Abstract: A method may include generating a vector from unstructured data included in an untransformed transaction, and determining, for the vector, a cluster ID of cluster IDs by matching the vector with a matching cluster vector of cluster vectors. The method may further include generating a query using the cluster ID and the untransformed transaction, and transforming, using the cluster IDs, untransformed transactions to transformed transactions. The transformed transactions may each include a cluster ID. The method may further include generating, using the query, a query result from features of the transformed transactions, generating a fraud score using the query result, and presenting the fraud score and the cluster ID.

Abstract: Aspects of the present disclosure relate to proactive intervention in a software application. Embodiments include selecting, by a proactive intervention system related to an application, an event of a plurality of events related to use of the application for processing based on event priorities associated with the plurality of events. Embodiments further include receiving, by the proactive intervention system, contextual information related to the event. Embodiments further include determining, by the proactive intervention system, a proactive intervention based on the event and the contextual information. Embodiments further include determining, by the proactive intervention system, that the proactive intervention can presently be provided based on intervention availability data. Embodiments further include providing, by the proactive intervention system, the proactive intervention via a user interface associated with the application.