CN114730359A

CN114730359A - System and method for unsupervised abstraction of sensitive data for federation sharing

Info

Publication number: CN114730359A
Application number: CN202080076408.0A
Authority: CN
Inventors: B·哈里斯; E·I·凯尔顿; C·沃尔默
Original assignee: International Business Machines Corp
Current assignee: International Business Machines Corp
Priority date: 2019-11-05
Filing date: 2020-11-02
Publication date: 2022-07-08
Also published as: JP2023501343A; WO2021090141A1; DE112020005484T5; WO2021090142A1; CN114616546A; GB202207340D0; GB2605054A; JP2023500698A

Abstract

An abstraction system for generating a standard client profile in a data processing system has a processing device and a memory. The abstraction system may receive customer data from a computing device over a network, perform unsupervised learning on the customer data to produce a plurality of customer clusters having a plurality of common characteristics, and determine that a cluster represents a standard customer, and store a plurality of standard customer profiles based on the determined standard customer, wherein a standard customer profile includes a plurality of data distributions of the plurality of common characteristics. The abstraction system also provides the standard customer profile and the additional standard customer profile to the cognitive system for use in generating the composite transactional data.

Description

System and method for unsupervised abstraction of sensitive data for federation sharing

Technical Field

The present invention relates generally to cognitive systems implementing transactional data simulators, and more particularly to systems and methods for unsupervised abstraction of sensitive data for information federation sharing.

Background

Financial crime detection systems, e.g.

Financial crime warning insight in conjunction with IBM

Cognitive analysis can be utilized to help banks detect money laundering and terrorist financing. Cognitive analysis distinguishes "normal" financial activity from "suspicious" activity and uses the distinguishing information to build a predictive model for the bank. A large amount of real financial customer data is required to train the predictive model.

Banks can only provide a limited amount of real customer data, since real customer data is very sensitive. However, to best simulate fraud and detect different types of financial crimes, more simulated customer data that appears realistic, such as transaction data for training, may yield better predictive models. IBM and IBM Watson are trademarks of International Business machines corporation, registered in many jurisdictions around the world. Accordingly, there is a need in the art to address the above-mentioned problems.

Disclosure of Invention

Viewed from a first aspect, the present invention provides a computer-implemented method for generating a standard client profile in a data processing system, said data processing system comprising a processing device and a memory, said memory including instructions for execution by said processing device, said method comprising: receiving customer data from a plurality of computing devices over a network, the customer data including information for a plurality of customers to a plurality of entities; performing, by the processing device, unsupervised learning on the customer data to produce a plurality of customer clusters having a plurality of common characteristics; determining, by the processing device, that a cluster represents a standard customer and storing a plurality of standard customer profiles based on the determined standard customer, wherein the standard customer profiles include a plurality of data distributions for the plurality of common characteristics; and providing the plurality of standard customer profiles to each of the plurality of computing devices for generating synthetic transaction data based on the standard customers.

Viewed from another aspect, the present invention provides an abstraction system comprising a processing device and a memory, the memory including instructions for execution by the processing device for generating a standard client profile in a data processing system configured to: receiving customer data from a plurality of computing devices over a network, the customer data including information for a plurality of customers to a plurality of entities; performing, by the processing device, unsupervised learning on the customer data to produce a plurality of customer clusters having a plurality of common characteristics; determining, by the processing device, that a cluster represents a standard customer and storing a plurality of standard customer profiles based on the determined standard customer, wherein the standard customer profiles include a plurality of data distributions for the plurality of common characteristics; and providing the plurality of standard customer profiles to each of the plurality of computing devices for generating synthetic transaction data based on the standard customers.

Viewed from another aspect the present invention provides a computer program product for generating a standard client profile in a data processing system, the computer program product comprising a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method for performing the steps of the present invention.

Viewed from another aspect the present invention provides a computer program stored on a computer readable medium and loadable into the internal memory of a digital computer, comprising software code portions, when said program is run on a computer, for performing the steps of the invention.

Viewed from another aspect, the present invention provides a computer program product comprising software which, when executed by a processor, performs a method comprising: receiving customer data from a plurality of computing devices over a network, the customer data including information for a plurality of customers to a plurality of entities; performing, by the processing device, unsupervised learning on the customer data to produce a plurality of customer clusters having a plurality of common characteristics; determining, by the processing device, that a cluster represents a standard customer and storing a plurality of standard customer profiles based on the determined standard customer, wherein the standard customer profiles include a plurality of data distributions for the plurality of common characteristics; and providing the plurality of standard customer profiles to each of the plurality of computing devices for generating synthetic transaction data based on the standard customers

According to some embodiments, the present disclosure describes a computer-implemented method for generating a standard client profile in a data processing system. The method includes steps performed by a processing device, including: the method includes receiving client data from a plurality of computing devices over a network, the client data including information of a plurality of clients to a plurality of entities, performing unsupervised learning on the client data to produce a plurality of client clusters having a plurality of common characteristics, and determining that a cluster represents a standard client and storing a plurality of standard client profiles based on the determined standard client. The standard client profile includes a plurality of data distributions of a plurality of common characteristics. The method also includes providing the plurality of standard customer profiles to each of the plurality of computing devices for generating composite transaction data based on the standard customers.

According to other embodiments, the present disclosure describes an abstraction system for generating standard customer profiles in a data processing system. The abstraction system may include a processing device and a memory. The abstraction system may receive customer data from a plurality of computing devices over a network, the customer data including information for a plurality of customers to a plurality of entities. The abstraction system may also perform unsupervised learning on the customer data to produce a plurality of customer clusters having a plurality of common characteristics, and determine that the clusters represent a standard customer, and store a plurality of standard customer profiles based on the determined standard customer, wherein the standard customer profiles include a plurality of data distributions of the plurality of common characteristics. The abstraction system may also provide a plurality of standard customer profiles to each of the plurality of computing devices for generating composite transaction data based on the standard customers.

According to further embodiments, the present disclosure describes a non-transitory computer-readable medium having stored thereon instructions for generating a standard client profile in a data processing system, which when executed by at least one processing device performs the disclosed method consistent with the disclosed embodiments.

Additional features and advantages of the present disclosure will become apparent from the following detailed description of illustrative embodiments thereof, which proceeds with reference to the accompanying drawings.

Drawings

The foregoing and other aspects of the invention are best understood from the following detailed description, when read with the accompanying drawing figures. For the purpose of illustrating the invention, there is shown in the drawings embodiments which are presently preferred, it being understood, however, that the invention is not limited to the specific instrumentalities disclosed. Included in the drawings are the following figures:

FIG. 1 depicts a block diagram of one illustrative embodiment of a cognitive system implementing a transaction data simulator in a computer network in accordance with the disclosed embodiments;

FIG. 2 depicts a block diagram of an example data processing system in which aspects of the illustrative embodiments may be implemented, in accordance with the disclosed embodiments;

FIG. 3 depicts a schematic diagram of one illustrative embodiment of an abstraction system in accordance with the disclosed embodiments;

FIG. 4 depicts an exemplary flow from customer data to a standard customer in accordance with a disclosed embodiment;

FIG. 5 depicts a flow diagram of one illustrative embodiment of a method of abstracting data to generate a standard client in accordance with the disclosed embodiments;

FIG. 6 depicts a schematic diagram of an example standard client generated by an abstraction system, according to disclosed embodiments;

FIG. 7 depicts a schematic diagram of one illustrative embodiment of a transaction data simulator in accordance with the disclosed embodiments;

FIG. 8 depicts a flow diagram of one illustrative embodiment of a method of simulating transaction data in accordance with the disclosed embodiments; and

FIG. 9 depicts a schematic diagram showing a plurality of synthetic transaction data entries, according to a disclosed embodiment.

Detailed Description

By way of overview, a cognitive system is a special purpose computer system, or group of computer systems, that is configured with hardware and/or software logic (in combination with hardware logic that executes software thereon) to emulate human cognitive functions. These cognitive systems apply humanoid features to convey and manipulate ideas that, when combined with the inherent strength of digital computing, can solve problems with high accuracy and large-scale elasticity. IBM

Is an example of one such cognitive system that can process human readable language and recognize inferences between text segments with human-like accuracy at a much faster rate and on a much larger scale than humans. Generally, such cognitive systems are capable of performing the following functions;

navigating complexity of human language and understanding

Ingesting and processing large amounts of structured and unstructured data

Generating and evaluating hypotheses

Weighting and evaluating responses based only on relevant evidence

Providing situation-specific advice, insight, and guidance

Improving knowledge and learning with each iteration and interaction through a machine learning process

Enabling decisions to be made at points of influence (context guidance)

Scaling by task

Extending and augmenting human expertise and cognition

Identifying resonant human-like attributes and traits from natural language and inferring language-specific or unknown attributes from natural language

High-correlation recall (memory and recall) from data points (images, text, speech)

Prediction and sensing with situational awareness based on empirical modeling of human cognition

Answering questions based on natural language and specific evidence

In one aspect, the cognitive system may be augmented with a transaction data simulator to simulate a set of customer transaction data from a financial institution (e.g., a bank). Even if the simulated customer transaction data is not "actual" customer transaction data from a financial institution, it may be used to train predictive models for identifying financial crimes

The transactional data simulator combines a multi-tiered unsupervised clustering approach with an Interactive Reinforcement Learning (IRL) model to create a large number of intelligent agents that have learned to behave like "standard customers".

In one embodiment, the multi-tiered unsupervised clustering approach uses information that includes hundreds of attributes for "standard customers" over varying time periods to create a large number of standard customer transaction behaviors (extracted from real customer transaction data provided by banks). Each standard customer transaction behavior may be associated with a group of customers having similar transaction characteristics. The intelligent agent generates an artificial customer profile and selects one of the standard customer transaction behaviors to combine with the generated artificial customer profile. In this way, the intelligent agent can simulate a "standard customer" and learn to behave like a "standard customer". The intelligent agent is then provided with a period of time (e.g., ten years) during which the intelligent agent can observe the environment, e.g., past behavior of the represented "standard customers", and learn to perform "fake" customer transactions similar to the standard customer transaction behavior of the represented "standard customers". Each factor of standard customer transaction behavior may be statistical data. For example, standard customer transactionsThe transaction amount for an action may be a range of values, for example, a transaction amount for a standard customer transaction action is 20-3000 dollars. The transaction locations for standard customer transaction activities may be provided in a statistical manner, e.g., 30% of transaction locations are shopping centers, 50% of transaction locations are restaurants, and 20% of transaction locations are gas stations. The transaction types for standard customer transactions may be provided statistically, for example, 20% of the transaction types are check payments, 40% of the transaction types are POS payments, 25% of the transaction types are ATM withdrawals, and 15% of the transaction types are wire transfers. The transaction medium for standard customer transactions may be provided in a statistical manner, e.g., 15% of the transaction medium is cash, 45% of the transaction medium is credit card, 25% of the transaction medium is checking account, 15% of the transaction medium is cash, and

in one embodiment, a plurality of artificial customer profiles are generated from a plurality of real customer profile data. The real customer profile data may be provided by one or more banks. Each real customer profile may include the address of the customer; the name of the customer (the customer may be a legal entity or an individual); contact information such as a telephone number, an email address, etc.; credit information, such as credit scores, credit reports, etc.; revenue information (e.g., corporate annual revenue, or personal wages), etc. The real customer profile data is stored under different categories. For example, business customers (i.e., legal entities) may be divided into different categories based on the size, product, or service of the business customer. An artificial customer profile may be generated by randomly searching all real customer profile data. For example, a human customer profile may be generated by combining randomly selected information including address, first name, last name, phone number, email address, credit score, income or payroll, etc. The generated artificial customer profile thus extracts different pieces of information from the real customer profile data and thus looks like a real customer profile. A financial transaction human customer profile.

In one embodiment, to protect the privacy of real customers, compound information such as address, name, etc. may be divided into multiple parts prior to random selection. For example, the address "2471 george wale street" can be resolved into 3 parts: number 2471, name George Wallace and suffix street. These portions may be individually randomly selected to form an artificial customer profile. In another embodiment, the synthetic information of the artificial customer profile, such as address, name, etc., is compared to the synthetic information of the real customer profile. If the similarity is greater than a predetermined threshold, the artificial customer profile is unacceptable and needs to be updated until the similarity is less than the predetermined threshold.

FIG. 1 depicts a schematic diagram of one illustrative embodiment of a cognitive system 100 implementing a transactional data simulator 110 and an abstraction system 120 in a computer network 114. The cognitive system 100 is implemented on one or more computing devices 112 (including one or more processing devices and one or more memories, and potentially any other computing device elements commonly known in the art, including buses, storage devices, communication interfaces, etc.) connected to a computer network 114. The computer network 114 includes a plurality of computing devices 112 that communicate with each other and with other devices or components via one or more wired and/or wireless data communication links, where each communication link includes one or more of a wire, a router, a switch, a transmitter, a receiver, and so forth. Other embodiments of the cognitive system 100 may be used with components, systems, subsystems, and/or devices other than those described herein. In various embodiments, the computer network 114 includes local network connections and remote connections such that the cognitive system 100 may operate in any size environment, including local and global, such as the internet. The cognitive system 100 is configured to implement a transaction data simulator 110 that can simulate standard customer transaction data 106 (i.e., standard customer transaction behavior). The transaction data simulator 110 may generate a large amount of simulated customer transaction data 108 based on the standard customer transaction data 106 such that the simulated customer transaction data 108 appears as real customer transaction data. In an embodiment, the standard customer transaction data 106 is obtained by an unsupervised clustering method. Raw customer data, including a large amount of customer transaction data, is provided by one or more banks, and a large number of groups representing different characteristics of the bank customers are clustered or grouped from the raw customer data by an unsupervised clustering method. Each group includes transactional data from customers with similar characteristics. For example, group a represents a client who is a single attorney in the new york practice patent law, while group B represents a client who is a married attorney in the new york practice business law.

The abstraction system 120 is implemented in hardware and/or software and is configured to perform an unsupervised abstraction of the standard customer transaction data 106 to produce one or more standard customers that are abstract representations of real customers but that do not contain traceable customer information that may expose sensitive information. In an exemplary embodiment, the abstraction system 120 is configured to perform repeated unsupervised learning steps to cluster and sub-cluster real customer data to produce a standard customer representing a small group of customers.

FIG. 2 is a block diagram of an example data processing system 200 in which aspects of the illustrative embodiments may be implemented. Data processing system 200 is an example of a computer in which computer usable code or instructions implementing the processes for illustrative embodiments of the present invention may be located. In one embodiment, fig. 2 represents a transaction data simulator 110 that implements at least some aspects of the cognitive system 100 described herein.

In the depicted example, data processing system 200 may employ a hub architecture including a north bridge and memory controller hub (NB/MCH)201 and a south bridge and input/output (I/O) controller hub (SB/ICH) 202. Processing unit 203, main memory 204, and graphics processor 205 may be connected to NB/MCH 201. Graphics processor 205 may be connected to NB/MCH 201 through an Accelerated Graphics Port (AGP).

In the depicted example, network adapter 206 connects to SB/ICH 202. Audio adapter 207, keyboard and mouse adapter 208, modem 209, Read Only Memory (ROM)210, Hard Disk Drive (HDD)211, compact disk drive (CD or DVD)212, Universal Serial Bus (USB) ports and other communications ports 213, and PCI/PCIe devices 214 may connect to SB/ICH 202 through bus system 216. PCI/PCIe devices 214 may include Ethernet adapters, add-in cards, and PC cards for notebook computers. ROM 210 may be, for example, a flash basic input/output system (BIOS). The HDD 211 and the optical disk drive 212 may use an Integrated Drive Electronics (IDE) or Serial Advanced Technology Attachment (SATA) interface. A super I/O (SIO) device 215 may connect to SB/ICH 202.

An operating system may run on processing unit 203. An operating system may coordinate and provide control of various components within data processing system 200. As a client, the operating system may be a commercially available operating system. Object-oriented programming systems, e.g. Java^TMA programming system may run in conjunction with the operating system and provides calls to the operating system from object oriented programs or applications executing on data processing system 200. As a server, data processing system 200 may be a running high-level mutual execution operating system

eServer^TMSystem or

A system of operating systems. Registered trademark

Is used by sub-licensors from the proprietary licensee Linux foundation from Linus Torvalds, a brand owner worldwide. eServer is a trademark of international business machines corporation, registered in many jurisdictions around the world. Data processing system 200 may be a Symmetric Multiprocessor (SMP) system including a plurality of processors in processing unit 203. Alternatively, a single processor system may be employed.

Instructions for the operating system, the object-oriented programming system, and applications or programs are located on storage devices, such as HDD 211, and are loaded into main memory 204 for execution by processing unit 203. The processes for embodiments of the website navigation system may be performed by processing unit 203 using computer usable program code, which may be located in a memory such as main memory 204, ROM 210, or in one or more peripheral devices.

The bus system 216 may include one or more buses. Bus system 216 may be implemented using any type of communications fabric or architecture that provides for a transfer of data between different components or devices attached to the fabric or architecture. A communication unit, such as modem 209 or network adapter 206, may include one or more devices that may be used to transmit and receive data.

Those of ordinary skill in the art will appreciate that the hardware depicted in FIG. 2 may vary depending on the implementation. For example, data processing system 200 includes several components that will not be included directly in some embodiments of abstraction system 120. However, it is to be understood that the transaction data simulator 110 may include one or more of the components and configurations of the data processing system 200 for performing the processing methods and steps according to the disclosed embodiments.

In addition, other internal hardware or peripheral devices, such as flash memory, equivalent non-volatile memory, or optical disk drives and the like, may be used in addition to or in place of the hardware depicted. Moreover, the data processing system 200 may take the form of any of a number of different data processing systems including, but not limited to, client computing devices, server computing devices, a tablet computer, laptop computer, telephone or other communication device, a personal digital assistant, and the like. Data processing system 200 may be essentially any known or later developed data processing system without architectural limitation.

FIG. 3 is a schematic diagram of one illustrative embodiment of abstraction system 120. In some embodiments, abstraction system 120 may include a number of modules stored in main memory 204. The modules may be implemented in hardware and/or software. Abstraction system 120 may include a data collection module 310, an unsupervised learning module 320, a criteria client module 330, and a boundary module 340. In some embodiments, the abstraction system 120 may also include and/or be connected to one or more data repositories 250.

The data collection module 310 may be configured to receive customer data from the computing device 112. The customer data may be actual customer data. Customer data 106 is, for example, from a financial institution and includes information such as identification information, transaction information, and the like. Customer data 106 may include various characteristics that are stored separately as individual categories of information. For example, customer data 106 may include expense data, payment data, time period data, location data, and the like. In some embodiments, the data collection module 310 may be configured to collect data from multiple computing devices 112, such as from multiple financial institutions. In some embodiments, the data collection module 310 may be configured to perform a filtering process to create a data set for analysis. For example, the data collection module 310 may create a pool of similar customers (e.g., individuals, companies, retail, services, etc.) using manual or automatic categorization of customers

The unsupervised learning module 320 may be configured to perform unsupervised learning on the data set. Unsupervised learning may be, for example, a clustering algorithm configured to group one or more subsets of data based on patterns, trends, and/or other similarities found in the data. Unsupervised learning module 320 may be configured to perform the clustering process without manual input into the groupings (and thus "unsupervised" learning). As a result, clusters can be freed from the bias of how much a user may believe that data should be grouped.

The standard client module 330 may be configured to extract clusters or groups from the output of the unsupervised learning module in order to generate and store a standard client profile based on input data from the data collection module. The standard client module 330 may be configured to perform a general sanity check of the cluster (e.g., sample size, statistical significance, etc.) to determine when the cluster or sub-cluster may be considered a standard client.

The demarcation module 340 may be configured to further divide the collected customer data according to one or more demarcations. For example, the boundary module 340 may be a statistical and/or time-slicing module configured to further filter the data according to one or more parameters, such that individual customers and/or standard customers may be analyzed from different viewpoints. For example, the boundary module 340 may create a sub-category of data based on two or more characteristics (e.g., transaction information and time information). For example, customer data collected by the data collection module 310 may provide the customer with transaction information for a year. The boundary module 340 may set a time period boundary for the data over the years to identify additional features that may be considered data points. For example, the boundary module 340 may create categories of "holiday spending," "lunch time spending," "savings period," and so forth. Accordingly, the boundary module 340 may be used to further subdivide and classify customer data. In some embodiments, the boundary module 340 may apply these principles to standard customers. For example, the boundary module 340 may derive additional standard customer behavior from the established customer behavior by following certain time periods or based on other statistical boundary exploration data.

Fig. 4 is a flow diagram of a process for generating one or more standard customer profiles using data abstraction using unsupervised learning of customer data 106. As a result of the data abstraction, the customer data 106 is abstracted/aggregated to the extent that it can be saved and stored locally without privacy concerns. In some embodiments, the data collection module 310 may receive customer data 106 from one or more computing devices 112. The data collection module 310 may perform an initial filtering 405 of the data. For example, the data collection module 310 may perform RFM (recency, frequency, monetary value) analysis on the subgroup data from the customer data 106. Unsupervised learning module 320 may perform clustering process 410 to create one or more data clusters 415. One or more of the data clusters 415 may be a grouping of customers based on an unsupervised learning algorithm applied as a clustering process 410. The cluster 415 may be based on the similarity of one or more features in the customer data. For example, "cluster 1" of cluster 415 may be all customers in a particular geographic area, while "cluster 2" of cluster 415 may be all customers of a particular age, who spend an amount per year, who make less than an amount of deposits per year, etc. Unsupervised learning 410 may produce any number of clusters 415, and clients may be in more than one cluster.

Unsupervised learning module 320 may perform additional clustering processes 420 to create one or more sub-clusters 425. The unsupervised learning module 320 may generate the sub-clusters 425 by further grouping clients based on additional similarities in the data. For example, for customers in the initial location-based cluster 415, the sub-clusters may be based on age, job, cost, transaction details, and the like. Unsupervised learning 420 to generate sub-clusters 425 may be repeated any number of times until the standard client module 330 identifies clusters that are considered to be sub-clusters of the standard client 430. For example, the criteria client module 330 may select clusters that meet certain criteria, such as the number of clients in a group and/or similar characteristics. The client module 330 may store these clients as standard clients 430 as profiles to serve as "abstract" clients that may be used to render real client data. For example, the standard customer 430 may be provided to the cognitive system 100 for use with the transaction data simulator 110.

FIG. 5 is an exemplary process 500 for converting customer data to abstract standard customers for generating synthetic transactional data that is real but cannot be traced back to actual data. In step 510, the data collection module 310 receives and filters customer data. In step 520, unsupervised learning module 320 applies an algorithm to the data to generate a cluster of customers based on their similarity in at least one feature. In step 530, the unsupervised learning module performs unsupervised learning on the clusters to generate sub-clusters of the client and client features. The clustering process can be repeated as needed to produce smaller and more specific customer clusters. In at least some embodiments, each unsupervised learning step adds data characteristics to the customer group.

In step 540, standard client module 330 determines standard clients by unsupervised learning based on clusters and sub-clusters of data. The standard client module 330 may use a rules database to determine when a cluster is considered a standard client. For example, the standard client module 330 may compare the number of data features and the number of clients in a group to a threshold to determine whether the group has sufficient and/or narrow enough data to be considered a standard client.

In step 550, the boundary module 340 may further export additional standard customers. For example, in some embodiments, the boundary module 340 may add the customer to the standard customer profile based on a portion of the customer data that fits the customer profile. For example, the boundary module 340 may perform boundary operations on the customer data to identify customers that fit a standard customer profile when certain boundaries are applied. For example, the boundary module 340 may select a cluster or standard customer profile and perform additional analysis to see the evolution of the customer's behavior when considering temporal elements. In other examples, the boundary module 340 may apply statistical boundaries to derive additional criteria customers.

In step 560, the abstraction system 120 may provide the cognitive system 100 with standard clients. The cognitive system may use the standard customer as input to create new synthetic transaction data 108 that conforms to the standard customer behavior but is not traceable to the original actual customer data. As a result, real customer data 106 is used to create artificial customer data 108, and artificial customer data 108 can be trusted as real but does not expose actual sensitive customer data.

FIG. 6 is a representation of a

standard customer

610, 620, which may be generated based on customer data 106 through one or more disclosed processes. In an exemplary embodiment,

standard clients

610, 620 include a plurality of features that describe the clients present in the group that makes up

standard clients

610, 620. For example, feature 1 may include customer age, feature 2 may include customer income, feature 3 may include customer spending, and so on. At least some of the features comprising the

standard clients

610, 620 may be represented as distributions of data. For example, the distribution may be a distribution of data with data points for each customer in a standard customer profile. Thus, a distribution is a representation of the actual customer data, but it is a generic statistical representation that is abstracted such that the actual data is not exposed.

FIG. 7 depicts a schematic diagram of one illustrative embodiment of transaction data simulator 110. The transaction data simulator 110 utilizes reinforcement learning techniques to simulate financial transaction data. The transaction data simulator 110 includes an intelligent agent 702 and an environment 704. The intelligent agent 702 randomly selects standard trading behavior 720 (i.e., targets 720) that represents a set of "customers" with similar trading characteristics and associates the standard trading behavior with the randomly selected artificial customer profile 718. Intelligent agent 702 takes action 712 in each iteration. In this embodiment, the action 712 taken in each iteration includes conducting multiple transactions in a single day. Each transaction has information including a transaction type (e.g., Automatic Clearing House (ACH) transfer, check payment, wire transfer, Automated Teller Machine (ATM) withdrawal, point of sale (POS) payment, etc.); a transaction amount; a transaction time; a transaction location; a transaction medium (e.g., cash, credit card, debit card, checking account, etc.); a second party associated with the transaction (e.g., the person receiving the wire transfer payment), and the like. The environment 704 takes as input an action 712 and returns as output a reward 714 (or feedback) and status 716 from the environment 704. Reward 714 is feedback by which the success or failure of act 712 is measured. In this embodiment, environment 704 compares action 712 with goal 720 (e.g., standard transaction behavior). If act 712 deviates from goal 720 by more than a predefined threshold, intelligent agent 702 is penalized, and if act 712 deviates from goal 720 within a predefined threshold (i.e., act 712 is similar to goal 720), intelligent agent 702 is rewarded. Act 712 is effectively evaluated so that intelligent agent 702 can refine next act 712 based on reward 714. In this embodiment, environment 704 is the set of all old actions taken by intelligent agent 702, i.e., environment 704 is the set of all old simulated transactions. The intelligent agent 702 observes the environment 704 and obtains information about old transactions, e.g., the number of transactions made within a day, week, month, or year; amount per transaction, account balance, type per transaction, etc. Policy engine 706 may adjust the policy based on the observations so that intelligent agent 702 may take better action 712 in the next iteration.

Intelligent agent 702 also includes policy engine 706, which is configured to adjust policies based on state 716 and rewards 714. A policy is a countermeasure used by intelligent agent 702 to determine the next action 712 based on status 716 and reward 714. To obtain a higher reward 714 for the next action 712 taken by intelligent agent 702, the policy is adjusted. The policy includes a set of different policy probabilities or decision probabilities that can be used to decide whether to execute a transaction on a particular day, the number of transactions per day, the amount of transactions, the type of transactions, the parties to the transactions, etc. In the reinforcement learning model, the results of events are random, and a Random Number Generator (RNG) is a system that generates random numbers from a real source of randomness. In one example, the maximum number of transactions per day is 100, and the maximum transaction amount is fifteen million dollars. In the first iteration, intelligent agent 702 conducts a random transaction for an amount of fifteen thousand dollars to zimbabwe. This action 712 is far from goal 720 (e.g., a transaction at Maine by a married attorney executing a business law), and thus this action 712 is penalized (i.e., reward 714 is negative). Policy engine 706 is trained to adjust the policy so that different transactions can be conducted closer to goal 720. With more iterations, transactions similar to the goal 720 may be simulated by the "smarter" policy engine 706. As shown in FIG. 8, a number of transactions from the customer "James Culley" are simulated, and the simulated transaction data is similar to the goal 720.

As shown in FIG. 2, in one embodiment, one feedback loop (i.e., one iteration) corresponds to one "day" of action (i.e., one "day" of simulated transactions). Over a period of time, such as ten years, intelligent agent 702 learns how to take action 712 to obtain as high a reward 714 as possible. The number of iterations corresponds to the duration. For example, ten years corresponds to 10 × 365 ═ 3650 iterations. Reinforcement learning model determines act 712 from the results produced by act 712. It is an objective 720, and its purpose is to learn an action sequence 712 that will direct intelligent agent 702 to achieve its objective 720 or maximize its objective function.

In an embodiment, the transaction data simulator 110 further comprises an updater 710. A new action 712 is performed in each iteration. Updater 710 updates environment 704 after each iteration with action 712 taken by intelligent agent 702. The action 712 taken in each iteration is added to the environment 704 by the updater 710. In an embodiment, the transaction data simulator 110 further includes a trimmer 708 configured to trim the environment 704. In an embodiment, trimmer 708 may remove one or more undesirable actions. For example, action 712 taken in the previous ten iterations is removed because the ten iterations deviate far from target 720 and the similarity is below a predefined threshold. In another embodiment, a full re-initialization of the transaction data simulator 110 may be performed to remove all cumulative actions in the environment 704 so that the intelligent agent 702 may start up again.

FIG. 8 shows a flow diagram illustrating one illustrative embodiment of a method 800 of simulating transaction data. At step 802, standard customer transaction behavior data is provided as a target 720. A standard customer transaction behavior represents a group of customers with similar transaction characteristics. Standard customer transaction behavior is obtained by unsupervised clustering methods.

At step 804, action 712 is taken to perform multiple transactions in an iteration representative of, for example, a day (e.g., 100 transactions per day). Each transaction has information including a transaction type, a transaction amount, a transaction time, a transaction location, a transaction medium, a second party associated with the transaction, and the like.

At step 806, environment 704 compares goal 720 with actions 712 taken in the iteration, rewarding or penalizing actions 712 based on similarities or deviations from goal 720. The threshold or rule for deciding whether act 712 is similar to goal 720 is predefined and may be adjusted based on how similar the user preferences are to goal 720.

At step 808, environment 704 is updated to include action 712 in the current iteration. The environment 704 includes a collection of all old actions.

At step 810, policy engine 706 adjusts the policy used to determine the next action 712 based on reward 714 (i.e., reward or penalty). The policy is formulated based on various factors such as the probability of a transaction occurring, the number of transactions per day, the amount of the transaction, the type of transaction, the party to the transaction, the frequency of transactions per type of transaction, the upper and lower limits for each transaction, the medium of the transaction, etc. The policy may adjust the weights of these factors based on the rewards 714 in each iteration.

In a new iteration, intelligent agent 702 takes a new action 712, step 812. Steps 804 through 812 are repeated until act 712 is sufficiently similar to target 720 (step 814). For example, the transaction amount specified in the target 720 is 20-3000 dollars. If the transaction amount for each transaction in act 712 falls within the range of 20-3000 dollars, then act 712 is sufficiently similar to goal 720.

Because the standard customer transaction data 106 may include anomalous data, such as fraudulent transactions, the simulated customer transaction data 108 may also include anomalous data because the simulated customer transaction data 108 is similar to the standard customer transaction data 106. In a reinforcement learning model, intelligent agent 702 randomly or randomly explores environment 704, learns policies from its experiences, and updates the policies as it explores to improve the behavior (i.e., transactions) of intelligent agent 702. In embodiments, as opposed to random actions, patterns of behavior can occur during RNG-based exploration (e.g., spending "swinging" until run out of savings, or experiencing "buyer grief" for a large consumption, etc.). Abnormal behavior patterns may indicate fraudulent transactions. For example, a simulated customer James Culley may typically make transactions with less than 1000 dollars in transaction amount. There is suddenly a transaction with a transaction amount of 5000 dollars, and the suspicious transaction may be a fraudulent transaction (e.g., James Culley's credit card stolen, or James Culley's checking account hacked).

There are behavioral patterns that occur naturally during exploration. For example, as shown in FIG. 9, the simulated customer James Culley received 12387.71 dollars in money in the checking account on 1 month 1 of 2014. James Culley spent 474.98 yuan on 9 days 1 month 2014, 4400 yuan on 31 days 1 month, and 3856.55 yuan on 2 months 3 month 2014 by a debit card associated with the checking account. In the next month, James Culley received 12387.71 dollars in the checking account on 2/1/2014. James Culley spent 4500 dollars on 2 months 2, 2014, 1713.91 dollars on 3 months 2, and 8100 dollars off the checking account on 27 months 6, 2014 by a debit card associated with the checking account. In this example, the simulated customer James Culley has a tendency to deposit and spend money, and occasionally has a large purchase. The behavioral patterns make the simulated customer James club appear more realistic (i.e., look more like a real customer, not a robot). Policy engine 706 generates a plurality of parameters such as "consistency of behavior" (degree of consistency of behavior over time), "volatility of consistency" (frequency of change of behavior), "anomaly of behavior" (deviation from regular transaction behavior), etc., and is used to show different personalities for each simulated customer.

The transactional data simulator 110 uses the abstract or aggregated real customer data to simulate customer data representing real customers. The transactional data simulator 110 may provide a large amount of simulated customer data (i.e., simulated transactional data combined with an artificial customer profile) that may be used to train predictive models for detecting anomalous customer behavior. Furthermore, the simulated customer data is generated based on abstract data of the real raw customer data, rather than the real raw customer data itself, and therefore it is not possible to derive the actual transaction actions of any real customer.

Additionally, the transaction data simulator 110 allows for the generation of behavioral patterns for each simulated customer during the iteration.

The systems and processes in the drawings are not exclusive. Other systems, processes, and menus may be derived to achieve the same objectives according to the principles of the embodiments described herein. It is to be understood that the embodiments and variations shown and described herein are for illustration purposes only. Modifications to the current design may be implemented by those skilled in the art without departing from the scope of the embodiments. As described herein, various systems, subsystems, agents, managers and processes may be implemented using hardware components, software components and/or combinations thereof.

The present invention may be a system, method and/or computer program product. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon for causing a processor to perform various aspects of the present invention.

The computer readable storage medium may be a tangible device capable of retaining and storing instructions for use by the instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic memory device, a magnetic memory device, an optical memory device, an electromagnetic memory device, a semiconductor memory device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer-readable storage medium includes the following: a portable computer diskette, a head disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a Static Random Access Memory (SRAM), a portable compact disc read-only memory (CD-ROM), a Digital Versatile Disc (DVD), a memory stick, a floppy disk, a mechanical coding device such as punch cards or raised structures in grooves that have instructions recorded thereon, and any suitable combination of the foregoing. A computer-readable storage medium as used herein should not be interpreted as a transitory signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., optical pulses through a fiber optic cable), or an electrical signal transmitted through a wire.

The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a corresponding computing/processing device, or to an external computer or external storage device via a network, such as the internet, a Local Area Network (LAN), a Wide Area Network (WAN), and/or a wireless network. The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers and/or edge servers. The network adapter card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing/processing device.

The computer-readable program instructions for carrying out operations of the present invention may be assembly instructions, Instruction Set Architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Java^TMSmalltalk, C + +, etc., and conventional procedural programming languages, such as the "C" programmingA program language or similar programming language. The computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or a WAN, or the connection may be made to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, to perform aspects of the present invention, an electronic circuit comprising, for example, a programmable logic circuit, a Field Programmable Gate Array (FPGA), or a Programmable Logic Array (PLA), may be personalized by executing computer-readable program instructions with state information of the computer-readable program instructions.

Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer-readable program instructions.

These computer-readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer-readable storage medium having stored therein the instructions comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus or other devices implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The terms "a," "an," "at least one," and "one or more" may be used herein with respect to particular features and elements of the illustrative embodiments. It should be understood that these terms and phrases are intended to indicate that at least one particular feature or element is present in a particular illustrative embodiment, but may be present in more than one. That is, these terms/phrases are not intended to limit the specification or claims to the presence of a single feature/element or to the presence of multiple such features/elements. Rather, these terms/phrases only require at least a single feature/element, with the possibility of multiple such features/elements being within the scope of the specification and claims.

Furthermore, it should be appreciated that the following description uses a number of various examples of the various elements of the illustrative embodiments to further illustrate example implementations of the illustrative embodiments and to aid in understanding the mechanisms of the illustrative embodiments. These examples are intended to be non-limiting and not exhaustive of the various possibilities for implementing the mechanisms of the illustrative embodiments. In view of this description, it will be apparent to those of ordinary skill in the art that many other alternative implementations of these various elements may be used in addition to or in place of the examples provided herein without departing from the spirit and scope of the invention.

Although the present invention has been described with reference to exemplary embodiments, the present invention is not limited thereto. Those skilled in the art will appreciate that many changes and modifications may be made to the preferred embodiments of the invention and that such changes and modifications may be made without departing from the true spirit of the invention. It is therefore intended that the following appended claims be interpreted as covering all such equivalent variations as fall within the true spirit and scope of the invention.

Claims

1. A computer-implemented method for generating a standard client profile in a data processing system, the data processing system comprising a processing device and a memory, the memory including instructions for execution by the processing device, the method comprising:

receiving customer data from a plurality of computing devices over a network, the customer data including information for a plurality of customers to a plurality of entities;

performing, by the processing device, unsupervised learning on the customer data to produce a plurality of customer clusters having a plurality of common characteristics;

determining, by the processing device, that a cluster represents a standard customer and storing a plurality of standard customer profiles based on the determined standard customer, wherein the standard customer profiles include a plurality of data distributions for the plurality of common characteristics; and

providing the plurality of standard customer profiles to each of the plurality of computing devices for generating composite transaction data based on the standard customers.

2. The method of claim 1, wherein the information for the plurality of customers comprises identification information and transaction information.

3. The method of any preceding claim, further comprising: filtering the customer data prior to performing unsupervised learning.

4. The method of claim 3, wherein the filtering comprises RFM analysis to group customers.

5. The method of any preceding claim, wherein the performing unsupervised learning comprises clustering customers based on common features, and repeating unsupervised learning to form sub-clusters of customers based on the plurality of common features.

6. The method of any preceding claim, wherein determining that a sub-cluster represents a standard client comprises: one or more rules are applied.

7. The method of claim 6, wherein the one or more rules include a size determination indicating a minimum or maximum number of clients in a sub-cluster determined to be a standard client.

8. An abstraction system comprising a processing device and a memory, the memory including instructions for execution by the processing device for generating a standard client profile in a data processing system configured to:

9. The system of claim 8, wherein the information of the plurality of customers includes identification information and transaction information.

10. The system of any of claims 8 or 9, further comprising: filtering the customer data prior to performing unsupervised learning.

11. The system of claim 10, wherein the filtering comprises RFM analysis to group customers.

12. The system of any of claims 8 to 11, wherein performing unsupervised learning comprises clustering customers based on common features, and repeating unsupervised learning to form sub-clusters of customers based on the plurality of common features.

13. The system of any of claims 8 to 12, wherein determining that a sub-cluster represents a standard client comprises: one or more rules are applied.

14. The system of claim 13, wherein the one or more rules include a size determination indicating a minimum or maximum number of customers in a sub-cluster determined to be a standard customer.

15. A computer program product for generating a standard customer profile in a data processing system, the computer program product comprising:

a computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing the method of any of claims 1-7.

16. A computer program stored on a computer readable medium and loadable into the internal memory of a digital computer, comprising software code portions, when said program is run on a computer, for performing the method of any of claims 1 to 7.