System and method for determining a risk root cause

1. A method for determining risk root cause link, the method comprising:

determining, by a computing device, a first and second fraud related risk scores respectively associated with a first and second nodes;

determining, by the computing device, a relation strength value related to at least one relation between the first and second nodes; and

using by the computing device, a value function that monotonically increases according to the first and second node risk scores and the relation strength value to calculate a cluster risk score for a cluster of nodes, the cluster including at least the first and second nodes; and

wherein calculating a cluster risk score comprises:

determining at least one path between a first and second nodes, the at least one path including at least one relation between two nodes included in the cluster;

determining a relation strength value of at least one relation included in the path and a first and second node risk scores respectively associated with the first and second nodes; and

calculating the cluster risk score based on the relation strength values and based on the node risk scores.

2. The method of claim 1 , comprising extending the cluster to include an additional node, wherein extending the cluster includes:

determining an additional relation strength value related to at least one relation between the additional node and a node included in the cluster; and

using the additional relation strength value and a node risk score associated with the additional node to calculate a cluster risk score for the extended cluster.

3. The method of claim 1 , wherein a path between the first and second nodes includes a relation between the first node and a third node and a relation between the third node and the second node.

4. The method of claim 1 , comprising associating a node with a constant node risk score if not all paths traversing the node have been determined.

5. The method of claim 1 , comprising producing an alert if the cluster risk score is greater than a determined threshold.

6. The method of claim 1 , comprising:

determining a relation between a first node included in a first cluster and a second node included in a second cluster;

joining the first and second clusters to produce an extended cluster; and

calculating a cluster risk score for the extended cluster.

7. The method of claim 1 , comprising selecting one of the first and second nodes based on estimating their respective potential contribution to the cluster risk score.

8. The method of claim 1 , comprising dynamically modifying a cluster risk score based on an event related to a node included in the cluster.

9. An article comprising a non-transitory computer-readable storage medium, having stored thereon instructions, that when executed on a computer, cause the computer to:

determine a first and second fraud related risk scores respectively associated with a first and second nodes;

determine a relation strength value related to at least one relation between the first and second nodes; and

use a value function that monotonically increases according to the first and second node risk scores and the relation strength value to calculate a cluster risk score for a cluster of nodes, the cluster including at least the first and second nodes; and

wherein calculating a cluster risk score comprises:

determining at least one path between a first and second nodes, the at least one path including at least one relation between two nodes included in the cluster;

determining a relation strength value of at least one relation included in the path and a first and second node risk scores respectively associated with the first and second nodes; and

calculating the cluster risk score based on the relation strength values and based on the node risk scores.

10. The article of claim 9 , wherein the instructions when executed further result in extending the cluster to include an additional node, wherein extending the cluster includes:

determining an additional relation strength value related to at least one relation between the additional node and a node included in the cluster; and

using the additional relation strength value and a node risk score associated with the additional node to calculate a cluster risk score for the extended cluster.

11. The article of claim 9 , wherein a path between the first and second nodes includes a relation between the first node and a third node and a relation between the third node and the second node.

12. The article of claim 9 , wherein the instructions when executed further result in associating a node with a constant node risk score if not all paths traversing the node have been determined.

13. The article of claim 9 , wherein the instructions when executed further result in producing an alert if the cluster risk score is greater than a determined threshold.

14. The article of claim 9 , wherein the instructions when executed further result in:

determining a relation between a first node included in a first cluster and a second node included in a second cluster;

joining the first and second clusters to produce an extended cluster; and

calculating a cluster risk score for the extended cluster.

15. The article of claim 9 , wherein the instructions when executed further result in selecting one of the first and second nodes based on estimating their respective potential contribution to the cluster risk score.

16. The article of claim 9 , wherein the instructions when executed further result in dynamically modifying a cluster risk score based on an event related to a node included in the cluster.