Systems and user interfaces for dynamic and interactive investigation based on automatic malfeasance clustering of related data in various data structures

• US 10,275,778 B1
• Filed: 12/30/2015
• Issued: 04/30/2019
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Maag, Peter, O'Brien, Tom, Cross, Phil, Tosirisuk, Sarun Peter
• Primary Examiner(s): Hamilton, Lalita M
• Application Number:
  US14/984,505
• Time in Patent Office: 1,217 Days
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/04 Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange

Abstract

In various embodiments, systems, methods, and techniques are disclosed for generating a collection of clusters of related data from a seed to assist in detection of financial malfeasance. Seeds may be generated based on seed generation strategies or rules. Clusters may be generated by, for example, retrieving a seed, adding the seed to a first cluster, retrieving a clustering strategy or rules, and adding related data (such as trades, emails or chat messages) and/or data entities to the cluster based on the clustering strategy. Various cluster scores may be generated based on attributes of data in a given cluster, and the clusters may be displayed and ranked based on their scores. Various embodiments may enable an analyst to review clusters of trades, emails and/or chat messages that are the most likely to reveal financial malfeasance.

Claims

1. A computer-implemented method comprising:

accessing properties associated with a first transaction data item;

identifying, from a plurality of transaction data items, the first transaction data item based at least on the properties;

determining a trader identifier associated with the first transaction data item;

determining a first electronic communication that was sent or received by a first trader associated with the trader identifier;

determining that the first electronic communication satisfies at least one of;

the first electronic communication comprising at least one less of a particular participant than a previous electronic communication associated with the first electronic communication,

the first electronic communication comprising at least one additional participant than another previous electronic communication associated with the first electronic communication, wherein the additional participant is determined to be a supervisor of the first trader, or

the first electronic communication comprising a participant that is associated with an external personal account of the first trader;

designating the first electronic communication as a seed; and

generating a data item cluster from a plurality of transaction-related data items based on the seed, wherein a data item of the data item cluster comprises information associated with at least one of;

a trader, an electronic communication, a transaction, or an institution.

2. The computer-implemented method of claim 1, wherein identifying the first transaction data item further comprises:

accessing a time property from the properties, the time property associated with an execution time of the first transaction data item; and

determining the time property falls within a period of time.

3. The computer-implemented method of claim 1, wherein identifying the first transaction data item further comprises:

determining a second trader identifier associated with the first transaction data item, wherein the second trader identifier and the trader identifier are on opposite sides of a trade associated with the first transaction data item; and

determining that each of the second trader identifier and the trader identifier are associated with respective traders that work for a same institution.

4. The computer-implemented method of claim 1, wherein identifying the first transaction data item further comprises identifying a property of the properties that indicates at least one of:

an unapproved trade, a late booked trade, a canceled trade, an after hours trade, or an unmatched trade.

5. The computer-implemented method of claim 1, wherein determining the first electronic communication further comprises:

determining a delivery time associated with the first electronic communication; and

selecting the first electronic communication, from a plurality of electronic communications, based at least on the delivery time being within a period of time before or after an execution time of the first transaction data item.

6. The computer-implemented method of claim 1, further comprising:

designating the first transaction data item as a second seed;

determining, from the plurality of transaction-related data items, a second transaction-related data item associated with the second seed; and

adding the second transaction-related data item to the data item cluster.

7. A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed by a computer system, configure the computer system to perform operations comprising:

accessing properties associated with a first transaction data item;

identifying the first transaction data item based at least on the properties;

determining a trader identifier associated with the first transaction data item;

determining a first electronic communication that was sent or received by a first trader associated with the trader identifier;

determining that the first electronic communication satisfies at least one of;

the first electronic communication comprising at least one less of a particular participant than a previous electronic communication associated with the first electronic communication,

the first electronic communication comprising at least one additional participant than another previous electronic communication associated with the first electronic communication, wherein the additional participant is determined to be a supervisor of the first trader, or

the first electronic communication comprising a participant that is associated with an external personal account of the first trader;

designating the first electronic communication as a seed; and

generating a data item cluster from a plurality of transaction-related data items based on the seed, wherein a data item of the data item cluster comprises information associated with at least one of;

a trader, an electronic communication, a transaction, or an institution.

8. The non-transitory computer-readable storage medium of claim 7, wherein identifying the first transaction data item further comprises:

accessing a time property from the properties, the time property associated with an execution time of the first transaction data item; and

determining the time property falls within a period of time when a trader associated with the trader identifier was logged out of a computing device.

9. The non-transitory computer-readable storage medium of claim 7, wherein the computer-executable instructions further configure the computer system to perform operations comprising:

querying an employee data source for employee data associated with at least one of;

the first trader or the additional participant; and

determining the additional participant is the supervisor of the first trader using the employee data.

10. The non-transitory computer-readable storage medium of claim 7, wherein identifying the first transaction data item further comprises:

determining a second trader identifier associated with the first transaction data item, wherein the second trader identifier and the trader identifier are on opposite sides of a trade associated with the first transaction data item; and

determining that each of the second trader identifier and the trader identifier are associated with respective traders that work for a same institution.

11. The non-transitory computer-readable storage medium of claim 7, wherein identifying the first transaction data item further comprises identifying a property of the properties that indicates at least one of:

an unapproved trade, a late booked trade, a canceled trade, an after hours trade, or an unmatched trade.

12. The non-transitory computer-readable storage medium of claim 7, wherein determining the first electronic communication further comprises:

determining a delivery time associated with the first electronic communication; and

selecting the first electronic communication, from a plurality of electronic communications, based at least on the delivery time being within a predetermine period of time before or after an execution time of the first transaction data item.

13. The non-transitory computer-readable storage medium of claim 7, wherein the computer-executable instructions further configure the computer system to perform operations comprising:

designating the first transaction data item as a second seed;

determining, from the plurality of transaction-related data items, a second transaction-related data item associated with the second seed; and

adding the second transaction-related data item to the data item cluster.

14. A computer system comprising:

one or more computer readable storage devices configured to store;

a plurality of transaction-related data items, wherein a data item of the plurality of transaction-related data items comprises information associated with at least one of;

a trader, an electronic communication, a transaction, or an institution; and

one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute computer executable instructions in order to cause the one or more hardware computer processors to;

access properties associated with a first transaction data item;

identify the first transaction data item based at least on the properties;

determine a trader identifier associated with the first transaction data item;

determine a first electronic communication that was sent or received by a first trader associated with the trader identifier;

determine that the first electronic communication satisfies at least one of;

the first electronic communication comprising at least one less of a particular participant than a previous electronic communication associated with the first electronic communication,

the first electronic communication comprising at least one additional participant than another previous electronic communication associated with the first electronic communication, wherein the additional participant is determined to be a supervisor of the first trader, or

the first electronic communication comprising a participant that is associated with an external personal account of the first trader;

designate the first electronic communication as a seed; and

generate a data item cluster from the plurality of transaction-related data items based on the seed.

15. The computer system of claim 14, wherein the one or more hardware computer processors are further configured to:

query an employee data source for employee data associated with at least one of;

the first trader or the additional participant; and

determine the additional participant is the supervisor of the first trader using the employee data.

16. The computer system of claim 14, wherein identifying the first transaction data item further comprises:

accessing a time property from the properties, the time property associated with an execution time of the first transaction data item; and

determining the time property falls within a period of time when the first trader was logged out of a computing device.

17. The computer system of claim 14, wherein identifying the first transaction data item further comprises:

determining a second trader identifier associated with the first transaction data item, wherein the second trader identifier and the trader identifier are on opposite sides of a trade associated with the first transaction data item; and

determining that each of the second trader identifier and the trader identifier are associated with respective traders that work for a same institution.

18. The computer system of claim 14, wherein identifying the first transaction data item further comprises identifying a property of the properties that indicates at least one of:

an unapproved trade, a late booked trade, a canceled trade, an after hours trade, or an unmatched trade.

19. The computer system of claim 14, wherein determining the first electronic communication further comprises:

determining a delivery time associated with the first electronic communication; and

selecting the first electronic communication, from a plurality of electronic communications, based at least on the delivery time being within a predetermine period of time before or after an execution time of the first transaction data item.

20. The computer system of claim 14, wherein the one or more hardware computer processors are further configured to:

designate the first transaction data item as a second seed;

determine, from the plurality of transaction-related data items, a second transaction-related data item associated with the second seed; and

add the second transaction-related data item to the data item cluster.