Detecting and measuring risk with predictive models using content mining

• US 8,032,448 B2
• Filed: 10/04/2007
• Issued: 10/04/2011
• Est. Priority Date: 06/30/2000
• Status: Expired due to Term

• Current Assignee: Fair Isaac Corporation
• Original Assignee: Fair Isaac Corporation
• Inventors: Baker, James C., Shao, Xuhui, Dungca, Ricardo M., Hassibi, Khosrow M., Anderson, Russell, Dulany, Paul C., Milana, Joseph P., Peranich, Larry S.
• Primary Examiner(s): Kalinowski; Alexander
• Assistant Examiner(s): Chang; Edward
• Application Number:
  US11/867,602
• Publication Number:
  US 20090234683A1
• Time in Patent Office: 1,461 Days
• Field of Search: 705/38
• US Class Current: 705/38
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 40/03 Credit; Loans; Processing thereof
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: G06Q 40/12 Accounting

Abstract

Computer implemented methods and systems of processing transactions to determine the risk of transaction convert high categorical information, such as text data, to low categorical information, such as category or cluster IDs. The text data may be merchant names or other textual content of the transactions, or data related to a consumer, or any other type of entity which engages in the transaction. Content mining techniques are used to provide the conversion from high to low categorical information. In operation, the resulting low categorical information is input, along with other data, into a statistical model. The statistical model provides an output of the level of risk in the transaction. Methods of converting the high categorical information to low categorical clusters, of using such information, and other aspects of the use of such clusters are disclosed.

Claims

1. A system for detecting risk in a transaction, the system comprising:

a database of unique merchant names, each merchant name associated with a merchant cluster, each merchant name being textual data or other high categorical data;

at least one computing system implementing a transaction processing component that receives a transaction of a plurality of transactions between a consumer and a merchant, the transaction process component deriving transaction data from the transaction, the transaction processing component determining from the database a unique merchant identity for the merchant; and

at least one computing system implementing a statistical model that receives the derived transaction data and the unique entity identity to output a score indicative of a level of risk in the transaction;

wherein the statistical model uses clustered context vectors generated by;

selecting a plurality of high categorical information elements from the plurality of transactions,

linking each high categorical information element with a context vector in a vector space such that high categorical information elements that co-occur in the plurality of transactions have context vectors that are similarly oriented in the vector space, the co-occurrence representing that context vectors corresponding to the co-occurring high categorical information elements are less than a predetermined distance apart in the vector space for more than a predetermined number of transactions, and

clustering the context vectors of the high categorical information elements into a number of clusters that is less than number of high categorical information elements, each cluster being a low categorical information cluster.

2. A computer-implemented method of determining a level of risk in a transaction, the method comprising:

receiving, by at least one data processor, a transaction of a plurality of transactions between a first entity and a second entity, the first entity comprising a consumer associated with the transaction and the second entity comprising a merchant associated with the transaction;

deriving, by at least one data processor and by using a selecting process, high categorical information elements from the transaction, the high categorical information elements being text data;

determining, by at least one data processor, a low categorical information cluster that is closest in vector space to a context vector that is derived from context vectors of the high categorical information elements, the determining comprising;

linking, by at least one data processor, each high categorical information element with a context vector in a vector space such that high categorical information elements that co-occur in the plurality of transactions have context vectors that are similarly oriented in the vector space, the co-occurrence representing that context vectors corresponding to the co-occurring high categorical information elements are less than a predetermined distance apart in the vector space for more than a predetermined number of transactions, and

clustering, by at least one data processor, the context vectors of the high categorical information elements into a number of clusters that is less than number of high categorical information elements, each cluster being a low categorical information cluster; and

applying, by at least one data processor, the low categorical information cluster and data derived from the transaction to a predictive model to output the level of risk in the transaction to detect if the transaction is fraudulent.

3. The method of claim 2, wherein:

the high categorical information elements comprise entity notes associated with the transaction.

4. A computer implemented method for determining a level of risk of a transaction between a consumer and an entity, the method comprising:

storing, by at least one data processor, a plurality of entity clusters, the plurality of entity clusters determined from statistical co-occurrences of the entity identified in a plurality of transactions, the statistical co-occurrences identified using entity identifiers or other high categorical data, the entity comprising a merchant associated with the transaction, the plurality of entity clusters being generated by;

selecting a plurality of high categorical information elements from the plurality of transactions from the plurality of transactions,

linking each high categorical information element with a context vector in a vector space such that high categorical information elements that co-occur in the plurality of transactions have context vectors that are similarly oriented in the vector space, the co-occurrence representing that context vectors corresponding to the co-occurring high categorical information elements are less than a predetermined distance apart in the vector space for more than a predetermined number of transactions, and

clustering the context vectors of the high categorical information elements into a number of entity clusters that is less than number of high categorical information elements, each entity cluster being a low categorical information cluster;

receiving, by at least one data processor, data from said transaction between said consumer and said entity;

determining, by at least one data processor, an entity cluster of the plurality of entity clusters linked to the entity of the transaction based on at least one or the entity identifier and the other high categorical data; and

applying, by at least one data processor, the determined entity cluster in conjunction with data derived from the transaction to a predictive model, the predictive model outputting a level of risk of the transaction to detect if the transaction is fraudulent.

5. The method of claim 4, further comprising the step of:

estimating, by at least one data processor, a likelihood that the transaction is fraudulent.

6. The method of claim 4, further comprising the step of:

determining, by at least one data processor and in response to the level of risk, whether to approve the transaction, decline the transaction, or obtain additional information regarding the transaction or the consumer.

7. The method of claim 4, wherein the step of determining the entity cluster further comprises the steps of:

storing, by at least one data processor, a lookup table that links each entity cluster with at least one entity identity, each entity identity of the at least one entity identity being unique; and

applying, by at least one data processor, the entity identifier to the lookup table to determine the linked in entity cluster.

8. The method of claim 7, wherein each unique entity identity is derived from a plurality of raw entity identities in transaction data by performing a stemming operation and an equivalencing operation on the raw entity identities,

wherein the stemming operation comprises eliminating low information characters and words from the raw entity identities, the low information characters and words including blank spaces, punctuation, plurals, suffixes, conjugations and articles, and

wherein the equivalencing operation comprises considering synonyms, different spellings and different character cases for the same words to correspond to a same unique entity identity.

9. The method of claim 4, further comprising the steps of:

storing, by at least one data processor, for each entity cluster a risk factor indicative of likelihood that transactions with entities within the entity cluster are fraudulent; and

applying, by at least one data processor, the risk factor of the entity cluster to the predictive model.

10. The method of claim 9, wherein the risk factor is an estimate of a percentage of transactions at entities within the entity cluster that are fraudulent.

11. The method of claim 4, further comprising the steps of:

storing, by at least one data processor, a plurality of consumer clusters;

storing, by at least one data processor and for each combination of a consumer cluster and an entity cluster, a risk factor indicative of a likelihood that transactions by consumers in the consumer cluster with entities within the entity cluster are fraudulent;

determining, by at least one data processor, a current consumer cluster associated with the consumer; and

applying, by at least one data processor, the risk factor of the combination of the current consumer cluster and the entity cluster to the predictive model.

12. The method of claim 11, wherein the risk factor is an estimate of a percentage of transactions at entities within the entity cluster by consumers in the consumer cluster that are fraudulent.

13. The method of claim 4, further comprising the steps of:

storing, by at least one data processor, for each entity cluster at least one summarized transaction statistic, descriptive of transactions occurring at entities in the entity cluster; and

applying, by at least one data processor, the at least one summarized transaction statistic of the entity cluster to the predictive model.

14. The method of claim 13, wherein the at least one summarized transaction statistic are selected from a group consisting of:

average transaction amount; and

average transaction volume.

15. The method of claim 4, further comprising the steps of:

storing, by at least one data processor and for each of a plurality of consumer clusters, at least one summarized transaction statistic, descriptive of transactions by consumers in the consumer cluster; and

applying, by at least one data processor, the at least one summarized transaction statistic of the consumer cluster to the predictive model.

16. A computer implemented method for determining a level of risk of a transaction between a consumer and an entity, the method comprising:

storing, by at least one data processor, a plurality of entity clusters, the plurality of entity clusters determined from statistical co-occurrences of the entity identified in a plurality of transactions, the statistical co-occurrences identified using entity identifiers or other high categorical data, the entity comprising a merchant associated with the transaction, the plurality of entity clusters being generated by;

selecting a plurality of high categorical information elements,

linking each high categorical information element with a context vector in a vector space such that high categorical information elements that co-occur in the plurality of transactions have context vectors that are similarly oriented in the vector space, the co-occurrence representing that context vectors corresponding to the co-occurring high categorical information elements are less than a predetermined distance apart in the vector space for more than a predetermined number of transactions, and

clustering the context vectors of the high categorical information elements into a number of entity clusters that is less than number of high categorical information elements, each entity cluster being a low categorical information cluster;

receiving, by at least one data processor, data from said transaction between said consumer and said entity;

determining, by at least one data processor, an entity cluster of the plurality of entity clusters associated with the entity of the transaction based on at least one or the entity identifier and the other high categorical data;

determining, by at least one data processor, an affinity measure indicative of an affinity of a consumer to the entity cluster; and

applying, by at least one data processor, the affinity measure in conjunction with data derived from the transaction to a predictive model, the predictive model outputting the level of risk of the transaction to characterize whether the transaction is fraudulent,

wherein the affinity measure comprises at least one of transaction frequency, total currency volume, and average transaction amount, which are associated with transactions between the consumer and one or more entities that are included in the entity cluster.

17. The method of claim 16, wherein the step of determining the affinity measure of an affinity of the consumer to the entity cluster further comprises the step of:

determining, by at least one data processor, an affinity vector that represents the measured affinity of the consumer to each entity cluster of a plurality of entity clusters.

18. The method of claim 16, wherein the step of determining the affinity measure of an affinity of the consumer to the entity cluster further comprises the steps of:

determining, by at least one data processor, a consumer cluster associated with the consumer; and

determining, by at least one data processor, an affinity measure of the affinity of the consumer cluster to the entity cluster.

19. The method of claim 16, wherein the step of determining the affinity measure of an affinity of the consumer to the entity cluster further comprises the steps of:

determining, by at least one data processor, a consumer cluster associated with the consumer; and

determining, by at least one data processor, an affinity vector that characterizes at least one affinity measures for the consumer cluster in relation to each of a plurality of entity clusters, including the entity cluster of the entity of the transaction.

20. A method of determining the level of risk in a transaction by a consumer, the method comprising:

storing, by at least one data processor, a plurality of entity clusters, the plurality of entity clusters determined from statistical co-occurrences of the entity identities in a plurality of transactions, the entity identities being entity identifiers or other high categorical data, the plurality of entity clusters being generated by;

selecting a plurality of high categorical information elements from the plurality of transactions,

linking each high categorical information element with a context vector in a vector space such that high categorical information elements that co-occur in the plurality of transactions have context vectors that are similarly oriented in the vector space, the co-occurrence representing that context vectors corresponding to the co-occurring high categorical information elements are less than a predetermined distance apart in the vector space for more than a predetermined number of transactions, and

clustering the context vectors of the high categorical information elements into a number of entity clusters that is less than number of high categorical information elements, each entity cluster being a low categorical information cluster;

receiving, by at least one data processor, data of a current transaction between a consumer and an entity, the entity comprising a merchant associated with the current transaction;

determining, by at least one data processor, a predicted entity cluster in which the consumer is predicted to perform a future transaction based on transactions of the consumer prior to the current transaction;

determining, by at least one data processor, an actual entity cluster associated with the entity of the transaction based on the entity identity, wherein said entity identity is an entity identifier or other high categorical data;

determining, by at least one data processor, a measure of difference between the predicted entity cluster and the actual entity cluster; and

applying, by at least one data processor, the determined measure of difference in conjunction with data derived from the transaction to a predictive model, and outputting the level of risk of the transaction to detect if the transaction is fraudulent.

21. A method for implementation by one or more data processors comprising:

receiving, by at least one data processor, data characterizing a transaction of transactions between a consumer and merchant;

linking, by at least one data processor, the merchant with one of a plurality of pre-defined merchant clusters, the merchant clusters defined by a frequency at which merchants historically shared customers, the merchant clusters being generated by;

selecting a plurality of high categorical information elements from the transactions,

linking each high categorical information element with a context vector in a vector space such that high categorical information elements that co-occur in the transactions have context vectors that are similarly oriented in the vector space, the co-occurrence representing that context vectors corresponding to the co-occurring high categorical information elements are less than a predetermined distance apart in the vector space for more than a predetermined number of transactions, and

clustering the context vectors of the high categorical information elements into a number of merchant clusters that is less than number of high categorical information elements, each merchant cluster being a low categorical information cluster;

determining, by at least one data processor, an affinity of the customer to an associated merchant cluster;

generating, by at least one data processor, a risk score using at least one predictive model and at least the determined affinity; and

initiating, by at least one data processor, provision of data characterizing the generated score.

22. A method as in claim 21, wherein the linking comprises:

polling a merchant lookup table to match an identification for the merchant with the associated merchant cluster; and

wherein the determining comprises;

polling an affinity database to obtain the determined affinity.

23. A method as in claim 21, wherein the at least one predictive model further utilizes a profile for the consumer to generate the risk score.

24. A method as in claim 21, wherein the affinity is based on historical transaction data for the customer.

25. A method as in claim 24, wherein the historical transaction data used for the determined affinity is selected from a group comprising:

transaction frequency in the associated merchant cluster, transaction money volume in the associated merchant cluster, average transaction amount in the associated merchant cluster.

26. A method as in claim 21, wherein the consumer is associated with a consumer cluster, and wherein the determined affinity is based on an affinity statistic derived from the consumer cluster as a whole relative to the associated merchant cluster.

27. A method as in claim 21, wherein the determined affinity is based on an affinity vector which is a combination of an affinity measure for the consumer in relation to each of the plurality of pre-defined merchant clusters.

28. A method as in claim 21, wherein the at least one predictive model further utilizes a variable representing historical transactions that were deemed to have been fraudulent among the merchants in the associated merchant cluster.