IP Library › Granted Patent US 12,124,933
Granted Patent B2
US 12,124,933 · App. 16/866,139 · Granted Oct 22, 2024

Artificial intelligence system for anomaly detection in transaction data sets

Inventors: Amir Shachar (Ramat Gan, IL); Einat Neumann Ben Ari (Hod Hasharon, IL); Danny Butvinik (Haifa, IL); Yoav Avneon (Ness-Ziona, IL); Gabrielle Zaghdoun Azoulay (Tel Aviv, IL); Liat Elboim (Rishon Lezion, IL)
Assignee: ACTIMIZE LTD.
G06N20/20G06N20/00G06Q20/4016G06F21/60
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,124,933
App. No.
16/866,139
Filed
May 4, 2020
Granted
Oct 22, 2024
Kind
B2
Art Unit
3697
USPC
705/75
Abstract

An artificial intelligence system configured to detect anomalies in transaction data sets. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform modeling operations which include receiving a first data set for training a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, accessing at least one micro-model trained using at least one second data set separate from the first data set, determining risk scores from the first data set using the at least one micro-model, enriching the first data set with the risk scores, and determining the first machine learning model for the enriched first data set using the machine learning technique.

Claims (66)

1. An artificial intelligence system configured to detect anomalies in transaction data sets, the artificial intelligence system comprising:

a processor and a non-transitory computer readable medium operably coupled thereto, the non-transitory computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform modeling operations which comprise:

receiving a first data set for an unsupervised training of a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, wherein a first number of the anomalies in the first data set corresponds to a low fraud scenario having less than a second number of the anomalies in at least one second data set that is required for the unsupervised training;

training, by machine learning (ML) modeling operations, a plurality of micro-models having a plurality of hyper-parameter settings using a supervised training based on the at least one second data set, wherein each of the plurality of micro-models are trained having a corresponding one of a plurality of hyper-parameter settings without a hyper-parameter optimization for a corresponding one of the at least one second data set used during model training, and wherein the first machine learning model is to be trained with the hyper-parameter optimization for the first data set;

computing micro-model importances of the plurality of micro-models based on individual and overall feature importance scores for the plurality of micro-models;

selecting at least one micro-model from the plurality of micro-models for the first data set based on the micro-model importances;

determining a set of intersecting features from first features of the first machine learning model and second features of the at least one micro-model;

reducing a first dimensionality of the first features from the first data set based on the set of intersecting features;

determining risk scores for the first features having the reduced first dimensionality from the first data set using the at least one micro-model;

enriching the first data set with the risk scores based on the set of intersecting features, wherein the enriching includes tagging data for the set of intersecting features in the first data set based on the risk scores, and wherein the enriching of the first data set with the risk scores allows for the unsupervised training of the first machine learning model with the enriched first data set;

training, by the ML modeling operations, the first machine learning model using the enriched first data set and the machine learning technique, wherein the first machine learning model is trained with the hyper-parameter optimization; and

detecting fraud corresponding to the anomalies in further transaction data sets using the trained first machine learning model.

2. The artificial intelligence system of claim 1 , wherein the modeling operations further comprise:

training, by the ML modeling operations, a second machine learning model for the first data set using the machine learning technique, wherein the second machine learning model is for an unenriched data set corresponding to the first data set.

3. The artificial intelligence system of claim 2 , wherein the modeling operations further comprise:

generating a model explanation output based on the first machine learning model and the second machine learning model, wherein the model explanation output comprises a comparison between each feature of each classification task within the first machine learning model and the second machine learning model.

4. The artificial intelligence system of claim 3 , wherein generating the model explanation output comprises:

obtaining an importance ranking of each feature in each classification task of the first machine learning model and the second machine learning model; and

averaging the importance ranking of each feature to each classification task to obtain the comparison.

5. The artificial intelligence system of claim 1 , wherein, before training the at least one micro-model, the modeling operations further comprise:

receiving the at least one second data set for the at least one micro-model, wherein the first data set and each of the at least one second data set comprise segregated data sets for a federated training system, and wherein the at least one second data set comprises at least one auxiliary data set.

6. The artificial intelligence system of claim 5 , wherein the risk scores are determined based on the set of intersecting features between the first data set and the at least one second data set for the at least one micro-model.

7. The artificial intelligence system of claim 5 , wherein, before training the at least one micro-model, the modeling operations further comprise:

pre-processing the at least one second data set to reduce a second dimensionality of the at least one second data set, wherein the at least one micro-model is generated using the supervised training with a sampled data set comprising a subset of data from the pre-processed at least one second data set including one or more anomalous transactions and one or more valid transactions within the pre-processed at least one second data set.

8. The artificial intelligence system of claim 5 , wherein each of the at least one micro-model is trained using one of a different algorithm corresponding to the supervised training or a different data set from the at least one second data set.

9. The artificial intelligence system of claim 1 , wherein the first data set comprises a first transaction data set associated with a first financial entity, wherein the at least one second data set comprises at least one second transaction data set associated with at least one second financial entity, and wherein the first data set comprises an unannotated data set associated with potential fraudulent transactions.

10. A method to detect anomalies in transaction data sets, the method comprising:

receiving a first data set for an unsupervised training of a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, wherein a first number of the anomalies in the first data set corresponds to a low fraud scenario having less than a second number of the anomalies in at least one second data set required for an unsupervised training of the first machine learning model using the machine learning technique;

training, by machine learning (ML) modeling operations, a plurality of micro-models having a plurality of hyper-parameter settings using a supervised training based on the at least one second data set, wherein each of the plurality of micro-models are trained having a corresponding one of a plurality of hyper-parameter settings without a hyper-parameter optimization for a corresponding one of the at least one second data set used during model training, and wherein the first machine learning model is to be trained with the hyper-parameter optimization for the first data set;

computing, using a processing component of the ML modeling operations for an ML model explainer, micro-model importances of the plurality of micro-models based on individual feature importance scores and an overall feature importance score for each of the plurality of micro-models;

selecting at least one micro-model from the plurality of micro-models for the first data set based on the micro-model importances;

determining a set of intersecting features from first features of the first machine learning model and second features of the at least one micro-model;

reducing a first dimensionality of the first features from the first data set based on the set of intersecting features;

determining risk scores for the first features having the reduced first dimensionality from the first data set using the at least one micro-model;

enriching the first data set with the risk scores based on the set of intersecting features, wherein the enriching includes tagging data for the set of intersecting features in the first data set based on the risk scores, and wherein the enriching of the first data set with the risk scores allows for the unsupervised training of the first machine learning model with the enriched first data set;

training, by the ML modeling operations, the first machine learning model using the enriched first data set and the machine learning technique, wherein the first machine learning model is trained with the hyper-parameter optimization; and

detecting fraud corresponding to the anomalies in further transaction data sets using the trained first machine learning model.

11. The method of claim 10 , further comprising:

training, by the ML modeling operations, a second machine learning model for the first data set using the machine learning technique, wherein the second machine learning model is for an unenriched data set corresponding to the first data set.

12. The method of claim 11 , further comprising:

generating a model explanation output based on the first machine learning model and the second machine learning model, wherein the model explanation output comprises a comparison between each feature of each classification task within the first machine learning model and the second machine learning model.

13. The method of claim 12 , wherein generating the model explanation output comprises:

obtaining an importance ranking of each feature in each classification task of the first machine learning model and the second machine learning model; and

averaging the importance ranking of each feature to each classification task to obtain the comparison.

14. The method of claim 10 , wherein, before training the at least one micro-model, the method further comprises:

receiving the at least one second data set for the at least one micro-model, wherein the first data set and each of the at least one second data set comprise segregated data sets for a federated training system, and wherein the at least one second data set comprises at least one auxiliary data set.

15. The method of claim 14 , wherein the risk scores are determined based on the set of intersecting features between the first data set and the at least one second data set for the at least one micro-model.

16. The method of claim 14 , wherein, before training the at least one micro-model, the method further comprises:

pre-processing the at least one second data set to reduce a second dimensionality of the at least one second data set, wherein the at least one micro-model is generated using the supervised training with a sampled data set comprising a subset of data from the pre-processed at least one second data set including one or more anomalous transactions and one or more valid transactions within the pre-processed at least one second data set.

17. The method of claim 14 , wherein each of the at least one micro-model is trained using one of a different algorithm corresponding to the supervised training or a different data set from the at least one second data set.

18. The method of claim 10 , wherein the first data set comprises a first transaction data set associated with a first financial entity, wherein the at least one second data set comprises at least one second transaction data set associated with at least one second financial entity, and wherein the first data set comprises an unannotated data set associated with potential fraudulent transactions.

19. A non-transitory computer-readable medium having stored thereon computer-readable instructions executable to detect anomalies in transaction data sets based on one or more machine learning models, the computer-readable instructions executable to perform modeling operations which comprises:

receiving a first data set for an unsupervised training of a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, wherein a first number of the anomalies in the first data set corresponds to a low fraud scenario having less than a second number of the anomalies in at least one second data set required for an unsupervised training of the first machine learning model using the machine learning technique;

training, by machine learning (ML) modeling operations, a plurality of micro-models having a plurality of hyper-parameter settings using a supervised training based on the at least one second data set, wherein each of the plurality of micro-models are trained having a corresponding one of a plurality of hyper-parameter settings without a hyper-parameter optimization for a corresponding one of the at least one second data set used during model training, and wherein the first machine learning model is to be trained with the hyper-parameter optimization for the first data set;

computing, using a processing component of the ML modeling operations for an ML model explainer, micro-model importances of the plurality of micro-models based on individual feature importance scores and an overall feature importance score for each of the plurality of micro-models;

selecting at least one micro-model from the plurality of micro-models for the first data set based on the micro-model importances;

determining a set of intersecting features from first features of the first machine learning model and second features of the at least one micro-model;

reducing a first dimensionality of the first features from the first data set based on the set of intersecting features;

determining risk scores for the first features having the reduced first dimensionality from the first data set using the at least one micro-model;

enriching the first data set with the risk scores based on the set of intersecting features, wherein the enriching includes tagging data for the set of intersecting features in the first data set based on the risk scores, and wherein the enriching of the first data set with the risk scores allows for the unsupervised training of the first machine learning model with the enriched first data set;

training, by the ML modeling operations, the first machine learning model using the enriched first data set and the machine learning technique, wherein the first machine learning model is trained with the hyper-parameter optimization;

detecting fraud corresponding to the anomalies in further transaction data sets using the trained first machine learning model.

20. The non-transitory computer-readable medium of claim 19 , wherein the modeling operations further comprise:

training, by the ML modeling operations, a second machine learning model for the first data set using the machine learning technique, wherein the second machine learning model is for an unenriched data set corresponding to the first data set; and

generating a model explanation output based on the first machine learning model and the second machine learning model, wherein the model explanation output comprises a comparison between each feature of each classification task within the first machine learning model and the second machine learning model, and

wherein the risk scores are determined based on the set of intersecting features between the first data set and the at least one second data set for the at least one micro-model, and wherein the at least one second data set comprises at least one auxiliary data set.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 13, 2025
From: HACKMON, ACHI
To: ACTIMIZE LTD.
Reel/Frame 069845/0560 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 8, 2020
From: SHACHAR, AMIR; BEN ARI, EINAT NEUMANN; BUTVINIK, DANNY; AVNEON, YOAV; AZOULAY, GABRIELLE ZAGHDOUN; ELBOIM, LIAT
To: ACTIMIZE LTD.
Reel/Frame 052867/0264 →
Continuity (1)
Related Publication 20210342847A1 · Nov 4, 2021