Granted Patent B2

US 12,205,109 · App. 17/120,150 · Granted Jan 21, 2025

Inventors: Li Zhang (Beijing, CN); Shi Lei Zhang (Beijing, CN); Toyotaro Suzumura (New York City, NY); Keith Coleman Houck (Rye, NY); Ryo Kawahara (Tokyo, JP)

Assignee: International Business Machines Corporation

G06Q20/382H04L63/1425H04L63/1483

Abstract

Claims (113)

1. A method, comprising:

selecting a subnet of a transaction network, the subnet comprising nodes and transactions represented by connections between the nodes, wherein the nodes in the subnet comprise a start node, an end node, and all nodes between the start node and the end node;

comparing, by a pattern matching algorithm, patterns of the connections between the nodes in the subnet with suspicious patterns of connections representing transactions between nodes in a database, wherein the suspicious patterns of connections are associated with fraudulent activity;

detecting at least one suspicious pattern of the connections between the nodes in the subnet based on the comparing;

walking nodes in the subnet based on the at least one suspicious pattern, wherein the walking comprises:

selecting the start node;

analyzing transactions carried out by the start node;

identifying, based on the analyzing the transactions carried out by the start node, a first set of nodes adjacent to the start node;

determining, based on connections representing transactions between the start node and the first set of nodes, that a first adjacent node of the first set of nodes is included in a first suspicious pattern from the at least one suspicious pattern;

selecting the first adjacent node in response to the determining; and

analyzing transactions carried out by the first adjacent node;

generating, based on the walking, a first node sequence of the subnet, the first node sequence including nodes selected based on the at least one suspicious pattern; and

outputting the first node sequence packaged with information associated with the included nodes.

2. The method of claim 1 , wherein the selecting the first adjacent node comprises:

calculating a magnitude of transactions associated with the first suspicious pattern;

comparing the magnitude to an importance threshold;

determining, based on the comparing, that the magnitude exceeds the importance threshold; and

determining, based on the determining that the magnitude exceeds the importance threshold, that the first suspicious pattern is a first important suspicious pattern.

3. The method of claim 2 , wherein the selecting the first adjacent node further comprises:

determining that a second suspicious pattern from the at least one suspicious pattern is a second important suspicious pattern;

determining that a second adjacent node of the first set of nodes is included in the second suspicious pattern;

calculating a first node importance of the first adjacent node and a second node importance of the second adjacent node; and

determining that the first node importance is greater than the second node importance.

4. The method of claim 1 , wherein the walking further includes updating an identifier registry to indicate that the first adjacent node has been selected.

5. The method of claim 1 , wherein the walking further comprises:

identifying, based on the analyzing the transactions of the first adjacent node, a second set of nodes adjacent to the first adjacent node, the second set of nodes comprising a second adjacent node and a third adjacent node;

calculating a first degree of the second adjacent node and a second degree of the third adjacent node, wherein the calculating performed in response to determining that:

the second adjacent node is included in a second suspicious pattern from the at least one suspicious pattern and not included in the first suspicious pattern;

the second suspicious pattern is not an important suspicious pattern; and

the third adjacent node is not included in either the first or second suspicious patterns;

determining, based on the calculating, that the second degree is greater than the first degree; and

selecting, based on the second degree being greater than the first degree, the third adjacent node.

6. The method of claim 1 , wherein the detecting includes:

receiving an example suspicious pattern from the suspicious patterns of connections;

performing, by the pattern matching algorithm, pattern matching based on the example suspicious pattern and the subnet;

identifying, based on the pattern matching, a potential suspicious pattern in the subnet; and

determining a pattern importance of the potential suspicious pattern.

7. The method of claim 1 , wherein the first suspicious pattern is a fan-out pattern.

8. A system comprising:

a memory; and

a central processing unit (CPU) coupled to the memory, the CPU configured to:

select a subnet of a transaction network, the subnet comprising nodes and transactions represented by connections between the nodes, wherein the nodes in the subnet comprise a start node, an end node, and all nodes between the start node and the end node;

compare, by a pattern matching algorithm, patterns of the connections between the nodes in the subnet with suspicious patterns of connections representing transactions between nodes in a database, wherein the suspicious patterns of connections form arrangements associated with fraudulent activity;

detect at least one suspicious pattern of the connections between the nodes in the subnet based on the comparing;

walk nodes in the subnet based on the at least one suspicious pattern, wherein the walking comprises:

selecting the start node;

analyzing transactions carried out by the start node;

identifying, based on the analyzing the transactions carried out by the start node, a first set of nodes adjacent to the start node;

determining, based on connections representing transactions between the start node and the first set of nodes, that a first adjacent node of the first set of nodes is included in a first suspicious pattern from the at least one suspicious pattern; and

selecting the first adjacent node in response to the determining;

generate, based on the walking, a first node sequence of the subnet, the first node sequence including nodes selected based on the at least one suspicious pattern; and

output the first node sequence packaged with information associated with the included nodes.

9. The system of claim 8 , wherein the selecting the first adjacent node comprises:

calculating a magnitude of transactions associated with the first suspicious pattern;

comparing the magnitude to an importance threshold;

determining, based on the comparing, that the magnitude exceeds the importance threshold; and

determining, based on the determining that the magnitude exceeds the importance threshold, that the first suspicious pattern is a first important suspicious pattern.

10. The system of claim 9 , wherein the selecting the first adjacent node further comprises:

determining that a second suspicious pattern from the at least one suspicious pattern is a second important suspicious pattern;

determining that a second adjacent node of the first set of nodes is included in the second suspicious pattern;

calculating a first node importance of the first adjacent node and a second node importance of the second adjacent node; and

determine that the first node importance is greater than the second node importance.

11. The system of claim 8 , wherein the walking further includes recording account information of an account associated with the first adjacent node.

12. The system of claim 8 , wherein the walking further comprises:

identifying, based on the analyzing the transactions of the first adjacent node, a second set of nodes adjacent to the first adjacent node, the second set of nodes comprising a second adjacent node and a third adjacent node;

calculating a first degree of the second adjacent node and a second degree of the third adjacent node, wherein the calculating performed in response to determining that:

the second adjacent node is included in a second suspicious pattern from the at least one suspicious pattern and not included in the first suspicious pattern;

the second suspicious pattern is not an important suspicious pattern;

the third adjacent node is not included in either the first or second suspicious patterns; and

determining, based on the calculating, that the second degree is greater than the first degree; and

selecting, based on the second degree being greater than the first degree, the third adjacent node.

13. The system of claim 8 , wherein the detecting includes:

receiving an example suspicious pattern from the suspicious patterns of connections;

performing pattern matching based on the example suspicious pattern and the subnet;

identifying, based on the pattern matching, a potential suspicious pattern in the subnet; and

determining a pattern importance of the potential suspicious pattern.

14. The system of claim 8 , wherein the first suspicious pattern is a fan-out pattern.

15. A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to:

select a subnet of a transaction network, the subnet comprising nodes and transactions represented by connections between the nodes, wherein the nodes in the subnet comprise a start node, an end node, and all nodes between the start node and the end node;

compare, by a pattern matching algorithm, patterns of the connections between the nodes in the subnet of suspicious patterns of connections representing transactions between nodes in a database, wherein the suspicious patterns of connections form arrangements associated with fraudulent activity;

detect at least one suspicious pattern of the connections between the nodes in the subnet based on the comparing, wherein the at least one suspicious pattern forms an arrangement of the connections between the nodes in the subnet matching an arrangement from the arrangements associated with the fraudulent activity;

walk nodes in the subnet based on the at least one suspicious pattern, wherein the walking comprises:

selecting the start node;

analyzing transactions carried out by the start node;

identifying, based on the analyzing the transactions carried out by the start node, a first set of nodes adjacent to the start node;

determining, based on connections representing transactions between the start node and the first set of nodes, that a first adjacent node of the first set of nodes is included in a first suspicious pattern from the at least one suspicious pattern; and

selecting the first adjacent node in response to the determining;

generate, based on the walking, a first node sequence of the subnet, the first node sequence including nodes selected based on the at least one suspicious pattern; and

output the first node sequence packaged with information associated with the included nodes.

16. The computer program product of claim 15 , wherein the selecting the first adjacent node comprises:

calculating a magnitude of transactions associated with the first suspicious pattern;

comparing the magnitude to an importance threshold;

determining, based on the comparison, that the magnitude exceeds the importance threshold; and

determining, based on the determining that the magnitude exceeds the importance threshold, that the first suspicious pattern is a first important suspicious pattern.

17. The computer program product of claim 16 , wherein the selecting the first adjacent node further comprises:

determining that a second suspicious pattern from the at least one suspicious pattern is a second important suspicious pattern;

determining that a second adjacent node of the first set of nodes is included in the second suspicious pattern;

calculating a first node importance of the first adjacent node and a second node importance of the second adjacent node; and

determine that the first node importance is greater than the second node importance.

18. The computer program product of claim 15 , wherein the walking further includes recording account information of an account associated with the first adjacent node.

19. The computer program product of claim 15 , wherein the walking further comprises:

identifying, based on the analyzing the transactions of the first adjacent node, a second set of nodes adjacent to the first adjacent node, the second set of nodes comprising a second adjacent node and a third adjacent node;

calculating a first degree of the second adjacent node and a second degree of the third adjacent node, wherein the calculating is performed in response to determining that:

the second adjacent node is included in a second suspicious pattern from the at least one suspicious pattern and not included in the first suspicious pattern;

the second suspicious pattern is not an important suspicious pattern; and

the third adjacent node is not included in either the first or second suspicious patterns;

determining, based on the calculating, that the second degree is greater than the first degree; and

selecting, based on the second degree being greater than the first degree, the third adjacent node.

20. The computer program product of claim 15 , wherein the detecting includes:

receiving an example suspicious pattern from the suspicious patterns of connections;

performing pattern matching based on the example suspicious pattern and the subnet;

identifying, based on the pattern matching, a potential suspicious pattern in the subnet; and

determining a pattern importance of the potential suspicious pattern.

Assignments (1)

Continuity (1)

References Cited (13)