IBM Security i2

Expand all | Collapse all

Compare the balances - Fraud behviour

  • 1.  Compare the balances - Fraud behviour

    Posted Tue December 08, 2020 02:16 PM

    is there smooth and usable way to compare the account balances (source entity - dest entity) and transaction values together? I would like to filter out unnecessary accounts, based on balances and transaction amoutns, and focus for the possible fraudulent money transfer transactions using i2. Currently I have to jump back and forth with excel and i2 using importing - exporting features as I have not figured out how the i2 ANB can calculate and compare the entities and links values/amounts.

    Would be neat to have math calculation features in i2.


  • 2.  RE: Compare the balances - Fraud behviour

    Posted Wed December 09, 2020 02:39 AM
    Hi Sami

    You need to put the amount in the label of the link and remember to use direction on the transaction.

    This would allow you to start using calculations such as "List Most" connected

    Analyst's Notebook also creates what is called "Analysis Attributes" which is basically attributes that it calculates for you on the fly. One of them is "Entity Sum Link Flow" - as you can see in the image below - one of the accounts is actually sending more money than it is receiving which is why its "Entity Sum Link Flow" is -100

    From there on you can start to explore conditional formatting using the information from "Entity Sum Link Flow" to make entities "blue" that has a negative balance and maybe red for those account who has a positive balance.

    Conditional Formating Specifications can be shared with your colleagues so that they can just "click-the-button" and it will change the appearance on all acounts based on their "balance".

    I hope it is helpful.

    Martin Kragh

  • 3.  RE: Compare the balances - Fraud behviour

    Posted Wed December 09, 2020 03:42 AM
    Hello Sami

    In addition to the advice from Martin, you could also use Bar Charts and Histograms, especially if you have fully populated Attributes.

    I am presuming the data has been (or in future will be) added to your chart via an import? If so, the data can be easily used to create Attributes, and the same column of data in the Table can be used to populate more than one detail on the chart.

    E.g. the transaction amount can both be added to the Link Label (important if you want to use the Entity Flow... Analysis Attributes Martin has mentioned) and to populate a dedicated Dollar/Euro/Pound/Yen Amount Attribute from the Financial Palette.  Then the ...Amount can be viewed via a Bar Chart or a Histogram, and if you use the latter, i2 ANB will create bins to group transaction amounts together.

    Another Attribute you could create for the link would be one to identify the Account at either end, e.g. "11111111 > 22222222."  This could be created as part of the import spec, or you may want to concatenate in Excel first.  Then you could show a bar chart of all the link flows, very similar to a Pivot Table in Excel.  Either find a suitable Attribute Class, or create one from scratch.

    If you have concerns that all these Attributes will clutter up your chart, then this is resolved by going to the Chart Properties and amending the configuration for these populated Attribute Classes by unticking the Show On Chart option.  Then - for just this chart unless you save it as a Template for future re-use - those Attributes will hold data that can be used for analysis, but they won't be displayed and making the chart look a mess.

    Two more tips around the Entity Flow... Analysis Attributes that Martin describes 
    - if you intend to use them, then the first numerical value contained in the Link label has to be the amount.  If you put in the Acc No or a date or any other numerical ID, i2 ANB will consider that to be the 'value' of the link and it will send the calculations awry
    - Analysis Attributes such as Entity Flow... will dynamically change as you add/remove data to/from the chart.  You can take a snapshot of any Analysis Attribute by using the Combine Attributes function to copy from one to another.

    I hope between the two replies you have some more options available to you.


    Anthony Patamia

  • 4.  RE: Compare the balances - Fraud behviour

    Posted Wed December 09, 2020 03:45 AM
    Hi- would you be able to post up a chart as an example so I can understand better what you mean - as is often the key here it's the detail that can help understand exactly what you need to do. 

    I am assuming you have come across analysis  attributes and combine attributes- sometimes they can help

    cheers Mark

    Mark Fleet

  • 5.  RE: Compare the balances - Fraud behviour

    Posted Wed December 09, 2020 04:44 AM
    Hi Martin,

    yes. By setting that transaction amount as label value gives me some freedom to use the dynamic attributes and act based on that. :-) It's neat feature.  Unfortunately my imported dataset cannot use the example you described, as there does not seems to be any chained accounts (acc1->acc2->acc3). Most of them seems to be just acc1->acc2. This problem ends up into a situation where I'm forced to check if the the account balance (attribute: Euro amount) before the transaction has exact the same value as the transferred amount (label value). Once I have figured out how to get that done, I definitely will use the conditional formatting! :-)
    The data, what I'm using for this problem is from Kaggle. It surely could be so, that the data is not relevant and it causes the reason why I'm facing this challenge. 


    Sami Serpola

  • 6.  RE: Compare the balances - Fraud behviour

    Posted Wed December 09, 2020 04:54 AM
    Thank you Anthony for the tip. I will need to think about to use those extra attributes :-). Currently I'm thinking to concatenate the dataset as ready as possible and generate some extra fields in it. That dataset I can then import into i2 ANB to show the fraud cases.


    Sami Serpola