Method and system for behavioral and risk prediction in networks using automatic feature generation and selection using network topolgies

摘要

A system or method may include receiving, by a processor, data describing a network, wherein the network includes a plurality of entities and links describing relationships between the plurality of entities. The method may further include identifying a set of seed entities from the plurality of entities based on predefined rules. The method may further include generating a set of sub-networks based on the set of identified seed entities, wherein each of the sub-networks may include one or more other entities of the plurality of entities having at least one link to the at least one seed entity. The method may further include calculating a risk score for each of the generated sub-networks.

主权项

1. A method for network risk assessment, comprising:
receiving, by a processor, data describing a network, wherein the network includes a plurality of entities and links describing relationships between the plurality of entities; identifying a set of seed entities from the plurality of entities based on predefined rules; generating a set of sub-networks based on the set of identified seed entities, wherein each sub-network includes at least one seed entity and one or more other entities of the plurality of entities having at least one link to the at least one seed entity; calculating a risk score for each of the generated sub-networks; generating a plurality of sets of sub-networks iteratively by:
a) identifying an Nth set of seed entities from the plurality of entities, based on the risk scores calculated for the N−1 set of sub-networks;b) generating an Nth set of sub-networks based on the identified Nth set of seed entities; andc) calculating the risk scores for each of the sub-networks in the Nth set; andrepeating steps a) through c) until a stopping condition is reached, wherein a lower threshold and upper threshold define a range and the stopping condition is reached when the risk scores of the entities are less than a lower threshold or greater than an upper threshold; and providing a fraud alert regarding whether one of the entities or sub-network is at risk for suspicious financial activity either when a respective calculated risk score is below a risk score threshold or when a respective calculated risk score is above a risk score threshold.