Incorporating feedback in network graph hotspot identification

1. A computer-implemented method comprising:

receiving, by a processor, input data, wherein the input data includes a plurality of messages, each message containing a set of message data;

generating, by a pattern detector and based on the plurality of messages, a network graph;

analyzing the network graph to identify one or more hotspots, wherein each hotspot of the one or more hotspots is identified as a scenario that includes potentially fraudulent activity;

identifying, in the network graph and by a learning model, a first hotspot of the one or more hotspots;

compiling a set of hotspot characteristics for the first hotspot, wherein the identifying of the first hotspot is based a first characteristic of the set of characteristics;

indicating, to a user through a network interface, the first hotspot;

receiving, in response to identifying and indicating the first hotspot and in response to a review of the hotspot characteristics for the first hotspot, a first user feedback, wherein the first user feedback includes a level of agreement and the first hotspot includes the potentially fraudulent activity;

updating, based on the first user feedback, the learning model, wherein the updating is configured to reduce a number of false positive hot spots;

generating, by the learning model and based in part on the first user feedback, a hotspot confidence score for the first hotspot; and

outputting, by the network interface, the hotspot confidence score and the network graph.

2. The method of claim 1 , wherein the hotspot confidence score is based on a weight for each of a location within the network graph, the set of hotspot characteristics, and the first user feedback.

3. The method of claim 2 , wherein said each weight is determined by the learning model.

4. The method of claim 1 , further comprising:

wherein generating the hotspot confidence score is in response to updating the learning model.

5. The method of claim 1 , wherein the network graph is configured to display relationships between one or more nodes in the network graph.

6. The method of claim 5 , wherein the first hotspot is a first node of the one or more nodes.

7. The method of claim 1 , wherein the input data includes configuration criteria, wherein the configuration criteria are configured to identify data patterns to detect in the network graph.

8. The method of claim 1 , wherein each message includes a financial transaction.

9. The method of claim 8 , wherein the set of data includes at least one of: a source account, a destination account, a first associated party, an amount, a source location, a destination location, and a transaction time.

10. The method of claim 1 , wherein each message includes an insurance claim.

11. A system comprising:

a processor; and

a computer-readable storage medium communicatively coupled to the processor and storing program instructions which, when executed by the processor, are configured to cause the processor to:

receive input data, wherein the input data includes a plurality of messages, each message containing a set of message data, wherein the first user feedback includes a level of agreement and the first hotspot includes the potentially fraudulent activity;

generate, based on the plurality of messages, a network graph;

analyze the network graph to identify one or more hotspots, wherein each hotspot of the one or more hotspots is identified as a scenario that includes potentially fraudulent activity;

identify, by a pattern detector and by a learning model, in the network graph, a first hotspot of the one or more hotspots;

compile a set of hotspot characteristics for the first hotspot, wherein the identifying of the first hotspot is based a first characteristic of the set of characteristics;

indicate, to a user through a network interface, the first hotspot;

receive, in response to identifying and indicating the first hotspot and in response to a review of the hotspot characteristics for the first hotspot, a first user feedback, wherein the first user feedback includes a level of agreement, the first hotspot includes the potentially fraudulent activity, and the first user feedback includes hiding a second node of the network graph;

updating, based on the first user feedback, the learning model, wherein the updating is configured to reduce a number of false positive hot spots;

generate, by the learning model and based in part on the first user feedback, a hotspot confidence score for the first hotspot; and

output, by the network interface, the hotspot confidence score and the network graph.

12. The system of claim 11 , wherein the hotspot confidence score is based on a weight for each of a location within the network graph, the set of hotspot characteristics, and the first user feedback.

13. The system of claim 11 , wherein the hotspot confidence score is generated in response to the learning model being updated.

14. The system of claim 11 , wherein the network graph is configured to display relationships between one or more nodes in the network graph.

15. A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing unit to cause the processing unit to:

receive input data, wherein the input data includes a plurality of messages, each message containing a set of message data;

generate, based on the plurality of messages, a network graph;

analyze the network graph to identify one or more hotspots, wherein each hotspot of the one or more hotspots is identified as a scenario that includes potentially fraudulent activity;

identify, by a pattern detector and by a learning model, in the network graph, a first hotspot of the one or more hotspots;

compile a set of hotspot characteristics for the first hotspot, wherein the identifying of the first hotspot is based a first characteristic of the set of characteristics;

indicating, to a user through a network interface, the first hotspot;

receive, in response to identifying and indicating the first hotspot and in response to a review of the hotspot characteristics for the first hotspot, a first user feedback, wherein the first user feedback includes a level of agreement and the first hotspot includes the potentially fraudulent activity;

updating, based on the first user feedback, the learning model, wherein the updating is configured to reduce a number of false positive hot spots;

generate, by the learning model and based in part on the first user feedback, a hotspot confidence score for the first hotspot; and

output, by the network interface, the hotspot confidence score and the network graph.

16. The computer program product of claim 15 , wherein the hotspot confidence score is based on a weight for each of a location within the network graph, the set of hotspot characteristics, and the first user feedback.

17. The computer program product of claim 16 , wherein the first user feedback includes hiding a second node of the network graph.

18. The computer program product of claim 17 , wherein the hotspot confidence score is generated in response to the learning model being updated.

19. The computer program product of claim 17 , wherein the second node is noise in the second graph.

20. The computer program product of claim 17 , wherein the first user feedback is validated by a second user.