Advanced learning system for detection and prevention of money laundering

Abstract

An automated system for detecting risky entity behavior using an efficient frequent behavior-sorted list is disclosed. From these lists, fingerprints and distance measures can be constructed to enable comparison to known risky entities. The lists also facilitate efficient linking of entities to each other, such that risk information propagates through entity associations. These behavior sorted lists, in combination with other profiling techniques, which efficiently summarize information about the entity within a data store, can be used to create threat scores. These threat scores may be applied within the context of anti-money laundering (AML) and retail banking fraud detection systems. A particular instantiation of these scores elaborated here is the AML Threat Score, which is trained to identify behavior for a banking customer that is suspicious and indicates high likelihood of money laundering activity.

1 - 24 . (canceled) 
     
     
         25 . A computer-implemented system for improving predictive capabilities of a machine learning system, the system comprising at least one processor and a machine-readable medium storing instructions that, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
 retrieving one or more profiles from the machine learning system's data store that stores a plurality of profiles associated with a plurality of behavior sorted lists, at least a first profile out of the plurality of profiles being associated with an input data record for a first entity from among a plurality of entities;   updating the first profile to recursively compute summary statistics of behavior of the first entity by adding an observed behavior represented by the input data record to at least one of a plurality of behavior sorted lists with a first weight;   decaying weights of existing observed behaviors;   comparing one or more entries between at least two of the plurality of behavior sorted lists to generate a numerical value representing a consistency between entries in a behavior sorted list for the first entity and the behavior sorted list of other entities;   executing one or more distance models to the plurality of behavior sorted lists to determine a variation of the consistency between the entries in the at least two behavior sorted lists according to the numerical value; and   generating a threat score utilizing self-calibrating outlier models based on entity recursively summarized profile behavior and recurrences in an entities behavior sorted list due to variation of matches on behavior sorted lists of risk entities.   
     
     
         26 . The system of  claim 25 , wherein at least a first profile is created for the first entity, the first profile being formed as a data structure that captures statistics of the first entity's behavior without storing a record of past activity of the first entity. 
     
     
         27 . The system of  claim 26 , wherein the first profile comprises a plurality of behavior sorted lists and recursive features. 
     
     
         28 . The system of  claim 27 , wherein the behavior sorted lists are formed of tuples of entries including a key, a weight, and a payload that represent a frequently-observed behavior of the first entity. 
     
     
         29 . The system of  claim 27 , wherein the recursive features are configured to summarize the frequently-observed behavior of the first profile. 
     
     
         30 . The system of  claim 26 , wherein the data structure captures statistics of the first entity's behavior without storing a record of past activity of the first entity. 
     
     
         31 . The system of  claim 25 , wherein an alert is generated to identify an activity as suspicious, in response to determining that the activity is anomalous for that entity based on the first entity's prior history and peer group. 
     
     
         32 . The system of  claim 25 , wherein a payload of at least one entry of the first profile includes recursive features. 
     
     
         33 . The system of  claim 25 , wherein the payload of at least one entry of the first profile includes archetype distributions, derived archetype profile features, and soft clustering misalignment scores. 
     
     
         34 . The system of  claim 25 , wherein the input data record is a transaction performed by the first entity and based on determining a degradation of a set of threat scores and using one or more auto-retraining mechanisms, the machine learning system is retrained. 
     
     
         35 . A computer-implemented method for improving predictive capabilities of a machine learning system, the method comprising:
 retrieving one or more profiles from the machine learning system's data store that stores a plurality of profiles associated with a plurality of behavior sorted lists, at least a first profile out of the plurality of profiles being associated with an input data record for a first entity from among a plurality of entities;   updating the first profile to recursively compute summary statistics of behavior of the first entity by adding an observed behavior represented by the input data record to at least one of a plurality of behavior sorted lists with a first weight;   decaying weights of existing observed behaviors;   comparing one or more entries between at least two of the plurality of behavior sorted lists to generate a numerical value representing a consistency between entries in a behavior sorted list for the first entity and the behavior sorted list of other entities;   executing one or more distance models to the plurality of behavior sorted lists to determine a variation of the consistency between the entries in the at least two behavior sorted lists according to the numerical value; and   generating a threat score utilizing self-calibrating outlier models based on entity recursively summarized profile behavior and recurrences in an entities behavior sorted list due to variation of matches on behavior sorted lists of risk entities.   
     
     
         36 . The method of  claim 35 , wherein at least a first profile is created for the first entity, the first profile being formed as a data structure that captures statistics of the first entity's behavior without storing a record of past activity of the first entity. 
     
     
         37 . The method of  claim 36 , wherein the first profile comprises a plurality of behavior sorted lists and recursive features. 
     
     
         38 . The method of  claim 37 , wherein the behavior sorted lists are formed of tuples of entries including a key, a weight, and a payload that represent a frequently-observed behavior of the first entity. 
     
     
         39 . The method of  claim 39 , wherein the recursive features are configured to summarize the frequently-observed behavior of the first profile. 
     
     
         40 . The method of  claim 36 , wherein the data structure captures statistics of the first entity's behavior without storing a record of past activity of the first entity. 
     
     
         41 . A non-transitory computer program product storing instructions that, when executed by at least one programmable processor, cause the at least one programmable processor to perform operations comprising:
 retrieving one or more profiles from the machine learning system's data store that stores a plurality of profiles associated with a plurality of behavior sorted lists, at least a first profile out of the plurality of profiles being associated with an input data record for a first entity from among a plurality of entities;   updating the first profile to recursively compute summary statistics of behavior of the first entity by adding an observed behavior represented by the input data record to at least one of a plurality of behavior sorted lists with a first weight;   decaying weights of existing observed behaviors;   comparing one or more entries between at least two of the plurality of behavior sorted lists to generate a numerical value representing a consistency between entries in a behavior sorted list for the first entity and the behavior sorted list of other entities;   executing one or more distance models to the plurality of behavior sorted lists to determine a variation of the consistency between the entries in the at least two behavior sorted lists according to the numerical value; and   generating a threat score utilizing self-calibrating outlier models based on entity recursively summarized profile behavior and recurrences in an entities behavior sorted list due to variation of matches on behavior sorted lists of risk entities.   
     
     
         42 . The computer program product of  claim 41 , wherein at least a first profile is created for the first entity, the first profile being formed as a data structure that captures statistics of the first entity's behavior without storing a record of past activity of the first entity and the first profile comprises a plurality of behavior sorted lists and recursive features. 
     
     
         43 . The computer program product of  claim 42 , wherein the behavior sorted lists are formed of tuples of entries including a key, a weight, and a payload that represent a frequently-observed behavior of the first entity and wherein the recursive features are configured to summarize the frequently-observed behavior of the first profile. 
     
     
         44 . The computer program product of  claim 42 , wherein the data structure captures statistics of the first entity's behavior without storing a record of past activity of the first entity.