Systems and user interfaces for dynamic and interactive investigation of bad actor behavior based on automatic clustering of related data in various data structures
Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, automatically tag and group those clustered data structures, and provide results of the automated analysis and grouping in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria or rules so as to generate a tiled display of the groups of related data clusters such that the analyst may quickly and efficiently evaluate the groups of data clusters. In particular, the groups of data clusters may be dynamically re-grouped and/or filtered in an interactive user interface so as to enable an analyst to quickly navigate among information associated with various groups of data clusters and efficiently evaluate those data clusters in the context of, for example, a fraud investigation.
1. A computer system configured to provide a dynamic graphical user interface relating to clusters of data items, the computer system comprising:
one or more electronic data structures configured to store at least a plurality of clusters of data items; and
one or more hardware computer processors configured to execute software code to cause the computer system to:
determine permissions of the user to access data items of the plurality of clusters of data items;
based on the determined permissions, determine a subset of clusters of data items, of the plurality of clusters of data items, which the user is permitted to access;
analyze the subset of clusters of data items to determine, for each cluster of the subset of clusters, respective one or more attribute values associated with the respective clusters of data items;
provide a dynamic user interface configured to include at least indications of a plurality of types of attributes; and
in response to a user input, by a user, selecting a first type of attribute of the plurality of types of attributes, update the dynamic user interface to include at least indications of a first one or more attribute values associated with the first type of attribute, wherein:
each of the first one or more attribute values is indicated along with a corresponding graphical tile in the dynamic user interface, and
each graphical tile is representative of one or more clusters, of the subset of clusters, associated with the corresponding attribute value.
2. The computer system of claim 1 , wherein the permissions of the user are determined based on at least one of: an identity of the user, a group to which the user belongs, or a type of investigation being performed by the user.
3. The computer system of claim 1 , wherein determining the subset of clusters comprises determining clusters, of the plurality of clusters, having data items that the user is not permitted to access, and not including such clusters in the subset of clusters.
4. The computer system of claim 1 , wherein permissions information is applied to at least one of: data items, data item attributes, clusters, groups of clusters, types of data, or user interfaces.
5. The computer system of claim 1 , wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:
further in response to the user input selecting the first type of attribute:
group, into a plurality of groups of clusters, the subset of clusters of data items such that each group of clusters of the subset of groups of clusters comprises clusters of data items associated with respective attribute values of the one or more attribute values associated with the first type of attribute,
wherein each of the graphical tiles in the dynamic user interface corresponds to a different one of the plurality of groups of clusters.
6. The computer system of claim 1 , wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:
in response to a second user input selecting a second type of attribute of the plurality of types of attributes, update the dynamic user interface to include at least indications of a second one or more attribute values associated with the second type of attribute, wherein:
each of the second one or more attribute values is indicated along with a corresponding graphical tile in the dynamic user interface, and
each graphical tile is representative of one or more clusters, of the subset of clusters, associated with the corresponding attribute value.
7. The computer system of claim 1 , wherein each of the respective graphical tiles is overlaid with:
indications of respective numbers of clusters represented by the graphical tiles.
8. The computer system of claim 7 , wherein each of the respective graphical tiles is further overlaid with:
respective indications of numbers of critical activities associated with data clusters associated the respective tiles.
9. The computer system of claim 8 , wherein each of the respective graphical tiles is further overlaid with:
respective time-based graphs showing events associated with data clusters associated with the respective one or more attribute values represented by the respective graphical tiles.
10. The computer system of claim 9 , wherein the one or more hardware computer processors are further configured to execute software code to cause the computer system to:
in response to selection of a graphical tile of the plurality of tiles, update the dynamic user interface such that the time-based graph associated with the selected graphical tile is resized to be larger and comprise a greater portion of the dynamic user interface.
11. A computer-implemented method for providing a dynamic graphical user interface relating to clusters of data items, the computer-implemented method comprising:
by one or more hardware processors executing computer executable instructions:
determining permissions of the user to access data items of a plurality of clusters of data items;
based on the determined permissions, determining a subset of clusters of data items, of the plurality of clusters of data items, which the user is permitted to access;
analyzing the subset of clusters of data items to determine, for each cluster of the subset of clusters, respective one or more attribute values associated with the respective clusters of data items;
providing a dynamic user interface configured to include at least indications of a plurality of types of attributes; and
in response to a user input, by a user, selecting a first type of attribute of the plurality of types of attributes, updating the dynamic user interface to include at least indications of a first one or more attribute values associated with the first type of attribute, wherein:
each of the first one or more attribute values is indicated along with a corresponding graphical tile in the dynamic user interface, and
each graphical tile is representative of one or more clusters, of the subset of clusters, associated with the corresponding attribute value.
12. The computer-implemented method of claim 11 , wherein the permissions of the user are determined based on at least one of: an identity of the user, a group to which the user belongs, or a type of investigation being performed by the user.
13. The computer-implemented method of claim 11 , wherein determining the subset of clusters comprises determining clusters, of the plurality of clusters, having data items that the user is not permitted to access, and not including such clusters in the subset of clusters.
14. The computer-implemented method of claim 11 , wherein permissions information is applied to at least one of: data items, data item attributes, clusters, groups of clusters, types of data, or user interfaces.
15. The computer-implemented method of claim 11 further comprising:
by the one or more hardware processors executing computer executable instructions:
further in response to the user input selecting the first type of attribute:
group, into a plurality of groups of clusters, the subset of clusters of data items such that each group of clusters of the subset of groups of clusters comprises clusters of data items associated with respective attribute values of the one or more attribute values associated with the first type of attribute,
wherein each of the graphical tiles in the dynamic user interface corresponds to a different one of the plurality of groups of clusters.
16. The computer-implemented method of claim 11 further comprising:
by the one or more hardware processors executing computer executable instructions:
in response to a second user input selecting a second type of attribute of the plurality of types of attributes, updating the dynamic user interface to include at least indications of a second one or more attribute values associated with the second type of attribute, wherein:
each of the second one or more attribute values is indicated along with a corresponding graphical tile in the dynamic user interface, and
each graphical tile is representative of one or more clusters, of the subset of clusters, associated with the corresponding attribute value.
17. The computer-implemented method of claim 11 , wherein each of the respective graphical tiles is overlaid with:
indications of respective numbers of clusters represented by the graphical tiles.
18. The computer-implemented method of claim 17 , wherein each of the respective graphical tiles is further overlaid with:
respective indications of numbers of critical activities associated with data clusters associated the respective tiles.
19. The computer-implemented method of claim 18 , wherein each of the respective graphical tiles is further overlaid with:
respective time-based graphs showing events associated with data clusters associated with the respective one or more attribute values represented by the respective graphical tiles.
20. The computer-implemented method of claim 19 further comprising:
by the one or more hardware processors executing computer executable instructions:
in response to selection of a graphical tile of the plurality of tiles, updating the dynamic user interface such that the time-based graph associated with the selected graphical tile is resized to be larger and comprise a greater portion of the dynamic user interface.