US 11,734,419 B1
Directed graph interface for detecting and mitigating anomalies in entity interactions
Stuart James Mackle, Seattle, WA (US)
Assigned to SAS Institute, Inc., Cary, NC (US)
Filed by SAS Institute Inc., Cary, NC (US)
Filed on Mar. 14, 2023, as Appl. No. 18/121,372.
Claims priority of provisional application 63/437,582, filed on Jan. 6, 2023.
Claims priority of provisional application 63/354,782, filed on Jun. 23, 2022.
Int. Cl. G06F 9/00 (2006.01); G06F 21/55 (2013.01); G06F 9/451 (2018.01)
CPC G06F 21/552 (2013.01) [G06F 9/451 (2018.02); G06F 2221/034 (2013.01)] 30 Claims
OG exemplary drawing
 
1. A non-transitory computer-readable medium comprising program code that is executable by one or more processors for causing the one or more processors to:
receive interaction data describing a plurality of interactions associated with a plurality of entities;
generate a directed network graph based on the interaction data, the directed network graph including nodes corresponding to the plurality of entities, and the directed network graph including directed links between the nodes to indicate relationships between the plurality of entities, wherein generating the directed network graph based on the interaction data involves:
identifying pairs of interactions associated with a first entity and a second entity in the plurality of interactions, each pair of interactions including a first interaction with the first entity and a second interaction with the second entity subsequent to the first interaction, the first interaction and the second interaction being identified as a pair of interactions based on the first interaction and the second interaction involving a same unique identifier and having occurred within a predefined time period of one another;
identifying outbound interaction pairs in the pairs of interactions, wherein the outbound interaction pairs involve the second interaction at the second entity occurring subsequent to the first interaction at the first entity; and
generating one or more directed links in the directed network graph to represent the outbound interaction pairs, each directed link representing at least one outbound interaction pair and being directed from a first node representing the first entity to a second node representing the second entity;
generate an aggregate value based on the outbound interaction pairs, wherein the aggregate value characterizes the outbound interaction pairs;
detect an anomaly associated with the first entity or the second entity by comparing the aggregate value to a baseline value; and
generate one or more outputs including the directed network graph and an indicator of the detected anomaly.