System and method for determining a risk root cause

Abstract

A system and method for determining a risk root cause are provided. A first and second fraud related risk scores respectively associated with a first and second nodes may be determined. A relation strength value related to at least one relation between the first and second nodes may be determined. A relation strength value and a first and second node risk scores may be used to calculate a cluster risk score for a cluster including the first and second nodes. Other embodiments are described and claimed.

What is claimed is: 
     
         1 . A method for determining risk root cause link, the method comprising:
 determining by a computing device, at least one path between a first and second nodes included in a cluster of nodes, the at least one path including at least one relation between the first and second nodes;   determining, by the computing device, a first and second fraud related risk scores respectively associated with the first and second nodes;   determining, by the computing device, a relation strength value related to the at least one relation between the first and second nodes;   calculating, by the computing device, a cluster risk score for the cluster based on the relation strength value and based on the fraud related risk scores using a value function that monotonically increases according to the first and second fraud related risk scores.   
     
     
         2 . The method of  claim 1 , comprising extending the cluster to include an additional node, wherein extending the cluster includes:
 determining an additional relation strength value related to at least one relation between the additional node and a node included in the cluster; and   using the additional relation strength value and a fraud related risk score associated with the additional node to calculate a cluster risk score for the extended cluster.   
     
     
         3 . The method of  claim 1 , wherein a path between the first and second nodes includes a relation between the first node and a third node and a relation between the third node and the second node. 
     
     
         4 . The method of  claim 1 , comprising associating a node with a constant node risk score if not all paths traversing the node have been determined. 
     
     
         5 . The method of  claim 1 , comprising producing an alert if the cluster risk score is greater than a determined threshold. 
     
     
         6 . The method of  claim 1 , comprising:
 determining a relation between a first node included in a first cluster and a second node included in a second cluster;   joining the first and second clusters to produce an extended cluster; and   calculating a cluster risk score for the extended cluster.   
     
     
         7 . The method of  claim 1 , comprising selecting one of the first and second nodes based on estimating their respective potential contribution to the cluster risk score. 
     
     
         8 . The method of  claim 1 , comprising dynamically modifying a cluster risk score based on an event related to a node included in the cluster. 
     
     
         9 . An article comprising a non-transitory computer-readable storage medium, having stored thereon instructions, that when executed on a computer, cause the computer to:
 determine at least one path between a first and second nodes included in a cluster of nodes, the at least one path including at least one relation between the first and second nodes;   determine a first and second fraud related node risk scores respectively associated with the first and second nodes;   determine a relation strength value related to at least one relation between the first and second nodes; and   calculate a cluster risk score for the cluster based on the relation strength value and based on the fraud related node risk scores using a value function that monotonically increases according to the first and second node risk scores.   
     
     
         10 . The article of  claim 9 , wherein the instructions when executed further result in extending the cluster to include an additional node, wherein extending the cluster includes:
 determining an additional relation strength value related to at least one relation between the additional node and a node included in the cluster; and   using the additional relation strength value and a node risk score associated with the additional node to calculate a cluster risk score for the extended cluster.   
     
     
         11 . The article of  claim 9 , wherein a path between the first and second nodes includes a relation between the first node and a third node and a relation between the third node and the second node. 
     
     
         12 . The article of  claim 9 , wherein the instructions when executed further result in associating a node with a constant node risk score if not all paths traversing the node have been determined. 
     
     
         13 . The article of  claim 9 , wherein the instructions when executed further result in producing an alert if the cluster risk score is greater than a determined threshold. 
     
     
         14 . The article of  claim 9 , wherein the instructions when executed further result in:
 determining a relation between a first node included in a first cluster and a second node included in a second cluster;   joining the first and second clusters to produce an extended cluster; and   calculating a cluster risk score for the extended cluster.   
     
     
         15 . The article of  claim 9 , wherein the instructions when executed further result in selecting one of the first and second nodes based on estimating their respective potential contribution to the cluster risk score. 
     
     
         16 . The article of  claim 9 , wherein the instructions when executed further result in dynamically modifying a cluster risk score based on an event related to a node included in the cluster.