Actimize Ltd.

A computerized-method for real-time detection of real concept drift in predictive machine learning models, by processing high-speed streaming data. The computerized-method includes: receiving a real-time data stream having labeled and unlabeled instances. Obtaining a window of ‘n’ instances having a portion of the ‘n’ instances as reliable labels. Computing posterior distribution of the reliable labels; and operating a Drift-Detection (DD) module. The DD module is configured to: operate a kernel density estimation on the computed posterior distribution for sensitivity control of the DD module; operate an error rate function on the estimated kernel density to yield an error value; and train an incremental estimator module, according to the kernel density estimation. When the error value is not above a preconfigured drift threshold repeating operations (i) through (iii), else when the error value is above the preconfigured drift threshold, at least one concept drift related action takes place.

Systems and methods for unsupervised feature selection for online machine learning are provided. Features can be selected from a plurality of online data sources having a plurality of respective online data streams, and an aggregated feature set and aggregated data can be formed therefrom. The aggregated feature set and the aggregated data can be used by machine learning models in real time to provide real time online machine learning.

A computerized-method for generating a dataset for a Machine Learning (ML) model for an increased accurate financial crime detection from an initiation stage of the ML model implementation. The computerized-method includes: retrieval of financial transaction records from a database of financial transaction records to arrange a dataset of financial transaction records, according to preconfigured techniques. Then, processing the records in the dataset; Then, operating feature engineering on preselected anomalous related features to yield probabilistic categorical features and to yield probabilistic numerical features, and then combining the probabilistic categorical features with the probabilistic numerical features to generate a complex features dataset, and providing the probabilistic categorical features, the probabilistic numerical features and the complex features dataset to an ML model, thus, increasing accuracy of detection that is performed right from an initiation stage of the ML model implementation.

An artificial intelligence system configured to detect anomalies in transaction data sets. The system includes a processor and a computer readable medium operably coupled thereto, the computer readable medium comprising a plurality of instructions stored in association therewith that are accessible to, and executable by, the processor, to perform modeling operations which include receiving a first data set for training a first machine learning model to detect anomalies in the transaction data sets using a machine learning technique, accessing at least one micro-model trained using at least one second data set separate from the first data set, determining risk scores from the first data set using the at least one micro-model, enriching the first data set with the risk scores, and determining the first machine learning model for the enriched first data set using the machine learning technique.

In a method for detecting unauthorized or suspicious financial activity, a graph convolutional network for financial crime prevention, a separate node is created for each entity: each account, each person, each address (e.g. email address), etc. Separate attributes are provided to aggregate transactions in which the node acts as a sender; transactions in which the node acts as a receiver; transactions using a specific channel (e.g. ATM); and transactions of a specific type (e.g. online money transfer). In some embodiments, the attributes exclude data on individual transactions to reduce the amount of data and hence provide more effective computer utilization. The approach is suitable for many applications, including anti-money laundering. Other features are also provided, as well as systems for such detection.

A computerized-method for real-time detection of anomalous data, by processing high-speed streaming data. In a computerized-system receiving a data-stream comprised of unlabeled data points, and operating an Anomalous Data Detection (ADD) module. The ADD module receives at least one of: (i) k number of data point neighbors for each data point; (ii) X number of data points in a predetermined period of time; (iii) d number of dimensions of each data point, threshold; and (iv) n number of data points that said ADD module is operating on, in a predefined time unit. Then, the ADD module prepares a dataset having n data points from the received X data points; and then identifies one or more data points, from the received data stream, as outliers to send an alert with details related to the identified outliers, thus, dynamically evaluating local outliers in the received data stream.

A computerized-method for real-time detection of financial transactions suspicious for money-laundering, by processing high-speed streaming financial data. In a computerized-system receiving a financial data stream comprised of data points. Operating a Fused-Density (FD)-based clustering module that is configured to: (i) read the data points; (ii) maintain a grid system; (iii) maintain one or more provisional clusters (PROC)s; (iv) associate each data point with a grid or merge it to a PROC; (v) systemize the grid system and the PROCs; (vi) trim one or more grids and remove one or more PROCs; (vii) form one or more shape devise clusters based on the PROCs; and (viii) transmit the one or more shape devise clusters for analysis thereof, thus, enabling detection of financial transactions suspicious for money-laundering according to the one or more shape devise clusters which were formed out of the high-speed streaming financial data with money-laundering changing trends.

A computerized-system and method for generating a reduced-size superior labeled training-dataset for a high-accuracy machine-learning-classification model for extreme class imbalance by: (a) retrieving minority and majority class instances to mark them as related to an initial dataset; (b) retrieving a sample of majority instances; (c) selecting an instance to operate a clustering classification model on it and the instances marked as related to the initial dataset to yield clusters; (d) operating a learner model to: (i) measure each instance in the yielded clusters according to a differentiability and an indicativeness estimators; (ii) mark measured instances as related to an intermediate training dataset according to the differentiability and the indicativeness estimators; (e) repeating until a preconfigured condition is met; (f) applying a variation estimator on all marked instances as related to an intermediate training dataset to select most distant instances; and (g) marking the instances as related to a superior training-dataset.

Spectral clustering is used for clustering high dimensional data via sparse representation. The sparsity is increased by data pre-processing via weighted local principal component analysis. The approach is suitable for many applications, including financial applications such as anti-money laundering (AML). Other features are also provided.