Systems and user interfaces for dynamic and interactive investigation based on automatic malfeasance clustering of related data in various data structures
In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed to assist in detection of financial malfeasance. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data (such as trades, emails or chat messages) and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster, and the clusters may be displayed and ranked based on their scores. Various embodiments may enable an analyst to review clusters of trades, emails and/or chat messages that are the most likely to reveal financial malfeasance.
1. A computer-implemented method comprising:
accessing properties associated with a first transaction data item;
identifying, from a plurality of transaction data items, the first transaction data item based at least on the properties;
determining a trader identifier associated with the first transaction data item;
determining a first electronic communication that was sent or received by a first trader associated with the trader identifier;
determining that the first electronic communication satisfies at least one of:
the first electronic communication comprising at least one less of a particular participant than a previous electronic communication associated with the first electronic communication,
the first electronic communication comprising at least one additional participant than another previous electronic communication associated with the first electronic communication, wherein the additional participant is determined to be a supervisor of the first trader, or
the first electronic communication comprising a participant that is associated with an external personal account of the first trader;
designating the first electronic communication as a seed; and
generating a data item cluster from a plurality of transaction-related data items based on the seed, wherein a data item of the data item cluster comprises information associated with at least one of: a trader, an electronic communication, a transaction, or an institution.
2. The computer-implemented method of claim 1 , wherein identifying the first transaction data item further comprises:
accessing a time property from the properties, the time property associated with an execution time of the first transaction data item; and
determining the time property falls within a period of time.
3. The computer-implemented method of claim 1 , wherein identifying the first transaction data item further comprises:
determining a second trader identifier associated with the first transaction data item, wherein the second trader identifier and the trader identifier are on opposite sides of a trade associated with the first transaction data item; and
determining that each of the second trader identifier and the trader identifier are associated with respective traders that work for a same institution.
4. The computer-implemented method of claim 1 , wherein identifying the first transaction data item further comprises identifying a property of the properties that indicates at least one of: an unapproved trade, a late booked trade, a canceled trade, an after hours trade, or an unmatched trade.
5. The computer-implemented method of claim 1 , wherein determining the first electronic communication further comprises:
determining a delivery time associated with the first electronic communication; and
selecting the first electronic communication, from a plurality of electronic communications, based at least on the delivery time being within a period of time before or after an execution time of the first transaction data item.
6. The computer-implemented method of claim 1 , further comprising:
designating the first transaction data item as a second seed;
determining, from the plurality of transaction-related data items, a second transaction-related data item associated with the second seed; and
adding the second transaction-related data item to the data item cluster.
7. A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed by a computer system, configure the computer system to perform operations comprising:
accessing properties associated with a first transaction data item;
identifying the first transaction data item based at least on the properties;
determining a trader identifier associated with the first transaction data item;
determining a first electronic communication that was sent or received by a first trader associated with the trader identifier;
determining that the first electronic communication satisfies at least one of:
the first electronic communication comprising at least one less of a particular participant than a previous electronic communication associated with the first electronic communication,
the first electronic communication comprising at least one additional participant than another previous electronic communication associated with the first electronic communication, wherein the additional participant is determined to be a supervisor of the first trader, or
the first electronic communication comprising a participant that is associated with an external personal account of the first trader;
designating the first electronic communication as a seed; and
generating a data item cluster from a plurality of transaction-related data items based on the seed, wherein a data item of the data item cluster comprises information associated with at least one of: a trader, an electronic communication, a transaction, or an institution.
8. The non-transitory computer-readable storage medium of claim 7 , wherein identifying the first transaction data item further comprises:
accessing a time property from the properties, the time property associated with an execution time of the first transaction data item; and
determining the time property falls within a period of time when a trader associated with the trader identifier was logged out of a computing device.
9. The non-transitory computer-readable storage medium of claim 7 , wherein the computer-executable instructions further configure the computer system to perform operations comprising:
querying an employee data source for employee data associated with at least one of: the first trader or the additional participant; and
determining the additional participant is the supervisor of the first trader using the employee data.
10. The non-transitory computer-readable storage medium of claim 7 , wherein identifying the first transaction data item further comprises:
determining a second trader identifier associated with the first transaction data item, wherein the second trader identifier and the trader identifier are on opposite sides of a trade associated with the first transaction data item; and
determining that each of the second trader identifier and the trader identifier are associated with respective traders that work for a same institution.
11. The non-transitory computer-readable storage medium of claim 7 , wherein identifying the first transaction data item further comprises identifying a property of the properties that indicates at least one of: an unapproved trade, a late booked trade, a canceled trade, an after hours trade, or an unmatched trade.
12. The non-transitory computer-readable storage medium of claim 7 , wherein determining the first electronic communication further comprises:
determining a delivery time associated with the first electronic communication; and
selecting the first electronic communication, from a plurality of electronic communications, based at least on the delivery time being within a predetermine period of time before or after an execution time of the first transaction data item.
13. The non-transitory computer-readable storage medium of claim 7 , wherein the computer-executable instructions further configure the computer system to perform operations comprising:
designating the first transaction data item as a second seed;
determining, from the plurality of transaction-related data items, a second transaction-related data item associated with the second seed; and
adding the second transaction-related data item to the data item cluster.
14. A computer system comprising:
one or more computer readable storage devices configured to store:
a plurality of transaction-related data items, wherein a data item of the plurality of transaction-related data items comprises information associated with at least one of: a trader, an electronic communication, a transaction, or an institution; and
one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute computer executable instructions in order to cause the one or more hardware computer processors to:
access properties associated with a first transaction data item;
identify the first transaction data item based at least on the properties;
determine a trader identifier associated with the first transaction data item;
determine a first electronic communication that was sent or received by a first trader associated with the trader identifier;
determine that the first electronic communication satisfies at least one of:
the first electronic communication comprising at least one less of a particular participant than a previous electronic communication associated with the first electronic communication,
the first electronic communication comprising at least one additional participant than another previous electronic communication associated with the first electronic communication, wherein the additional participant is determined to be a supervisor of the first trader, or
the first electronic communication comprising a participant that is associated with an external personal account of the first trader;
designate the first electronic communication as a seed; and
generate a data item cluster from the plurality of transaction-related data items based on the seed.
15. The computer system of claim 14 , wherein the one or more hardware computer processors are further configured to:
query an employee data source for employee data associated with at least one of: the first trader or the additional participant; and
determine the additional participant is the supervisor of the first trader using the employee data.
16. The computer system of claim 14 , wherein identifying the first transaction data item further comprises:
accessing a time property from the properties, the time property associated with an execution time of the first transaction data item; and
determining the time property falls within a period of time when the first trader was logged out of a computing device.
17. The computer system of claim 14 , wherein identifying the first transaction data item further comprises:
determining a second trader identifier associated with the first transaction data item, wherein the second trader identifier and the trader identifier are on opposite sides of a trade associated with the first transaction data item; and
determining that each of the second trader identifier and the trader identifier are associated with respective traders that work for a same institution.
18. The computer system of claim 14 , wherein identifying the first transaction data item further comprises identifying a property of the properties that indicates at least one of: an unapproved trade, a late booked trade, a canceled trade, an after hours trade, or an unmatched trade.
19. The computer system of claim 14 , wherein determining the first electronic communication further comprises:
determining a delivery time associated with the first electronic communication; and
selecting the first electronic communication, from a plurality of electronic communications, based at least on the delivery time being within a predetermine period of time before or after an execution time of the first transaction data item.
20. The computer system of claim 14 , wherein the one or more hardware computer processors are further configured to:
designate the first transaction data item as a second seed;
determine, from the plurality of transaction-related data items, a second transaction-related data item associated with the second seed; and
add the second transaction-related data item to the data item cluster.