System and method for remote activity detection

• US 9,396,438 B2
• Filed: 04/24/2015
• Issued: 07/19/2016
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Trove Predictive Data Science LLC
• Original Assignee: Trove Predictive Data Science LLC
• Inventors: McConky, Katie, Viens, Richard, Stotz, Adam, Galoppo, Travis, Fusillo, Thomas
• Primary Examiner(s): Ly, Anh
• Application Number:
  US14/695,243
• Publication Number:
  US 20150227842A1
• Time in Patent Office: 452 Days
• Field of Search: 707/748, 707/769, 707/754, 707/715, 707/E17.014, 707/E17.017, 707/E17.044, 707/E17.108, 707/E17.022, 709/224, 709/206, 709/203, 709/230, 709/232, 709/226, 709/227, 709/225, 709/217, 709/218, 709/219, 705/14.53, 705/37, 705/412, 705/1, 705/30, 705/317, 705/347, 705/400
• US Class Current: 1/1
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 18/23213 with fixed number of clusters, e.g. K-means clustering
• CPC Class Codes: G06F 18/24323 Tree-organised classifiers
• CPC Class Codes: G06F 2218/16 by matching signal segments
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 65/60 Network streaming of media packets

Abstract

A system and method is disclosed for a remote activity detection process using an analysis of data streams of an entity such as an end user and/or a customer. In an embodiment, the detection process uses the data stream analysis to evaluate an entity'"'"'s potential involvement in an activity based on individual measures for the entity such as comparison of the entity'"'"'s data stream to the entity'"'"'s peers, comparison of the entity'"'"'s data stream to historical information for the entity, and/or comparison of the entity'"'"'s data stream to data streams for a known second entity involved in the activity. The detection process may also use other information available which may impact the data points in a data stream, such as premises attributes associated with an entity, demographic attributes for the entity, financial attributes for the entity, and system alerts.

Claims

1. A method for detecting the presence of an activity, the method comprising the steps of:

(a) calculating, using a processor, for each entity in a plurality of entities;

(i) a peer comparison score for the activity for the entity;

(ii) a self comparison score for the activity for the entity;

(iii) a truth comparison score for the activity for the entity; and

(iv) an activity confidence score for the entity;

and

(b) selecting, using the processor, a first entity from the plurality of entities, wherein the selecting is based at least in part on the activity confidence score for the first entity,

wherein the calculation of the self comparison score includes the steps of;

(A) generating, using the processor, an individual model for the first entity wherein the individual model is based on at least one of a data stream for the first entity and an impact variable for the first entity;

(B) calculating, using the processor, a forecast data stream for the first entity, wherein the forecast data stream is based at least in part on the individual model for the first entity;

(C) calculating a difference, using the processor, between the individual model for the first entity and the forecast data stream for the first entity;

(D) calculating, using the processor, a time period for which the calculated difference is greater than a predetermined threshold; and

(E) assigning, using the processor, the self comparison score to the first entity based on at least one of the calculated difference and the time period;

and wherein the calculation of the truth comparison score includes the steps of;

(F) providing a ground truth data stream for the activity;

(G) comparing, using the processor, the ground truth data stream with a data stream model for the first entity; and

(H) assigning a truth comparison score to the first entity based at least in part on a result of the comparison of the ground truth data stream with the data stream model for the first entity.

2. The method of claim 1 further comprising the steps of:

(c) transmitting to an investigation unit an identifier for the first entity;

(d) receiving from the investigation unit information regarding an analysis of the activity associated with the first entity; and

(e) modifying, using the processor, the activity confidence score for the first entity based on the analysis of the activity associated with the first entity.

3. The method of claim 1 wherein the calculation of the activity confidence score is based at least in part on one or more of the peer comparison score, the self comparison score, and the truth comparison score.

4. The method of claim 1 wherein the calculation of the peer comparison score includes determining a peer group for each entity in the plurality of entities.

5. The method of claim 1 wherein the calculation of the peer comparison score includes the steps of:

(I) generating, using the processor, an individual model for the first entity wherein the individual model is based on at least one of a data stream for the first entity and an impact variable for the first entity;

(J) assigning, using the processor, the first entity to one or more clusters in a first set of clusters, wherein the assigning to the one or more clusters in the first set of clusters is based on the individual model for the first entity;

(K) assigning, using the processor, the first entity to one or more clusters in a second set of clusters, wherein the assigning to the one or more clusters in the second set of clusters is based on a set of external data for the first entity;

(L) correlating, using the processor, the assigning of the first entity to one or more clusters in the first set of clusters with the assigning of the first entity to one or more clusters in the second set of clusters, wherein the results of the correlation are used to refine the assigning of the first entity to the second set of clusters; and

(M) assigning, using the processor, the first entity to at least one peer group, wherein the assigning to the at least one peer group is based at least in part on the results of the correlation.

6. The method of claim 5 wherein the data stream for the first entity comprises a time series of data points associated with the activity for the first entity.

7. The method of claim 5 wherein the impact variable for the first entity is selected from the group consisting of:

an hour of the day, a day of the week, a temperature value local to the first entity, a cloud cover value local to the first entity, a humidity value local to the first entity, a minutes of sun value local to the first entity, a holiday schedule for the first entity, a television schedule for the first entity, and combinations thereof.

8. The method of claim 5 wherein the external data for the first entity is selected from the group consisting of:

premises attributes associated with the first entity, demographic attributes for the first entity, financial attributes for the first entity, and combinations thereof.

9. The method of claim 5 further comprising the steps of:

(N) assigning other entities of the plurality of entities to one or more peer groups;

(O) calculating, using the processor, a first normalcy score for the first entity in a first peer group, wherein the calculating of the first normalcy score includes comparing the data stream for the first entity with the corresponding data streams of other entities assigned to the first peer group;

(P) calculating, using the processor, a second normalcy score for the first entity in a second peer group, wherein the calculating of the second normalcy score includes comparing the data stream for the first entity with the corresponding data streams of the other entities in the second peer group;

(Q) calculating, using the processor, a combined normalcy score for the first entity, wherein the combined normalcy score is based on the first normalcy score and the second normalcy score; and

(R) normalizing, using the processor, the combined normalcy score for the first entity.

10. A system for detecting the presence of an activity, the system comprising:

a memory device for storing entity information for each of a plurality of entities;

a processor for calculating for each entity in the plurality of entities;

(i) a peer comparison score for the activity for the entity;

(ii) a self comparison score for the activity for the entity;

(iii) a truth comparison score for the activity for the entity; and

(iv) an activity confidence score for the entity;

and

said processor for selecting a first entity from the plurality of entities, wherein the selecting is based at least in part on the activity confidence score for the first entity,

wherein the processor for the calculation of the self comparison score includes;

(A) circuitry for generating an individual model for the first entity wherein the individual model is based on at least one of a data stream for the first entity and an impact variable for the first entity;

(B) circuitry for calculating a forecast data stream for the first entity, wherein the forecast data stream is based at least in part on the individual model for the first entity;

(C) circuitry for calculating a difference between the individual model for the first entity and the forecast data stream for the first entity;

(D) circuitry for calculating a time period for which the calculated difference is greater than a first predetermined threshold; and

(E) circuitry for assigning the self comparison score to the first entity based on at least one of the calculated difference and the time period;

and wherein the processor for the calculation of the truth comparison score includes;

(F) circuitry for comparing a ground truth data stream for the activity with a data stream model for the first entity; and

(G) circuitry for assigning a truth comparison score to the first entity based at least in part on a result of the comparison of the ground truth data stream with the data stream model for the first entity.

11. The system of claim 10 further comprising:

a transmitter for transmitting to an investigation unit an identifier for the first entity;

a receiver for receiving from the investigation unit information regarding an analysis of the activity associated with the first entity; and

said processor for modifying the activity confidence score for the first entity based on the analysis of the activity associated with the first entity.

12. The system of claim 10 wherein the calculation of the activity confidence score is based at least in part on one or more of the peer comparison score, the self comparison score, and the truth comparison score.

13. The system of claim 10 wherein the calculation of the peer comparison score includes:

(H) circuitry for generating an individual model for the first entity wherein the individual model is based on at least one of a data stream for the first entity and an impact variable for the first entity;

(I) circuitry for assigning the first entity to one or more clusters in a first set of clusters, wherein the assigning to the one or more clusters in the first set of clusters is based on the individual model for the first entity;

(J) circuitry for assigning the first entity to one or more clusters in a second set of clusters, wherein the assigning to the one or more clusters in the second set of clusters is based on a set of external data for the first entity;

(K) circuitry for correlating the assigning of the first entity to one or more clusters in the first set of clusters with the assigning of the first entity to one or more clusters in the second set of clusters, wherein the results of the correlation are used to refine the assigning of the first entity to the second set of clusters; and

(L) circuitry for assigning the first entity to at least one peer group, wherein the assigning to the at least one peer group is based at least in part on the results of the correlation.

14. The system of claim 13 wherein the processor for the calculation of the peer comparison score further includes:

(M) circuitry for assigning other entities of the plurality of entities to one or more peer groups;

(N) circuitry for calculating a first normalcy score for the first entity in a first peer group, wherein the calculating of the first normalcy score includes comparing the data stream for the first entity with the corresponding data streams of other entities assigned to the first peer group;

(O) circuitry for calculating a second normalcy score for the first entity in a second peer group, wherein the calculating of the second normalcy score includes comparing the data stream for the first entity with the corresponding data streams of the other entities in the second peer group;

(P) circuitry for calculating a combined normalcy score for the first entity, wherein the combined normalcy score is based on the first normalcy score and the second normalcy score; and

(Q) circuitry for normalizing the combined normalcy score for the first entity.

15. A machine-readable medium having stored thereon a plurality of executable instructions to be executed by a processor, the plurality of executable instructions comprising instructions to:

(a) calculate for each entity in a plurality of entities;

(i) a peer comparison score for the activity for the entity;

(ii) a self comparison score for the activity for the entity;

(iii) a truth comparison score for the activity for the entity; and

(iv) an activity confidence score for the entity;

and

(b) select a first entity from the plurality of entities, wherein the selecting is based at least in part on the activity confidence score for the first entity,

wherein the executable instructions further comprise instructions to calculate the self comparison score by;

(A) generating an individual model for the first entity wherein the individual model is based on at least one of a data stream for the first entity and an impact variable for the first entity;

(B) calculating a forecast data stream for the first entity, wherein the forecast data stream is based at least in part on the individual model for the first entity;

(C) calculating a difference between the individual model for the first entity and the forecast data stream for the first entity;

(D) calculating a time period for which the calculated difference is greater than a first predetermined threshold; and

(E) assigning the self comparison score to the first entity based on at least one of the calculated difference and the time period;

and wherein the executable instructions further comprise instructions to calculate the truth comparison score by;

(F) comparing a ground truth data stream for the activity with a data stream model for the first entity; and

(G) assigning a truth comparison score to the first entity based at least in part on a result of the comparison of the ground truth data stream with the data stream model for the first entity.

16. The machine-readable medium of claim 15 having stored thereon additional executable instructions, the additional executable instructions comprising instructions to:

(c) transmit to an investigation unit an identifier for the first entity;

(d) receive from the investigation unit information regarding an analysis of the activity associated with the first entity; and

(e) modify the activity confidence score for the first entity based on the analysis of the activity associated with the first entity.

17. The machine-readable medium of claim 15 having stored thereon additional executable instructions, the additional executable instructions comprising instructions to calculate the activity confidence score based at least in part on one or more of the peer comparison score, the self comparison score, and the truth comparison score.

18. The machine-readable medium of claim 15 having stored thereon additional executable instructions, the additional executable instructions comprising instructions to calculate the peer comparison score by:

(H) generating an individual model for the first entity wherein the individual model is based on at least one of a data stream for the first entity and an impact variable for the first entity;

(I) assigning the first entity to one or more clusters in a first set of clusters, wherein the assigning to the one or more clusters in the first set of clusters is based on the individual model for the first entity;

(J) assigning the first entity to one or more clusters in a second set of clusters, wherein the assigning to the one or more clusters in the second set of clusters is based on a set of external data for the first entity;

(K) correlating the assigning of the first entity to one or more clusters in the first set of clusters with the assigning of the first entity to one or more clusters in the second set of clusters, wherein the results of the correlation are used to refine the assigning of the first entity to the second set of clusters; and

(L) assigning the first entity to at least one peer group, wherein the assigning to the at least one peer group is based at least in part on the results of the correlation.

19. The machine-readable medium of claim 18 having stored thereon additional executable instructions, the additional executable instructions comprising instructions to calculate the peer comparison score by:

(M) assigning other entities of the plurality of entities to one or more peer groups;

(N) calculating a first normalcy score for the first entity in a first peer group, wherein the calculating of the first normalcy score includes comparing the data stream for the first entity with the corresponding data streams of other entities assigned to the first peer group;

(O) calculating a second normalcy score for the first entity in a second peer group, wherein the calculating of the second normalcy score includes comparing the data stream for the first entity with the corresponding data streams of the other entities in the second peer group;

(P) calculating a combined normalcy score for the first entity, wherein the combined normalcy score is based on the first normalcy score and the second normalcy score; and

(Q) normalizing the combined normalcy score for the first entity.