US 12,265,968 B1
Detecting undesirable activity based on matching parameters of groups of nodes in graphical representations
Paola Gittino, Riverview, FL (US); William George Cormier, Clearwater, FL (US); Steve Thomas Dayton, Brandon, FL (US); and Miriam Silver, Tel Aviv (IL)
Assigned to Citigroup Technology, Inc., Weehawken, NJ (US)
Filed by Citigroup Technology, Inc., Weehawken, NJ (US)
Filed on May 17, 2024, as Appl. No. 18/668,087.
Application 18/668,087 is a continuation in part of application No. 18/379,405, filed on Oct. 12, 2023, granted, now 12,147,986.
Application 18/379,405 is a continuation in part of application No. 14/707,852, filed on May 8, 2015, abandoned.
Claims priority of provisional application 62/079,110, filed on Nov. 13, 2014.
Int. Cl. G06Q 40/00 (2023.01); G06Q 20/40 (2012.01)
CPC G06Q 20/4016 (2013.01) [G06Q 20/4014 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system for identifying matching parameters of groups of nodes in graphical representations, the system comprising:
one or more processors communicatively coupled to a storage device, wherein the one or more processors execute instructions that are stored in the storage device to cause the system to:
receive, by the system and from a computing device associated with one or more financial institutions, records of transactions involving a first plurality of entities who have direct or indirect connections with a second plurality of entities who have histories of anomalous activities;
generate, using the records and in a graphical user interface, a first graphical representation of encoded data comprising encoded data parameters of each of a first plurality of users associated with the first plurality of entities, wherein the first plurality of users have both direct and indirect connections to one another and wherein a subset of the first plurality of users has detected anomalous interactions, wherein the first graphical representation comprises a first plurality of nodes corresponding to the first plurality of users, wherein each node represents an individual user and is encoded with data representing a plurality of risk-related or interaction-related parameters or attributes of the user;
activate, in the first graphical representation for each node, an icon which differentiates the parameters or attributes of one user from the parameters or attributes of another user in terms of anomalous behavior;
activate, in the first graphical representation, the encoded data as a first plurality of links connecting a first plurality of pairs of the first plurality of nodes, the first plurality of links representing interactions between respective users of the first plurality of users, wherein each link connects a single pair of users and is encoded with transactional details associated with the interactions between each pair of users;
identify, by the one or more processors and using a community-finding algorithm, at least one community of interest which is relevant to anomalous behavior, wherein each community comprises a grouping of nodes;
select at least one grouping of nodes which merits investigation and activate, in the first graphical representation, a visualization of each selected grouping;
activate, in the first graphical representation, a visualization of the interactions and transaction details within each grouping of nodes to allow analysis of the interactions relevant to anomalous behavior between users without a history of anomalous behavior and users with a history of anomalous behavior;
identify a level of local clustering for each grouping of a first plurality of groupings of the first plurality of nodes, wherein the level is indicative of anomalous behavior and is based on a ratio of a first number to a second number, the first number comprising a number of links connecting nodes of the grouping to at least one user of the grouping with the detected anomalous interactions, the second number comprising a maximum possible number of links connecting the nodes of the grouping to one another;
detect, based on the level of local clustering identified for each grouping, a first grouping of the first plurality of groupings for which a corresponding level of local clustering satisfies a predetermined level of local clustering indicative of undesired activity;
determine, for a portion of the first graphical representation corresponding to the first grouping, one or more graphical parameters relating to the corresponding level of local clustering;
receive, via the graphical user interface, a user selection of a second grouping within a second plurality of groupings of a second plurality of nodes within a second dataset associated with a second graphical representation;
in response to receiving the user selection, generate, in the graphical user interface, the second graphical representation of the second grouping;
identify, in the second grouping, the one or more graphical parameters matching the first grouping; and
generate, on the second graphical representation, visual indicators of the one or more graphical parameters matching the first grouping, the visual indicators indicating that the second grouping requires further analysis.