity label. A mailing node can be a node that represents mailing information (e.g., a name and an address). Two or more entity labels thatPATENTAttorney Docket No. 096923-1516360 have the same dominant name can be entity labels with a common dominant name. The number of entity labels with a common dominant name may be used to determine whether to merge the entity labels. For example, the entity labels may not be merged if the number of entity7labels with the common dominant name is above a merge threshold. The entity labels may be merged if the number of entity labels with the common dominant name is below a merge threshold. Merging the entity labels can mean assigning a same entity label to each node that has any of the merged entity labels.

[0073] In some embodiments, the entity labels may not be merged if the number of entity labels is above the merge threshold. Not merging the number of entity labels can mean splitting the entity7labels into smaller groups and merging one or more of the smaller groups of entity labels. For example, each candidate entity (e.g., an entity label) with a degree greater than 1 may be merged with all neighboring candidate entities with a degree of 1. In this case, degree refers to the number of candidate entities that are to be merged. For example, a candidate entity with a degree of 2 is to be merged with tw o candidate entities.

[0074] At block 914 an operation with the graph data structure can be performed. For example, the operation can include determining whether to authorize or deny a transaction instance (e.g., transaction information for an individual transaction). The data from the transaction instance and the graph data structure can be processed to determine w hether the transaction instance is authorized or fraudulent. In some embodiments, the operation can include classifying some or all of the transactions from the transaction data from 902 as authorized or fraudulent. A notification may be provided to one or more client devices in response to the classification. For example, the notification may be a message that requests a user to confirm or deny the classification for the transaction. The notification can cause the client device to present one or more identifiers from the transaction and the classification.

[0075] The operation can involve determining a risk indicator for a target entity based on the graph data structure, determining a risk indicator for the target entity based on the graph data structure using a risk prediction model in the graph engine 840. The graph data structure, or any suitable risk score or inference determined or received therefrom, can be used as input to the risk prediction model. The graph data structure associated with the target entity can be generated by extracting features from received or produced entity data and by determining signals based on the extracted features. The output of the risk prediction model can include the risk indicator for the target entity7. In some examples, the risk prediction model canPATENTAttorney Docket No. 096923-1516360 determine associations between nodes or connections included in the graph data structure, can infer relationships between data points included in the graph data structure, or the like. The risk prediction model can determine the risk indicator based at least in part on the associations, the connections, and the like.

[0076] The operations can include transmitting a responsive message based on the risk indicator. The risk indicator can be generated by a machine learning model that executes within the graph engine 840. In some examples, the graph system 800, or any other suitable module, model, or computing device, can transmit the responsive message to a computing device, such as the client computing device 850, or any other suitable computing device that can control access to the interactive computing environment 860. The responsive message can vary based on the risk indicator. For example, the responsive message may indicate that the target entity submitting the access request is the legitimate entity and may recommend granting access to the interactive computing environment 860 based on the request. In other examples, the responsive message may indicate that the entity is unknown or otherwise not associated with legitimate activity and may recommend challenging or denying the request.

[0077] FIG. 10 illustrates an example computing device 1000 that may implement the methods disclosed herein. In some embodiments, the computing device 1000 may include one or more processors (e.g., processor(s) 1002). The processor(s) 1002 may be implemented in hardware, computer-executable instructions, firmware, or combinations thereof. Computerexecutable instruction or firmware implementations of the processor(s) 1002 may include computer-executable or machine-executable instructions written in any suitable programming language.

[0078] Computing device 1000 may include memory 1004. The memory 1004 may store computer-executable instructions that are loadable and executable by the processor(s) 1002, as well as data generated during the execution of these programs. The memory 1004 may be volatile (such as RAM) and / or non-volatile (such as ROM, flash memory, etc.). The computing device 1000 may include additional storage 1006, which may include removable storage and / or non-removable storage. The additional storage 1006 may include, but is not limited to, magnetic storage, optical disks and / or tape storage. The disk drives and their associated computer-readable media may provide non-volatile storage of computer-readable instructions, data structures, program engines, and other data for the computing devices. InPATENTAttorney Docket No. 096923-1516360 some implementations, the memory 1004 or additional storage 1006 may individually, or collectively, include multiple different types of memory, such as SRAM, DRAM, or ROM.

[0079] The memory 1004 and / or additional storage 1004 may be examples of computer- readable storage media. Computer-readable storage media may include volatile, or nonvolatile, removable or non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program engines, or other data. In some embodiments, memory 1004 and the additional storage 1004 are examples of computer storage media. Memory 1004 and / or additional storage 1004 may include, but are not limited to, PRAM, SRAM, DRAM, RAM, ROM, EEPROM, flash memory' or other memory' technology, CD-ROM, DVD, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by the computing device 1000. Combinations of any of the above should also be included within the scope of computer-readable media. Computer-readable media may include computer-readable instructions, program engines, or other data transmitted within a data signal, such as a carrier wave, or other transmission.However, as used herein, computer-readable storage media does not include computer- readable communication media.

[0080] The memory 1004 may7include an operating system 1008 and one or more data stores 1010, and / or one or more application programs, engines, or sendees for implementing the features disclosed herein, such as the features provided by the Graph System 1014 (an example of the Graph System 800 of FIG. 8).

[0081] The computing device may also contain communications connection(s) 1016 that allow the computing device 1000 to communicate with a stored database, another computing device, a server, user terminals and / or other devices (e.g., via one or more networks, not depicted). The computing device may also include I / O device(s) 1018, such as a keyboard, a mouse, a pen. a voice input device, a touch input device, a display, speakers, a printer, etc.

[0082] The various embodiments further can be implemented in a wide variety of operating environments, which in some cases can include one or more user computers, computing devices or processing devices which can be used to operate any of a number of applications. User or client devices can include any of a number of general-purpose personal computers, such as desktop or laptop computers running a standard operating system, as well as cellular, wireless, and handheld devices running mobile software and capable of supporting a numberPATENTAttorney Docket No. 096923-1516360 of networking and messaging protocols. Such a system also can include a number of workstations running any of a variety of commercially available operating systems and other known applications for purposes such as development and database management. These devices also can include other electronic devices, such as dummy terminals, thin-clients, gaming systems, and other devices capable of communicating via a network.

[0083] Most embodiments utilize at least one network that would be familiar to those skilled in the art for supporting communications using any of a variety of commercially - available protocols, such as Transmission Control Protocol / Intemet Protocol (“TCP / IP”), Open System Interconnection (“OSI”), File Transfer Protocol (“FTP”), Universal Plug and Play (“UpnP”), Network File System (“NFS”), Common Internet File System (“CIFS”), and AppleTalk. The network can be, for example, a local area network, a wide-area network, a virtual private network, the Internet, an intranet, an extranet, a public switched telephone network, an infrared network, a wireless network, and any combination thereof.

[0084] In embodiments utilizing a Web server, the Web server can run any of a variety of server or mid-tier applications, including Hypertext Transfer Protocol (“HTTP”) servers, FTP servers. Common Gateway Interface (“CGI”) servers, data servers, Java servers, and business application servers. The server(s) also may be capable of executing programs or scripts in response to requests from user devices, such as by executing one or more Web applications that may be implemented as one or more scripts or programs written in any programming language, such as Java®, C, C#, or C++, or any scripting language, such as Perl, Python, or TCL, as well as combinations thereof. The server(s) may also include database servers, including without limitation those commercially available from Oracle®, Microsoft®, Sybase®, and IBM®.

[0085] The environment can include a variety7of data stores and other memory7and storage media as discussed above. These can reside in a variety of locations, such as on a storage medium local to (and / or resident in) one or more of the computers or remote from any or all of the computers across the network. In a particular set of embodiments, the information may reside in a storage-area network (“SAN”) familiar to those skilled in the art. Similarly, any necessary fdes for performing the functions attributed to the computers, servers, or other network devices may be stored locally and / or remotely, as appropriate. Where a system includes computerized devices, each such device can include hardware elements that may be electrically coupled via a bus, the elements including, for example, at least one centralPATENTAttorney Docket No. 096923-1516360 processing unit ("CPU"), at least one input device (e.g., a mouse, keyboard, controller, touch screen, or keypad), and at least one output device (e.g., a display device, printer, or speaker). Such a system may also include one or more storage devices, such as disk drives, optical storage devices, and solid-state storage devices such as random-access memory' (“RAM”) or read-only memory' (“ROM”), as well as removable media devices, memory cards, flash cards, etc.

[0086] Such devices also can include a computer-readable storage media reader, a communications device (e.g., a modem, a network card (wireless or wired)), an infrared communication device, etc.), and working memory as described above. The computer- readable storage media reader can be connected with, or configured to receive, a computer- readable storage medium, representing remote, local, fixed, and / or removable storage devices as well as storage media for temporarily and / or more permanently containing, storing, transmitting, and retrieving computer-readable information. The system and various devices also ty pically will include a number of software applications, engines, services, or other elements located within at least one working memory device, including an operating system and application programs, such as a client application or Web browser. It should be appreciated that alternate embodiments may have numerous variations from that described above. For example, customized hardware might also be used and / or particular elements might be implemented in hardware, software (including portable software, such as applets), or both. Further, connection to other computing devices such as network input / output devices may be employed.

[0087] Storage media computer readable media for containing code, or portions of code, can include any appropriate media known or used in the art, including storage media and communication media, such as but not limited to volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage and / or transmission of information such as computer readable instructions, data structures, program engines, or other data, including RAM, ROM, Electrically Erasable Programmable Read- Only Memory' (“EEPROM”), flash memory or other memory technology, Compact Disc Read-Only Memory (“CD-ROM”), digital versatile disk (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a system device. Based on the disclosure and teachings provided herein, a personPATENTAttorney Docket No. 096923-1516360 of ordinary skill in the art will appreciate other ways and / or methods to implement the various embodiments.

[0088] The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. It will, however, be evident that various modifications and changes may be made thereunto without departing from the broader spirit and scope of the disclosure as set forth in the claims.

[0089] Other variations are within the spirit of the present disclosure. Thus, while the disclosed techniques are susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the disclosure to the specific form or forms disclosed, but on the contrary, the intention is to cover all modifications, alternative constructions, and equivalents falling within the spirit and scope of the disclosure, as defined in the appended claims.

[0090] The use of the terms “a” and '‘an” and “the” and similar referents in the context of describing the disclosed embodiments (especially in the context of the following claims) are to be construed to cover both the singular and the plural, unless otherwise indicated herein or clearly contradicted by context. The terms “comprising.” “having,” “including,” and “containing” are to be construed as open-ended terms (i.e., meaning “including, but not limited to,”) unless otherwise noted. The term “connected” is to be construed as partly or wholly contained within, attached to, or joined together, even if there is something intervening. Recitation of ranges of values herein are merely intended to serve as a shorthand method of referring individually to each separate value falling within the range, unless otherwise indicated herein and each separate value is incorporated into the specification as if it were individually recited herein. All methods described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The use of any and all examples, or exemplary language (e.g.. “such as”) provided herein, is intended merely to better illuminate embodiments of the disclosure and does not pose a limitation on the scope of the disclosure unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the disclosure.

[0091] Disjunctive language such as the phrase “at least one of X, Y, or Z,” unless specifically stated otherwise, is intended to be understood within the context as used inPATENTAttorney Docket No. 096923-1516360 general to present that an item, term, etc., may be either X, Y, or Z, or any combination thereof (e.g., X, Y, and / or Z). Thus, such disjunctive language is not generally intended to, and should not, imply that certain embodiments require at least one of X, at least one of Y, or at least one of Z to each be present.

[0092] Preferred embodiments of this disclosure are described herein, including the best mode known to the inventors for carrying out the disclosure. Variations of those preferred embodiments may become apparent to those of ordinary skill in the art upon reading the foregoing description. The inventors expect skilled artisans to employ such variations as appropriate and the inventors intend for the disclosure to be practiced otherwise than as specifically described herein. Accordingly, this disclosure includes all modifications and equivalents of the subject matter recited in the claims appended hereto as permitted by applicable law. Moreover, any combination of the above-descnbed elements in all possible variations thereof is encompassed by the disclosure unless otherw ise indicated herein or otherwise clearly contradicted by context.

[0093] All references, including publications, patent applications, and patents, cited herein are hereby incorporated by reference to the same extent as if each reference were individually and specifically indicated to be incorporated by reference and w ere set forth in its entirety herein.

Claims

WHAT IS CLAIMED IS:

1. A method comprising: generating, by a computer system, a graph data structure from transaction data by: accessing, by the computer system, transaction data, wherein each transaction in the transaction data comprises one or more identifiers; processing, by the computer system, the transaction data to obtain a set of identifiers, wherein each identifier in the set of identifiers is included in the transaction data for at least one transaction; and creating, by the computer system, the graph data structure comprising a set of nodes and edges, wherein each node represents one or more identifiers in the set of identifiers and each edge connects two identifiers that are included in a same transaction; processing, by the computer system, the graph data structure to merge entity labels by: processing, by the computer system, nodes with a common entity label to determine a dominant name for the common entity label, wherein the identifier for a node comprises mailing information, wherein a dominant name is a most frequent name from the nodes that are associated with the common entity label; and processing, by the computer system, the graph data structure to identify entity labels that share a common dominant name; and merging, by the computer system, the entity labels that share the common dominant name; and performing, by the computer system, an operation with the graph data structure.

2. The method of claim 1, wherein the operation with the graph data structure comprises: generating, by the computer system, a message that is usable to control access to an interactive computer environment.

3. The method of claim 1, wherein merging the entity labels that share the common dominant name comprises, for each common dominant name:comparing, by the computer system, a number of entity labels for the common dominant name to a merge threshold; determining, by the computer system, that the number of entity labels is less than the merge threshold; and merging, by the computer system, the entity labels that share the common dominant name, wherein merging the entity labels comprises assigning a same entity label to a set of nodes that have one of the entity labels.

4. The method of claim 1, wherein merging the entity labels that share the common dominant name comprises, for each common dominant name: comparing, by the computer system, a number of entity labels for the common dominant name to a merge threshold; determining, by the computer system, that the number of entity labels is greater than the merge threshold; and declining to merge the entity labels that share the common dominant name.

5. The method of claim 1, wherein generating the graph data structure further comprises: processing, by the computer system, the set of nodes and edges to remove high degree nodes in the graph data structure that are connected to at least a threshold number of edges, wherein removing the high degree nodes comprises removing the high degree nodes and any connected edges.

6. The method of claim 1, wherein generating the graph data structure further comprises: processing, by the computer system, the set of nodes and edges to merge duplicate node pairs, the duplicate note pairs comprising two nodes that are connected to a common node, wherein a similarity metric of an identifier for each of the two nodes is greater than a similarity threshold.

7. The method of claim 1, wherein generating the graph data structure further comprises:processing, by the computer system, the set of nodes and edges to initialize entity labels for the nodes; and updating, by the computer system, an entity label for each node of the set of nodes and edges based at least in part on the entity labels for neighboring nodes that are connected to the node.

8. The method of claim 7, wherein one or more identifiers include mailing information, email addresses, phone numbers, device tokens, and payment tokens, wherein the mailing information includes a name and a mailing address.

9. The method of claim 1, wherein performing an operation with the graph data structure comprises: receiving, by the computing system, data for a transaction instance; and processing, by the computer system, the data for the transaction instance and the graph data structure to classify the transaction instance as fraudulent.

10. A computing device, comprising: one or more memories; and one or more processors in communication with the one or more memories and configured to execute instructions stored in the one or more memories to perform operations to: generate a graph data structure from transaction data by operations to: access, transaction data, wherein each transaction in the transaction data comprises one or more identifiers; process the transaction data to obtain a set of identifiers, wherein each identifier in the set of identifiers is included in the transaction data for at least one transaction; and create the graph data structure comprising a set of nodes and edges, wherein each node represents one or more identifiers in the set of identifiers and each edge connects two identifiers that are included in a same transaction; process the graph data structure to merge entity labels by operations to: process nodes with a common entity label to determine a dominant name for the common entity label, wherein the identifier for a node comprises mailinginformation, wherein a dominant name is a most frequent name from the nodes that are associated with the common entity label; and process the graph data structure to identify entity labels that share a common dominant name; and merge the entity labels that share the common dominant name; and perform an operation with the graph data structure.

11. The computing device of claim 10, wherein the operation with the graph data structure comprises operations to: generate a message that is usable to control access to an interactive computer environment.

12. The computing device of claim 10, wherein merging the entity labels that share the common dominant name comprises, for each common dominant name performing operations to: compare a number of entity labels for the common dominant name to a merge threshold; determine that the number of entity labels is less than the merge threshold; and merge the entity labels that share the common dominant name, wherein merging the entity labels comprises assigning a same entity label to a set of nodes that have one of the entity labels.

13. The computing device of claim 10, wherein merging the entity labels that share the common dominant name comprises, for each common dominant name performing operations to: compare a number of entity labels for the common dominant name to a merge threshold; determine that the number of entity labels is greater than the merge threshold; and decline to merge the entity labels that share the common dominant name.

14. The computing device of claim 10, wherein generating the graph data structure further comprises operations to: process the set of nodes and edges to remove high degree nodes in the graph data structure that are connected to at least a threshold number of edges, wherein removing the high degree nodes comprises removing the high degree nodes and any connected edges.

15. The computing device of claim 10, wherein generating the graph data structure further comprises operations to: process the set of nodes and edges to merge duplicate node pairs, the duplicate note pairs comprising two nodes that are connected to a common node, wherein a similarity metric of an identifier for each of the two nodes is greater than a similarity threshold.

16. A non-transitory computer-readable medium storing a plurality of instructions that, when executed by one or more processors of a computing device, cause the one or more processors to perform operations to: generate a graph data structure from transaction data by operations to: access, transaction data, wherein each transaction in the transaction data comprises one or more identifiers; process the transaction data to obtain a set of identifiers, wherein each identifier in the set of identifiers is included in the transaction data for at least one transaction; and create the graph data structure comprising a set of nodes and edges, wherein each node represents one or more identifiers in the set of identifiers and each edge connects two identifiers that are included in a same transaction; process the graph data structure to merge entity labels by operations to: process nodes with a common entity label to determine a dominant name for the common entity label, wherein the identifier for a node comprises mailing information, wherein a dominant name is a most frequent name from the nodes that are associated with the common entity label; andprocess the graph data structure to identify entity labels that share a common dominant name; and merge the entity labels that share the common dominant name; and perform an operation with the graph data structure.

17. The non-transitory computer-readable medium of claim 16, wherein the operation with the graph data structure comprises operations to: generate a message that is usable to control access to an interactive computer environment.

18. The non-transitory computer-readable medium of claim 16, wherein merging the entity labels that share the common dominant name comprises, for each common dominant name performing operations to: compare a number of entity labels for the common dominant name to a merge threshold; determine that the number of entity labels is less than the merge threshold; and merge the entity labels that share the common dominant name, wherein merging the entity labels comprises assigning a same entity label to a set of nodes that have one of the entity labels.

19. The non-transitory computer-readable medium of claim 16, wherein merging the entity labels that share the common dominant name comprises, for each common dominant name performing operations to: compare a number of entity labels for the common dominant name to a merge threshold; determine that the number of entity labels is greater than the merge threshold; and decline to merge the entity labels that share the common dominant name.

20. The non-transitory computer-readable medium of claim 16, wherein generating the graph data structure further comprises operations to:process the set of nodes and edges to remove high degree nodes in the graph data structure that are connected to at least a threshold number of edges, wherein removing the high degree nodes comprises removing the high degree nodes and any connected edges.

Images