Method and system for advanced scenario based alert generation and processing

• US 7,693,810 B2
• Filed: 03/04/2003
• Issued: 04/06/2010
• Est. Priority Date: 03/04/2003
• Status: Active Grant

• Current Assignee: Mantas, Inc. (Oracle Corporation)
• Original Assignee: Mantas, Inc. (Oracle Corporation)
• Inventors: Grote, Linda Hagen, Hayden, James Joseph, Brooks, William Edgar Jr., Donoho, Steven Kirk, Dybala, Tomasz Grzegorz
• Primary Examiner(s): Vincent; David R
• Assistant Examiner(s): BUSS, BENJAMIN J
• Application Number:
  US10/379,425
• Publication Number:
  US 20040177053A1
• Time in Patent Office: 2,590 Days
• Field of Search: 706/12, 706 46- 48, 706/925, 706/934, 706/10, 700/49, 707/6, 707/100, 707/104.1, 364/550, 705 35- 36, 705/4, 705 38- 39, 705/1, 455/410, 709/224, 726 22- 23
• US Class Current: 706/48
• CPC Class Codes: G06Q 10/04 Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem" market predictions or forecasting for commercial activities G06Q30/0202
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes

Abstract

A computer based method and system generates alerts based on the detection of an advanced scenario in a data set. The system and method may take data related to events and entities, transform the data, and apply advanced scenarios to the data to produce matches that reflect the occurrence of an advanced scenario and the behavior of interest. The advanced scenarios can be defined to cover specific product lines and services, lines of businesses, and combinations thereof. The advanced scenarios can be defined to be indicative of a behavior class, or a specific behavior which is part of a behavior class. Alerts produced by the system can be grouped, prioritized and routed such that the appropriate users are notified in a timely manner. The system and method can be applied to a variety of industries including financial and health care, and can detect both illicit and licit behaviors of interest.

Claims

1. A computer-based method for generating alerts to a behavior as represented in data, the method comprising:

receiving financial data from at least one source, wherein the received financial data comprises data representative of a plurality of transactions and a plurality of entities, wherein the plurality of transactions and the plurality of entities are not predetermined to be related;

identifying a behavior of interest that comprises one or more sequence detection requirements;

determining, by a computing device, whether one or more groups of the transactions and the entities collectively satisfy at least one of the sequence detection requirements;

if so, assigning a corresponding priority to each group by, for each group;

determining a match score value associated with the group, and

determining the priority for the group by one or more of the following;

summing the match score and a first value associated with the behavior of interest,

summing the match score and a second value, wherein the second value is based on a graduated scale, and

summing the match score and a third value, wherein the third value is based on one or more prior occurrences of the behavior of interest within a period of time; and

generating an alert comprising one or more of the groups and the corresponding priority.

2. The method of claim 1, wherein determining whether one or more groups of the transactions and the entities collectively satisfy at least one of the sequence detection requirements comprises performing:

link analysis to establish relationships between the plurality of events and the plurality of entities.

3. The method of claim 2, wherein determining whether one or more relationships exist further comprises using rules-based detection to determine whether constraints are met.

4. The method of claim 2, wherein determining whether one or more groups of the transactions and the entities collectively satisfy at least one of the sequence detection requirements further comprises:

determining a focus;

identifying one or more highlights of the events and entities that correspond to a plurality of relationships; and

identifying one or more parameters that may be varied by a user to set a relationship match and confirm whether the specified behavior of interest is present from the identified relationships.

5. The method of claim 1, wherein generating an alert comprises:

sending a user a data summary; and

providing the user with one or more dynamic links to information associated with the alert.

6. The method of claim 5, further comprising:

identifying one or more past alerts associated with one or more of the identified events and the identified entities, wherein the past alerts are created prior to the generated alert; and

providing the one or more past alerts to a user.

7. The method of claim 1, wherein generating an alert comprises:

sending a user a data summary;

receiving, from the user, a request for alert details associated with the data summary; and

sending the alert details to the user.

8. The method of claim 1, wherein generating an alert comprises:

receiving, from a user, a request to change a status associated with the alert from a first status to a second status, wherein the request comprises supporting information; and

changing the status of the alert from the first status to the second status.

9. The method of claim 1, wherein generating an alert comprises:

providing history information associated with one or more of the identified events and the identified entities to a user; and

providing one or more past alert transactions associated with one or more of the identified events and the identified entities to the user.

10. The method of claim 1, wherein generating an alert comprises:

providing one or more alert visualizations associated with identified events and the identified entities to a user.

11. The method of claim 1, further comprising:

assigning a score to each group;

determining an alert value associated with the alert based on the assigned score; and

if the alert value is below a threshold value, automatically closing the alert.

12. A computer-based method of generating alerts to a behavior as represented in data, the method comprising:

receiving financial data from at least one source, wherein the received financial data comprises data representative of a plurality of transactions and a plurality of entities, wherein the plurality of transactions and the plurality of entities are not predetermined to be related;

accessing a scenario library to identify a detection algorithm for identifying a behavior of interest;

identifying a group of potentially significant transactions by analyzing each transaction in the received data;

applying the detection algorithm to determine whether the potentially significant transactions in the group collectively exhibit a time-based pattern that is indicative of the behavior of interest;

if so, assigning a priority to the group by;

determining a match score value associated with the group, and

determining the priority for the group by one or more of the following;

summing the match score and a first value associated with the behavior of interest,

summing the match score and a second value, wherein the second value is based on a graduated scale, and

summing the match score and a third value, wherein the third value is based on one or more prior occurrences of the behavior of interest within a period of time; and

generating an alert comprising;

the potentially significant transactions in the group,

the entities engaged in the potentially significant transactions,

the priority,

a focus,

one or more highlights of the events and entities that correspond to each identified relationship, and

one or more parameters that may be varied by a user to set a relationship match and confirm whether the specified behavior of interest is present from identified relationships.

13. The method of claim 12, wherein applying the detection algorithm to determine whether the potentially significant transactions in the group collectively exhibit a time-based pattern comprises:

performing sequence matching to identify one or more sequences in the plurality of events; and

relating the identified sequences to the plurality of entities.

14. The method of claim 13, wherein the analyzing also comprises using rules-based detection to determine whether constraints are met.

15. The method of claim 12, wherein applying the detection algorithm to determine whether the potentially significant transactions in the group collectively exhibit a time-based pattern comprises:

automatically analyzing a first plurality of events by a first entity to determine whether a change in behavior occurred; and

if a change in behavior occurred, automatically analyzing a second plurality of events by a second entity to determine whether the change of behavior occurred.

16. The method of claim 12, wherein assigning a priority to the group further comprises prioritizing the groups based on one or more of the following adjustable parameters:

an amount;

a number of events;

a type of event;

a geographic location associated with an entity;

a geographic location associated with an event;

one or more parties involved in an event;

a product line; and

a line of business.

17. The method of claim 12, wherein applying the detection algorithm to determine whether the potentially significant transactions in the group collectively exhibit a time-based pattern comprises:

applying link analysis to establish one or more pairs of linked events;

linking at least a portion of the pairs into a web of interrelated events; and

applying sequence matching to the interrelated events to determine whether the events occurred in a sequence corresponding to a behavior of interest.

18. The method of claim 12, further comprising:

routing the alert to one or more recipients based on the assigned priority.

19. A system for generating alerts to a behavior as represented in data, the system comprising:

a processor; and

a processor readable storage medium in communication with the processor,

wherein the processor readable storage medium contains one or more programming instructions for;

receiving financial data from at least one source, wherein the received financial data comprises a plurality of transactions and a plurality of entities, wherein the plurality of transactions and the plurality of entities are not predetermined to be related;

identifying a descriptive element that comprises one or more sequence detection requirements;

determining, whether one or more groups of the transactions and the entities collectively satisfy at least one of the sequence detection requirements;

if so, assigning a corresponding priority to each group by, for each group;

determining a match score value associated with the group, and

determining the priority for the group by one or more of the following;

summing the match score and a first value associated with the behavior of interest,

summing the match score and a second value, wherein the second value is based on a graduated scale, and

summing the match score and a third value, wherein the third value is based on one or more prior occurrences of the behavior of interest within a period of time; and

generating an alert comprising one or more of the groups and the corresponding priority.

20. The system of claim 19, wherein the one or more programming instructions for determining whether one or more groups of the transactions and the entities collectively satisfy at least one of the sequence detection requirements further comprise one or more programming instructions for:

determining a focus;

identifying one or more highlights of the events and entities that correspond to a plurality of relationships; and

identifying one or more parameters that may be varied by a user to set a relationship match and confirm whether the specified behavior of interest is present from the identified relationships.

21. The system of claim 19, wherein the one or more programming instructions for generating an alert comprise one or more programming instructions for:

sending a user a data summary; and

providing the user with one or more dynamic links to information associated with the alert.

22. The system of claim 19, wherein the one or more programming instructions further comprise one or more programming instructions for:

identifying one or more past alerts associated with one or more of the identified events and the identified entities, wherein the past alerts are created prior to the generated alert; and

providing the one or more past alerts to a user.

23. The system of claim 19, wherein the one or more programming instructions further comprise one or more programming instructions for:

assigning a score to each group;

determining an alert value associated with the alert based on the assigned score; and

if the alert value is below a threshold value, automatically closing the alert.

24. A computer-based method for generating alerts to a behavior as represented in data, the method comprising:

receiving a first set of financial data from a first source, wherein the first set of financial data comprises a first plurality of transactions and a first plurality of entities, wherein the first plurality of transactions and the first plurality of entities are not predetermined to be related;

accessing a scenario library to identify a detection algorithm for identifying a behavior of interest;

applying the detection algorithm to identify a second plurality of transactions and a second plurality of entities in the first set of financial data that are collectively indicative of the behavior of interest;

determining whether one or more relationships exist among the identified second plurality of transactions and the identified second plurality of entities from the first set of financial data;

if so, generating a first alert having a first priority, wherein the first priority is determined by;

determining a first match score value, and

determining a sum of one or more of the following;

the first match score and a first value associated with the behavior of interest,

the first match score and a second value, wherein the second value is based on a graduated scale, and

the first match score and a third value, wherein the third value is based on one or more prior occurrences of the behavior of interest within a period of time;

receiving a second set of financial data from a second source, wherein the second set of financial data comprises a third plurality of transactions and a third plurality of entities, wherein the third plurality of transactions and the third plurality of entities are not predetermined to be related;

combining the first set of financial data and the second set of financial data to produce an updated set of financial data;

applying the detection algorithm to identify a fourth plurality of transactions and a fourth plurality of entities in the updated set of financial data that are collectively indicative of the behavior of interest;

determining whether one or more relationships exist among the fourth plurality of transactions and the fourth plurality of entities from the updated set of financial data;

if so, generating a second alert having a second priority;

prioritizing the first alert and the second alert based on the first priority and the second priority; and

providing a user an alert summary comprising one or more of the first alert and the second alert.