Abstract: Computer vision and deep learning techniques are leveraged to detect behavior patterns in transaction histories. A transaction timeline is built for a series of transactions, e.g., financial, and a graphic image is constructed representing the transaction timeline. The graphic image is then matched to a known behavior pattern using a cognitive system. The cognitive system is trained with historical timeline images having associated labels. In one example the graphic image is a bar chart and each financial transaction is represented as a bar in the bar chart having a height proportional to a transaction amount, the bar being located along a time axis of the bar chart according to the transaction date and being color coded according to the transaction type.

Abstract: A detection modeling system has a processing device and a memory coupled to the processing device. The detection modeling system is configured to obtain health value data associated with an analytical model, determine a time period at which the model was trained based on the obtained health value data, and identify a survival time period of the model based on the determined time period at which the model was trained and a failure time period of the model. The detection modeling system is further configured to repeat these steps to determine a survival time period for a plurality of analytical models, and perform a survival analysis based on the survival time period for the plurality of analytical models.

Abstract: A detection modeling system performs a distribution analysis to alert to model degradation. The detection modeling system may have a distribution analysis module configured to perform an alerting process in conjunction with a processing device. The distribution analysis module may select, by the processing device, model metrics for analysis, the model metrics being a measure of a parameter associated with the analytical model and determine normal distributions for model metric results for each of the selected model metrics. The detection modeling system may further receive model metric values for each of the selected model metric, compare, by the processing device, the model metric values to the normal distributions for model metric results for each of the received model metric value, and alert, by the processing device, to model degradation of the analytical model based on the comparison of the model metric values to the normal distributions for model metric results.

Abstract: The disclosed embodiments include a method for performing financial fraud assessment that includes creating a machine learning model based on features used to identify financial fraud risk; receiving financial information associated with customer accounts; establishing communities for the customer accounts; creating a baseline set of the features for each of the communities; receiving new financial information associated with customer accounts; updating the communities for the customer accounts based on the new financial information; extracting an updated set of the features for each of the communities; and determining a difference between the baseline set of the features and the updated set of the features for each of the communities; and using the machine learning model to determine financial fraud risk for each of the communities based on the difference between the baseline set of the features and the updated set of the features for each of the communities.

Abstract: A computer-implemented method for performing financial fraud assessment, the method includes receiving financial information associated with customer accounts that have been identified as being associated with suspicious financial activity; establishing communities for the customer accounts; creating a baseline set of features for each of the communities; receiving new financial information associated with customer accounts; updating the communities for the customer accounts based on the new financial information; extracting an updated set of features for each of the communities; and performing fraud assessment by determining whether a change between the updated set of features and the baseline set of features for each of the communities is indicative of an increased risk of fraud.

Abstract: An entity resolution system performs a method of resolving one or more candidate entities based on a data set. The entity resolution system has a machine learning module and a narrative module. The machine learning module generates a synthesized data set, the synthesized data set comprising similarity ratings for each entity feature. The narrative module applies a clustering analysis to determine one or more distances between the group of similarity ratings for each entity feature and one or more clusters associated with known relationships between entities, generates a narrative output based on one or more distances. The narrative output states at least one identified relationship between at least two entities of the plurality of candidate entities and a confidence score. The narrative engine also provides the narrative output to a user interface.

Abstract: An entity resolution system performs a method of resolving one or more candidate entities based on a data set. The entity resolution system has a rules-based module, a machine learning module, a narrative module, and an evaluation module. The rules-based module compares the first entity features to the second entity features and determines whether a rule identifies a relationship between the first entity and the second entity. The machine learning module rates a similarity of the first entity features and the second entity features. The narrative module generates a narrative output based on one or more of the rules-based module and the machine learning module, the narrative output stating an identified relationship between the first entity and the second entity. The evaluation module determines one or more metrics to apply feedback to the system.

Abstract: A detection modeling system performs a distribution analysis to alert to model degradation. The detection modeling system may have a distribution analysis module configured to perform an alerting process in conjunction with a processing device. The distribution analysis module may receive a risk tolerance rating for alerting to degradation of an analytical model, and determine a threshold value for a model metric based on the risk tolerance rating. The model metric may be a measure of a parameter associated with the analytical model. The distribution analysis module may also monitor the analytical model for degradation using the threshold value for the model metric and model metric values and alert to model degradation of the analytical model based on the monitoring of the analytical model.

Abstract: A detection modeling system for alerting to analytical model degradation has a processing device and a memory coupled to the processing device. The detection modeling system is configured to perform a distribution analysis on the selected detection model to determine a first health rating for the selected detection model, perform a survival analysis on the selected detection model to determine a second health rating for the selected detection model, generate an indicative score for the detection model based on the first health rating and the second health rating, and compare the indicative score to a threshold value and alert to model degradation based on the comparison.

Abstract: Computer vision and deep learning techniques are leveraged to detect behavior patterns in transaction histories. A transaction timeline is built for a series of transactions, e.g., financial, and a graphic image is constructed representing the transaction timeline. The graphic image is then matched to a known behavior pattern using a cognitive system. The cognitive system is trained with historical timeline images having associated labels. In one example the graphic image is a bar chart and each financial transaction is represented as a bar in the bar chart having a height proportional to a transaction amount, the bar being located along a time axis of the bar chart according to the transaction date and being color coded according to the transaction type.

Abstract: A detection modeling system for alerting to analytical model degradation has a processing device and a memory coupled to the processing device. The detection modeling system is configured to perform a distribution analysis on the selected detection model to determine a first health rating for the selected detection model, perform a survival analysis on the selected detection model to determine a second health rating for the selected detection model, generate an indicative score for the detection model based on the first health rating and the second health rating, and compare the indicative score to a threshold value and alert to model degradation based on the comparison.

Abstract: A detection modeling system for alerting to analytical model degradation has a processing device and a memory coupled to the processing device. The detection modeling system is configured to perform a distribution analysis on a selected detection model to determine a first health rating for the selected detection model. The detection modeling system is further configured to perform a survival analysis on the selected detection model to determine a second health rating for the selected detection model. The detection modeling system further generates an indicative score for the detection model based on the first health rating, the second health rating, and an ensemble weighting of the first health rating and the second health rating, and compares the indicative score to a threshold value to alert to model degradation based on the comparison.

Abstract: A detection modeling system has a processing device and a memory coupled to the processing device. The detection modeling system is configured to obtain health value data associated with an analytical model, determine a time period at which the model was trained based on the obtained health value data, and identify a survival time period of the model based on the determined time period at which the model was trained and a failure time period of the model. The detection modeling system is further configured to repeat these steps to determine a survival time period for a plurality of analytical models, and perform a survival analysis based on the survival time period for the plurality of analytical models.

Abstract: A detection modeling system has a processing device and a memory coupled to the processing device. The detection modeling system is configured to select a detection model for assessing model degradation, the detection model being an analytical model for analyzing data and identifying target events, perform a survival analysis on a plurality of like detection models, determine a survival metric for the selected detection model based on the survival analysis, and compare the survival metric to a threshold value and alerting to model degradation based on the comparison.

Abstract: A detection modeling system performs a distribution analysis to alert to model degradation. The detection modeling system may have a distribution analysis module configured to perform an alerting process in conjunction with a processing device. The distribution analysis module may receive a risk tolerance rating for alerting to degradation of an analytical model, and determine a threshold value for a model metric based on the risk tolerance rating. The model metric may be a measure of a parameter associated with the analytical model. The distribution analysis module may also monitor the analytical model for degradation using the threshold value for the model metric and model metric values and alert to model degradation of the analytical model based on the monitoring of the analytical model.

Abstract: A detection modeling system performs a distribution analysis to alert to model degradation. The detection modeling system may have a distribution analysis module configured to perform an alerting process in conjunction with a processing device. The distribution analysis module may select, by the processing device, model metrics for analysis, the model metrics being a measure of a parameter associated with the analytical model and determine normal distributions for model metric results for each of the selected model metrics. The detection modeling system may further receive model metric values for each of the selected model metric, compare, by the processing device, the model metric values to the normal distributions for model metric results for each of the received model metric value, and alert, by the processing device, to model degradation of the analytical model based on the comparison of the model metric values to the normal distributions for model metric results.

Abstract: An entity resolution system performs a method of resolving one or more candidate entities based on a data set. The entity resolution system has a rules-based module, a machine learning module, a narrative module, and an evaluation module. The rules-based module compares the first entity features to the second entity features and determines whether a rule identifies a relationship between the first entity and the second entity. The machine learning module rates a similarity of the first entity features and the second entity features. The narrative module generates a narrative output based on one or more of the rules-based module and the machine learning module, the narrative output stating an identified relationship between the first entity and the second entity. The evaluation module determines one or more metrics to apply feedback to the system.

Abstract: An entity resolution system performs a method of resolving one or more candidate entities based on a data set. The entity resolution system has a machine learning module and a narrative module. The machine learning module generates a synthesized data set, the synthesized data set comprising similarity ratings for each entity feature. The narrative module applies a clustering analysis to determine one or more distances between the group of similarity ratings for each entity feature and one or more clusters associated with known relationships between entities, generates a narrative output based on one or more distances. The narrative output states at least one identified relationship between at least two entities of the plurality of candidate entities and a confidence score. The narrative engine also provides the narrative output to a user interface.

Abstract: The disclosed embodiments include a method for performing financial fraud assessment that includes creating a machine learning model based on features used to identify financial fraud risk; receiving financial information associated with customer accounts; establishing communities for the customer accounts; creating a baseline set of the features for each of the communities; receiving new financial information associated with customer accounts; updating the communities for the customer accounts based on the new financial information; extracting an updated set of the features for each of the communities; and determining a difference between the baseline set of the features and the updated set of the features for each of the communities; and using the machine learning model to determine financial fraud risk for each of the communities based on the difference between the baseline set of the features and the updated set of the features for each of the communities.

Abstract: A computer-implemented method for performing financial fraud assessment, the method includes receiving financial information associated with customer accounts that have been identified as being associated with suspicious financial activity; establishing communities for the customer accounts; creating a baseline set of features for each of the communities; receiving new financial information associated with customer accounts; updating the communities for the customer accounts based on the new financial information; extracting an updated set of features for each of the communities; and performing fraud assessment by determining whether a change between the updated set of features and the baseline set of features for each of the communities is indicative of an increased risk of fraud.