Abstract: A method of categorizing a recent transaction as anomalous includes a) receiving information about a recent transaction and b) accessing information about one or more historical transactions. The one or more historical transactions have at least one party in common with the recent transaction. The method also includes c) determining a similarity value between the recent transaction and a transaction i of the one or more historical transactions and d) determining if the similarity value is greater than or equal to a predetermined threshold value. The method further includes e) if the similarity is greater than or equal to the predetermined threshold value, categorizing the recent transaction as not anomalous or f) if the similarity is less than the predetermined threshold value, determining if there are additional transactions. If there are additional transactions, incrementing counter i and repeating steps c) through f).

Abstract: A method of determining a clustering metric includes receiving a first set of transactions and a second set of transactions. For transaction i of the first set and transaction j of the second set, the method includes (a) determining an intersection set, (b) determining a union set; (c) computing a common linkage between transaction i and transaction j equal to the intersection set divided by the union set, and (d) incrementing index j and repeating steps (a)-(c). The method also includes (e) summing the common linkages between transaction i and the transactions of the second set, (f) normalizing the sum of the common linkages by a number of the second set, and (g) incrementing index i and repeating steps (a)-(f). The method further includes (h) summing the normalized common linkages and (i) normalizing the sum of the normalized common linkages by a number of the first set.

Abstract: A method of computing a similarity between a first transaction having a set of properties and a second transaction having the set of properties includes computing an initial weight for each of the properties of the set of properties and computing a similarity between each of the properties of the first transaction and the properties of the second transaction. The method also includes adjusting the initial weight for each of the properties based on a measure of the commonness of each of the properties of the set of properties, normalizing the adjusted weights, and computing the similarity by summing the products of the normalized adjusted weights and the computed similarities.

Abstract: A method of determining a clustering metric includes receiving a first set of transactions and a second set of transactions. For transaction i of the first set and transaction j of the second set, the method includes (a) determining an intersection set, (b) determining a union set; (c) computing a common linkage between transaction i and transaction j equal to the intersection set divided by the union set, and (d) incrementing index j and repeating steps (a)-(c). The method also includes (e) summing the common linkages between transaction i and the transactions of the second set, (f) normalizing the sum of the common linkages by a number of the second set, and (g) incrementing index i and repeating steps (a)-(f). The method further includes (h) summing the normalized common linkages and (i) normalizing the sum of the normalized common linkages by a number of the first set.

Abstract: A method of categorizing a recent transaction as anomalous includes a) receiving information about a recent transaction and b) accessing information about one or more historical transactions. The one or more historical transactions have at least one party in common with the recent transaction. The method also includes c) determining a similarity value between the recent transaction and a transaction i of the one or more historical transactions and d) determining if the similarity value is greater than or equal to a predetermined threshold value. The method further includes e) if the similarity is greater than or equal to the predetermined threshold value, categorizing the recent transaction as not anomalous or f) if the similarity is less than the predetermined threshold value, determining if there are additional transactions. If there are additional transactions, incrementing counter i and repeating steps c) through f).

Abstract: A method of determining a clustering metric includes receiving a first set of transactions and a second set of transactions. For transaction i of the first set and transaction j of the second set, the method includes (a) determining an intersection set, (b) determining a union set; (c) computing a common linkage between transaction i and transaction j equal to the intersection set divided by the union set, and (d) incrementing index j and repeating steps (a)-(c). The method also includes (e) summing the common linkages between transaction i and the transactions of the second set, (f) normalizing the sum of the common linkages by a number of the second set, and (g) incrementing index i and repeating steps (a)-(f). The method further includes (h) summing the normalized common linkages and (i) normalizing the sum of the normalized common linkages by a number of the first set.

Abstract: A method of computing a similarity between a first transaction having a set of properties and a second transaction having the set of properties includes computing an initial weight for each of the properties of the set of properties and computing a similarity between each of the properties of the first transaction and the properties of the second transaction. The method also includes adjusting the initial weight for each of the properties based on a measure of the commonness of each of the properties of the set of properties, normalizing the adjusted weights, and computing the similarity by summing the products of the normalized adjusted weights and the computed similarities.