IDENTIFYING RISK PATTERNS IN A MULTI-LEVEL NETWORK STRUCTURE

• US 20180308026A1
• Filed: 04/21/2017
• Published: 10/25/2018
• Est. Priority Date: 04/21/2017
• Status: Active Grant

• Current Assignee: Accenture Global Solutions Limited (Accenture PLC)
• Original Assignee: Accenture Global Solutions Limited (Accenture PLC)
• Inventors: SINHA, Nishant, SOBIECH, Karol, JUNGWIRTH, Michaela, O'SHEA, Oonagh, BORER, Robert, CHAKRABORTY, Arnab D.
• Granted Patent: US 10,592,837 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/288 Entity relationship models
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A device may receive, from sources, data objects identifying values relating to entities for which a risk indicator is to be determined, and may process the data objects to generate an analytical record that identifies relationships between values of different data objects. The device may determine, based on the analytical record, the risk indicator corresponding to one or more entities. The risk indicator may be determined based on at least one of: a comparison between the analytical record and a data structure that identifies expected values of one or more of the data objects; an identification of a group of the entities, and an outlier from the group of the entities based on the analytical record; or an identification of a change in behavior of the one or more entities based on the analytical record. The device may perform an action based on determining the risk indicator.

Claims

1. One or more devices, comprising:

one or more processors to;

receive a plurality of data objects from a plurality of sources,

the plurality of data objects identifying values relating to a plurality of entities for which a risk indicator is to be determined;

process the plurality of data objects to generate an analytical record,

the analytical record identifying relationships between respective values of different data objects of the plurality of data objects;

determine the risk indicator based on the analytical record,

the risk indicator corresponding to one or more entities of the plurality of entities, and

the risk indicator being determined based on one or more tests including at least one of;

a comparison between the analytical record and a data structure that identifies expected values of one or more data objects of the plurality of data objects,

an identification of a group of entities, of the plurality of entities, and an outlier from the group of entities based on the analytical record, or

an identification of a change in behavior of the one or more entities based on the analytical record; and

perform an action based on determining the risk indicator.

2. The one or more devices of claim 1, where the comparison between the analytical record and the data structure is performed based on a fuzzy matching of textual information of the analytical record to the expected values.

3. The one or more devices of claim 1, where the risk indicator indicates a predicted probability of occurrence of a condition with regard to the one or more entities.

4. The one or more devices of claim 1, where the identification of the change in behavior of the one or more entities is based on a change in a value associated with the one or more entities satisfying a threshold.

5. The one or more devices of claim 1, further comprising:

identifying respective variances of outputs of a plurality of tests including the one or more tests; and

selecting the one or more tests for determining the risk indicator based on the respective variances.

6. The one or more devices of claim 1, where selecting the one or more tests further comprises:

identifying a test, of the plurality of tests other than the one or more tests, that is not to be used to determine the risk indicator,

the test being identified based on the test having a higher variance than the one or more tests or based on a variance of the test satisfying a threshold.

7. The one or more devices of claim 1, where the risk indicator relates to at least two entities of the plurality of entities.

8. A method, comprising:

receiving, by a device, a plurality of data objects from a plurality of sources,

the plurality of data objects identifying values relating to a plurality of entities for which a risk indicator is to be determined;

processing, by the device, the plurality of data objects to generate an analytical record,

the analytical record identifying relationships between respective values of different data objects of the plurality of data objects;

determining, by the device, the risk indicator based on the analytical record,

the risk indicator identifying a probability of occurrence of a condition with regard to one or more entities of the plurality of entities, and

the risk indicator being determined based on one or more tests including at least one of;

a comparison between the analytical record and a data structure that identifies expected values of one or more data objects of the plurality of data objects,

an identification of a group of entities, of the plurality of entities, and an outlier from the group of entities based on the analytical record, or

an identification of a change in behavior of the one or more entities based on the analytical record; and

automatically performing, by the device, an action with regard to the one or more entities based on determining the risk indicator.

9. The method of claim 8, where the one or more entities includes a particular entity;

and

where the risk indicator is determined based on respective scores associated with other entities of the one or more entities,

the respective scores being determined based on the one or more tests, and

the respective scores identifying levels of contribution of the other entities to a risky behavior pattern associated with the particular entity.

10. The method of claim 9, where the other entities are associated with respective interactions with the particular entity,

the respective scores being determined based on the respective interactions.

11. The method of claim 9, where the other entities are associated with respective risk indicators,

the risk indicator associated with the particular entity having a value higher than values of the respective risk indicators;

and

where automatically performing the action comprises;

automatically performing the action with regard to the particular entity based on the risk indicator associated with the particular entity having a value higher than the values of the respective risk indicators.

12. The method of claim 8, where the relationships between the respective values are based on predefined relationships between corresponding entities of the plurality of entities.

13. The method of claim 12, where the risk indicator relates to at least two entities of the plurality of entities,

the at least two entities being associated with different hierarchical levels based on the predefined relationships.

14. The method of claim 8, where the risk indicator identifies a likelihood of fraud perpetrated by the one or more entities.

15. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors, cause the one or more processors to;

receive a plurality of data objects from a plurality of sources,

the plurality of data objects identifying values relating to a plurality of entities for which a risk indicator is to be determined;

process the plurality of data objects to generate an analytical record,

the analytical record identifying relationships between respective values of different data objects of the plurality of data objects;

determine the risk indicator based on the analytical record,

the risk indicator identifying a probability of occurrence of a condition with regard to one or more entities of the plurality of entities, and

the risk indicator being determined based on one or more tests including at least one of;

a comparison between the analytical record and a data structure that identifies expected values of one or more objects of the plurality of data objects,

an identification of a group of entities, of the plurality of entities, and an outlier from the group of entities based on the analytical record, or

an identification of a change in behavior of the one or more entities based on the analytical record; and

automatically perform an action with regard to the one or more entities based on determining the risk indicator.

16. The non-transitory computer-readable medium of claim 15, where the one or more entities includes a particular entity;

and

where the risk indicator is determined based on respective risk indicators associated with other entities of the one or more entities,

the respective risk indicators being determined based on the one or more tests.

17. The non-transitory computer-readable medium of claim 15, where the risk indicator indicates a predicted probability of occurrence of a condition with regard to the one or more entities.

18. The non-transitory computer-readable medium of claim 15, where the risk indicator identifies a likelihood of fraud perpetrated by the one or more entities.

19. The non-transitory computer-readable medium of claim 15, where the comparison between the analytical record and the data structure is performed based on a fuzzy matching of textual information of the analytical record to the expected values.

20. The non-transitory computer-readable medium of claim 15, where the one or more entities includes a particular entity;

and

where the risk indicator is determined based on respective risk contribution scores associated with other entities of the one or more entities,

the respective risk contribution scores being determined based on the one or more tests, and

the respective risk contribution scores identifying levels of contribution of the other entities to a risky behavior pattern associated with the particular entity.