De-duping identities using network analysis and behavioral comparisons

• US 9,602,674 B1
• Filed: 06/17/2016
• Issued: 03/21/2017
• Est. Priority Date: 07/29/2015
• Status: Active Grant

• Current Assignee: Mark43, Inc.
• Original Assignee: Mark43, Inc.
• Inventors: Polega, Matthew, Crouch, Scott, Mayr, Florian, Okano, Stephen
• Primary Examiner(s): TIEU, BINH KIEN
• Application Number:
  US15/185,545
• Publication Number:
  US 20170085722A1
• Time in Patent Office: 277 Days
• Field of Search: 379/32.01, 379/32.02, 379/32.04, 379/32.05, 379/111, 379/112.01, 379/112.04, 379/112.08, 379/116, 379/118, 379/120, 379/121.04, 379/121.05, 379/126, 379/133, 379/134
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/1748 De-duplication implemented within the file system, e.g. based on file segments de-duplication techniques in storage systems for the management of data blocks G06F3/0641
• CPC Class Codes: G06F 16/215 Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/3338 Query expansion
• CPC Class Codes: G06F 16/337 Profile generation, learning or modification
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9558 Details of hyperlinks; Management of linked annotations
• CPC Class Codes: G06Q 50/26 Government or public services business processes related to the transportation industry G06Q50/40
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 17/02 Coin-freed or check-freed systems , e.g. mobile- or card-operated phones, public telephones or booths
• CPC Class Codes: H04M 3/2218 Call detail recording
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls

Abstract

A processing device identifies comparison subjects comprising a first subject and a second subject. The processing device builds a first network of a first profile of the first subject and a second network of a second profile of the second subject, wherein the first network and the second network are multi-degree connections networks. The processing device the first network and second network to produce a similarity score. The processing device examining first-degree connections between the first network and the second network and accounting for centralities that rely on information about the entire first network and the entire second network. Responsive to the similarity score exceeding a similarity threshold, the processing device merges the first profile and the second profile into a common profile for the first subject and the second subject.

Claims

1. A method comprising:

identifying, by a processing device, comparison subjects comprising a first subject and a second subject;

building, by the processing device, a first network of a first profile of the first subject and a second network of a second profile of the second subject, wherein the first network and the second network are multi-degree connections networks;

comparing, by the processing device, the first network and second network to produce a similarity score, wherein comparing comprises examining first-degree connections between the first network and the second network and accounting for centralities that rely on information about the entire first network and the entire second network; and

responsive to the similarity score exceeding a similarity threshold,

merging, by the processing device, the first profile and the second profile into a common profile for the first subject and the second subject.

2. The method of claim 1, wherein the first profile and the second profile further comprise an inventory of at least one of centrality scores, call data records (CDRs), social connections, or network behavior.

3. The method of claim 2, wherein the information about the entire network comprises second degree or greater connections.

4. The method of claim 1, wherein the comparing further comprises examining at least one of the popularity, connectedness, or influence in the network context of the entire network between the first network and the second network.

5. The method of claim 1, wherein the comparing further comprises examining cross-references relationship-based data with additional data in order to generate network-based data.

6. The method of claim 1, further comprising seeking, by the processing device, authorization for a profile merger from a system user before performing a profile merge operation.

7. The method of claim 1, wherein merging the first profile and the second profile comprises merging identity data associated with the first subject with identity data associated with the second subject.

8. The method of claim 1, wherein the first subject and the second subject are persons.

9. The method of claim 1, further comprising collecting communication records of the first subject and the second subject and inserting the communication records the first network and the second network, respectively.

10. The method of claim 9, further comprising comparing the collected communication records of the first subject and the second subject for at least one of a relationship type, relationship strength, or whether a relationship is bidirectional.

11. The method of claim 1, further comprising, wherein building the first network and the second network comprises:

selecting a seed node for a network;

locating a unique set of nodes in the network;

determining a unique set of links in the network among the seed node and the unique set of nodes; and

outputting a network object.

12. The method of claim 11, wherein the seed node refers to a focus node that is being analyzed.

13. The method of claim 1, wherein the comparing comprises:

determining a centrality score for each of the first subject and the second subject;

creating a call frequency list for each of the first subject and the second subject; and

determining a level of variation between the first subject and the second subject in view of centrality scores and call frequency lists.

14. A system comprising:

a memory;

a processing device operatively couple to the memory to;

identify comparison subjects comprising a first subject and a second subject;

build a first network of a first profile of the first subject and a second network of a second profile of the second subject, wherein the first network and the second network are multi-degree connections networks;

compare the first network and second network to produce a similarity score, wherein comparing comprises examining first-degree connections between the first network and the second network and accounting for centralities that rely on information about the entire first network and the entire second network; and

responsive to the similarity score exceeding a similarity threshold,

merge the first profile and the second profile into a common profile for the first subject and the second subject.

15. A method, comprising:

linking a phone number to a subject;

determining that the phone number of the subject is no longer being used;

building, by a processing device, a first network of nodes comprising calls made by the subject;

identifying, by the processing device, the most commonly called telephone numbers of the subject by traversing the nodes in the first network;

building, by a processing device, a second network of nodes of call data records (CDR) of telephone numbers of the subject;

identifying, by the processing device, call frequencies of the telephone numbers in the CDRs of the subject by traversing the nodes in the second network; and

responsive to determining that one or more nodes in the second network have call frequencies of a telephone number matching corresponding nodes having the telephone number in the first network,

identifying a phone associated with the telephone number as a burner phone.

16. The method of claim 15, wherein linking a phone number to a subject comprises subpoenaing phone record of the subject and matching a calling number to a phone the subject had obtained.

17. The method of claim 16, further comprising determining that the calling number is no longer being used.

18. The method of claim 15, wherein building the second network of CDRs further comprises including associated centrality scores for the suspect along with a corresponding CDR.

19. The method of claim 15, wherein determining that or one more nodes in the second network have call frequencies of a telephone number matching corresponding nodes in the first network having the telephone number further comprises matching associated at least one of centralities or a location corresponding nodes in the second network to the first network.

20. A system comprising:

a memory;

a processing device operatively couple to the memory to;

link a phone number to a subject;

determine that the phone number of the subject is no longer being used;

build a first network of nodes comprising calls made by the subject;

identify the most commonly called telephone numbers of the subject by traversing the nodes in the first network;

build a second network of nodes of call data records (CDR) of telephone numbers of the subject;

identify call frequencies of the telephone numbers in the CDRs of the subject by traversing the nodes in the second network; and

responsive to determining that one or more nodes in the second network have call frequencies of a telephone number matching corresponding nodes having the telephone number in the first network,

identify a phone associated with the telephone number as a burner phone.