International Business Machines Corporation

Subhendu Das

Srinivasan S Muthuswamy

Willie Robert Patten, Jr

Mukesh Kumar

Xiao Jun Dai

Zhi Gan

Zhang Yue

Yashodhara M Patnaik

Negandhi Vrunda Ravindra

Thomas T Hanis

Shanna Hayes

Shweta Shandilya

Ratul Sarkar

Ankit Kumar Singh

Carl Ottman

Yashodara M Patnaik

Srinivasan Muthuswamy Sivaraman

Manish Anand Bhide

Yi-Hui Ma

A computer-implemented system, platform, computer program product, tool, and/or method for capturing data and metadata for providing traceability of data analytic pipeline runs that includes: triggering a first pipeline run; obtaining a pipeline configuration for the first pipeline run, including one or more tasks; capturing and storing the pipeline configuration and starting inputs for the first pipeline run; executing the first pipeline run; capturing, before each task in the first pipeline run is executed, input data and input metadata for each task; capturing, after each task in the first pipeline run is executed, output data and output metadata for each task; and capturing the alerts for the first pipeline run.

System and method to perform governance on suspicious activity detection pipeline in risk networks

A computer-implemented system, platform, computer program product, and/or method for optimizing a data analytics suspicious activity detection pipeline that includes identifying a data analytics suspicious activity detection (SAD) pipeline for optimization; inputting desired key performance indicators for the data analytics suspicious activity detection (SAD) pipeline; gathering key performance indicators from previous runs of the data analytics suspicious activity detection (SAD) pipeline; identifying candidate pipeline configurations for simulation runs; running simulations of the candidate pipeline configurations; analyzing the simulations of the candidate pipeline configurations; and identifying the optimal pipeline configuration for the desired key performance indicators.

System and method to optimize processing pipeline for key performance indicators

In some embodiments, a processor may receive a claim, where the claim relates to an event. The processor may identify characteristics of the claim. The processor may determine, using an AI model, an alert reason based on a similarity of the characteristics of the claim to characteristics of one or more other claims. The processor may generate an alert notification, and the processor may output the alert notification to a user.

Cognitive claims processing

In an approach to facilitate contactless remote shopping assistance, a computer-implemented method includes one or more processors configured for receiving first order data from a user device corresponding to an order of items to be retrieved from a parking lot of a retail entity proximate to a retail entity location, transmitting the first order data to the retail entity, and assigning the order to a mobility device stationed at the retail entity. The method further includes transmitting order retrieval instructions to the mobility device causing the mobility device to navigate the retail to secure the items, receiving an indication that the mobility device secured the items, and transmitting order delivery instructions to the mobility device. The method further includes receiving a second indication that the mobility device transported the items to the parking lot and placed the items in a vehicle associated with a user of the user device.

Contactless remote shopping assistance

A computer-implemented system, method and computer program product for detecting fraud. The system and method receives data representing transacting parties where a party transacts with another party to define a relationship therebetween. The received data is incorporated into a relationship network graph comprising nodes that capture data about transacting parties and corresponding information associated with each transaction. A risk model is run that is configured to determine a risk weight for the relation between nodes associated with the transacting parties based on the data captured in the relationship network graph. Then there is determined a degree of a party's association score based on risk scores of nodes associated with the party and a defined relationship with another suspicious party. The system then dynamically updates the risk weight of the relation based on the party's association score.

Applying machine learning to learn relationship weightage in risk networks

A computer-implemented method to generate a hotspot confidence score for a hotspot in a network graph includes, receiving input data, wherein the input data includes a plurality of messages, each message containing a set of message data. The method further includes generating, based on the plurality of messages, a network graph. The method also includes identifying, in the network graph, a first hotspot. The method includes compiling a set of hotspot characteristics for the first hotspot. The method further includes receiving, in response to identifying the first hotspot, a first user feedback. The method also includes, generating, by a learning model, a hotspot confidence score for the first hotspot; and outputting the hotspot confidence score.

Incorporating feedback in network graph hotspot identification

In an approach for detecting non-obvious relationships between entities from visual data sources, a processor calculates a co-occurrence frequency score for an entity pair from visual data. A processor calculates a distance proximity score for the entity pair from the visual data. A processor determines an event type in the visual data. A processor determines a timeline relationship in the visual data. A processor calculates a relationship score based on the co-occurrence frequency score, the distance proximity score, the event type, and the timeline relationship. A processor detects a relationship between the entity pair based on the relationship score.

Detecting non-obvious relationships between entities from visual data sources

Aspects of the present disclosure relate to identifying and quantifying relationships between entities. Data sources can be queried to receive data regarding a party. Entities can be extracted from the data to receive a set of entities, wherein the party is a first entity of the set of entities. An ontological structure can be built that interrelates entities within the set of entities. An initial relationship strength can be determined between the first entity and a second entity based on co-occurrence between the first and second entities, wherein the second entity is a second party. A relationship score can be calculated between the first and second entities based on the initial relationship strength and at least one additional factor.

Relationship discovery and quantification

A computer-implemented method uses a context node to identify sister nodes. The method includes receiving, by a processor, input data. The input data includes a plurality of messages, each message containing a set of message data. The method further includes, generating, by a pattern detector, and based on the input data, a network graph, where the network graph includes a plurality of nodes. The method also includes selecting a first context node. The method includes determining a first pattern for the first context node. The method further includes identifying, based on the first pattern, a first sister node. The method also includes outputting, by a network interface, the first sister node and the network graph.

Identifying sister nodes based on a context node

A computer-implemented method to automatically identify hotspots in a network graph. The method includes receiving, by a processor, input data, wherein the input data includes a plurality of messages, each message containing a set of message data. The method further includes generating, by a pattern detector, and based on the input data, a network graph, wherein the network graph includes a plurality of nodes. The method also includes determining a first risk indicator for each of the plurality of nodes. The method includes assigning a first weight to the first risk indicator for each of the plurality of nodes. The method further includes identifying a first hotspot in the plurality of nodes, wherein the first hotspot is based on the first weight of the first risk indicator of a first node. The method also includes outputting, by a network interface, the first hotspot and the network graph.

Automatic hotspot identification in network graphs

Approaches presented herein enable identification of routine communication content. More specifically, a communication between one or more users is received. Words or phrases in the communication that are contained in a database of words or phrases related to misconduct are identified. The identified words or phrases are removed from the communication to create a set of remaining words. The set of remaining words are analyzed to predict the likelihood of the removed words or phrases appearing in the communication, such that a confidence level of the prediction is determined. In response to the determined confidence level being high, the identified words or phrases in the communication are classified as routine.

Identifying routine communication content

A computer-implemented system, method and computer program product for preparing alert reports that includes: receiving an override request to override an insight used to prepare the alert reports; determining, determining one or more execution pipelines used to prepare the alert reports that used the insight that is the subject of the override request; determining one or more impacted pipeline runs that were executed to prepare the alert reports that used the insight that is the subject of the override request; updating the one or more execution pipelines used to prepare the alert reports; and generating new alert reports, wherein generating the new alert reports comprises re-running the one or more impacted pipeline runs using the one or more updated execution pipelines wherein the insight that is the subject of the override request is overridden.

Override process in data analytics processing in risk networks

A computer-implemented system, platform, computer program product, tool, and/or method for re-running alert reports that includes: identifying an alert report to be rerun; collecting information on the alert report; gathering information on the configuration of a data analytics pipeline that generated the alert report; gathering data used to generate the alert report; recreating a regenerated data analytics pipeline based upon the information gathered on the configuration of the data analytics pipeline that generated the alert report; running the regenerated data analytics pipeline using the gathered data to create a rerun alert report; and optionally comparing the rerun to the original run including optionally generating a visual display of the results including in an aspect creating a side-by-side comparison of the tasks.

System and method to replay suspicious activity detection pipeline in risk networks

The disclosed embodiments include a method for performing financial fraud assessment that includes creating a machine learning model based on features used to identify financial fraud risk; receiving financial information associated with customer accounts; establishing communities for the customer accounts; creating a baseline set of the features for each of the communities; receiving new financial information associated with customer accounts; updating the communities for the customer accounts based on the new financial information; extracting an updated set of the features for each of the communities; and determining a difference between the baseline set of the features and the updated set of the features for each of the communities; and using the machine learning model to determine financial fraud risk for each of the communities based on the difference between the baseline set of the features and the updated set of the features for each of the communities.

Fraud detection based on community change analysis using a machine learning model

A computer-implemented method for performing financial fraud assessment, the method includes receiving financial information associated with customer accounts that have been identified as being associated with suspicious financial activity; establishing communities for the customer accounts; creating a baseline set of features for each of the communities; receiving new financial information associated with customer accounts; updating the communities for the customer accounts based on the new financial information; extracting an updated set of features for each of the communities; and performing fraud assessment by determining whether a change between the updated set of features and the baseline set of features for each of the communities is indicative of an increased risk of fraud.

Growing community of inventors

Chapel Hill, NC, United States of America

Subhendu Das