1 - Data collection

Data collection
The system is set up to load and store a number of transactions, which provide a statistical basis to ensure the validity of the classification and clustering operations.

2 - Analysis

Target Recorder
Creates a list of recipients of all the transactions carried out by the individual user.

GeoIP Recorder
Draws up a list of the locations and ISPs from which each individual user connects to the service, and creates the "mobility profile".

3 - Clustering

Movements Cluster
The clustering module converts the historical record of transactions carried out by the individual users into a chart representing his or her customary behaviour.

Clusters are calculated by using only the movements that relate to the last 6 months, so that only "recent" behaviour is taken into account.

Using these movements, statistical clusters are examined using the E.M. (Expectation Maximisation) algorithm, after excluding any outliers (events that fall outside the clusters) using other clustering algorithms (OPTICS + Dbscan or DENCLUE).

The clustering process is carried out every day, after the logs have been obtained and processed, and the results are saved on a second DB to improve the performance of the system.

The clustering results are entered in a DB so that comparisons can easily be drawn between new transaction orders and pre-calculated clusters and a weighting can be assigned to the transactions.

4 - Classification

Classifier
Analyses movements and classifies them according to the "danger level" of the transactions based on the results of previous modules.

Reporter
At regularly programmed intervals a report is created with information about the movements that are considered to be at risk.