×

Systems and user interfaces for dynamic and interactive investigation of bad actor behavior based on automatic clustering of related data in various data structures

  • US 9,367,872 B1
  • Filed: 12/22/2014
  • Issued: 06/14/2016
  • Est. Priority Date: 12/22/2014
  • Status: Active Grant
First Claim
Patent Images

1. A computer system comprising:

  • one or more non-transitory computer readable storage devices configured to store;

    a plurality of computer executable instructions including at least a clustering engine;

    one or more cluster data sources configured to store a plurality of data items, wherein the plurality of data items include at least one of;

    emails, electronic chat logs, or electronic trades; and

    a plurality of data cluster types, each data cluster type associated with a respective one of a plurality of data clustering strategies and a respective plurality of data cluster tagging rules; and

    one or more hardware computer processors in communication with the one or more non-transitory computer readable storage devices and configured to execute the plurality of computer executable instructions in order to;

    generate, by the clustering engine, a plurality of data clusters by at least;

    designating, for each of at least some of the plurality of data clustering strategies and based on the respective data clustering strategies, one or more data item seeds, wherein the one or more data items seeds are designated from the plurality of data items and accessed from the one or more cluster data sources;

    for each of the data items seeds, and based on the respective data clustering strategies;

    identifying one or more additional data items related to the data item seed, wherein the one or more additional data items are accessed from the one or more cluster data sources;

    combining the data item seed and the one or more additional data items to generate a data cluster; and

    associating the data cluster with a data cluster type associated with the data clustering strategy by which the seed was designated and the one or more additional data items were identified;

    store the plurality of data clusters in the one or more non-transitory computer readable storage devices;

    for each particular data cluster of the plurality of data clusters;

    access the particular data cluster from the one or more non-transitory computer readable storage devices;

    determine the data cluster type associated with the particular data cluster;

    associate one or more tags types with the particular data cluster based on the data cluster tagging rules associated with the determined data cluster type, wherein the one or more tags types include at least one of;

    trader, trading book, counterparty, or trading desk; and

    for each particular tag type of the one or more tags types, associate at least one tag value with the particular tag type, wherein each tag type and each associated tag value is expressed in the format tag type;

    tag value;

    generate user interface data for rendering an interactive user interface on a computing device, the interactive user interface including one or more selectable elements useable by a user for indicating a tag type;

    receive an indication of a first tag type via selection of one of the selectable elements by the user;

    automatically identify tag types associated with each of the plurality of data clusters that have the first tag type;

    automatically generate a plurality of first groups of the plurality of data clusters, wherein each of the first groups is associated with a different common tag value of the first tag type;

    automatically update the user interface data such that the interactive user interface further includes a plurality of first tiles, wherein each of the first tiles represents a different one of the first groups, and wherein;

    each of the first tiles displays a time-based graph showing events associated with data clusters associated with the respective common tag values of the respective first tiles,the time-based graphs represent a merger or aggregation of all data items associated with that particular tag value for that respective group of data clusters;

    each of the time-based graphs of the first tiles includes at least one common axis and a common scale for the at least one common axis;

    the interactive user interface further displays the first tiles in an orthogonal arrangement on the display with multiple tiles arranged in rows and columns on the display;

    the orthogonal tiles are separated by thin seams or lines, each tile having an indication of the number of alerts associated with the tag value for that particular tile and an indication of critical alerts for that particular tile;

    the tiles are arranged horizontally on the display in order of number of critical alerts;

    the first tiles have only one of two colors with tiles of one color being arranged at the top of the display and tiles of a different color being arranged generally at the bottom of the display, the colors representing a tag value having more or less critical alerts; and

    each tile is selectable by the user in the interactive user interface, the selection generating a second display of only the selected tile wherein the time-based graph is automatically resized to be displayed horizontally across the entire display while maintaining the common axis and common scale displayed in the previous display;

    receive an indication of a second tag type via selection of one of the selectable elements by the user;

    automatically identify tag types associated with each of the plurality of data clusters that have the second tag type;

    automatically generate a plurality of second groups of the plurality of data clusters, wherein each of the second groups is associated with a different common tag value of the second tag type; and

    automatically update the user interface data such that the plurality of first tiles in the interactive user interface are dynamically replaced with a plurality of second tiles, wherein each of the second tiles represents a different one of the second groups, and wherein;

    each of the second tiles displays a time-based graph showing events associated with data clusters associated with the respective common tag values of the respective second tiles, andeach of the time-based graphs of the second tiles includes at least one common axis and a common scale for the at least one common axis.

View all claims
  • 8 Assignments
Timeline View
Assignment View
    ×
    ×