Automated database analysis to detect malfeasance

• US 9,552,615 B2
• Filed: 03/05/2015
• Issued: 01/24/2017
• Est. Priority Date: 12/20/2013
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Mathura, Shivam, Lemanowicz, Lucas, Vergenz, Tim
• Primary Examiner(s): CHEIN, ALLEN C
• Application Number:
  US14/639,606
• Publication Number:
  US 20160048937A1
• Time in Patent Office: 691 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: G06Q 50/26 Government or public services business processes related to the transportation industry G06Q50/40
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

In various embodiments, systems, methods, and techniques are disclosed for analyzing various entity data items including users, computing devices, and IP addresses, to detect malfeasance. The data and/or database items may be automatically analyzed to detect malfeasance, such as criminal activity to disguise the origins of illegal activities. Various money laundering indicators or rules may be applied to the entity data items to determine a likelihood that money laundering is occurring. Further, the system may determine one or more scores (and/or metascores) for each entity data item that may be indicative of a likelihood that it is involved in money laundering. Scores/metascores may be determined based on, for example, various money laundering scoring criteria and/or strategies. Account entities may be ranked based on their associated scores/metascores. Various embodiments may enable an analyst to discover various insights related to money laundering.

Claims

1. A computer system to assist a human analyst in analyzing large amounts of money laundering related data, the computer system comprising:

one or more computer readable storage devices configured to store;

one or more software modules including computer executable instructions, the one or more software modules including a rules engine module and a workflow engine module;

a plurality of entity data items;

a plurality of Internet Protocol address data items;

a plurality of entity activity data items, the entity activity data items each associated with;

a user, an Internet Protocol address, an investigation, or one or more respective financial accounts, and

at least one entity data item of the plurality of entity data items;

a plurality of money laundering indicators;

a clustering strategy; and

a plurality of money laundering scoring criteria; and

one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the computer executable instructions of the one or more software modules in order to cause the computer system to;

designate, by the rules engine module, one or more seeds by;

accessing, from the one or more computer readable storage devices, the plurality of entity data items, the plurality of Internet Protocol address data items, and the plurality of the entity activity data items;

determining a first Internet Protocol address from the plurality of Internet Protocol address data items associated with a first entity data item of the plurality of entity data items, wherein a computing device associated with the first entity data item was assigned the first Internet Protocol address;

comparing the plurality of money laundering indicators to the plurality of entity activity data items associated with the first entity data item to determine whether the first entity data item satisfies money laundering indicators that include;

determining that the first Internet Protocol address corresponds to a first geographic area within predetermined first high-risk geographic areas for money laundering;

determining that the plurality of entity activity data items includes a first entity activity data item where the first Internet Protocol address was used to access a first financial account;

determining a first amount associated with the first financial account;

determining a transaction amount associated with the first financial account; and

determining that the transaction amount relative to the first amount corresponds to a predetermined percentage, wherein the predetermine percentage corresponds to a remaining amount that is indicative of a potential money laundering fee; and

designating the first entity data item as a seed;

for the designated first entity data item seed;

identify, by the rules engine module, one or more entity activity data items determined to be associated with the designated first entity data item seed based at least on the clustering strategy, wherein the clustering strategy queries the one or more computer readable storage devices to determine at least one of;

one or more users associated with the designated first entity data item seed,

one or more Internet Protocol addresses associated with the designated first entity data item seed,

one or more financial accounts associated with the designated first entity data item seed, or

one or more investigations associated with the designated first entity data item seed;

generate, by the rules engine module, a cluster based at least on the designated first entity data item seed, wherein generating the cluster comprises;

adding the designated first entity data item seed to the cluster;

adding the one or more entity activity data items to the cluster;

identifying an additional one or more entity activity data items associated with any data item of the cluster;

adding the additional one or more entity activity data items to the cluster; and

storing the generated cluster in the one or more computer readable storage devices;

score the cluster by;

determining raw score values for each of the satisfied money laundering indicators associated with the first entity data item; and

based on at least one of the plurality of money laundering scoring criteria, determining a score for the first entity data item based at least on the determined raw score values of the satisfied money laundering indicators and a quantity of satisfied money laundering indicators, wherein the determined score is indicative of a likelihood that the first entity data item is associated with money laundering; and

cause presentation, by the workflow engine module, of the cluster and the score for the first entity data item in a user interface of a client computing device.

2. The computer system of claim 1, wherein determining whether the first entity data item satisfies money laundering indicators further includes:

determining that the plurality of entity activity data items further includes a second entity activity data item where a second Internet Protocol address was used to access the first financial account, wherein the second Internet Protocol address corresponds to a second geographic area within predetermined second high-risk geographic areas for money laundering, and wherein the first and second high-risk geographic areas correspond to a potential money laundering route.

3. The computer system of claim 1, wherein the plurality of money laundering indicators comprises a second money laundering indicator configured to determine a configuration change of a computing device indicative of a change in respective geographic areas of the computing device that is associated with a potential pattern of money laundering.

4. The computer system of claim 1, wherein at least one money laundering indicator of the plurality of money laundering indicators comprises one or more rules configured to determine whether a first entity, uniquely associated with the first entity data item in the plurality of entity data items, accessed a financial account from one or more locations associated with illegal activity.

5. The computer system of claim 4, wherein the one or more locations associated with illegal activity comprises a plurality of distinct locations, and the at least one money laundering indicator requires that the first entity, uniquely associated with the first entity data item, accessed the financial account from at least two distinct locations in the plurality of distinct locations.

6. The computer system of claim 5, wherein the at least one money laundering indicator requires that the first entity accessed the financial account from at least three distinct locations in the plurality of distinct locations in a specific order or pattern.

7. The computer system of claim 6, wherein the specific order or pattern comprises a timing requirement for the first entity accessing the financial account from the at least three distinct locations in the plurality of distinct locations.

8. The computer system of claim 6, wherein at least one money laundering scoring criteria is configured to determine a score for an entity based on whether the first entity accessed the financial account from locations that are within a threshold range of a registered address associated with the entity.

9. A computer-implemented method to assist a human analyst in analyzing large amounts of money laundering related data, the computer-implemented method comprising:

under control of one or more hardware computing devices configured with specific computer executable instructions,

enabling communication with one or more computer readable storage devices configured to store;

one or more software modules including computer executable instructions, the one or more software modules including a rules engine module and a workflow engine module;

a plurality of entity data items;

a plurality of Internet Protocol address data items;

a plurality of entity activity data items, the entity activity data items each associated with;

a user, an Internet Protocol address, an investigation, or one or more respective financial accounts, and

at least one entity data item in the plurality of entity data items;

a plurality of money laundering indicators;

a clustering strategy; and

a plurality of money laundering scoring criteria;

designating, by the rules engine module, one or more seeds by;

accessing, from the one or more computer readable storage devices, the plurality of entity data items, the plurality of Internet Protocol address data items, and the plurality of the entity activity data items;

determining a first Internet Protocol address from the plurality of Internet Protocol address data items associated with a first entity data item of the plurality of entity data items, wherein a computing device associated with the first entity data item was assigned the first Internet Protocol address;

comparing the plurality of money laundering indicators to the plurality of entity activity data items associated with the first entity data item to determine whether the first entity data item satisfies money laundering indicators that include;

determining that the first Internet Protocol address corresponds to a first geographic area within predetermined first high-risk geographic areas for money laundering;

determining that the plurality of entity activity data items includes a first entity activity data item where the first Internet Protocol address was used to access a first financial account;

determining a first amount associated with the first financial account;

determining a transaction amount associated with the first financial account; and

determining that the transaction amount relative to the first amount corresponds to a predetermined percentage, wherein the predetermine percentage corresponds to a remaining amount that is indicative of a potential money laundering fee; and

designating the first entity data item as a seed;

for the designated first entity data item seed;

identifying, by the rules engine module, one or more entity activity data items determined to be associated with the designated first entity data item seed based at least on the clustering strategy, wherein the clustering strategy queries the one or more computer readable storage devices to determine at least one of;

one or more users associated with the designated first entity data item seed, one or more Internet Protocol addresses associated with the designated first entity data item seed, one or more financial accounts associated with the designated first entity data item seed, or one or more investigations associated with the designated first entity data item seed;

generating, by the rules engine module, a cluster based at least on the designated first entity data item seed, wherein generating the cluster comprises;

adding the designated first entity data item seed to the cluster;

adding the one or more entity activity data items to the cluster;

identifying an additional one or more entity activity data items associated with any data item of the cluster;

adding the additional one or more entity activity data items to the cluster; and

storing the generated cluster in the one or more computer readable storage devices;

score the cluster by;

determining raw score values for each of the satisfied money laundering indicators associated with the first entity data item; and

based on at least one of the plurality of money laundering scoring criteria, determining a score for the first entity data item based at least on a quantity of satisfied money laundering indicators; and

causing presentation, by the workflow engine module, of the cluster and the score for the first entity data item in a user interface of a client computing device.

10. The computer-implemented method of claim 9, wherein determining whether the first entity data item satisfies money laundering indicators further includes:

determining that the plurality of entity activity data items further includes a second entity activity data item where a second Internet Protocol address was used to access the first financial account, wherein the second Internet Protocol address corresponds to a second geographic area within predetermined second high-risk geographic areas for money laundering, and wherein the first and second high-risk geographic areas correspond to a potential money laundering route.

11. The computer-implemented method of claim 9, wherein determining whether the first entity data item satisfies money laundering indicators further includes determining that a transaction associated with the transaction amount includes a change in currency.

12. The computer-implemented method of claim 9, wherein at least one money laundering indicator of the plurality of money laundering indicators comprises one or more rules configured to determine whether a first entity, uniquely associated with the first entity data item in the plurality of entity data items, accessed a financial account from one or more locations associated with illegal activity.

13. The computer-implemented method of claim 12, wherein the one or more locations associated with illegal activity comprises a plurality of distinct locations, and the at least one money laundering indicator requires that the first entity, uniquely associated with the first entity data item, accessed the financial account from at least two distinct locations in the plurality of distinct locations.

14. The computer-implemented method of claim 13, wherein the at least one money laundering indicator requires that the first entity accessed the financial account from at least three distinct locations in the plurality of distinct locations in a specific order or pattern.

15. The computer-implemented method of claim 14, wherein the specific order or pattern comprises a timing requirement for the first entity accessing the financial account from the at least three distinct locations in the plurality of distinct locations.

16. The computer-implemented method of claim 14, wherein at least one money laundering scoring criteria is configured to determine a score for an entity based on at least one access location of the financial account by the first entity.

17. A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed by a computer system, configure the computer system to perform operations comprising:

enabling communication with one or more computer readable storage devices configured to store;

one or more software modules including computer executable instructions, the one or more software modules including a rules engine module and a workflow engine module;

a plurality of entity data items;

a plurality of Internet Protocol address data items;

a plurality of entity activity data items, the entity activity data items each associated with;

a user, an Internet Protocol address, an investigation, or one or more respective financial accounts, and

at least one entity data item in the plurality of entity data items;

a plurality of money laundering indicators;

a clustering strategy; and

a plurality of money laundering scoring criteria;

designating, by the rules engine module, one or more seeds by;

accessing, from the one or more computer readable storage devices, the plurality of entity data items, the plurality of Internet Protocol address data items, and the plurality of the entity activity data items;

determining a first Internet Protocol address from the plurality of Internet Protocol address data items associated with a first entity data item of the plurality of entity data items, wherein a computing device associated with the first entity data item was assigned the first Internet Protocol address;

comparing the plurality of money laundering indicators to the plurality of entity activity data items associated with the first entity data item to determine whether the first entity data item satisfies money laundering indicators that include;

determining that the first Internet Protocol address corresponds to a first geographic area within predetermined first high-risk geographic areas for money laundering;

determining that the plurality of entity activity data items includes a first entity activity data item where the first Internet Protocol address was used to access a first financial account;

determining a first amount associated with the first financial account;

determining a transaction amount associated with the first financial account; and

determining that the transaction amount relative to the first amount corresponds to a predetermined percentage, wherein the predetermine percentage corresponds to a remaining amount that is indicative of a potential money laundering fee; and

for the designated first entity data item seed;

identifying, by the rules engine module, one or more entity activity data items determined to be associated with the designated first entity data item seed based at least on the clustering strategy, wherein the clustering strategy queries the one or more computer readable storage devices to determine at least one of;

one or more users associated with the designated first entity data item seed, one or more Internet Protocol addresses associated with the designated first entity data item seed, one or more financial accounts associated with the designated first entity data item seed, or one or more investigations associated with the designated first entity data item seed;

generating, by the rules engine module, a cluster based at least on the designated first entity data item seed, wherein generating the cluster comprises;

adding the designated first entity data item seed to the cluster;

adding the one or more entity activity data items to the cluster;

identifying an additional one or more entity activity data items associated with any data item of the cluster;

adding the additional one or more entity activity data items to the cluster; and

storing the generated cluster in the one or more computer readable storage devices;

score the cluster by;

determining raw score values for each of the satisfied money laundering indicators associated with the first entity data item; and

based on at least one of the plurality of money laundering scoring criteria, determining a score for the first entity data item; and

causing presentation, by the workflow engine module, of the cluster and the score for the first entity data item in a user interface of a client computing device.

18. The non-transitory computer-readable storage medium of claim 17, wherein determining whether the first entity data item satisfies money laundering indicators further includes:

determining that the plurality of entity activity data items further includes a second entity activity data item where a second Internet Protocol address was used to access the first financial account, wherein the second Internet Protocol address corresponds to a second geographic area within predetermined second high-risk geographic areas for money laundering, and wherein the first and second high-risk geographic areas correspond to a potential money laundering route.

19. The non-transitory computer-readable storage medium of claim 17, wherein determining whether the first entity data item satisfies money laundering indicators further includes:

determining a first user accessed the first financial account; and

determining that the first user is affiliated with a predetermined user watch list.

20. The non-transitory computer-readable storage medium of claim 17, wherein at least one money laundering indicator of the plurality of money laundering indicators comprises one or more rules configured to determine whether a first entity, uniquely associated with the first entity data item in the plurality of entity data items, accessed a financial account from one or more locations associated with illegal activity.