WO2003069435A2 - Analysis of third party networks - Google Patents

Abstract

A method of analyzing customer behavior, where customers are engaged in customer-to-customer transactions (52) in the third-party network, includes the transformation of data representing the customer-to-customer transactions (52) from a data representation (50) to a network representation, and then analyzing the network representation. The network representation includes a set of nodes and a set of links (54) where each node represents a customer and each link represents a transaction between two of the customers (54).

Description

ANALYSIS OF THIRD PARTY NETWORKS

RELATED APPLICATION AND CLAIM OF PRIORITY [0001] This application claims priority to, and incorporates herein by reference, the co-pending U.S. provisional application entitled "Analysis of Third Party Networks" filed February 12, 2002, having serial number 60/256,206.

FIELD OF THE INVENTION [0002] This invention relates generally to the field of data mining, or more specifically methods and systems for analyzing properties or behaviors of business transactions. In particular, the invention relates to a method and system for analyzing groups behaviors, characteristics, and/or patterns associated with customer-to-customer business transactions in a network, such as a financial network.

BACKGROUND OF THE INVENTION [0003] In financial industries such as the banking industry or the brokerage industry, a bank or broker provides business opportunities to its customers. In banking, the main business includes financial transactions between the bank as a banking business provider and its customers. However, there may be financial transactions conducted between customers themselves. These customer-to-customer (C2C) transactions may be called third party business activities because the provider bank is not financially involved in such activities. A group of customers connected through C2C business activities may be called a third party network. Better methods of understanding C2C transactions in groups and third party networks could help financial institutions identify new business opportunities and solve C2C business problems due to illegal group activities, such as money laundering activities and other group related frauds.

[0004] One approach to solve such financial problems in a database is data mining. There are two conventional approaches to study or understand transactions using data mining. One is an individual approach, in which each transaction and each customer are analyzed, and patterns associated with individual customers may be found. However, this approach does not provide any analysis of group patterns. Another approach is a group approach such as link analysis. Link analysis is a visual data-mining algorithm that helps to visualize connections between entities linked through transactions or other types of business activities. In comparison with the individual approach, link analysis shows the relationships and connections between individual entities within a linked group or network.

[0005] However, conventional link analysis approaches present several disadvantages. A third party network, i.e., one defined by a group of customers connected through C2C business activities, typically has at least two types of network properties. One is an internal property describing interactions and connections between member customers in a network. Link analysis is an adequate technique for analyzing and understanding the internal property of a link network. Another type of network property is an external property describing interactions and connections between a network (as a group object just like an individual customer) and other external entities such as a banking business provider. Under the existing link analysis techniques, external properties or characteristics of a link network are not apparent. Thus, the prior art presents no reliable way to understand and solve third party business problems, such as money laundering, thus allowing group patterns to become evident.

[0006] To understand the external property of a link network in solution space, it is desirable to extend link analysis to third-party or customer-to-customer network analysis in which business transactions between individual customers within a network and the business provider may be treated as transactions between a network object and the business provider. For example, financial transactions between individual members of a money laundering network and a bank should be treated as transactions between the network and the bank.

SUMMARY OF THE INVENTION [0007] The present invention is directed to the solution of one or more of the problems described above. In a preferred embodiment, a method of analyzing characteristics or behaviors of customers engaged in customer-to-customer transactions in a third party network includes the steps of: (i) transforming data representative of a plurality of individual customer-to-customer transactions from a data representation to a network representation, and (ii) performing third-party network analysis on the network representation. Optionally and preferably, the method also includes the step of building one or more third-party networks corresponding to customer-to-customer transactions. Each third-party network preferably represents a group of customers connected through customer-to-customer transactions and comprises a plurality of nodes and a plurality of links, such that each node is associated with at least one link and each link is associated with at least two nodes. Each node preferably represents a member, customer or individual involved in third-party business activity, while each link preferably represents a connection or transaction between two member customers.

[0008] Optionally and preferably, each network has internal link pattern characteristics corresponding to interactions and connections between member customers in the network. Alternately or additionally, each network preferably has external network pattern characteristics, representing interactions and relationships between a network and external entities outside the network.

[0009] Optionally and preferably, the performance of third party analysis includes the performance of network mining using one or more mining algorithms. For example, the network mining may include decision tree mining that stores third- party network patterns in nodes, and at least one of the nodes may store a subset of networks having similar group pattern behaviors. Alternatively or in addition, the network mining may include using association rule mining to find networks having important association relationships with external patterns outside networks. Further, the network mining step may include using clustering group networks having similar network properties, and it may detect transactions that correspond, or that deviate from, a pattern.

[0010] In an alternate embodiment of the invention, a method of monitoring customer behavior includes the steps of: (i) monitoring data that corresponds to a plurality of individual transactions between customers; (ii) transforming the data corresponding to a group of the transactions into a network representation; and (iii) analyzing the network representation of the group of transactions to identify at least one transaction pattern. Optionally and preferably, the transforming step includes the step of building a network comprising a plurality of links and a plurality of nodes, where each node corresponds to a customer in a customer-to-customer transaction and each link corresponds to a transaction between two of the customer.

[0011] In an alternate embodiment of the invention, a method of monitoring activity in a network, includes the steps of: (i) monitoring a plurality of transactions that occur at least partially in a second network; (ii) storing a plurality of nodes in a computer program memory, wherein each node comprises data indicative of a participant in one or more of the transactions; and (ii) storing a plurality of links in the memory, wherein each link is associated with two nodes and each link includes data indicative of a measurement associated with the transaction between the participants associated with the same two nodes. Preferably, each transaction comprises a transaction between two parties and comprises a transfer of funds. Also preferably, the data indicative of a measurement comprises a customer ID or an account ID, a measure of transaction value, a measure of funds, a measure of time, a measure of distance between the participants associated with the nodes, or a measure of transaction frequency.

[0012] In this embodiment the method preferably also includes the step of analyzing the links to identify at least one group transaction pattern. It may also include the step of detecting a link that corresponds to or deviates from the at least one group transaction pattern. It may also include the additional steps of analyzing the links to identify at least one intra-network group transaction pattern, and analyzing the links to identify at least one extra-network group transaction pattern.

[0013] There have thus been outlined the more important features of the invention in order that the detailed description that follows may be better understood, and in order that the present contribution to the art may be better appreciated. There are, of course, additional features of the invention that will be described below and which will form the subject matter of the claims appended hereto.

[0014] In this respect, before explaining at least one embodiment of the invention in detail, it is to be understood that the invention is not limited in its application to the details of construction and to the arrangements of the components set forth in the description or illustrated in the drawings. The invention is capable of other embodiments and of being practiced and carried out in various ways. Also, it is to be understood that the phraseology and terminology employed herein, as well as the abstract, are for the purpose of description and should not be regarded as limiting.

[0015] As such, those skilled in the art will appreciate that the conception upon which this disclosure is based may readily be used as a basis for designing other structures, methods, and systems for carrying out the several purposes of the present invention. It is important, therefore, that the claims be regarded as including such equivalent constructions insofar as they do not depart from the spirit and scope of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS [0016] FIG. 1 illustrates representative business transactions, including

C2C transactions (arrowed lines), in a data representation.

[0017] FIG. 2 illustrates representative business transactions, including

C2C transactions (arrowed lines), in a pattern (individual pattern) representation. [0018] FIG. 3 illustrates representative business transactions, including

C2C transactions (arrowed lines), in a link pattern (group pattern) representation. [0019] FIG. 4 illustrates representative business transactions in a network pattern (group pattern) representation.

[0020] FIG. 5 is a flow chart showing steps that may be followed in accordance with a first part of a preferred embodiment of this invention, namely, the transformation of transaction representations from a data platform to a network platform.

[0021] FIG. 6 is a flow chart showing steps that may be followed in accordance with a second part of a preferred embodiment of this invention, namely, the analysis of group behaviors in a network platform.

[0022] FIG. 7 illustrates a sub-tree structure storing networks of different characteristics at various nodes.

[0023] FIG. 8 shows a representative computer suitable for carrying out the methods of the present invention, along with an exemplary computer-readable carrier.

[0024] FIG. 9 illustrates several elements of a preferred embodiment of the computer illustrated in FIG. 8.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS OF THE INVENTION [0025] The present invention provides a method and system for the analysis of group properties or group characteristics of customers connected through third-party or customer-to-customer transactions. In particular, the invention relates to a network representation wherein groups of data values describing customer-to- customer business transactions are transformed into third-party networks. Through this invention, banks, financial service providers, regulators and others can better analyze group behaviors of such networks. Thus, they may gain a better understanding of group characteristics or group properties of the third-party network patterns though the analysis of customer-to-customer transactions or third party business activities, thus allowing those using the method to understand and recognize normal patterns, as well as to quickly identify potential problems because of known problem patterns or deviations from expected patterns.

[0026] A primary feature of a preferred embodiment of the invention is the transformation of C2C business activities from a data representation, where they appear as individual activities between customers, to a third-party network representation where they appear as group activities in a third-party network. Group behaviors become more evident, and therefore are more conveniently analyzed in a third-party network representation since each group of customers connected through C2C activities becomes a single object in the network representation. The new network representation forms a third-party network platform.

[0027] FIGs. 1-4 illustrate the concept associated with a data representation, as compared to a network representation, and various intermediate representations. Referring to FIG. 1, financial transactions are illustrated in a data representation. Specifically, each transaction between banking business provider 10 and customers 1 through 6 is identified by a unique link. In addition, each transaction between any customer and another customer is identified by a unique link. Customer-to-customer transactions are illustrated in FIG. 1 by lines having arrows at each end, while customer to business provider transactions are illustrated by lines that contain no arrows. FIG. 2 illustrates a pattern representation of the transactions. Rather than identifying each individual transaction as a unique link, FIG. 2 illustrates only one link between business provider 10 and individual customers, or between individual customers, regardless of the number of actual transactions that occur.

[0028] In FIG. 3, the transactions are transformed into a link pattern representation. Rather than illustrating each individual customer, customers are combined depending on their transaction patterns. For example, in FIG. 2, customers 5 and 6 each engaged in transactions with business provider 10 and they also engaged in customer-to-customer transactions with each other. This unique pattern is illustrated in FIG. 3 by link 14, while link 13 is used to show that customer 4 may participate in an intermediate transaction between business provider 10 and customer 5. FIG. 4 illustrates the networks that have developed, based on the separation of groups that began to be illustrated in FIG. 3. As noted above, customers 5 and 6 in FIG. 3 include a common pattern and are linked to business provider 10 by link 14, while customer 5, along with customer 4, also contain a common pattern and are linked to business provider 10 by link 14. FIG. 3 illustrates customers 4, 5 and 6 as being combined into a third-party network 22 as the three customers are all linked to each other by customer-to-customer transactions and/or transactions with business provider 10.

[0029] A third-party network platform includes two major parts: network transform and network analysis. The third-party network transform portion of the platform builds a network platform by transforming C2C business activities from a data representation into a third-party network representation. The third-party network analysis portion of the platform performs network queries for analyzing group behaviors and properties in a standardized manner, in addition to behaviors and properties of individual customers. A standardized approach for performing network analysis in a network platform is to build a network query language and a network query engine. Since link network analysis is a part of the third-party network analysis, link query language becomes a part of network query language.

[0030] A third-party network object in a network representation has an internal network structure representing interactions and connections between member customers within a network. The internal structure is described by a link pattern through description of link pattern properties. In addition, a third-party network object has external properties describing its interactions with an external entity such as a bank. Analysis of both internal link pattern properties and external network pattern properties provides opportunities for better understanding of a network object representing a third party business network in financial industries.

[0031] A preferred embodiment of the present invention provides a method for the transformation of representations of C2C business activities from a data representation to a third-party network representation and for analyzing and mining internal link properties and external network properties. The preferred method converts a group of customers and C2C activities connecting the customers into a third-party network consisting of nodes and links. Each node in a third-party network represents a member customer and each link describes a unique C2C business activity or transaction between two member customers.

[0032] An example table showing illustrative data representing customer- to-customer transactions. The first two columns represent customer IDs. The third column shows the amounts of money being transferred (brackets represent a transfer in the opposite direction). The last column shows the frequency. Customer 1 Customer 4 $800,000 5

Customer 2 Customer 6 $150,000 2

Customer 3 Customer 5 ($20,000) 2 Customer 4 Customer 8 $1,000,000 5

Customer 5 Customer 7 $35,000 3

Customer 6 Customer 9 $100,000 4

Customer 5 Customer 10 $10,000 1

Customer 1 Customer 8 $1,500,000 8

[0033] Surprisingly and advantageously, we have found that the methods described herein for the transformation of representations of C2C business activities from a data representation to a network representation provides opportunities for better understanding of group pattern properties by analysis of at least two types of group pattern properties: internal link pattern property and external network pattern property.

[0034] In describing the invention in detail, the following general definitions will apply to the following terms when used herein. Of course, many terms are capable of having different but equivalent definitions. Equivalent definitions are also intended to fall within the scope of the present invention:

[0035] A node represents a member customer involved in a given C2C business activity in a third-party network, or a processing or communications device associated with such a customer.

[0036] A link represents a unique C2C business activity or transaction connecting to two member nodes in a third-party network and describes the relationships between the two member nodes.

[0037] A third-party network represents a group of customers connected through C2C business activities, or a communications network on which such customers perform such activities. [0038] A dictionary represents a set of unique values of nodes, links, or networks.

[0039] A measure is a metric measuring nodes, links, or networks.

[0040] A frequency measure is a measure of the number of occurrences for a node, link, or network.

[0041] A non-frequency measure is a measure of something other than frequency, and preferably of money, time, and/or distance related to a node, link, or network.

[0042] A token is an index or key associated with a dictionary value of a node or link. Network Transform

[0043] In order to simplify the transformation of groups of customers connected through C2C activities from a data representation to a network representation, it is preferable to preprocess original data to have a simple format suitable for the network transform before performing a network transform. First, one may separate C2C data from other data, especially if the other data includes data describing transactions between customers and the business provider. Then, all C2C data may be stored in a standard format, such as a tabular format in which each unique C2C activity or transaction is stored in one row. Each such row would contain a pair of customers involved in a given C2C activity and measure of the C2C activity such as frequency counts of occurrences of the activity or the amounts of money involved in the activity. For example, a fund transfer between customers is a C2C activity in which two customers are involved and a measure of the transfer can be the amount of money transferred or the number of transactions taking place between the two customers. Thus, the standard, and thus a preferred, format for a two-customer activity is customer A (from), customer B (to), and a measure of the transaction or connection between the two customers connected through C2C transactions. The measure can be a frequency measure, such as a count of the transaction occurrences, or it may be a non-frequency measure, such as one of money amounts, involved in a C2C activity. All binary C2C activities should preferably have this format before transformation occurs.

[0044] The network transform is intended to convert unstructured C2C business activities in a data representation to structured group objects in a network representation. In order to make the transform scalable, one may perform an incremental transform of C2C data from a data representation to a network representation. In an incremental model, a fraction of a large amount of data is transformed at a time. The results are merged with those of the previous increment. These incrementally transformed results grow in size. The merge allows partial transform completed at any point of increment even when the transform is interrupted due to a crash. The interrupted transform may be resumed at the point where it is interrupted.

[0045] FIG. 5 illustrates a preferred embodiment of the transformation methods described herein. Referring to FIG. 5, the first step for the transform is to select preprocessed C2C data (step 50). This is preferably carried out by performing an SQL query with a group-by clause. Selection of C2C data is preferably performed incrementally. Each increment comes from a range of data in a relational table. The query results are preferably unique pairs of customers or accounts and the corresponding measure of links connecting pairs of customers.

[0046] After selection of data, one may build a dictionary for nodes (step 52). Each dictionary value is a definition for a node. For example, it can be a customer ID, an account ED, or optionally some other value. Node tokens are used to replace original node values in the selected data for building links and networks more efficiently later on. The node dictionary should be stored. Node measure, frequency or non-frequency measure, may be stored. Frequency counts of occurrences of nodes may be obtained and stored as a frequency measure of nodes. This is an option because the node counts can be obtained from a measure of links that should be stored. Similarly, a non-frequency measure, such as the amount of money associated with nodes, may be obtained and stored as a non-frequency measure of nodes. This is also an option. Other non-frequency measures include: time measure - the amounts of time spent by nodes (e.g., telephone business); measures of distance - total distances associated with nodes (e.g., distance between a provider and his/her customers in medical business, distance between suspects in criminal business or in fraud business). Tokens are used to represent values of nodes, links, and networks in order to make performance more efficient. An example of a node dictionary is shown below:

Customer 1 $2,300,000 13

Customer 2 $150,000 2

Customer 3 $20,000 2

Customer 4 $1,000,000 5

Customer 5 $65,000 6

Customer 6 $250,000 6

Customer 7 $35,000 3

Customer 8 $1,000,000 5

Customer 9 $100,000 4

Customer 10 $10,000 1 [0047] In the table listed above, the first column shows node values, in this case customer IDs. The second column shows the amounts of money for each node. The last column shows node frequency

[0048] In step 54, after replacing raw data values of nodes by node tokens, link values that are pairs of node values are expressed as pairs of tokens. A dictionary for links or pairs of tokens is built and stored. An example of such a link dictionary, with values, is illustrated below:

1 4 $800,000 5

2 6 $150,000 2

3 5 ($20,000) 2

4 8 $1,000,000 5

5 7 $35,000 3

6 9 $100,000 4 5 10 $10,000 1 1 8 $1,500,000 8

[0049] In the table above, the first two columns show link values, or pairs of node tokens. The third column shows the amounts of money for each link with direction (brackets for opposite direction). The last column shows link frequency.

[0050] Preferably, as shown above, a measure of links is also stored. Frequency counts of occurrences of links are obtained and stored as a frequency measure of links. Non-frequency measures may be also obtained and stored if needed. [0051] The final step illustrated in FIG. 5 (step 56) is to build networks in the new network representation. This is a process of obtaining networks from links. A dictionary for networks is built and stored. Each dictionary value represents a set of links connected through C2C activities. An example of such a network dictionary, with exemplary values, with each row representing a network, is illustrated below:

1.4 1,8 4,8 2,6 6,9

3.5 5,7 5,10

[0052] As an option, one may obtain and store frequency and non- frequency measures of networks. Unlike node and link measures, there is no single definition for frequency measure of networks since links within a network may have different frequency counts. Choices of mean, sum, minimum, maximum, or average deviation may be made. Similar choices for non-frequency measures of networks may be made also. Third-Party Network Analysis

[0053] A primary function of third-party network analysis is to study and understand network properties including both internal properties and external properties. The internal properties reflect the characteristics and properties of C2C transactions within each network, and may be analyzed using conventional techniques for link analysis. The external properties represent all other transactions than C2C transactions, such as transactions between customers and the business provider - a bank in banking business or a brokerage firm in brokerage industry. These properties are analyzed using a network approach. The main difference between a third-party network analysis and other pattern analyses is to treat a network of customers connected through third-party activities as a single customerlike network object, instead of treating each individual customer as an object. All the techniques developed for analysis and data mining of individual patterns may be used for third-party network analysis and third-party network mining by replacing individual objects by network objects.

[0054] One important element for performing network analysis in a third- party network platform is to have a network query language. The network query language is intended to provide the functionality of performing C2C network queries either in a network platform or in a hybrid platform consisting of a network platform and a data platform. Also, it provides query capability difficult to perform for data query languages such as SQL. A SQL-like network language would be more attractive to the relational database users. A typical process for network analysis is shown in FIG. 6. For analysis of the internal characteristics of networks, a query engine may select networks satisfying the internal constraints 58 shown in FIG. 6 and perform data mining (step 68) on the characteristics of the network internal structures. Similarly, the query engine may select networks satisfying external constraints 60 and perform data mining (step 72) on the external characteristics of the networks for analysis of external properties of networks.

[0055] In general, there are two types of results from third-party network analysis, coming out from internal 68 and external 72 data mining as shown in FIG. 6. One describes internal properties of networks, namely results from link analysis of connections and relationships between member customers within a network. The other describes external properties of networks representing interactions between a customer network and a business provider such as a bank, as if each network appeared like an individual customer. Similarly, there are two types of network constraints: internal constraints and external constraints, as shown in FIG. 6.

[0056] Third-party network analysis may be performed using conventional data mining algorithms developed for mining individual patterns, such as association rules, clustering, neural networks, and decision tree. The main difference is that these algorithms are used to mine network patterns or group patterns in third-party network analysis, instead of individual patterns. For example, a decision tree may be built to classify and store third-party network patterns in various nodes. Each node stores network patterns having different pattern properties from network patterns in each other node, as illustrated in FIG. 7. Also, association rules may be used to measure and mine relationships between a network and external entities.

[0057] Examples of network properties of third-party networks are given as follows. In brokerage industry, a brokerage firm has a number of customers. The main business activities are financial transactions between the firm and its customers. However, some customers have financial transactions between themselves. A C2C network represents a group of customers connected through C2C transactions. A typical network is a pension trust network in which a number of pension trust accounts are connected through transactions regularly between a central account and the rest in the network. In this case, C2C pension trust business is conducted through a pension trust network. Another typical network is a stock option network in which a number of individual accounts and a company account are set up for C2C transactions. Customers of the individual accounts are employees of the company. C2C transactions between individual accounts and the company account represent activities related to the company's stock options. Another typical network is a fee network in which C2C transactions represent fee payments between member customers in a fee network.

[0058] All of the above examples show typical third party businesses that are legal. However, there are C2C networks in which third party transactions are illegal. For example, a money-laundering network represents a group of customers transferring funds between them. The source of these funds comes from illegal activities. Link analysis of C2C transactions in a money-laundering network may not be sufficient for identification of the money-laundering problem. Third-party network analysis of such networks provides additional opportunity for more complete understanding of the problem. The characteristics of the networks in the above examples may be described by various nodes in a sub-tree structure as shown in FIG. 7. External Properties

[0059] To demonstrate external properties of networks, we use the example shown earlier may be used to illustrate a network transform. Consider the method performing a network query to show account registration types for customers in each network. The query may find, for example, that all customers in the first network have account registration type of PT, meaning in this example pension trust. The other two networks have a similar pattern in registration types. One customer in each network has account registration type of CORP, meaning in this example company. The other customers in each network have account registration type of IN, meaning in this example individual . It turns out that the first network is a pension-trust network consisting of three pension-trust accounts managed by a company. The company manages pension-trust investment for three clients. Each account is set up for one of its clients. Financial transactions between the three accounts represent allocations of diversified investment. Perform a network query to show account segment type for the remaining networks. All customers in the second network have a type of employee stock option action (ESOS) for stock option type. This network turns out to be a stock-option network. Typically, a company may set up an account for the company and a few accounts for its key employees having stock options. Transactions between the company account and the employees' accounts reflect stock option exercises by the employees. In the example, further study of the third network shows a pattern: one account (CORP) in the network receives funds from overseas and distributes the funds to the other three accounts. One scenario for such pattern could be a money laundering network. Exemplary Apparatus

[0060] Certain portions of the invention may be performed by an automated processing system. Viewed externally in FIG. 8, an exemplary computer system designated by reference numeral 101 has a central processing unit located within a housing 108 and disk drives 103 and 104. Disk drives 103 and 104 are merely symbolic of a number of disk drives which might be accommodated by the computer system. Typically these would include a hard disk drive and optionally one or more floppy disk drives such as 103 and/or one or more CD-ROMs, CD-Rs, CD-RWs flash memory, memory stick or digital video disk (DVD) devices indicated by slot 104. The number and types of drives typically varies with different computer configurations. Disk drives 103 and 104 are in fact options, and they may be omitted from the computer system used in connection with the processes described herein. An exemplary type of storage media 110, which may serve as a carrier for program instructions, is also illustrated. Additionally, the computer system utilized for implementing the present invention may be a stand-alone computer having communications capability, a computer connected to a network or able to communicate via a network, a handheld computing device, or any other form of computing device capable of carrying out equivalent operations.

[0061] The computer also has or is connected to or delivers signals to a display 105 upon which graphical, video and/or alphanumeric information is displayed. The display may be any device capable of presenting visual images, such as a television screen, a computer monitor, a projection device, a handheld or other microelectronic device having video display capabilities, or even a device such as a headset or helmet worn by the user to present visual images to the user's eyes. The computer may also have or be connected to other means of obtaining signals to be processed. Such means of obtaining these signals may include any device capable of receiving images and image streams, such as video input and graphics cards, digital signal processing units, appropriately configured network connections, or any other microelectronic device having such input capabilities.

[0062] An optional keyboard 106 and a directing device 107 such as a remote control, mouse, joystick, touch pad, track ball, steering wheel, remote control or any other type of pointing or directing device may be provided as input devices to interface with the central processing unit.

[0063] FIG. 9 illustrates a block diagram of the internal hardware of the computer of FIG. 8. A bus 256 serves as the main information highway interconnecting the other components of the computer. CPU 258 is the central processing unit of the system, performing calculations and logic operations required to execute a program. Read only memory (ROM) 260 and random access memory (RAM) 262 constitute the main memory of the computer. [0064] A disk controller 264 interfaces one or more disk drives to the system bus 256. These disk drives may be external or internal floppy disk drives such as 270, external or internal CD-ROM, CD-R, CD-RW flash memory, memory stick or DVD drives such as 266, or external or internal hard drives 268 or other many devices. As indicated previously, these various disk drives and disk controllers are optional devices.

[0065] Program instructions may be stored in the ROM 260 and/or the RAM 262. Optionally, program instructions may be stored on a computer readable carrier such as a floppy disk or a digital disk or other recording medium, a communications signal, or a carrier wave.

[0066] Returning to FIG. 9, a display interface 272 permits information from the bus 256 to be displayed on the display 248 in audio, graphic or alphanumeric format. Communication with external devices may optionally occur using various communication ports such as 274.

[0067] In addition to the standard components of the computer, the computer also includes an interface 254 which allows for data input through the keyboard 250 or other input device and/or the directional or pointing device 252 such as a remote control, pointer, mouse or joystick Transformation Process

[0068] The many features and advantages of the invention are apparent from the detailed specification. Thus, the appended claims are intended to cover all such features and advantages of the invention which fall within the true spirits and scope of the invention. Further, since numerous modifications and variations will readily occur to those skilled in the art, it is not desired to limit the invention to the exact construction and operation illustrated and described. Accordingly, all appropriate modifications and equivalents may be included within the scope of the invention.

Claims

The invention claimed is:

1. A method of analyzing characteristics or behaviors of customers engaged in customer-to-customer transactions in a third party network, comprising the steps of:

transforming data representative of a plurality of individual customer-to-customer transactions from a data representation to a network representation; and

performing third-party network analysis on the network representation.

2. The method of claim 1, further including the step of building one or more third- party networks corresponding to customer-to-customer transactions.

3. The method of claim 2, wherein each third-party network comprises a plurality of nodes and a plurality of links, wherein each node is associated with at least one link and each link is associated with at least two nodes.

4. The method of claim 3, wherein each node in a network represents a member, customer or individual involved in third-party business activity.

5. The method of claim 3, wherein each link represents a connection or transaction between two member customers.

6. The method of claim 2, wherein each third-party network represents a group of customers connected through customer-to-customer transactions.

7. The method of claim 2, wherein each network has internal link pattern characteristics corresponding to interactions and connections between member customers in the network.

8. The method of claim 2, wherein each network has external network pattern characteristics, representing interactions and relationships between a network and external entities outside the network.

9. The method of claim 1, wherein the performing step comprises analyzing third- party networks, wherein each third-party network represents a group of customers connected through customer-to-customer transactions.

10. The method of claim 9, wherein the step of analyzing third-party networks identifies internal characteristics and behaviors of each network.

11. The method of claim 9, wherein the step of analyzing third-party networks identifies external characteristics and behaviors of each network by treating each network as a network object.

12. The method of claim 9, wherein the performing step further comprises the step of network mining using one or more mining algorithms.

13. The method of claim 12, wherein the network mining step comprises using decision tree mining to store third-party network patterns in nodes.

14. The method of claim 13, wherein at least one of the nodes stores a subset of networks having similar group pattern behaviors.

15. The method of claim 12, wherein the network mining step comprises using association rule mining to find networks having important association relationships with external patterns outside networks.

16. The method of claim 12, wherein the network mining step comprises using clustering group networks having similar network properties.

17. The method of claim 12 wherein the network mining step comprises detecting transactions that correspond to a pattern.

18. The method of claim 12 wherein the network mining step comprises detecting transactions that deviate from a pattern.

19. A method of monitoring customer behavior comprising the steps of:

monitoring data that corresponds to a plurality of individual transactions between customers;

transforming the data corresponding to a group of the transactions into a network representation; and

analyzing the network representation of the group of transactions to identify at least one transaction pattern.

20. The method of claim 19 wherein the transforming step comprises building a network, wherein:

the network comprises a plurality of links and a plurality of nodes;

each node corresponds to a customer in a customer-to-customer transaction; and

each link corresponds to a transaction between two of the customers.

21. A method of monitoring activity in a network, comprising: monitoring a plurality of transactions that occur at least partially in a second network;

storing, in a computer program memory, a plurality of nodes, wherein each node comprises data indicative of a participant in one or more of the transactions; and

storing, in the computer program memory, a plurality of links, wherein each link is associated with two nodes, and each link comprises data indicative of a measurement associated with the transaction between the participants associated with the same two nodes.

22. The method of claim 21 wherein each transaction comprises a transaction between two parties.

23. The method of claim 21 wherein each transaction comprises a transfer of funds.

24. The method of claim 21 wherein the data indicative of a measurement comprises a customer ID or an account ED.

25. The method of claim 21 wherein the data indicative of a measurement comprises a measure of transaction value, a measure of funds, a measure of time, a measure of distance between the participants associated with the nodes, or a measure of transaction frequency.

26. The method of claim 21 comprising the additional step of analyzing the links to identify at least one group transaction pattern.

27. The method of claim 26 comprising the additional step of detecting a link that deviates from the at least one group transaction pattern.

28. The method of claim 26 comprising the additional step of detecting a link that corresponds to a pre-identified transaction pattern.

29. The method of claim 21 comprising the additional steps of:

analyzing the links to identify at least one intra-network group transaction pattern; and

analyzing the links to identify at least one extra-network group transaction pattern.

30. The method of claim 29 comprising the additional step of detecting a link that does not conform to any applicable group transaction pattern.

31. The method of claim 29 comprising the additional step of detecting a link that corresponds to a pre-identified transaction pattern.