TECHNICAL FIELD

The present disclosure relates to the field of online incremental machine learning clustering paradigm in which data becomes available in a sequential order and is used to update the best predictor for future data at each step, as opposed to a classical machine learning approaches with offline batch learning techniques.

BACKGROUND

Financial institutions including banks, brokerage firms and insurance companies are required by law to monitor and report suspicious financial activities that may relate to money laundering and terrorist financing. As such, Anti-Money Laundering (AML) compliance officers must create and maintain an effective transaction monitoring program to keep up with evolving regulations and control their AML program costs. Missteps of these financial institutions, might result in fines and a reputational damage.

Anti-Money Laundering (AML) refers to a set of financial and technological controls that aim to combat an entrance of “dirty money” i.e., money that has been illegally gained through illegal activities such as forgery, bribery, prostitution or theft, into financial systems. Therefore, a robust AML detection system that is operating in a financial system must have the ability to automatically detect any unusual or anomalous financial transactions which have been committed via the financial system.

Nowadays, the industry is implementing a retrospective reporting of suspicious financial transactions, rather than intercepting suspicious financial transactions in real-time. The regulation guidelines are not particularly clear on the timing in which suspicious financial transactions have to be addressed. While retrospective reporting is the current standard there is also a regulatory language that suggests that if a financial transaction is not consistent with what is expected, it should not be completed. In other words, the suspicious financial transaction should be identified as such and rejected.

Accordingly, there is a need for a technical solution that will reject suspicious financial transactions, and stop fraudsters immediately and potentially thwart the additional harm that their actions cause the community and the broader economy.

In addition, as criminals become ever more technically proficient, Financial Institutions (FI)s find themselves in a constant arms race, attempting to stay one step ahead. In recent years, the main issue in anti-fraud activity has been the diversity of fraud types because of the challenges that it imposes on its detection by the FI systems. A wide range of new threats and possibilities have immerged, as technological changes inside and outside the FIs have exposed them to faster payments, risky intermediaries, and new technical environments.

Across the world, the time taken to process and clear payments is speeding up, and to respond effectively Anti-Money Laundering (AML) systems must be both fast and accurate. For prompt response and accuracy, AML systems need continuous analytics on streaming financial data and an online incremental machine learning models to adopt to changing trends in data.

Therefore, there is a need for a method and a system for real-time automatic handling of massive amounts of financial data to evaluate and detect unusual or anomalous financial transactions with low maintenance and lightweight production.

Furthermore, there is a need for a method and a system for identifying new trends in the data by an implementation of an online incremental clustering machine learning models.

SUMMARY

There is thus provided, in accordance with some embodiments of the present disclosure, a computerized-method for real-time detection of financial transactions which are suspicious for money laundering, by processing high-speed streaming financial data. In a computerized-system comprising a processor, and a memory, receiving by the processor a financial data stream comprised of data points.

Furthermore, in accordance with some embodiments of the present disclosure, operating by the processor a Fused-Density (FD)-based clustering module. The FD-based clustering module may be configured to: (i) read data points in the received financial data stream; (ii) maintain a grid system of one or more grids; (iii) maintain one or more provisional clusters (PROC)s; (iv) associate each data point with a grid or merge it to a PROC; (v) systemize the grid system and the PROCs; (vi) trim one or more grids which their calculated weight is less than a calculated outlier and removing one or more PROCs which their calculated weight is less than a calculated value of weight of a PROC; (vii) form one or more shape devise clusters based on the PROCs after a calculated minimum time; and (viii) transmit the one or more shape devise clusters for analysis thereof, thus, enabling detection of financial transactions suspicious for money laundering according to the one or more shape devise clusters which were formed out of the high-speed streaming financial data with money laundering changing trends.

Furthermore, in accordance with some embodiments of the present disclosure, the associating of each data point with a grid or the merging of each data point to a PROC may be further performed by the FD-based clustering module by: (i) for each PROC maintaining a center point of each PROC; (ii) for each data point in each grid, maintaining a radius within a calculated neighborhood; (iii) calculating a distance between each data point and a center of each PROC in the one or more PROCs; when a calculated distance between the data point and the center of a related PROC is less than a radius of the related PROC: (iv) merging to the PROC; and when the calculated distance between the data point and the center of a related PROC is greater or equal to the radius of the related PROC: (v) associating to a grid in the grid system according to predefined distance metrics.

Furthermore, in accordance with some embodiments of the present disclosure, a neighborhood of a data point p may be calculated or denoted by Nε(p).
Nε(p)={q∈Ddist(p, q)≤ε},
where dist (p, q) is an Euclidean distance between data points p and q.
An Euclidean distance is straight-line distance between two data points such as p and q in Euclidean space.

Furthermore, in accordance with some embodiments of the present disclosure, the systemizing of the grid system and the PROCs may be further performed by the FD-based clustering module by: (i) maintaining a number of data points in each grid in the grid system; (ii) checking the number of data points in each grid; when the number of data points in a grid is higher than a calculated dense grid threshold (iii) calculating a weight of the grid in the grid system by: a. calculating a weight for each read data point according to a preconfigured function in each time unit; b. calculating a weight for each grid according to a predetermined function in each time unit; and c. updating the weight for each grid according to a predetermined function.

Furthermore, in accordance with some embodiments of the present disclosure, when one or more grids are forming a pattern in the grid system and each one is having a calculated weight that is higher than a weight of a prospect PROC, then, the FD-based clustering module may generate a PROC having a shape similar to the pattern in the grid system, and may calculate weight, center and radius of the generated PROC.

According to some embodiments of the present disclosure, a time unit may be preconfigured to be any value such as 1 second, 5 seconds or 1 millisecond and the like.

Furthermore, in accordance with some embodiments of the present disclosure, the preconfigured function to calculate the weight of each data point may be:
w(x, tc)=w(x·tp)ƒ(tc, tp),
whereby:
x is the data point,
ƒ(tc, tp) is a fading function,
tcis a current time unit, and
tpis previous time unit.

Furthermore, in accordance with some embodiments of the present disclosure, the calculated weight may decrease in each time unit compared to calculated weight in preceded time unit. A time unit may be preconfigured to be 1 second, 5 seconds or 1 millisecond or any other value.

Furthermore, in accordance with some embodiments of the present disclosure, the predetermined function to calculate the weight of each grid may be:

w⁡(g,tc)=∑x⁢⁢ϵ⁢⁢g⁢2-λ⁡(tc-tx)
whereby:
g is the grid,
tcis a current time unit,
λ is preconfigured and λ>0,
txis a timestamp of data point x in the grid.

Furthermore, in accordance with some embodiments of the present disclosure, the updating of the weight of each grid may be further performed by recalculating the weight of each data point according to the predetermined function and summing all the recalculated weights. Each data point may be attributed with a timestamp, and the predetermined function may be:
wg(tc, x)=2−λ(tc-tp)·wg(tp)+1
whereby:
g is the grid,
x is a data point,
tcis a current time unit,
λ is preconfigured and λ>0,
tpis previous time unit.

Furthermore, in accordance with some embodiments of the present disclosure, the calculating of dense grid threshold may be performed according to:
wg(t)≥α/N(1-2−λ)
whereby:
wg(t) is a weight of a grid in time unit t,
α is a maximum preconfigured value,
λ is preconfigured and λ>0, and
N is the number of data points in the grid.

Furthermore, in accordance with some embodiments of the present disclosure, the fading function may be:
ƒ(tc)=2−λtp,
whereby:
λ is preconfigured and λ>0.

Furthermore, in accordance with some embodiments of the present disclosure, the calculated outlier may be according to:

O⁢W⁢T⁡(tc,tp)=αN⁢∑i=0tc-tp⁢2-λ⁢i=a⁡(1-2-λ⁡(tc-tp+1))N⁡(1-2-λ⁢tp)
whereby:
tcis a current time unit,
tpis previous time unit.
λ is preconfigured and λ>0,
α is a maximum preconfigured value,
N is the number of data points in the grid.

Furthermore, in accordance with some embodiments of the present disclosure, the calculated value of weight of a PROC or a prospect PROC is performed according to:

wPROC=wg⁡(t),wg⁡(t)=αN⁡(1-2-λ)
whereby:
wPROCis a weight of a PROC or a prospect PROC,
wg(t) is a weight of a grid in time unit t,
λ is preconfigured and λ>0,
α is a maximum preconfigured value,
N is the number of data points in the grid.

Furthermore, in accordance with some embodiments of the present disclosure, the calculated minimum time may be performed according to:

tTT=log⁢λαα-N⁡(1-2-λ)
whereby:
λ is preconfigured and λ>0,
α is a maximum preconfigured value,
N is the number of data points in the grid.

Furthermore, in accordance with some embodiments of the present disclosure, the calculated minimum time tTThas been developed from:
wPROC(tc)=2−λ(tc-tp)·wPROC(tc)+1
α/N(1-2−λ)=2−λ(tc-tp)·α/N(1-2−λ)30 1
whereby:

tTT=tc-tp⁢⁢tTT=logλαα-N⁡(1-2-λ)

