ConceptioArchiveGoogle Patents
Google Patentsopen access

Unsupervised machine learning system to automate functions on a graph structure — Bank Of America Corporation (US12547647B2)

Bank Of America Corporation · Google Patents
Google Patents · Patents · License: Open Access
Open Source ↗
bankofamericacorporation
patent, google patents, intellectual property, US12547647B2, Bank Of America Corporation, Ronnie J. Morris, en, 2026

ABSTRACT

Abstract

Machine learning models, semantic networks, adaptive systems, artificial neural networks, convolutional neural networks, and other forms of knowledge processing systems are disclosed. An ensemble machine learning system is coupled to a graph module storing a graph structure, wherein a collection of entities and the relationships between those entities forms nodes and connection arcs between the various nodes. A hotfile module and hotfile propagation engine coordinate with the graph module or may be subsumed within the graph module, and implement the various hot file functionality generated by the machine learning systems.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of and is a continuation of U.S. application Ser. No. 16/006,559, filed Jun. 12, 2018. The above application is incorporated by reference herein in its entirety.

TECHNICAL FIELD

This disclosure pertains to machine learning models, semantic networks, adaptive systems, artificial neural networks, convolutional neural networks, and other forms of knowledge processing systems. An ensemble machine learning system is coupled to a graph structure, wherein a collection of entities and the relationships between those entities forms nodes and connection arcs between the various nodes.

BACKGROUND

Machine learning has enabled the automated processing of problems formerly limited to human intervention. Traditionally, computers have been explicitly programmed to perform tasks, meaning that even fairly simple tasks can take significant amounts of programming time to implement. Machine learning may be used to allow a computer to perform the same or similar tasks without being explicitly programmed to do so. For example, where formerly a programmer may have manually programmed a face detection algorithm (e.g., providing code telling a computer to look for two eyes, a nose, and a mouth), machine learning may be used instead by providing a computer with a large set of pictures of human faces (e.g., some winking, some smiling, some partially obscured) and rewarding the computer for correct identifications of human faces over repeated trials. Colloquially, such methods may be said to allow a machine learning algorithm to both think and learn.

Machine learning has benefits far beyond programming efficiency: machines may also learn and identify correlations in data that would otherwise go undetected if reviewed by humans. For example, a video game company may know that players are likely to play video games during weekends, but may be unable to determine a formerly unknown correlation between weather (e.g., the cold and/or amount of snow) and the number of players on a game at any given time. While a human would be unlikely to detect such a correlation given the volume of data involved and a lack of a motivation to compare such datasets, a machine learning algorithm may do so largely without human intervention.

Machine learning algorithms are asked to label data in large data sets. For example, a machine learning algorithm may be asked to label a face in a photograph, or to indicate the presence or absence of a face in an entire photo. Other forms of machine learning algorithm output have been implemented. For example, a machine learning algorithm may be asked to make future predictions based on current data, may be asked to group data, may be asked to determine human-language responses to queries, or the like.

Machine learning is of increasing interest in fields where significant human time and subjective decision-making is otherwise necessary. Many voice-controlled artificial intelligence (“AI”) systems rely on machine learning to better understand spoken words and phrases. While human-programmed voice recognition systems have existed previously, machine learning algorithms allow for the rapid adaptation of voice-controlled AI systems to handle, for example, poorly spoken words and colloquialisms. Machine learning can even be used for areas of subjective taste. For example, some entities use uses machine learning to improve its video recommendation engine. While programming a video recommendation engine by hand is possible (e.g., one that recommends action movies if a user watches many action movies), machine learning algorithms have proven particularly adept at identifying and acting on user preferences that are not easily predicted.

Machine learning is still nascent in many fields, and the integration of its capabilities still leaves much room for improvement. In particular, there is little in the way of an ensemble machine learning system coupled to a graph structure that has a collection of entities/nodes and relationships/edges between those entities.

SUMMARY

The following summary presents a simplified summary of certain features. The summary is not an extensive overview and is not intended to identify key or critical elements.

In a first embodiment, a system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. One general aspect includes a machine learning system that optimizes a feature vector, the system including: a first interface configured to receive transaction data; a graph module configured to store and update a graph using the transaction data, the graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; and a machine learning engine including a plurality of machine learning sub-engines, where each entity type in the graph is assigned a separate machine learning sub-engine, the machine learning engine is programmed to perform steps including: training a machine learning model of a machine learning sub-engine of the machine learning engine using the transaction data; classifying a plurality of nodes in the graph based on known patterns in the transaction data and the machine learning model, by setting a classification attribute of each node to one of a plurality of classifications; detecting, by the machine learning sub-engine, an emerging pattern between a first node and second node in the graph based on the transaction data; inserting an edge between the first node and the second node in the graph in response to the detecting of the emerging pattern; and adjusting the feature vector based on an objective function to minimize a loss function. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The system where the machine learning engine including a plurality of machine learning sub-engines is an ensemble, where the first node is a first entity type and the second node is not the first entity type, and where the machine learning sub-engine is assigned to the first node and is different than a machine learning sub-engine assigned to the second node. The system where the ensemble includes a graphics processing unit. The system where the ensemble includes a semi-supervised machine learning engine. The system where the first node stored by the graph module corresponds to a device entity type and the second node stored by the graph module corresponds to a customer entity type, and where the edge inserted between the first node and the second node is in response to the ensemble detecting the emerging pattern between a customer's smartphone device and fraud. The system where the classifying of the first node in the graph includes populating a confidence attribute of the first node, based on the machine learning model. The system where the machine learning model corresponds to the machine learning sub-engine assigned to the entity type of the first node. The system where the adjusting the feature vector includes adding a feature to the feature vector. The system where the feature is a hardware identifier assigned to a device originating the transaction data received by the first interface. The system where the feature is one of: a phone number corresponding to a device originating the transaction data received by the first interface, a unique identifier assigned to a cookie corresponding to the transaction data, an email address, and a screen resolution of the device. The system where the adjusting the feature vector includes removing a feature from the feature vector. The system the system further including: a user computing device configured to originate the transaction data received by the first interface, where the transaction data includes a hardware identifier assigned to the user computing device, a phone number corresponding to the user computing device, a unique identifier assigned to a cookie corresponding to the transaction data, an email address, and a screen resolution of the user computing device. The system the system further including: a historical data store communicatively coupled to the graph module, where the historical data store includes historical transaction data corresponding to the plurality of nodes. The system where the graph module, in response to receiving a current event data, is configured to set the classification attribute of the first node to a value predicted by the machine learning engine. The system where the current event data includes at least one of: new transaction data, a report of a stolen card, an uninstallation of a software application from a device, and an installation of a software application onto a device. The system where the graph module is configured to update a confidence attribute of the first node based on the machine learning model that detected the emerging pattern. The apparatus where each entity type in the graph is assigned a separate machine learning sub-engine, and where a first machine learning sub-engine of the ensemble of machine learning sub-engines is a neural network, and where a second machine learning sub-engine of the ensemble of machine learning sub-engines is a Boltzmann machine, and where a third machine learning sub-engine of the ensemble of machine learning sub-engines is a restricted Boltzmann machine, and where a fourth machine learning sub-engine of the ensemble of machine learning sub-engines is an autoencoder. The non-transitory computer readable medium where the first entity type is a device entity type and the second entity type is a customer entity type, and where the edge inserted linking the first node to the second node is in response to the ensemble detecting a smartphone device corresponding to the first node is associated with a fraudulent transaction reported by a customer corresponding to the second node. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes an apparatus including: a first interface configured to receive transaction data; a graph module configured to store and update a graph using the transaction data, the graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; and an ensemble of machine learning sub-engines programmed to perform steps including: training a machine learning model of a machine learning sub-engine of the ensemble using a corpus, where the corpus includes a training data and a test data; classifying a plurality of nodes in the graph based on the machine learning model, by setting a classification attribute of a first node and a second node of the plurality of nodes to one of a plurality of classifications; and inserting an edge in the graph between the first node and the second node in response to the machine learning model detecting a pattern. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The apparatus where each entity type in the graph is assigned a separate machine learning sub-engine, and where a first machine learning sub-engine of the ensemble of machine learning sub-engines is a neural network, and where a second machine learning sub-engine of the ensemble of machine learning sub-engines is a Boltzmann machine, and where a third machine learning sub-engine of the ensemble of machine learning sub-engines is a restricted Boltzmann machine, and where a fourth machine learning sub-engine of the ensemble of machine learning sub-engines is an autoencoder. The non-transitory computer readable medium where the first entity type is a device entity type and the second entity type is a customer entity type, and where the edge inserted linking the first node to the second node is in response to the ensemble detecting a smartphone device corresponding to the first node is associated with a fraudulent transaction reported by a customer corresponding to the second node. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a non-transitory computer readable medium storing computer-executable instructions that, when executed by a graphics processing unit, cause an ensemble of machine learning sub-engines to: train a machine learning model of the ensemble of machine learning sub-engines using a corpus, where the corpus includes a training data and a test data; classify a plurality of nodes in a graph, which includes nodes and edges and is stored in computer memory, based on the machine learning model, by setting a classification attribute of a first node and a second node of the plurality of nodes to one of a plurality of classifications; and insert an edge in the graph between the first node and the second node in response to the machine learning model detecting a pattern, where the first node corresponds to a first entity type and the second node does not correspond to a second entity type. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The non-transitory computer readable medium where the first entity type is a device entity type and the second entity type is a customer entity type, and where the edge inserted linking the first node to the second node is in response to the ensemble detecting a smartphone device corresponding to the first node is associated with a fraudulent transaction reported by a customer corresponding to the second node. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

In a second embodiment, a system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. One general aspect includes a system including: a machine learning engine including a machine learning model trained using historical transaction data to identify a known pattern; a graph module configured to store and update a graph with incoming transaction data, the graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; a hotfile module configured to assign one or more functions to each node in the graph; and a hotfile propagation engine programmed to perform functions including: detecting in the incoming transaction data the known pattern identified by the machine learning engine; labeling the incoming transaction data by integrating a first node corresponding to the incoming transaction data into the graph and by inserting an edge linking the first node with an existing node in the graph, where the first node is an entity type based on the incoming transaction data; spreading heat from the existing node to the first node, where the heat corresponds to a classification attribute, and where an amount of the heat spread is based on a weight assigned to the edge connecting the first node with the existing node; fading the heat of the first node based on one or more conditions; and restricting one or more nodes in the graph based on the heat of the first node. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The system further including a feature vector, where the machine learning engine is configured to minimize a loss function based on an objective function using the feature vector. The system where the feature vector includes one or more of: a hardware identifier of a computing device that originated the incoming transaction data, a phone number of the computing device that originated the incoming transaction data, a unique identifier assigned to a cookie corresponding to the incoming transaction data, an email address, an email domain of the email address, a screen resolution of the computing device that originated the incoming transaction data, and an IP address of the computing device that originated the incoming transaction data. The system where the machine learning engi

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of and is a continuation of U.S. application Ser. No. 16/006,559, filed Jun. 12, 2018. The above application is incorporated by reference herein in its entirety.

TECHNICAL FIELD

This disclosure pertains to machine learning models, semantic networks, adaptive systems, artificial neural networks, convolutional neural networks, and other forms of knowledge processing systems. An ensemble machine learning system is coupled to a graph structure, wherein a collection of entities and the relationships between those entities forms nodes and connection arcs between the various nodes.

BACKGROUND

Machine learning has enabled the automated processing of problems formerly limited to human intervention. Traditionally, computers have been explicitly programmed to perform tasks, meaning that even fairly simple tasks can take significant amounts of programming time to implement. Machine learning may be used to allow a computer to perform the same or similar tasks without being explicitly programmed to do so. For example, where formerly a programmer may have manually programmed a face detection algorithm (e.g., providing code telling a computer to look for two eyes, a nose, and a mouth), machine learning may be used instead by providing a computer with a large set of pictures of human faces (e.g., some winking, some smiling, some partially obscured) and rewarding the computer for correct identifications of human faces over repeated trials. Colloquially, such methods may be said to allow a machine learning algorithm to both think and learn.

Machine learning has benefits far beyond programming efficiency: machines may also learn and identify correlations in data that would otherwise go undetected if reviewed by humans. For example, a video game company may know that players are likely to play video games during weekends, but may be unable to determine a formerly unknown correlation between weather (e.g., the cold and/or amount of snow) and the number of players on a game at any given time. While a human would be unlikely to detect such a correlation given the volume of data involved and a lack of a motivation to compare such datasets, a machine learning algorithm may do so largely without human intervention.

Machine learning algorithms are asked to label data in large data sets. For example, a machine learning algorithm may be asked to label a face in a photograph, or to indicate the presence or absence of a face in an entire photo. Other forms of machine learning algorithm output have been implemented. For example, a machine learning algorithm may be asked to make future predictions based on current data, may be asked to group data, may be asked to determine human-language responses to queries, or the like.

Machine learning is of increasing interest in fields where significant human time and subjective decision-making is otherwise necessary. Many voice-controlled artificial intelligence (“AI”) systems rely on machine learning to better understand spoken words and phrases. While human-programmed voice recognition systems have existed previously, machine learning algorithms allow for the rapid adaptation of voice-controlled AI systems to handle, for example, poorly spoken words and colloquialisms. Machine learning can even be used for areas of subjective taste. For example, some entities use uses machine learning to improve its video recommendation engine. While programming a video recommendation engine by hand is possible (e.g., one that recommends action movies if a user watches many action movies), machine learning algorithms have proven particularly adept at identifying and acting on user preferences that are not easily predicted.

Machine learning is still nascent in many fields, and the integration of its capabilities still leaves much room for improvement. In particular, there is little in the way of an ensemble machine learning system coupled to a graph structure that has a collection of entities/nodes and relationships/edges between those entities.

SUMMARY

The following summary presents a simplified summary of certain features. The summary is not an extensive overview and is not intended to identify key or critical elements.

In a first embodiment, a system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. One general aspect includes a machine learning system that optimizes a feature vector, the system including: a first interface configured to receive transaction data; a graph module configured to store and update a graph using the transaction data, the graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; and a machine learning engine including a plurality of machine learning sub-engines, where each entity type in the graph is assigned a separate machine learning sub-engine, the machine learning engine is programmed to perform steps including: training a machine learning model of a machine learning sub-engine of the machine learning engine using the transaction data; classifying a plurality of nodes in the graph based on known patterns in the transaction data and the machine learning model, by setting a classification attribute of each node to one of a plurality of classifications; detecting, by the machine learning sub-engine, an emerging pattern between a first node and second node in the graph based on the transaction data; inserting an edge between the first node and the second node in the graph in response to the detecting of the emerging pattern; and adjusting the feature vector based on an objective function to minimize a loss function. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The system where the machine learning engine including a plurality of machine learning sub-engines is an ensemble, where the first node is a first entity type and the second node is not the first entity type, and where the machine learning sub-engine is assigned to the first node and is different than a machine learning sub-engine assigned to the second node. The system where the ensemble includes a graphics processing unit. The system where the ensemble includes a semi-supervised machine learning engine. The system where the first node stored by the graph module corresponds to a device entity type and the second node stored by the graph module corresponds to a customer entity type, and where the edge inserted between the first node and the second node is in response to the ensemble detecting the emerging pattern between a customer's smartphone device and fraud. The system where the classifying of the first node in the graph includes populating a confidence attribute of the first node, based on the machine learning model. The system where the machine learning model corresponds to the machine learning sub-engine assigned to the entity type of the first node. The system where the adjusting the feature vector includes adding a feature to the feature vector. The system where the feature is a hardware identifier assigned to a device originating the transaction data received by the first interface. The system where the feature is one of: a phone number corresponding to a device originating the transaction data received by the first interface, a unique identifier assigned to a cookie corresponding to the transaction data, an email address, and a screen resolution of the device. The system where the adjusting the feature vector includes removing a feature from the feature vector. The system the system further including: a user computing device configured to originate the transaction data received by the first interface, where the transaction data includes a hardware identifier assigned to the user computing device, a phone number corresponding to the user computing device, a unique identifier assigned to a cookie corresponding to the transaction data, an email address, and a screen resolution of the user computing device. The system the system further including: a historical data store communicatively coupled to the graph module, where the historical data store includes historical transaction data corresponding to the plurality of nodes. The system where the graph module, in response to receiving a current event data, is configured to set the classification attribute of the first node to a value predicted by the machine learning engine. The system where the current event data includes at least one of: new transaction data, a report of a stolen card, an uninstallation of a software application from a device, and an installation of a software application onto a device. The system where the graph module is configured to update a confidence attribute of the first node based on the machine learning model that detected the emerging pattern. The apparatus where each entity type in the graph is assigned a separate machine learning sub-engine, and where a first machine learning sub-engine of the ensemble of machine learning sub-engines is a neural network, and where a second machine learning sub-engine of the ensemble of machine learning sub-engines is a Boltzmann machine, and where a third machine learning sub-engine of the ensemble of machine learning sub-engines is a restricted Boltzmann machine, and where a fourth machine learning sub-engine of the ensemble of machine learning sub-engines is an autoencoder. The non-transitory computer readable medium where the first entity type is a device entity type and the second entity type is a customer entity type, and where the edge inserted linking the first node to the second node is in response to the ensemble detecting a smartphone device corresponding to the first node is associated with a fraudulent transaction reported by a customer corresponding to the second node. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes an apparatus including: a first interface configured to receive transaction data; a graph module configured to store and update a graph using the transaction data, the graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; and an ensemble of machine learning sub-engines programmed to perform steps including: training a machine learning model of a machine learning sub-engine of the ensemble using a corpus, where the corpus includes a training data and a test data; classifying a plurality of nodes in the graph based on the machine learning model, by setting a classification attribute of a first node and a second node of the plurality of nodes to one of a plurality of classifications; and inserting an edge in the graph between the first node and the second node in response to the machine learning model detecting a pattern. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The apparatus where each entity type in the graph is assigned a separate machine learning sub-engine, and where a first machine learning sub-engine of the ensemble of machine learning sub-engines is a neural network, and where a second machine learning sub-engine of the ensemble of machine learning sub-engines is a Boltzmann machine, and where a third machine learning sub-engine of the ensemble of machine learning sub-engines is a restricted Boltzmann machine, and where a fourth machine learning sub-engine of the ensemble of machine learning sub-engines is an autoencoder. The non-transitory computer readable medium where the first entity type is a device entity type and the second entity type is a customer entity type, and where the edge inserted linking the first node to the second node is in response to the ensemble detecting a smartphone device corresponding to the first node is associated with a fraudulent transaction reported by a customer corresponding to the second node. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a non-transitory computer readable medium storing computer-executable instructions that, when executed by a graphics processing unit, cause an ensemble of machine learning sub-engines to: train a machine learning model of the ensemble of machine learning sub-engines using a corpus, where the corpus includes a training data and a test data; classify a plurality of nodes in a graph, which includes nodes and edges and is stored in computer memory, based on the machine learning model, by setting a classification attribute of a first node and a second node of the plurality of nodes to one of a plurality of classifications; and insert an edge in the graph between the first node and the second node in response to the machine learning model detecting a pattern, where the first node corresponds to a first entity type and the second node does not correspond to a second entity type. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The non-transitory computer readable medium where the first entity type is a device entity type and the second entity type is a customer entity type, and where the edge inserted linking the first node to the second node is in response to the ensemble detecting a smartphone device corresponding to the first node is associated with a fraudulent transaction reported by a customer corresponding to the second node. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

In a second embodiment, a system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. One general aspect includes a system including: a machine learning engine including a machine learning model trained using historical transaction data to identify a known pattern; a graph module configured to store and update a graph with incoming transaction data, the graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; a hotfile module configured to assign one or more functions to each node in the graph; and a hotfile propagation engine programmed to perform functions including: detecting in the incoming transaction data the known pattern identified by the machine learning engine; labeling the incoming transaction data by integrating a first node corresponding to the incoming transaction data into the graph and by inserting an edge linking the first node with an existing node in the graph, where the first node is an entity type based on the incoming transaction data; spreading heat from the existing node to the first node, where the heat corresponds to a classification attribute, and where an amount of the heat spread is based on a weight assigned to the edge connecting the first node with the existing node; fading the heat of the first node based on one or more conditions; and restricting one or more nodes in the graph based on the heat of the first node. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The system further including a feature vector, where the machine learning engine is configured to minimize a loss function based on an objective function using the feature vector. The system where the feature vector includes one or more of: a hardware identifier of a computing device that originated the incoming transaction data, a phone number of the computing device that originated the incoming transaction data, a unique identifier assigned to a cookie corresponding to the incoming transaction data, an email address, an email domain of the email address, a screen resolution of the computing device that originated the incoming transaction data, and an IP address of the computing device that originated the incoming transaction data. The system where the machine learning engine is configured to adjust the feature vector by adding a feature to the feature vector and removing a feature from the feature vector. The system where the machine learning engine is programmed to perform steps including: detecting an emerging pattern between the first node in the graph and fraud; causing the hotfile module to increase the weight assigned to the edge of the first node, where the amount of the heat spread is based on the weight assigned to the edge; and adjusting a feature vector based on the emerging pattern. The system where the first node corresponds to a customer entity type and the existing node in the graph corresponds to a device entity type. The system where the first node includes a confidence attribute, and the hotfile module is configured to update the confidence attribute of the first node based on the machine learning model. The system where the labeling function includes updating a confidence attribute of the first node based on the machine learning model. The system where the heat of the first node is one of: low, medium, and high. The system where the one or more conditions of the fading function include time and speed. The system further including: a historical data store communicatively coupled to the graph module, where the historical data store contains the historical transaction data. The system further including: a user computing device that originated the incoming transaction data, where the user computing device is configured to receive user input through a graphical user interface of the user computing device then transmit the user input to the machine learning system; where the machine learning system includes a supervised learning system that trains the machine learning model using the user input. The system where the machine learning engine includes a hardware graphics processing unit configured to execute train the machine learning model. The method further including: fading the heat of the first node based on one or more conditions. The method where the one or more conditions of the fading includes time and speed. The method where the heat of the first node is one of: low, medium, and high. The method where the heat is a numeric value within a predetermined range. The computer memory where the machine learning engine includes a machine learning model trained using historical transaction data, and where the heat is a numeric value within a predetermined range. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a method to automatically detect, label, spread, and fade heat in a graph stored in a graph module, where the graph module is communicatively coupled to a machine learning engine, a hotfile module, and a hotfile propagation engine, the method including: detecting in an incoming transaction data a known pattern identified by the machine learning engine; labeling the incoming transaction data by integrating a first node corresponding to the incoming transaction data into the graph and by inserting an edge linking the first node with an existing node in the graph, where the first node is an entity type based on the incoming transaction data; spreading heat from the existing node to the first node, where the heat corresponds to a classification attribute, and where an amount of the heat spread is based on a weight assigned to the edge connecting the first node with the existing node; and restricting one or more nodes in the graph based on the heat of the first node. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The method further including: fading the heat of the first node based on one or more conditions. The method where the one or more conditions of the fading includes time and speed. The method where the heat of the first node is one of: low, medium, and high. The method where the heat is a numeric value within a predetermined range. The computer memory where the machine learning engine includes a machine learning model trained using historical transaction data, and where the heat is a numeric value within a predetermined range. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a computer memory storing computer-executable instructions that, when executed by a graphics processing unit (GPU), cause a graph module, which is communicatively coupled to a machine learning engine, to: detect, by the GPU, in an incoming transaction data a known pattern identified by the machine learning engine; label, by the GPU, the incoming transaction data by integrating a first node corresponding to the incoming transaction data into a graph and by inserting an edge linking the first node with an existing node in the graph, where the first node is an entity type based on the incoming transaction data, and where the graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; spread heat, by the GPU, from the existing node to the first node, where the heat corresponds to a classification attribute, and where an amount of the heat spread is based on a weight assigned to the edge connecting the first node with the existing node; fade, by the GPU, the heat of the first node based on one or more conditions; and restrict one or more nodes in the graph based on the heat of the first node. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The computer memory where the machine learning engine includes a machine learning model trained using historical transaction data, and where the heat is a numeric value within a predetermined range. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

In a third embodiment, a system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. One general aspect includes a supervised machine learning system that optimizes a feature vector and trains on a corpus based on historical data, known patterns, and emerging patterns, the system including: a graph module configured to store and update a graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; a first interface configured to receive (i) historical data and (ii) current event data, where the (i) and (ii) are used to update the graph; a second interface configured to receive user input to classify a first set of nodes in the graph with one of a plurality of classifications; and a machine learning engine programmed to perform steps including: training a machine learning model of the machine learning engine using the corpus, where the corpus includes a training data and a test data; classifying a plurality of nodes in the graph based on the known patterns and the machine learning model, by setting a classification attribute of each node to one of a plurality of classifications, where the plurality of nodes exclude the first set of nodes; detecting, by the machine learning engine, an emerging pattern between a first node and second node in the graph based on the (i) and (ii); inserting an edge between the first node and the second node in the graph in response to the detecting of the emerging pattern; and adjusting the feature vector based on an objective function to minimize a loss function. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The system where the machine learning engine includes a plurality of supervised machine learning engines, where each unique entity type in the graph is assigned a separate supervised machine learning engine of the plurality of supervised machine learning engines. The system where the machine learning model corresponds to the supervised machine learning engine assigned to the entity type of the first node. The system where the classifying of the first node in the graph includes populating a confidence attribute of the first node, based on the machine learning model. The system where the adjusting the feature vector includes adding a feature to the feature vector. The system where the adjusting the feature vector includes removing a feature from the feature vector. The system the system further including: a historical data store communicatively coupled to first interface, where the test data includes the first set of nodes and their corresponding historical data stored in the historical data store. The system the system further including: a user computing device, which is communicatively coupled to the second interface, configured to transmit a user selection of the one of the plurality of classifications for the first set of nodes in the graph. The system where the graph module, in response to receiving the current event data through the first interface, is configured to set the classification attribute of the plurality of nodes to a value predicted by the machine learning engine. The system where the machine learning engine includes a graphics processing unit. The system where the machine learning engine is a semi-supervised machine learning engine. The system where the current event data includes at least one of: new transaction data, a report of a stolen card, an uninstallation of a software application from a device, and an installation of a software application onto a device. The system where the first node stored by the graph module corresponds to a device entity type and the second node stored by the graph module corresponds to a customer entity type, and where the edge inserted between the first node and the second node is in response to the machine learning engine detecting the emerging pattern between a customer's smartphone device and fraud. The system where the first node includes a confidence attribute, and the graph module is configured to update the confidence attribute of the first node based on the machine learning model that detected the emerging pattern. The system where the supervised machine learning engine is further programmed to optimize a feature vector and train on the corpus. The system further including a second interface configured to receive user input, where the detecting step of the supervised machine learning engine is further based on the user input. The system where the classifying of the plurality of noes in the graph includes populating a confidence attribute of each of the plurality of nodes, based on the machine learning model. The non-transitory computer readable medium where the processor includes a graphics processing unit. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a system including: a first interface configured to receive (i) historical data and (ii) current event data; a graph module configured to update a graph including nodes and edges, where each node corresponds to an entity type, and where each edge represents a relationship between two nodes; and a supervised machine learning engine programmed to perform steps including: training a machine learning model of the supervised machine learning engine using a corpus, where the corpus includes a training data and a test data; classifying a plurality of nodes in the graph based on a known pattern and the machine learning model, by setting a classification attribute of each node to one of a plurality of classifications; detecting, by the supervised machine learning engine, an emerging pattern between a first node and second node of the plurality of nodes in the graph based on at least the (i) and (ii); inserting an edge between the first node and the second node in the graph in response to the detecting of the emerging pattern; and adjusting a feature vector of the supervised machine learning engine based on an objective function to minimize a loss function. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The system where the supervised machine learning engine is further programmed to optimize a feature vector and train on the corpus. The system further including a second interface configured to receive user input, where the detecting step of the supervised machine learning engine is further based on the user input. The system where the classifying of the plurality of noes in the graph includes populating a confidence attribute of each of the plurality of nodes, based on the machine learning model. The non-transitory computer readable medium where the processor includes a graphics processing unit. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a non-transitory computer readable medium storing computer-executable instructions that, when executed by a processor, cause a machine learning engine to: train a machine learning model of the machine learning engine using a corpus, where the corpus includes a training data and a test data; classify a plurality of nodes in a graph stored in computer memory based on known patterns and the machine learning model, by setting a classification attribute of each node in the graph to one of a plurality of classifications; detect, by the machine learning engine, an emerging pattern between a first node and second node in the graph based on historical data and current event data; insert an edge between the first node and the second node in the graph in response to the detecting of the emerging pattern; and adjust a feature vector of the machine learning engine based on an objective function to minimize a loss function. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The non-transitory computer readable medium where the processor includes a graphics processing unit. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

In a fourth embodiment, a system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. One general aspect includes a system including: a graph module configured to store and update a graph including nodes and edges, where each node represents an entity type, and where each edge represents a relationship between two nodes; an unsupervised machine learning engine programmed to perform a decision-making process, the unsupervised machine learning engine further configured to: train the decision-making process based on historical data; and output, based on the trained decision-making process, a feature vector; a hotfile module configured to: receive current event data associated with the graph; determine, based on the feature vector and the trained decision-making process, an action to take with respect to the graph; and cause, a hotfile propagation engine, to execute the action. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The system where the hotfile module is further configured to: determine one or more identities of one or more entities that correspond to hotfile parameters, where determining the action to take is further based on the one or more identities of the one or more entities. The system where training the decision-making process based on the historical data includes configuring one or more computer nodes of the unsupervised machine learning engine without external feedback, and where the historical data is unlabeled. The system where the action includes one or more of: adding or removing a first entity that corresponds to a hotfile; adding or removing a first relationship between two entities of the one or more entities to the hotfile; or modifying permissions of nodes associated with one or more entities of the hotfile. The system where the current event data is associated with a transaction between two entities of the graph. The system where the historical data is associated with a plurality of transactions between entities of the graph. The method further including: determining the modification to the hotfile based on the first graph representation, the plurality of definitional functions, and historical hotfile data. The method where a first definitional function of the plurality of definitional functions indicates a degree of relationship between a first entity of the second plurality of entities and a second entity of the second plurality of entities. The method where training the artificial neural network includes providing, to the artificial neural network, data including the one or more graph representations, and where the data is unlabeled. The method where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The method where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The method further including: determining a transaction between at least two entities of the first plurality of entities; and causing, based on the hotfile, rejection of the transaction. The apparatus where the instructions, when executed by the one or more processors, cause the apparatus to: determining the modification to the hotfile based on the first graph representation, the plurality of definitional functions, and historical hotfile data. The apparatus where a first definitional function of the plurality of definitional functions indicates a degree of relationship between a first entity of the second plurality of entities and a second entity of the second plurality of entities. The apparatus where training the artificial neural network includes providing, to the artificial neural network, data including the one or more graph representations, and where the data is unlabeled. The apparatus where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The apparatus where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The apparatus where the instructions, when executed by the one or more processors, cause the apparatus to: determining a transaction between at least two entities of the first plurality of entities; and causing, based on the hotfile, rejection of the transaction. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a method including: determining data corresponding to one or more graph representations of a first plurality of entities, where the one or more graph representations indicate a plurality of relationships between at least two of the first plurality of entities, and where the one or more graph representations are unlabeled; training, using the data corresponding to the one or more graph representations, an artificial neural network for machine learning executing on one or more computing devices, where the artificial neural network includes a plurality of nodes, where the nodes are configured to process an input, and where the plurality of nodes are configured based on the one or more graph representations; determining a first graph representation including a second plurality of entities; determining a plurality of definitional functions corresponding to one or more of the second plurality of entities; and receiving, from the artificial neural network and based on the first graph representation and the plurality of definitional functions, output indicating a modification to a hotfile. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The method further including: determining the modification to the hotfile based on the first graph representation, the plurality of definitional functions, and historical hotfile data. The method where a first definitional function of the plurality of definitional functions indicates a degree of relationship between a first entity of the second plurality of entities and a second entity of the second plurality of entities. The method where training the artificial neural network includes providing, to the artificial neural network, data including the one or more graph representations, and where the data is unlabeled. The method where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The method where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The method further including: determining a transaction between at least two entities of the first plurality of entities; and causing, based on the hotfile, rejection of the transaction. The apparatus where the instructions, when executed by the one or more processors, cause the apparatus to: determining the modification to the hotfile based on the first graph representation, the plurality of definitional functions, and historical hotfile data. The apparatus where a first definitional function of the plurality of definitional functions indicates a degree of relationship between a first entity of the second plurality of entities and a second entity of the second plurality of entities. The apparatus where training the artificial neural network includes providing, to the artificial neural network, data including the one or more graph representations, and where the data is unlabeled. The apparatus where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The apparatus where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The apparatus where the instructions, when executed by the one or more processors, cause the apparatus to: determining a transaction between at least two entities of the first plurality of entities; and causing, based on the hotfile, rejection of the transaction. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes an apparatus including: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the apparatus to: determine data corresponding to one or more graph representations of a first plurality of entities, where the one or more graph representations indicate a plurality of relationships between at least two of the first plurality of entities, and where the one or more graph representations are unlabeled; train, using the data corresponding to the one or more graph representations, an artificial neural network for machine learning executing on one or more computing devices, where the artificial neural network includes a plurality of nodes, where the nodes are configured to process an input, and where the plurality of nodes are configured based on the one or more graph representations; determine a first graph representation including a second plurality of entities; determine a plurality of definitional functions corresponding to one or more of the second plurality of entities; and receive, from the artificial neural network and based on the first graph representation and the plurality of definitional functions, output indicating a modification to a hotfile. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The apparatus where the instructions, when executed by the one or more processors, cause the apparatus to: determining the modification to the hotfile based on the first graph representation, the plurality of definitional functions, and historical hotfile data. The apparatus where a first definitional function of the plurality of definitional functions indicates a degree of relationship between a first entity of the second plurality of entities and a second entity of the second plurality of entities. The apparatus where training the artificial neural network includes providing, to the artificial neural network, data including the one or more graph representations, and where the data is unlabeled. The apparatus where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The apparatus where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The apparatus where the instructions, when executed by the one or more processors, cause the apparatus to: determining a transaction between at least two entities of the first plurality of entities; and causing, based on the hotfile, rejection of the transaction. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

In a fifth embodiment, a system of one or more computers can be configured to perform particular operations or actions by virtue of having software, firmware, hardware, or a combination of them installed on the system that in operation causes or cause the system to perform the actions. One or more computer programs can be configured to perform particular operations or actions by virtue of including instructions that, when executed by data processing apparatus, cause the apparatus to perform the actions. One general aspect includes a system including: a graph module configured to store and update a graph including nodes and edges, where each node represents an entity, where each entity is associated with one or more classifications, and where each edge represents a relationship between two entities; one or more machine learning engines configured to perform a respective decision-making process, where each of the one or more machine learning engines is associated with at least one of the one or more classifications, and where each machine learning engine is further configured to: train the respective decision-making process based on historical data associated with the one of the one or more classifications; receive new data associated with the graph; and determine, based on the new data and using the trained respective decision-making process, hotfile parameters; and a hotfile propagation engine configured to: determine, based on the hotfile parameters and historical hotfile data, an action to take with respect to a hotfile; and cause the action. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The system where the hotfile propagation engine is further configured to: determine one or more identities of one or more entities that correspond to the hotfile parameters, where determining the action to take with respect to the hotfile is further based on the one or more identities of the one or more entities. The system where each of the one or more machine learning engines is associated with a different entity of the graph. The system where the action includes one or more of: adding or removing a first entity of a plurality of entities to the hotfile; adding or removing a first relationship between two entities of the plurality of entities to the hotfile; or modifying permissions of the hotfile associated with one or more entities of the plurality of entities. The system where the new data is associated with a transaction between two entities of the graph. The system where the historical data is associated with a plurality of transactions between entities of the graph. The method where each of the second plurality of entities is associated with a corresponding machine learning model. The method further includes determining a characterization of the first graph representation including: transmitting output from the first artificial neural network and the second artificial neural network to a third artificial neural network; and receiving, from the third artificial neural network, the modification to the hotfile. The method where the modification to the hotfile is based on historical hotfile data. The method where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The method where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The method further including: determining a transaction between at least two entities of the first plurality of entities; and causing, based on the hotfile, rejection of the transaction. The apparatus where each of the second plurality of entities is associated with a corresponding machine learning model. The apparatus where the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to: determine a characterization of the first graph representation including: transmitting output from the first artificial neural network and the second artificial neural network to a third artificial neural network; and receiving, from the third artificial neural network, the modification to the hotfile. The apparatus where the modification to the hotfile is based on historical hotfile data. The apparatus where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The apparatus where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The apparatus where the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to: determine a transaction between at least two entities of the first plurality of entities; and cause, based on the hotfile, rejection of the transaction. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes a method including: determining data corresponding to one or more graph representations of a first plurality of entities, where the one or more graph representations indicate a plurality of relationships between the first plurality of entities; training, for a first entity type, a first artificial neural network for machine learning executing on one or more first computing devices, where the first artificial neural network includes a plurality of nodes, and where the plurality of nodes are configured based on a first portion of the data corresponding to the first entity type; training, for a second entity type, a second artificial neural network for machine learning executing on the one or more first computing devices, where the second artificial neural network includes a second plurality of nodes, and where the second plurality of nodes are configured based on a second portion of the data corresponding to the second entity type; determining a first graph representation including a second plurality of entities, where the second plurality of entities includes a first entity corresponding to the first entity type and a second entity corresponding to the second entity type; and receiving, from the first artificial neural network and the second artificial neural network and based on the first graph representation, output indicating a modification to a hotfile. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

Implementations may include one or more of the following features. The method where each of the second plurality of entities is associated with a corresponding machine learning model. The method further includes determining a characterization of the first graph representation including: transmitting output from the first artificial neural network and the second artificial neural network to a third artificial neural network; and receiving, from the third artificial neural network, the modification to the hotfile. The method where the modification to the hotfile is based on historical hotfile data. The method where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The method where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The method further including: determining a transaction between at least two entities of the first plurality of entities; and causing, based on the hotfile, rejection of the transaction. The apparatus where each of the second plurality of entities is associated with a corresponding machine learning model. The apparatus where the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to: determine a characterization of the first graph representation including: transmitting output from the first artificial neural network and the second artificial neural network to a third artificial neural network; and receiving, from the third artificial neural network, the modification to the hotfile. The apparatus where the modification to the hotfile is based on historical hotfile data. The apparatus where the one or more graph representations are associated with one or more transactions between at least two of the plurality of entities. The apparatus where the modification to the hotfile causes a hotfile propagation engine to: add or remove a first entity of the first plurality of entities to the hotfile; add or remove a first relationship between two entities of the first plurality of entities to the hotfile; or modify permissions of the hotfile associated with one or more entities of the first plurality of entities. The apparatus where the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to: determine a transaction between at least two entities of the first plurality of entities; and cause, based on the hotfile, rejection of the transaction. Implementations of the described techniques may include hardware, a method or process, or computer software on a computer-accessible medium.

One general aspect includes an apparatus including: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the apparatus to: determine data corresponding to one or more graph representations of a first plurality of entities, where the one or more graph representations indicate a plurality of relationships between the first plurality of entities; train, for a first entity type, a first artificial neural network for mac

CLAIMS

Claims ( 13 )

What is claimed is:

1 . A method comprising:

determining data corresponding to one or more graph representations of a first plurality of entities, wherein the one or more graph representations indicate a plurality of relationships between the first plurality of entities; training, for a first entity type, a first artificial neural network for machine learning executing on one or more first computing devices, wherein the first artificial neural network comprises a plurality of nodes, and wherein the plurality of nodes is configured based on a first portion of the data corresponding to the first entity type; training, for a second entity type, a second artificial neural network for machine learning executing on the one or more first computing devices, wherein the second artificial neural network comprises a second plurality of nodes, and wherein the second plurality of nodes is configured based on a second portion of the data corresponding to the second entity type; determining a first graph representation comprising a second plurality of entities, wherein the second plurality of entities comprises a first entity corresponding to the first entity type and a second entity corresponding to the second entity type; and receiving, from the first artificial neural network and the second artificial neural network and based on the first graph representation, output indicating a modification to a hotfile, wherein the hotfile comprises a dynamic graph structure representing risk associated with transaction data.

2 . The method of claim 1 , wherein each entity of the second plurality of entities is associated with a corresponding machine learning model.

3 . The method of claim 1 , further comprises determining a characterization of the first graph representation comprising:

transmitting output from the first artificial neural network and the second artificial neural network to a third artificial neural network; and receiving, from the third artificial neural network, the modification to the hotfile.

4 . The method of claim 1 , wherein the modification to the hotfile is based on historical hotfile data.

5 . The method of claim 1 , wherein the one or more graph representations are associated with one or more transactions between at least two entities of the first plurality of entities.

6 . The method of claim 1 , wherein after the modification to the hotfile, further comprising:

adding or removing a first entity of the first plurality of entities to the hotfile; adding or removing a first relationship between two entities of the first plurality of entities to the hotfile; or modifying permissions of the hotfile associated with one or more entities of the first plurality of entities.

7 . The method of claim 1 , further comprising:

determining a transaction between at least two entities of the first plurality of entities; and causing, based on the hotfile, rejection of the transaction.

8 . An apparatus comprising:

one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the apparatus to:

determine data corresponding to one or more graph representations of a first plurality of entities, wherein the one or more graph representations indicate a plurality of relationships between the first plurality of entities;

train, for a first entity type, a first artificial neural network for machine learning executing on one or more first computing devices, wherein the first artificial neural network comprises a plurality of nodes, and wherein the plurality of nodes is configured based on a first portion of the data corresponding to the first entity type;

train, for a second entity type, a second artificial neural network for machine learning executing on the one or more first computing devices, wherein the second artificial neural network comprises a second plurality of nodes, and wherein the second plurality of nodes is configured based on a second portion of the data corresponding to the second entity type;

determine a first graph representation comprising a second plurality of entities, wherein the second plurality of entities comprises a first entity corresponding to the first entity type and a second entity corresponding to the second entity type; and

receive, from the first artificial neural network and the second artificial neural network and based on the first graph representation, output indicating a modification to a hotfile,

wherein the hotfile comprises a dynamic graph structure representing risk associated with transaction data.

9 . The apparatus of claim 8 , wherein each entity of the second plurality of entities is associated with a corresponding machine learning model.

10 . The apparatus of claim 8 , wherein the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to:

determine a characterization of the first graph representation comprising:

transmitting output from the first artificial neural network and the second artificial neural network to a third artificial neural network; and

receiving, from the third artificial neural network, the modification to the hotfile.

11 . The apparatus of claim 8 , wherein the modification to the hotfile is based on historical hotfile data.

12 . The apparatus of claim 8 , wherein the one or more graph representations are associated with one or more transactions between at least two entities of the first plurality of entities.

13 . The apparatus of claim 8 , wherein the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to:

determine a transaction between at least two entities of the first plurality of entities; and cause, based on the hotfile, rejection of the transaction.

US18/207,861

2018-06-12

2023-06-09

Unsupervised machine learning system to automate functions on a graph structure

Active

2038-10-21

US12547647B2

( en )

Priority Applications (1)

Application Number

Priority Date

Filing Date

Title

US18/207,861

US12547647B2

( en )

2018-06-12

2023-06-09

Unsupervised machine learning system to automate functions on a graph structure

Applications Claiming Priority (2)

Application Number

Priority Date

Filing Date

Title

US16/006,559

US11710033B2

( en )

2018-06-12

2018-06-12

Unsupervised machine learning system to automate functions on a graph structure

US18/207,861

US12547647B2

( en )

2018-06-12

2023-06-09

Unsupervised machine learning system to automate functions on a graph structure

Related Parent Applications (1)

Application Number

Title

Priority Date

Filing Date

US16/006,559

Continuation

US11710033B2

( en )

2018-06-12

2018-06-12

Unsupervised machine learning system to automate functions on a graph structure

Publications (2)

Publication Number

Publication Date

US20230316076A1

US20230316076A1 ( en )

2023-10-05

US12547647B2

true

US12547647B2 ( en )

2026-02-10

Family

ID=68765114

Family Applications (2)

Application Number

Title

Priority Date

Filing Date

US16/006,559

Active

2042-04-22

US11710033B2

( en )

2018-06-12

2018-06-12

Unsupervised machine learning system to automate functions on a graph structure

US18/207,861

Active

2038-10-21

US12547647B2

( en )

2018-06-12

2023-06-09

Unsupervised machine learning system to automate functions on a graph structure

Family Applications Before (1)

Application Number

Title

Priority Date

Filing Date

US16/006,559

Active

2042-04-22

US11710033B2

( en )

2018-06-12

2018-06-12

Unsupervised machine learning system to automate functions on a graph structure

Country Status (1)

Country

Link

US

( 2 )

US11710033B2

( en )

Families Citing this family (53)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US10664936B2

( en )

2013-03-15

2020-05-26

Csidentity Corporation

Authentication systems and methods for on-demand products

US10839791B2

( en )

*

2018-06-27

2020-11-17

International Business Machines Corporation

Neural network-based acoustic model with softening target-layer

US11374950B2

( en )

*

2018-06-29

2022-06-28

The Mitre Corporation

Anomaly detection in complex systems

US11375404B2

( en )

*

2018-07-16

2022-06-28

Revokind, Inc.

Decentralized infrastructure methods and systems

US11003766B2

( en )

*

2018-08-20

2021-05-11

Microsoft Technology Licensing, Llc

Enhancing cybersecurity and operational monitoring with alert confidence assignments

US11868440B1

( en )

*

2018-10-04

2024-01-09

A9.Com, Inc.

Statistical model training systems

AU2019366949B2

( en )

*

2018-10-23

2024-06-13

Yext, Inc.

Knowledge search system

US11057409B1

( en )

*

2019-01-16

2021-07-06

Akitra, Inc.

Apparatus having engine using artificial intelligence for detecting anomalies in a computer network

JP7306446B2

( en )

*

2019-02-22

2023-07-11

日本電気株式会社

Anomaly detection device, anomaly detection method, and program

CN109948117B

( en )

*

2019-03-13

2023-04-07

南京航空航天大学

Satellite anomaly detection method for network self-encoder

JP7114528B2

( en )

*

2019-07-08

2022-08-08

株式会社東芝

Reasoning device, learning device, reasoning method and learning method

CN118349673A

( en )

*

2019-09-12

2024-07-16

华为技术有限公司

Text processing model training method, text processing method and device

US11294756B1

( en )

*

2019-09-19

2022-04-05

Amazon Technologies, Inc.

Anomaly detection in a network

US11836159B2

( en )

2019-10-11

2023-12-05

Visa International Service Association

System, method, and computer program product for analyzing a relational database using embedding learning

JP7242508B2

( en )

*

2019-10-29

2023-03-20

株式会社東芝

Information processing device, information processing method, and program

US11386408B2

( en )

*

2019-11-01

2022-07-12

Intuit Inc.

System and method for nearest neighbor-based bank account number validation

US11562203B2

( en )

*

2019-12-30

2023-01-24

Servicenow Canada Inc.

Method of and server for training a machine learning algorithm for estimating uncertainty of a sequence of models

US11687778B2

( en )

2020-01-06

2023-06-27

The Research Foundation For The State University Of New York

Fakecatcher: detection of synthetic portrait videos using biological signals

US11403643B2

( en )

*

2020-01-24

2022-08-02

Adobe Inc.

Utilizing a time-dependent graph convolutional neural network for fraudulent transaction identification

US20210241120A1

( en )

*

2020-01-30

2021-08-05

Experian Information Solutions, Inc.

Systems and methods for identifying synthetic identities

US11526814B2

( en )

*

2020-02-12

2022-12-13

Wipro Limited

System and method for building ensemble models using competitive reinforcement learning

US20230080172A1

( en )

*

2020-03-13

2023-03-16

Hewlett-Packard Development Company, L.P.

Transmitting node instructions

WO2021192249A1

( en )

*

2020-03-27

2021-09-30

日本電気株式会社

Degree of similarity calculator, verification system, degree of similarity calculation method, degree of similarity calculation program, and method for generating degree of similarity calculation program

US12039538B2

( en )

2020-04-01

2024-07-16

Visa International Service Association

System, method, and computer program product for breach detection using convolutional neural networks

CN111352229B

( en )

*

2020-04-07

2021-10-08

华中科技大学

A virtual multi-plane imaging system and method

US11568317B2

( en )

2020-05-21

2023-01-31

Paypal, Inc.

Enhanced gradient boosting tree for risk and fraud modeling

EP3913544B1

( en )

*

2020-05-22

2025-03-12

Toyota Jidosha Kabushiki Kaisha

A computer-implemented training method, classification method and system, computer program and computer-readable recording medium

CN112069903B

( en )

*

2020-08-07

2023-12-22

之江实验室

Implementing end-side offloading computing method and device for face recognition based on deep reinforcement learning

WO2022054079A1

( en )

*

2020-09-08

2022-03-17

Iqreate Infotech Pvt Ltd

System for contextual and positional parameterized record building

EP3975092B1

( en )

*

2020-09-29

2025-04-30

MasterCard International Incorporated

Method and system for detecting fraudulent transactions

US11928182B1

( en )

*

2020-11-30

2024-03-12

Amazon Technologies, Inc.

Artificial intelligence system supporting semi-supervised learning with iterative stacking

US20240086926A1

( en )

*

2021-01-19

2024-03-14

Visa International Service Association

System, Method, and Computer Program Product for Generating Synthetic Graphs That Simulate Real-Time Transactions

US20220245643A1

( en )

*

2021-01-29

2022-08-04

Walmart Apollo, Llc

Methods and apparatus for electronic detection of fraudulent transactions using machine learning processes

US11887172B2

( en )

2021-01-29

2024-01-30

Walmart Apollo, Llc

Methods and apparatus for electronic detection of fraudulent transactions using machine learning processes

US12175469B2

( en )

2021-01-29

2024-12-24

Walmart Apollo, Llc

Methods and apparatus for electronic detection of fraudulent transactions using machine learning processes

US12217190B2

( en )

*

2021-02-03

2025-02-04

Bank Of America Corporation

Decision making using integrated machine learning models and knowledge graphs

US12536428B2

( en )

*

2021-02-24

2026-01-27

International Business Machines Corporation

Knowledge graphs in machine learning decision optimization

US12169844B2

( en )

*

2021-06-30

2024-12-17

EMC IP Holding Company LLC

Methods and systems for identifying breakpoints in variable impact on model results

CN116157791A

( en )

*

2021-09-18

2023-05-23

京东方科技集团股份有限公司

A text recommendation method, model training method, device and readable storage medium

US11874732B2

( en )

*

2021-09-24

2024-01-16

Bmc Software, Inc.

Recommendations for remedial actions

CN118056207A

( en )

*

2021-12-07

2024-05-17

渊慧科技有限公司

Large-scale retrieval for sequence generation

CN114139729B

( en )

*

2022-01-29

2022-05-10

北京易真学思教育科技有限公司

Machine learning model training method and device, and text recognition method and device

US20230409979A1

( en )

*

2022-05-20

2023-12-21

RIBBIT Inc.

Machine learning-based graph analytics for user evaluation

CN117668302A

( en )

*

2022-08-26

2024-03-08

华为技术有限公司

Graph computing method, device and computing equipment

CN115202661B

( en )

*

2022-09-15

2022-11-29

深圳大学

Hybrid generation method with hierarchical structure layout and related equipment

US12205115B2

( en )

*

2022-09-15

2025-01-21

Paypal, Inc.

Data mining framework for segment prediction

US12400433B2

( en )

*

2022-10-26

2025-08-26

Shopify Inc.

System and method for automated construction of data sets for retraining a machine learning model

US12288215B2

( en )

*

2022-12-01

2025-04-29

Bank Of America Corporation

Multidimensional transaction pattern tracking and prediction

GB2625390B

( en )

*

2023-01-30

2025-01-29

Lloyds Banking Group Plc

Methods and systems for indicating the possibility of a cyber-attack on a computer network

US12585946B2

( en )

*

2023-03-30

2026-03-24

Microsoft Technology Licensing, Llc

Heterogeneous tree graph neural network for label prediction

US20250175484A1

( en )

*

2023-11-28

2025-05-29

Crowdstrike, Inc.

Risk scoring of cloud permission assignments using supervised machine learning

WO2025239929A1

( en )

*

2024-05-15

2025-11-20

Fidelity Information Services, Llc

Artificial intelligence for fraud detection

US12627481B2

( en )

2024-10-11

2026-05-12

Bank Of America Corporation

System and method for quantum-based data encryption and transmission

Citations (32)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US20050024398A1

( en )

2002-03-29

2005-02-03

Canon Kabushiki Kaisha

Printing apparatus and ink-consumption amount management method

US6961734B2

( en )

2002-01-17

2005-11-01

International Business Machines Corporation

Method, system, and program for defining asset classes in a digital library

US7171557B2

( en )

2001-10-31

2007-01-30

Hewlett-Packard Development Company, L.P.

System for optimized key management with file groups

US20070174214A1

( en )

2005-04-13

2007-07-26

Robert Welsh

Integrated fraud management systems and methods

US7562814B1

( en )

2003-05-12

2009-07-21

Id Analytics, Inc.

System and method for identity-based fraud detection through graph anomaly detection

US7720882B2

( en )

2007-03-03

2010-05-18

Industrial Technology Research Institute

Data file management and search method and system based on file attributes

US20100169137A1

( en )

2008-12-31

2010-07-01

Ebay Inc.

Methods and systems to analyze data using a graph

US7836065B2

( en )

2005-11-01

2010-11-16

Sap Ag

Searching multiple repositories in a digital information system

US20110022483A1

( en )

2009-07-22

2011-01-27

Ayman Hammad

Apparatus including data bearing medium for reducing fraud in payment transactions using a black list

US7908645B2

( en )

2005-04-29

2011-03-15

Oracle International Corporation

System and method for fraud monitoring, detection, and tiered user authentication

US8005842B1

( en )

2007-05-18

2011-08-23

Google Inc.

Inferring attributes from search queries

US8010454B2

( en )

2002-12-17

2011-08-30

Paper Payment Services Llc

System and method for preventing fraud in check orders

US8037113B2

( en )

2009-01-20

2011-10-11

Novell, Inc.

Techniques for file system searching

US8086638B1

( en )

2010-03-31

2011-12-27

Emc Corporation

File handle banking to provide non-disruptive migration of files

US20120226590A1

( en )

2011-03-01

2012-09-06

Early Warning Services, Llc

System and method for suspect entity detection and mitigation

US8296301B2

( en )

2008-01-30

2012-10-23

Commvault Systems, Inc.

Systems and methods for probabilistic data classification

US8296312B1

( en )

2008-01-14

2012-10-23

Netapp, Inc.

Search and update of attributes in file systems

US8316008B1

( en )

2006-04-14

2012-11-20

Mirapoint Software, Inc.

Fast file attribute search

US8700684B2

( en )

2009-11-03

2014-04-15

Pspace Inc.

Apparatus and method for managing a file in a distributed storage system

US8762298B1

( en )

2011-01-05

2014-06-24

Narus, Inc.

Machine learning based botnet detection using real-time connectivity graph based traffic features

US9087088B1

( en )

2012-11-13

2015-07-21

American Express Travel Related Services Company, Inc.

Systems and methods for dynamic construction of entity graphs

US9113001B2

( en )

2005-04-21

2015-08-18

Verint Americas Inc.

Systems, methods, and media for disambiguating call data to determine fraud

US20160307115A1

( en )

2014-03-25

2016-10-20

Tencent Technology (Shenzhen) Company Limited

Method and apparatus for acquiring training parameters for a model

US9547651B1

( en )

2014-03-31

2017-01-17

EMC IP Holding Company LLC

Establishing file relationships based on file operations

US20170169432A1

( en )

2015-12-15

2017-06-15

Mastercard International Incorporated

System and method of identifying baker's fraud in transactions

US9747644B2

( en )

2013-03-15

2017-08-29

Mastercard International Incorporated

Transaction-history driven counterfeit fraud risk management solution

US20180113899A1

( en )

2016-10-20

2018-04-26

Linkedin Corporation

Online fraud detection system in an electronic content exchange

US20180150572A1

( en )

2016-11-30

2018-05-31

Facebook, Inc.

Joint modeling of user and content feature vector data based on third party source data

US10009358B1

( en )

2014-02-11

2018-06-26

DataVisor Inc.

Graph based framework for detecting malicious or compromised accounts

US20180330258A1

( en )

2017-05-09

2018-11-15

Theodore D. Harris

Autonomous learning platform for novel feature discovery

US10628826B2

( en )

2015-11-24

2020-04-21

Vesta Corporation

Training and selection of multiple fraud detection models

US20210027182A1

( en )

2018-03-21

2021-01-28

Visa International Service Association

Automated machine learning systems and methods

Family Cites Families (1)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US10424185B2

( en )

2017-11-17

2019-09-24

International Business Machines Corporation

Responding to personal danger using a mobile electronic device

2018

2018-06-12

US

US16/006,559

patent/US11710033B2/en

active

Active

2023

2023-06-09

US

US18/207,861

patent/US12547647B2/en

active

Active

Patent Citations (32)

* Cited by examiner, † Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US7171557B2

( en )

2001-10-31

2007-01-30

Hewlett-Packard Development Company, L.P.

System for optimized key management with file groups

US6961734B2

( en )

2002-01-17

2005-11-01

International Business Machines Corporation

Method, system, and program for defining asset classes in a digital library

US20050024398A1

( en )

2002-03-29

2005-02-03

Canon Kabushiki Kaisha

Printing apparatus and ink-consumption amount management method

US8010454B2

( en )

2002-12-17

2011-08-30

Paper Payment Services Llc

System and method for preventing fraud in check orders

US7562814B1

( en )

2003-05-12

2009-07-21

Id Analytics, Inc.

System and method for identity-based fraud detection through graph anomaly detection

US20070174214A1

( en )

2005-04-13

2007-07-26

Robert Welsh

Integrated fraud management systems and methods

US9113001B2

( en )

2005-04-21

2015-08-18

Verint Americas Inc.

Systems, methods, and media for disambiguating call data to determine fraud

US7908645B2

( en )

2005-04-29

2011-03-15

Oracle International Corporation

System and method for fraud monitoring, detection, and tiered user authentication

US7836065B2

( en )

2005-11-01

2010-11-16

Sap Ag

Searching multiple repositories in a digital information system

US8316008B1

( en )

2006-04-14

2012-11-20

Mirapoint Software, Inc.

Fast file attribute search

US7720882B2

( en )

2007-03-03

2010-05-18

Industrial Technology Research Institute

Data file management and search method and system based on file attributes

US8005842B1

( en )

2007-05-18

2011-08-23

Google Inc.

Inferring attributes from search queries

US8296312B1

( en )

2008-01-14

2012-10-23

Netapp, Inc.

Search and update of attributes in file systems

US8296301B2

( en )

2008-01-30

2012-10-23

Commvault Systems, Inc.

Systems and methods for probabilistic data classification

US20100169137A1

( en )

2008-12-31

2010-07-01

Ebay Inc.

Methods and systems to analyze data using a graph

US8037113B2

( en )

2009-01-20

2011-10-11

Novell, Inc.

Techniques for file system searching

US20110022483A1

( en )

2009-07-22

2011-01-27

Ayman Hammad

Apparatus including data bearing medium for reducing fraud in payment transactions using a black list

US8700684B2

( en )

2009-11-03

2014-04-15

Pspace Inc.

Apparatus and method for managing a file in a distributed storage system

US8086638B1

( en )

2010-03-31

2011-12-27

Emc Corporation

File handle banking to provide non-disruptive migration of files

US8762298B1

( en )

2011-01-05

2014-06-24

Narus, Inc.

Machine learning based botnet detection using real-time connectivity graph based traffic features

US20120226590A1

( en )

2011-03-01

2012-09-06

Early Warning Services, Llc

System and method for suspect entity detection and mitigation

US9087088B1

( en )

2012-11-13

2015-07-21

American Express Travel Related Services Company, Inc.

Systems and methods for dynamic construction of entity graphs

US9747644B2

( en )

2013-03-15

2017-08-29

Mastercard International Incorporated

Transaction-history driven counterfeit fraud risk management solution

US10009358B1

( en )

2014-02-11

2018-06-26

DataVisor Inc.

Graph based framework for detecting malicious or compromised accounts

US20160307115A1

( en )

2014-03-25

2016-10-20

Tencent Technology (Shenzhen) Company Limited

Method and apparatus for acquiring training parameters for a model

US9547651B1

( en )

2014-03-31

2017-01-17

EMC IP Holding Company LLC

Establishing file relationships based on file operations

US10628826B2

( en )

2015-11-24

2020-04-21

Vesta Corporation

Training and selection of multiple fraud detection models

US20170169432A1

( en )

2015-12-15

2017-06-15

Mastercard International Incorporated

System and method of identifying baker's fraud in transactions

US20180113899A1

( en )

2016-10-20

2018-04-26

Linkedin Corporation

Online fraud detection system in an electronic content exchange

US20180150572A1

( en )

2016-11-30

2018-05-31

Facebook, Inc.

Joint modeling of user and content feature vector data based on third party source data

US20180330258A1

( en )

2017-05-09

2018-11-15

Theodore D. Harris

Autonomous learning platform for novel feature discovery

US20210027182A1

( en )

2018-03-21

2021-01-28

Visa International Service Association

Automated machine learning systems and methods

Non-Patent Citations (72)

* Cited by examiner, † Cited by third party

Title

" 1.11. Ensemble Methods ", Scikit learn, date unknown, retrieved from internet May 2, 2018, URL: http://scikit-learn.org/stable/modules/ensemble.html, 20 pp.

" A Guide to TF Layers: Building a Convolutional Neural Network ", date unknown, retrieved from internet May 2, 2018, URL: https://www.tensorflow.org/tutorials/layers, 17 pp.

" Anomaly Detection Using K-Means Clustering ", Jun. 30, 2015, retrieved from internet May 2, 2018, URL: https://anomaly.io/anomaly-detection-clustering/.

<t

Related documents

Record · ID 607045
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.