Apparatus, method and computer program product for identifying a set of messages of interest in a network

1. Apparatus for identifying a set of messages of interest in a network, the apparatus comprising circuitry configured to:

receive information of a plurality of sets of messages which have been exchanged by nodes in a network;

select a portion of the plurality of sets of messages which have been received using a property of a source message of each set of messages of the plurality of sets of messages;

generate, individual first values for the nodes of each set of messages of the selected portion of the plurality of sets of messages using a property of the nodes associated with each set of messages; and

identify at least one set of messages of the selected portion of the plurality of sets of messages as a set of messages of interest using the individual first values which have been generated for the selected portion of the sets of messages;

wherein the apparatus is configured to generate the individual first values for the nodes of each set of messages using a trained model;

wherein the trained model is trained in order to generate the first value using a behaviour of the nodes in the network as a property of the nodes associated with each set of messages;

wherein the trained model is a machine learning model, a deep learning model and/or a neural network;

wherein the behaviour includes at least a number of messages sent by the nodes, a rate of messages sent by the nodes, a value of the messages sent by the nodes, an average age of the relationship between nodes and/or a number of messages sent to nodes to which a node has not previously sent messages.

2. The apparatus according to claim 1 , wherein the information of the plurality of sets of messages includes at least one of a unique identifier associated with each of the sets of messages, a unique identifier of the nodes associated with each of the sets of messages and/or a unique identifier of messages associated with each of the sets of messages.

3. The apparatus according to claim 1 , wherein the apparatus is configured to select a portion of the plurality of sets of messages which have been received by selecting sets of messages where a value associated the source message of each set of messages exceeds a first predetermined threshold.

4. The apparatus according to claim 1 , wherein the apparatus is configured to select a portion of the plurality of sets of messages which have been received by selecting sets of messages where the source message is exchanged between two nodes which have not previously exchanged messages and/or where an earliest message exchanged between the two nodes occurred within a predetermined interval of time before the source message of the set of messages.

5. The apparatus according to claim 1 , wherein the apparatus is configured to generate a combined first value for each of the individual nodes associated with the set of messages.

6. The apparatus according to claim 5 , wherein the apparatus is configured to identify at least one set of messages as a set of messages of interest when the combined first value for that set of messages exceeds a predetermined threshold value.

7. The apparatus according to claim 1 , wherein the apparatus is further configured to determine a set of messages as a set of messages of interest using the first values which have been generated for the set of messages and a property of the set of messages.

8. The apparatus according to claim 1 , wherein the nodes are accounts in a banking network and the messages are transactions exchanged between the accounts in the banking network.

9. Apparatus for identifying a set of messages of interest in a network, the apparatus comprising circuitry configured to:

receive information of a plurality of sets of messages which have been exchanged by nodes in a network;

select a portion of the plurality of sets of messages which have been received using a property of a source message of each set of messages of the plurality of sets of messages;

generate, individual first values for the nodes of each set of messages of the selected portion of the plurality of sets of messages using a property of the nodes associated with each set of messages; and

identify at least one set of messages of the selected portion of the plurality of sets of messages as a set of messages of interest using the individual first values which have been generated for the selected portion of the sets of messages;

wherein the apparatus is further configured to determine a set of messages as a set of messages of interest using the first values which have been generated for the set of messages and a property of the set of messages;

wherein the property of the set of messages is that a target node to which the source message was sent has an individual first value above a predetermined threshold and at least one node to which the target node sent a message has an individual first value above a predetermined threshold.

10. The apparatus according to claim 9 , wherein the information of the plurality of sets of messages includes at least one of a unique identifier associated with each of the sets of messages, a unique identifier of the nodes associated with each of the sets of messages and/or a unique identifier of messages associated with each of the sets of messages.

11. The apparatus according to claim 9 , wherein the apparatus is configured to select a portion of the plurality of sets of messages which have been received by selecting sets of messages where a value associated the source message of each set of messages exceeds a first predetermined threshold.

12. The apparatus according to claim 9 , wherein the apparatus is configured to select a portion of the plurality of sets of messages which have been received by selecting sets of messages where the source message is exchanged between two nodes which have not previously exchanged messages and/or where an earliest message exchanged between the two nodes occurred within a predetermined interval of time before the source message of the set of messages.

13. The apparatus according to claim 9 , wherein the apparatus is configured to generate a combined first value for each of the individual nodes associated with the set of messages.

14. The apparatus according to claim 13 , wherein the apparatus is configured to identify at least one set of messages as a set of messages of interest when the combined first value for that set of messages exceeds a predetermined threshold value.

15. The apparatus according to claim 9 , wherein the nodes are accounts in a banking network and the messages are transactions exchanged between the accounts in the banking network.

16. Method of identifying a set of messages of interest in a network, the method comprising controlling circuitry to perform the steps of:

receiving information of a plurality of sets of messages which have been exchanged by nodes in a network;

selecting a portion of the plurality of sets of messages which have been received using a property of a source message of each set of messages of the plurality of sets of messages;

generating individual first values for each of the nodes of each set of messages of the selected portion of the plurality of sets of messages using a property of the nodes associated with each set of messages;

identifying at least one set of messages of the selected portion of the plurality of sets of messages as a set of messages of interest using the individual first values which have been generated for the selected portion of the sets of messages; and

generating the individual first values for the nodes of each set of messages using a trained model,

wherein the trained model is trained in order to generate the first value using a behaviour of the nodes in the network as a property of the nodes associated with each set of messages,

wherein the behaviour includes at least a number of messages sent by the nodes, a rate of messages sent by the nodes, a value of the messages sent by the nodes, an average age of the relationship between nodes and/or a number of messages sent to nodes to which a node has not previously sent messages.

17. A non-transitory computer-readable storage medium having computer-executable instructions stored thereon, the computer-executable instructions, when executed by a processor, cause the processor to perform the operations of:

receiving information of a plurality of sets of messages which have been exchanged by nodes in a network;

selecting a portion of the plurality of sets of messages which have been received using a property of a source message of each set of messages of the plurality of sets of messages;

generating individual first values for each of the nodes of each set of messages of the selected portion of the plurality of sets of messages using a property of the nodes associated with each set of messages; and

identifying at least one set of messages of the selected portion of the plurality of sets of messages as a set of messages of interest using the individual first values which have been generated for the selected portion of the sets of messages,

wherein generating the individual first values for the nodes of each set of messages involves using a trained model,

wherein the trained model is trained in order to generate the first value using a behaviour of the nodes in the network as a property of the nodes associated with each set of messages,

wherein the behaviour includes at least a number of messages sent by the nodes, a rate of messages sent by the nodes, a value of the messages sent by the nodes, an average age of the relationship between nodes and/or a number of messages sent to nodes to which a node has not previously sent messages.