Actimize Ltd.

A system and method may detect rogue trading by detecting a subset of trades among a plurality of trades, where each trade in the subset does not meet a trade surveillance system threshold, and does meet a trade surveillance system threshold within a tolerance, and each trade falls within the same time period. A ratio of the subset of trades to the plurality of trades may be determined. If the ratio is above a threshold, it may be determined that the subset of trades corresponds to undesirable trading. Undesirable trading may be determined using an additional factor, based on a weighted average of, for each of a trade surveillance system threshold, the number of trades in the subset meeting the trade surveillance system threshold within a tolerance and not meeting a trade surveillance threshold, times a weight based on the position of the threshold in the trade surveillance system.

A rule training system and methods are provided that are configured to automatically generate machine learning (ML) rules for intelligent decision-making by a policy manager platform. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform rule training operations which include accessing rule training data, iteratively generating a plurality of decision rules based on the rule training data and a plurality of ML model training techniques, testing each of the plurality of decision rules, filtering the plurality of decision rules by corresponding performances, selecting a set of the plurality of decision rules based on alert metrics, evaluating the set of the plurality of decision rules, and generating a decision ruleset for the ML task.

A risk-prediction-preparation module to generate a risk-prediction-model, is provided herein. The risk-prediction-preparation module includes accessing a data-storage of transactions to operate a group-by operation on transactions related to data-points, according to a logical-entity into entities. Then, clustering entities of a clean-financial dataset into clusters. Selecting data-points of: (a) entities from the clusters to a first dataset and (b) a preconfigured amount of entities randomly to a second dataset. Selecting all entities that have at least one ‘fraudulent’ data-points in at least one related data-point to add all the entities to the first dataset and the second dataset. Using vectorized and scaled extracted features for training a first machine-learning-model of fraud detection on the first dataset and training a second machine-learning-model of fraud detection on the second dataset to collect results. Using the results for combining the first machine-learning-model and the second machine-learning-model to an ensemble machine-learning-model for risk-prediction.

A computerized-method for reducing false-positive transaction-alerts in a trade-surveillance system. The computerized-method includes operating a raw-news-filtering module to select raw input stock-news to yield filtered stock-news. The raw input stock-news includes events which are related to stock market and each event in the events has associated news-metadata. Operating an alert-discovery module to evaluate transaction-alerts, based on the filtered stock-news, and to yield transaction-alert related data points. Operating K-means-clustering module to collect the transaction-alert related data points and form clusters of the transaction-alert related data points, where each cluster is associated with a category. Operating a prioritization module to assign a priority to each transaction-alert related data point of the transaction-alert related data points based on the associated category of the cluster of the transaction-alert related data point and a transaction-related risk and forwarding each transaction-alert related data point that is assigned a priority above a preconfigured threshold to a compliance-officer.

A system determines a transaction's risk level from the routing number. The system includes a processor, a list of routing numbers and a group of transactions. Each transaction includes a dollar amount, a sender, and a routing number of a receiving institution. For each respective routing number, based on the transactions, the processor determines a transaction volume of the routing number and a probability of a legitimate transaction from the routing number to other routing numbers on the list. For each other routing number on the list, based on the transaction volume of the routing number, the processor determines risk curves for transactions from the sender to the routing number based on dollar amount and relative probability of legitimate transactions being sent from the sender to the other routing number. For a new transaction from the sender, a risk score is computed based on its dollar amount and routing number.

An artificial intelligence system configured to detect anomalies in transaction data sets. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform modeling operations which include receiving a first data set for training a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, accessing at least one micro-model trained using at least one second data set separate from the first data set, determining risk scores from the first data set using the at least one micro-model, enriching the first data set with the risk scores, and determining the first machine learning model for the enriched first data set using the machine learning technique.

A system is provided for estimating quantile values for fraud assessments. The system includes a processor and a computer readable medium operably coupled thereto, to perform operations which include capturing one or more first data values for a quantile value profile associated with an entity, wherein the quantile value profile includes one of real values or a first plurality of quantile marker values calculated from the real values, accessing the quantile value profile for the entity, determining a first number of the one or more first data values, and based on the first number of the one or more first data values and the one of the real values or the first plurality of quantile marker values in the quantile value profile, performing one of a first merge operation, a second merge operation, or a third merge operation.

A computerized-method for testing a classification ML model of a tenant of a service provider, in a cloud-based environment. The computerized-method includes: (i) receiving an object of a classification ML model for testing from the tenant; (ii) executing an API with the received object of the classification ML model; (iii) identifying one or more tenants of the service provider based on an activity type and preconfigured characteristics by the executed API; (iv) performing an evaluation of the object of the classification ML model by operating the API on each retrieved dataset of the one or more tenants of the service provider to evaluate the object of the classification ML model and store score-results; and (v) calculating an average of the stored score-results to yield a performance-score of the classification ML model. When the performance-score is above a predefined performance-score deploying the classification ML model in a system of the tenant.

A processor is adapted to automatically generate and validate rules for monitoring suspicious activity by: For a first period of time, collecting a first group of transactions, automatically identifying and storing key indicators from the transactions, and automatically storing which of the transactions are pre-identified as fraudulent. Based on the key indicators and the pre-identified fraudulent transactions, training a learning algorithm and, with the learning algorithm, generating a decision tree of logical predicates including the key indicators. Based on the decision tree, generating a plurality of rules, each of which incorporates only one logical predicate from each layer of the decision tree. For a second period of time: collecting a second group of transactions, and generating a quality metric for each rule, by automatically testing the rules against the second group of transactions, and identifying a subset of rules for which the quality metric exceeds a threshold.

A computerized-method for generating a dataset for a Machine Learning (ML) model for an increased accurate financial crime detection from an initiation stage of the ML model implementation. The computerized-method includes retrieval of financial transaction records from a database of financial transaction records to arrange a dataset of financial transaction records, according to preconfigured techniques. Then, processing the records in the dataset; Then, operating feature engineering on preselected anomalous related features to yield probabilistic categorical features and to yield probabilistic numerical features, and then combining the probabilistic categorical features with the probabilistic numerical features to generate a complex features dataset, and providing the probabilistic categorical features, the probabilistic numerical features and the complex features dataset to an ML model, thus, increasing accuracy of detection that is performed right from an initiation stage of the ML model implementation.