Information security system for fraud detection

In one embodiment, a method includes receiving an invoice. The invoice includes invoice positions and each of the invoice positions includes a position text. The method also includes converting each word and number of the position text of each invoice position to a word embedding vector, summing the word embedding vectors for each invoice position to generate a word vector for each invoice position, and concatenating the word vector and a number vector of each invoice position to generate a position vector for each invoice position. The method further includes generating a first combined position vector for a first invoice position, generating a second combined position vector for a second invoice position, generating an invoice vector by summing the first and second combined position vectors, comparing the invoice vector to a fraud detection parameter, and determining whether the invoice is indicative of fraud based on the comparison.

TECHNICAL FIELD

This disclosure generally relates to an information security system, and more specifically to an information security system for fraud detection.

BACKGROUND

Many enterprises have expansive networks that receive large quantities of data. One of the technical challenges that occurs in a network environment is ensuring integrity of the data received by the network environment. As an example, an enterprise may receive thousands of invoices. Without the ability to efficiently detect error in large quantities of data, the enterprise is vulnerable to allowing fraudulent data (e.g. fraudulent invoices) to escape detection.

SUMMARY OF PARTICULAR EMBODIMENTS

According to an embodiment, a network security system for fraud detection includes one or more processors and a memory communicatively coupled to the one or more processors. The memory includes instructions executable by the one or more processors. The processors are operable when executing the instructions to receive an invoice. The invoice includes invoice positions, each of the invoice positions including a position text. The processors are also operable to convert each word and number of the position text of each invoice position to a word embedding vector, sum the word embedding vectors for each invoice position to generate a word vector for each invoice position, and concatenate the word vector and a number vector of each invoice position to generate a position vector for each invoice position. The processors are further operable to generate a first combined position vector for a first invoice position by modifying the position vectors that neighbor a first position vector, condensing the neighboring position vectors of the first position vector to generate a first condensed position vector, and concatenating the first condensed position vector and the first position vector to generate the first combined position vector. Similarly, the processors are operable to generate a second combined position vector for a second invoice position by modifying the position vectors that neighbor a second position vector, condensing the neighboring position vectors of the second position vector to generate a second condensed position vector, and concatenating the second condensed position vector and the second position vector to generate the second combined position vector. The processors are further operable to generate an invoice vector by summing the first combined position vector and the second combined position vector, compare the invoice vector to a fraud detection parameter; and determine whether the invoice is indicative of fraud based on the comparison.

Technical advantages of certain embodiments may include providing a system and/or method of detecting fraud in large quantities of invoices by transforming the invoice to a vector representative of the entire invoice and comparing the invoice vector to sample invoice vectors that are determined to be free from fraud. Another technical advantage of certain embodiments may include providing a system and/or method for deriving information missing from a position text within an invoice by using the neighboring position texts. For example, a deep neural network may be trained to transform incomplete position text to complete position text by utilizing several (e.g., hundreds or thousands) common position texts. Other technical advantages will be readily apparent to one skilled in the art from the following figures, descriptions, and claims. Moreover, while specific advantages have been enumerated above, various embodiments may include all, some, or none of the enumerated advantages.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

One of the technical challenges that occurs in computer technology, such as a network environment, is ensuring data integrity when large quantities of data are received by the network environment. As an example, an enterprise (e.g., an insurance company) may receive thousands of invoices (e.g., car repair invoices and/or property damage invoices) and may be required to take action based on these invoices (e.g., distributing payment for damaged property). Conventional systems are typically unable to efficiently detect malicious activity (e.g., fraud) in the invoices. Without the ability to efficiently and quickly detect malicious activity in the invoices, the enterprise is vulnerable to fraudulent attacks.

The system described in the present application provides a technical solution to detect and prevent malicious activity and/or inaccuracies in information received by an enterprise. The ability to detect and prevent malicious activity improves the operation of the system and the security of the enterprise. For example, the system is able to identify malicious activity in a repair invoice before the system decides whether to approve the invoice. As another example, the system is able to identify errors in a repair invoice, which provides an opportunity for corrective action prior to processing the invoice for payment. Thus, the system provides an unconventional technical solution that allows the system to protect itself from malicious activity and errors that may hinder an enterprise's success.

FIG. 1illustrates an example system100configured to implement fraud detection, according to certain embodiments. System100includes an administrative module120, a position conversion module140, and a fraud detection module160connected to each other by a network110. In general, system100facilitates implementing fraud detection through analysis by administrative module120, position conversion module140, and fraud detection module160of information stored in one or more databases.

System100or portions thereof may be associated with an entity, which may include any entity, such as a person, business, or company, that analyzes data for fraud detection. Throughout this description, this entity is referred to as the entity associated with system100. In one embodiment, administrative module120, position conversion module140, and fraud detection module160may be included within an entity and connected by network110. The elements of system100may be implemented using any suitable combination of hardware, firmware, and software.

AlthoughFIG. 1illustrates a particular arrangement of administrative module120, position conversion module140, fraud detection module160, and network110, this disclosure contemplates any suitable arrangement of administrative module120, position conversion module140, fraud detection module160, and network110. As an example and not by way of limitation, two or more of administrative module120, position conversion module140, and fraud detection module160may be connected to each other directly, bypassing network110. As another example, two or more of administrative module120, position conversion module140, and fraud detection module160may be physically or logically co-located with each other in whole or in part. Moreover, althoughFIG. 1illustrates a particular number of administrative modules120, position conversion modules140, fraud detection modules160, and networks110, this disclosure contemplates any suitable number of administrative modules120, position conversion modules140, fraud detection modules160, and networks110. As an example and not by way of limitation, network environment100may include multiple administrative modules120, position conversion modules140, and fraud detection modules160.

In some embodiments, administrative module120is a computer program for analyzing data to identify characteristics of the data (e.g., one or more positions of an invoice). In the illustrated embodiment, administrative module120includes an interface122, a memory124, and a processor134. Memory124of administrative module includes database126and invoice analyzer132. The elements of administrative module120may be implemented using any suitable combination of hardware, firmware, and software.

Administrative module120may be implemented using one or more computer systems at one or more locations. Each computer system may include any appropriate input devices, output devices, mass storage media, processors, memory, or other suitable components for receiving, processing, storing, and communicating data. For example, each computer system may include a personal computer, workstation, network computer, kiosk, wireless data port, PDA, one or more IP telephones, one or more servers, a server pool, switch, router, one or more processors within these or other devices, or any other suitable processing device. Administrative module120may be a stand-alone computer or may be a part of a larger network of computers associated with an entity.

Interface122of administrative module120represents any suitable computer element that can receive information from network110, transmit information through network110, perform suitable processing of the information, communicate to other components (e.g., position conversion module140) of system100, or any combination of the preceding. For example, interface122may receive a communication from a workstation, transmit information pertaining to the received communication to position conversion module140, receive responses from fraud detection module160, and/or communicate a response to the workstation. Interface122represents any port or connection, real or virtual, including any suitable combination of hardware, firmware, and software, including protocol conversion and data processing capabilities, to communicate through a Local Area Network (“LAN”), Wide Area Network (“WAN”), or other communication system that allows the entity associated with system100to exchange information between components of system100.

Memory124of administrative module120stores, permanently and/or temporarily, received and transmitted information, as well as system software, control software, other software for administrative module120, and a variety of other information. Memory124may store information for execution by processor134. In the illustrated embodiment, memory124stores database126and invoice analyzer132of administrative module120.

Memory124includes any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory124may include Random Access Memory (“RAM”), Read-only Memory (“ROM”), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices. Memory124may include any suitable information for use in the operation of administrative module120. Additionally, memory124may be a component external to (or may be partially external to) administrative module120. Memory124may be located at any location suitable for memory124to communicate with administrative module120.

Database126of administrative module120may be any database that stores data. Database126may store certain types of information for the entity associated with system100. For example, database126may store one or more invoices128a-n, where n is any suitable integer. In certain embodiments, database126stores characteristics associated with invoices128a-n. For example, database126may store one or more positions130a-nassociated with each invoice128. Each position130a-nis a line item of an invoice describing a service or product added to the invoice. For example, invoice128amay include five invoice positions130a-e, wherein: position130aincludes position text describing a service (e.g., “move desks”), an associated unit (e.g., “flat” rate), an associated quantity (e.g., “1” flat rate), and an associated price per unit (e.g., “$50” per flat rate); position130bincludes position text describing a product (e.g., “white paint”), an associated unit (e.g., “gallon”), an associated quantity (e.g., “10” gallons), and an associated price per unit (e.g., “$15” per gallon); and so on. In certain embodiments, database126stores certain types of information received from one or more components of system100. For example, database126may store results generated by fraud detection module160. Database126may be one database in a collection of databases126a-n. In some embodiments, each database126a-nmay store a particular type of information. For example, database126amay store invoices128a-nand database126bmay store results generated from fraud detection module160.

Database126includes any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, database126may include Random Access Memory (“RAM”), Read-only Memory (“ROM”), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices. While database126is shown in administrative module120in the illustrated embodiment ofFIG. 1, database126may be located in any location suitable for communication with administrative module120, position conversion module140, and/or fraud detection module160. For example, database126may be externally located from administrative module120, position conversion module140, and/or fraud detection module160. As another example, database126aof databases126a-nmay be located in administrative module120, database126bmay be located in position conversion module140, database126cmay be located in fraud detection module160, and so on. Although described as a database, databases126may be implemented as any suitable type of volatile or non-volatile memory. Database126may include one or more interfaces and/or processors.

Processor134of administrative module120controls certain operations of administrative module120by processing information received from interface122and memory124or otherwise accessed by processor134. Processor134communicatively couples to interface122and memory124. Processor126includes any hardware and/or software that operates to control and process information. Processor134may be a programmable logic device, a microcontroller, a microprocessor, any suitable processing device, or any suitable combination of the preceding. Additionally, processor134may be a component external to administrative module120. Processor134may be located in any location suitable for processor134to communicate with administrative module120. Processor134controls the operation of invoice analyzer132.

Invoice analyzer132accesses information in database126, processes and analyzes the accessed information, and arranges this information for input into position conversion module140. For example, invoice analyzer may search database126for particular invoice128aof invoices128a-n, determine which information (e.g., positions130a-n) to collect for input into position conversion module140, and arrange this collected information into a format so that interface122can transmit this collected information to position conversion module140. As another example, invoice analyzer may search database126for information (e.g., fraud results for invoice128a) received from fraud detection module160, determine which information (e.g., fraud results for a certain invoice128a) to collect in response to a request from a user (e.g., an insurance agent) of a workstation, and arrange this collected information into an intelligent view so that interface122can display this collected information to the user.

In the illustrated embodiment, position conversion module140is a computer program that receives information (e.g., positions130a-nof invoice128a) from administrative module120and converts this information to a vector (e.g., a vector representative of entire invoice128a). In the illustrated embodiment, position conversion module140includes an interface142, a memory144, and a processor154. Memory144of position conversion module140includes position converter146. The elements of position conversion module140may be implemented using any suitable combination of hardware, firmware, and software.

Position conversion module140may be implemented using one or more computer systems at one or more locations. Each computer system may include any appropriate input devices, output devices, mass storage media, processors, memory, or other suitable components for receiving, processing, storing, and communicating data. For example, each computer system may include a personal computer, workstation, network computer, kiosk, wireless data port, PDA, one or more IP telephones, one or more servers, a server pool, switch, router, one or more processors within these or other devices, or any other suitable processing device. Position conversion module140may be a stand-alone computer or may be a part of a larger network of computers associated with an entity.

Interface142of position conversion module140represents any suitable computer element that can receive information from network110, transmit information through network110, perform suitable processing of the information, communicate to other components (e.g., fraud detection module160) of system100, or any combination of the preceding. For example, interface142may receive a communication from administrative module120and/or transmit information pertaining to the received communication to fraud detection module160. Interface142represents any port or connection, real or virtual, including any suitable combination of hardware, firmware, and software, including protocol conversion and data processing capabilities, to communicate through a Local Area Network (“LAN”), Wide Area Network (“WAN”), or other communication system that allows the entity associated with system100to exchange information between components of system100.

Memory144of position conversion module140stores, permanently and/or temporarily, received and transmitted information, as well as system software, control software, other software for position conversion module140, and a variety of other information. Memory144may store information for execution by processor154. In the illustrated embodiment, memory144stores position converter146of position conversion module140.

Memory144includes any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory144may include Random Access Memory (“RAM”), Read-only Memory (“ROM”), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices. Memory144may include any suitable information for use in the operation of position conversion module140. Additionally, memory144may be a component external to (or may be partially external to) position conversion module140. Memory144may be located at any location suitable for memory124to communicate with position conversion module140.

Processor154of position conversion module140controls certain operations of position conversion module140by processing information received from interface142and memory144or otherwise accessed by processor154. Processor154communicatively couples to interface142and memory144. Processor154includes any hardware and/or software that operates to control and process information. Processor154may be a programmable logic device, a microcontroller, a microprocessor, any suitable processing device, or any suitable combination of the preceding. Additionally, processor154may be a component external to position conversion module140. Processor154may be located in any location suitable for processor154to communicate with position conversion module140. Processor154controls the operation of position converter146.

Position converter146of position conversion module140accesses information received from administrative module120, processes and analyzes the accessed information, and arranges this information for input into fraud detection module160. For example, position converter146may receive positions130a-nof invoice128afrom administrative module120, convert (see notation150) positions130a-nto a combined position vectors148-n, and arrange this information into a format (e.g., invoice vector167a) so that interface142can transmit this information to fraud detection module160. As another example, position converter146may receive positions130a-nof each invoice128a-nfrom administrative module120, convert positions130a-nfor each invoice128a-nto combined position vectors148a-n, respectively, and arrange this information into a format (e.g., n-dimensional hyperspace representation of invoice vectors167a-n) so that interface142can transmit this information to fraud detection module160. In certain embodiments, position converter146is a neural network (e.g., a deep neural network). Position converter146is described in more detail inFIG. 2below.

Fraud detection module160is a computer program for detecting fraud in data (e.g., invoices128a-n). In the illustrated embodiment, fraud detection module160includes an interface162, a memory164, and a processor174. Memory164of fraud detection module160includes fraud detector166. The elements of fraud detection module160may be implemented using any suitable combination of hardware, firmware, and software.

Fraud detection module160may be implemented using one or more computer systems at one or more locations. Each computer system may include any appropriate input devices, output devices, mass storage media, processors, memory, or other suitable components for receiving, processing, storing, and communicating data. For example, each computer system may include a personal computer, workstation, network computer, kiosk, wireless data port, PDA, one or more IP telephones, one or more servers, a server pool, switch, router, one or more processors within these or other devices, or any other suitable processing device. Fraud detection module160be a stand-alone computer or may be a part of a larger network of computers associated with an entity.

Interface162of fraud detection module160represents any suitable computer element that can receive information from network110, transmit information through network110, perform suitable processing of the information, communicate to other components (e.g., administrative module120) of system100, or any combination of the preceding. For example, interface162may receive a communication from position conversion module140and/or transmit information pertaining to the received communication to administrative module120. Interface162represents any port or connection, real or virtual, including any suitable combination of hardware, firmware, and software, including protocol conversion and data processing capabilities, to communicate through a Local Area Network (“LAN”), Wide Area Network (“WAN”), or other communication system that allows the entity associated with system100to exchange information between components of system100.

Memory164of fraud detection module160stores, permanently and/or temporarily, received and transmitted information, as well as system software, control software, other software for fraud detection module160, and a variety of other information. Memory164may store information for execution by processor174. In the illustrated embodiment, memory164stores fraud detector166of fraud detection module160.

Memory164includes any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory144may include Random Access Memory (“RAM”), Read-only Memory (“ROM”), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices. Memory164may include any suitable information for use in the operation of fraud detection module160. Additionally, memory164may be a component external to (or may be partially external to) fraud detection module160. Memory164may be located at any location suitable for memory164to communicate with fraud detection module160.

Processor174of fraud detection module160controls certain operations of fraud detection module160by processing information received from interface162and memory164or otherwise accessed by processor164. Processor174communicatively couples to interface162and memory164. Processor174includes any hardware and/or software that operates to control and process information. Processor174may be a programmable logic device, a microcontroller, a microprocessor, any suitable processing device, or any suitable combination of the preceding. Additionally, processor174may be a component external to fraud detection module160. Processor174may be located in any location suitable for processor174to communicate with fraud detection module160. Processor174controls the operation of fraud detector166.

Fraud detector166of fraud detection module160analyzes information for fraud. In the illustrated embodiment, fraud detector166accesses information received from position conversion module140, processes and analyzes the accessed information, and arranges this information for input into administrative module120. For example, fraud detector166may receive combined position vectors148a-nfrom position conversion module140, generate invoice vector167afrom combined position vectors148a-n, compare (see notation171) invoice vector167ato a fraud detection parameter168a, and arrange (see notation172) the comparison results into a format (e.g., list170) so that interface162can transmit these results to administrative module120. As another example, fraud detector166may receive invoice vectors167a-nfrom position conversion module140, compare invoice vectors167a-nto fraud detection parameters168a-n(where n represents any suitable integer), and arrange these comparison results into a format (e.g., list170) so that interface162can transmit these results to administrative module120.

Fraud detection parameters168a-nof fraud detector166represent constraints for detecting fraud in combined position vectors148a-n. For example, when invoice vector167ais located within fraud detection parameter168a, fraud is not detected in invoice128aassociated with invoice vector167a, as indicated in list170by the word “NO”. As another example, when invoice vector167bis located within fraud detection parameter168b, fraud is not detected in invoice128bassociated with invoice vector167b, as indicated in list170by the word “NO”. As still another example, when invoice vector167nis not located within fraud detection parameter168n, fraud is detected in invoice128nassociated with invoice vector167n, as indicated in list170by the word “YES”. While system100illustrates a list to indicate fraud results, any suitable format (e.g., a graph) may be utilized to indicate fraud in system100. Further, while list170indicates fraud in invoices using the terms “YES” and “NO”, list170may utilize any notation suitable to indicate fraud (e.g., a check or an “x”).

In certain embodiments, measurements are used to determine whether invoices128a-nare indicative of fraud. For example, fraud detector166may measure a similarity between combined position vector148aand one or more sample vectors determined to be free from fraud using cosine similarity. A high cosine similarity may represent similarities between combined position vector148aand the one or more sample vectors, which may indicate that invoice148ais fraudless. A low cosine similarity (e.g., a value close to 0) may represent differences between combined position vector148aand the one or more sample vectors, which may indicate that invoice148ais fraudulent. As another example, fraud detector166may measure a similarity between combined position vector148aand one or more sample vectors determined to be free from fraud using Euclidean distance similarity.

In response to fraud detection module160analyzing invoices128a-nfor fraud, fraud detection module160may take action based on the analysis. For example, fraud detection module160may accept the invoice, deny the invoice, execute further analysis (e.g., a further comparison), and/or trigger a business process (e.g., report fraud to one or more organizations).

Position conversion module140receives (see notation200) position text210aof position130aof invoice128afrom administrative module120. In response to receiving position text210afrom position130aof invoice128a, position converter146of position conversion module140converts (see notation215a) position text210ato a word vector220a. The conversion is described in more detail inFIG. 3below.

Position converter146of position conversion module140may concatenate (see notation225a) word vector220awith a number vector to generate a position vector230a. The concatenation is described in more detail inFIG. 3below. In certain embodiments, word vector220a, the number vector, and position vector230ahave a predetermined dimensionality. For example, word vector220amay have a predetermined dimensionality of 1500, the number vector may have a predetermined dimensionality of 75, and position vector230amay have a dimensionality of 1500+75. Position vector230ais a vector representation of position text210afrom position130aof invoice128a.

In the illustrated embodiment ofFIG. 2, the above described process of converting position text210aof invoice128ato position vector230ais repeated for neighboring position texts210b-n(where n represents any suitable integer). For example, position conversion module140may receive (see notation200) position text210bof invoice from position130bof invoice128afrom administrative module120, convert (see notation215b) position text210bto word vector220b, and concatenate (see notation225b) word vector220bwith a number vector to generate a position vector230b, and so on. In certain embodiments, position texts210a-nrepresent all position texts included in invoice128a.

Position conversion module140may include one or more networks. For example, position conversion module140may include a position level attention network240, a long short-term memory (“LSTM”) network250, and a multilayer perceptron (“MLP”) network260.

Position level attention network240of position conversion module140is any network that can receive position vectors230b-n, which neighbor position vector230a, from one or more components of system100. In certain embodiments, position level attention network240is a feed-forward MLP network. Position level attention network240may receive as input position vectors230b-nfrom a database of memory144of position conversion module140, generate a scalar value associated with the position vectors230b-n, and multiply each position vector230b-nto the generated scalar value to generate modified position vectors240b-n. Position level attention network may then transfer (see notation245) the modified position vectors240b-nto LSTM network250.

LSTM network250of position conversion module140is any network that can receive neighboring position vectors240b-nfrom one or more components of system100. For example, LSTM network250may receive (see notation245b) as input modified position vectors240b-nfrom a database of memory144of position conversion module140and condense information associated with modified position vectors240b-ninto a condensed position vector254. LSTM network250includes a hidden state252, which outputs condensed position vector254.

MLP network260is any network that can receive position vectors from one or more components of system100. For example, MLP network260may receive (see notation255) as input position vector230aand condensed position vector254from memory144(e.g., a database) of position conversion module140. In certain embodiments, MLP network260concatenates position vector230aand condensed position vector254to generate a combined position vector148a. For example, MLP network260may combine information from position text210awith information (e.g., contextual information) from position texts210a-nto generate combined position vector148a.

In certain embodiments, combined position vector148aprovides a complete description of the service or product of position text210a. For example, position text210amay read “technician”. Based on information derived from position texts210b-n(e.g., “roofing materials”), MLP network may generate a description that represents text “roof technician”. In some embodiments, MLP network260may use information derived from one or more sources other than position text210a-n. For example, position130aof invoice128amay include a units category indicating units (e.g., hours) for particular services, and MLP network260may generate a more complete description for position text210athat reads “hourly roof technician”.

In some embodiments, system100may train position conversion module140to generate a complete description for position text210aby utilizing machine learning. For example, several sample invoice positions (e.g., over 2,000 invoice positions) may be input into position conversion module140alongside combined position vector148arepresenting complete position text. System100may utilize the backpropagation method to learn neural network parameters of position conversion module140and map incomplete position text (e.g., “technician”) to a complete position text (e.g., “HVAC technician”). The mapping of incomplete position text to complete position text that is used to train the neural network of position conversion module140may be performed by subject experts who identify and map together different linguistic forms and ways to express the same semantic meaning in the natural language.

The above process of converting position texts210a-nto combined position vector148ais repeated for position texts210b-nto generate combined position vectors148b-n, respectively. For example, position level attention network240may receive position vectors230aand230c-n, which neighbor position vector230b, generate a scalar value associated with the position vectors230aand230c-n, and multiply each position vector230aand230c-nto the generated scalar value to generate modified position vectors240aand240c-n. Position level attention network240may then transfer the modified position vectors240aand240c-nto LSTM network250, which then condenses information associated with modified position vectors240aand240c-ninto a condensed position vector254(representative of240aand240c-n). MLP network260then concatenates position vector230band condensed position vector254to generate a combined position vector148b.

Combined position vectors148a-nare numeric representations of position texts210a-n, respectively. In addition to neighboring position text, the generation of combined position vectors148a-nby position conversion module140(e.g., a deep neural network) may take into account position texts, units, amounts, and/or prices associated with positions130a-n.

In certain embodiments, combined position vectors148a-nare summed to generate an invoice vector167a. Invoice vector167ais a numeric representation of the entire invoice (e.g., invoice128a). In some embodiments, MLP network260transfers combined position vectors148a-nto a processor (e.g., processor154ofFIG. 1) of position conversion module140, which generates invoice vector167aand then transfers (see notation280) invoice vector167ato fraud detection module160ofFIG. 1. In certain embodiments, the processor that generates invoice vector167amay be external to position conversion module140. This process of generating invoice vector167amay be repeated for invoices128b-nto generate invoice vectors167b-n, respectively.

FIG. 3illustrates additional example details of position conversion module140ofFIG. 2, according to certain embodiments. In particular,FIG. 3illustrates an example conversion of position text210c, as shown inFIG. 2, to position vector230c, as shown inFIG. 2. In certain embodiments, an invoice (e.g., invoice128aof administrative module120) includes position texts210a-n, units310a-n, amounts320a-n, and price per unit330a-n, where n represents any suitable integer. Position texts210a-ncan be any combination of words, numbers, and symbols representative of a service or product. For example, position text210aof invoice position130areads “move furniture,” position text210bof invoice position130breads “white paint,” position text130cof invoice position130creads “paint 100 m2 wall,” and position text210nof invoice position130nreads “clean room and dispose waste.” In certain embodiments, position texts210a-ninclude an incomplete description of the associated service and or product. For example, position text210dmay read “technician,” which could be interpreted as a roofing technician or an HVAC technician.

Units310a-nrepresent any standard for which amounts can be measured. For example, “flat” unit310aof invoice position130arepresents a flat rate to move furniture, “gallon” unit310bof invoice position130brepresents a gallon of white paint, “hour” unit130cof invoice position130crepresents an hour of painting 100 m2 wall, and “flat” unit310nof invoice position130nrepresents a flat rate to clean room and dispose waste. Units may be based on any measurement system (e.g., Metric or U.S. standard system).

Amounts320a-nrepresent quantities of units. For example, amount320aof invoice position130arepresents a single flat rate to move furniture, amount320bof invoice position130brepresents 10 gallons of white paint, amount320cof invoice position130crepresents 2 hours to paint 100 m2 wall, and amount320nof invoice position130nrepresents a single flat rate to clean room and dispose waste. Amount320a-nmay be represented by numbers (e.g., 10) or words (e.g., ten).

Prices per unit330a-nrepresent costs associated with a single unit310a-n. For example, price per unit330aof invoice position130arepresents a $50 flat rate to move furniture, price per unit330bof invoice position130brepresents a $15 cost for each gallon of white paint, price per unit330cof invoice position130crepresents a $20 cost for each hour to paint 100 m2 wall, and price per unit330nof invoice position130nrepresents a $100 flat rate to clean room and dispose waste.

In certain embodiments, position conversion module140converts position texts210a-nto position vectors230a-n, respectively. For example, as shown inFIG. 2, position conversion module140may convert position text210cto position vector230c. In the illustrated embodiment, each word and/or number340a,340b,340c, and340dof position text210c(i.e., “paint”, “100”, “m2”, and “wall”, respectively) is represented in table350. In instances where position text includes more than a certain number of words (e.g., 75 words), the words may be truncated so that table350includes a maximum number of words (e.g., 75 words). Each number in position text210cmay be replaced by a special token, in some embodiments. For example, number “100” in position text210cis replaced by <number> (see notation340b) in table350. Each word and number340a-dof position text210cis then converted to word embedding vectors360a-d, respectively.

Position conversion module140may utilize one or more of the following known word embedding techniques to convert each word and number340a-dof position text210cto word embedding vectors360a-d: Global Vectors for Word Representation (“GloVe”), word2vec, and fastText. For example, during a training phase, one of the word embedding techniques (e.g., GloVe) may generate a look-up table that maps individual words in vocabulary to vectors. This look-up-table is used to generate word embedding vectors360a-dfor each word340a-din position text210c.

Each word embedding vector360a-dof table350may have a predetermined dimensionality with a predetermined number of units. For example, word embedding vector360afor the word “paint” may have a predetermined dimensionality of 1500, which is represented by 1500 units that include units 0.1, 0.3, 0.5. and so on, with a last unit of −0.7. As another example, word embedding vector360bfor special token <number> may have a predetermined dimensionality of 1500, which is represented by 1500 units that include units 0.4, 0.5, −0.9. and so on, with a last unit of 0.3.

In the illustrated embodiment, word embedding vectors360a-360dare summed (see notation370) to generate word vector220c. In some embodiments, word embedding vectors360a-dand word vector220call have the same dimensionality (e.g., 1500). Word vector220cis then concatenated with a number vector380cto generate position vector230c. Number vector380cmay include one or more numbers from the position text210cmultiplied by a predefined normalization factor (e.g., 1/10,000). In the illustrated embodiment, number vector380cmay include number 0.01, which represents the number “100” from position text210cdivided by predetermined number 10,000. This predefined normalization factor may be selected to keep the median value of normalized numbers occurring in position texts of statistically large number of invoices (e.g., greater than 100,000) at approximately 0.5. Number 0.01 is located in a position (second unit from left) corresponding to a position of the number in position text210c(second word or number from left). In other embodiments, the number from position text210cmay be divided by any other predetermined number and may be located in a position other than a position corresponding to the position of the number in position text210c. All other units of number vector380cnot corresponding to a number in position text210may be set to a predetermined number (e.g., 0).

Number vector380cmay have a dimensionality that is less than the dimensionality of word vector220c. For example, word vector220cmay have a dimensionality of 1500 and number vector380cmay have a dimensionality of 75. Position converter146of system100may then concatenate word vector220cand number vector380cto generate position vector230c. In some embodiments, position vector230cmay have a dimensionality of 1500+75. Position vector230cmay then be used to generate modified position vector240cand ultimately invoice vector167a, as described above in reference toFIG. 2.

FIG. 4illustrates an example method400for detecting fraud in invoices, according to certain embodiments. In some embodiments, method400begins at step410, where a computer system (e.g., position conversion module140) receives an invoice (e.g., invoice128a). The invoice includes one or more invoice positions (e.g. invoice positions130a-n). Each invoice position includes invoice information. For example, an invoice position may include position text, units, amount, and a price per unit. In certain embodiments, the computer system receives particular invoice information from an administrative module (e.g., administrative module120). For example, position conversion module140may receive position text210afrom administrative module210.

Method400then proceeds to step415, where the computer system converts each word and number of the position text of each invoice position to a word embedding vector (e.g., word embedding vectors360a-d). In certain embodiments, converting each word and number of the position text of each invoice position to a word embedding vector includes truncating the words and the numbers of each position text to a predetermined number of words and numbers (e.g., 75 words and numbers). Converting each word and number of the position text of each invoice position to a word embedding vector may also include replacing the numbers with unique tokens. One of the following techniques may be utilized to convert each word and/or number of the position text to a word embedding vector: Global Vectors for Word Representation (“GloVe”); word2vec; and fastText.

Method400then advances to step420, where the word embedding vectors for each invoice position are summed to generate a word vector for each invoice position. The word vector and a number vector of each invoice position are concatenated at step425to generate a position vector for each invoice position (e.g., position vector230a). Method400then moves to step430, where a combined position vector associated with each invoice position is generated using one or more neighboring position vectors. An invoice vector (e.g., invoice vector167a) is then generated by the computer system at step440by summing the combined position vectors (e.g., combined position vectors148a-n). At step445, the invoice vector is compared to a fraud detection parameter (e.g., fraud detection parameter168a). In certain embodiments, fraud detection parameters168a-nmay be determined from historical data. For example, fraud detection parameters may be learned from invoices determined to be fraudulent and fraudless based on human expert knowledge. In some embodiments, learning may be realized using any suitable classification machine learning algorithm (e.g., linear classifier, support vector machine, or random forest).

At step450, the computer system determines whether the invoice is indicative of fraud based on the comparison. If the invoice is indicative of fraud, method400advances to step455, and the invoice is approved. If the invoice is indicative of fraud, method400moves to step460, and the invoice is denied. Method400then moves to step465, where the computer system determines whether another invoice (e.g., invoice128b) has been received. If another invoice has been received, method400moves to step410, where the above described process is repeated. If another invoice has not been received, method400moves to step470, where method400ends.

Particular embodiments may repeat one or more steps of the method ofFIG. 4, where appropriate. Although this disclosure describes and illustrates particular steps of the method ofFIG. 4as occurring in a particular order, this disclosure contemplates any suitable steps of the method ofFIG. 4occurring in any suitable order. Moreover, although this disclosure describes and illustrates an example method for detecting fraud in invoices including the particular steps of the method ofFIG. 4, this disclosure contemplates any suitable method for detecting fraud in invoices including any suitable steps, which may include all, some, or none of the steps of the method ofFIG. 4, where appropriate. Furthermore, although this disclosure describes and illustrates particular components, devices, or systems carrying out particular steps of the method ofFIG. 4, this disclosure contemplates any suitable combination of any suitable components, devices, or systems carrying out any suitable steps of the method ofFIG. 4.

FIG. 5illustrates an example computer system500. In particular embodiments, one or more computer systems500perform one or more steps of one or more methods described or illustrated herein. In particular embodiments, one or more computer systems500provide functionality described or illustrated herein. In particular embodiments, software running on one or more computer systems500performs one or more steps of one or more methods described or illustrated herein or provides functionality described or illustrated herein. Particular embodiments include one or more portions of one or more computer systems500. Herein, reference to a computer system may encompass a computing device, and vice versa, where appropriate. Moreover, reference to a computer system may encompass one or more computer systems, where appropriate.

In particular embodiments, computer system500includes a processor502, memory504, storage506, an input/output (I/O) interface508, a communication interface510, and a bus512. Although this disclosure describes and illustrates a particular computer system having a particular number of particular components in a particular arrangement, this disclosure contemplates any suitable computer system having any suitable number of any suitable components in any suitable arrangement.

In particular embodiments, processor502includes hardware for executing instructions, such as those making up a computer program. As an example and not by way of limitation, to execute instructions, processor502may retrieve (or fetch) the instructions from an internal register, an internal cache, memory504, or storage506; decode and execute them; and then write one or more results to an internal register, an internal cache, memory504, or storage506. In particular embodiments, processor502may include one or more internal caches for data, instructions, or addresses. This disclosure contemplates processor502including any suitable number of any suitable internal caches, where appropriate. As an example and not by way of limitation, processor502may include one or more instruction caches, one or more data caches, and one or more translation lookaside buffers (TLBs). Instructions in the instruction caches may be copies of instructions in memory504or storage506, and the instruction caches may speed up retrieval of those instructions by processor502. Data in the data caches may be copies of data in memory504or storage506for instructions executing at processor502to operate on; the results of previous instructions executed at processor502for access by subsequent instructions executing at processor502or for writing to memory504or storage506; or other suitable data. The data caches may speed up read or write operations by processor502. The TLBs may speed up virtual-address translation for processor502. In particular embodiments, processor502may include one or more internal registers for data, instructions, or addresses. This disclosure contemplates processor502including any suitable number of any suitable internal registers, where appropriate. Where appropriate, processor502may include one or more arithmetic logic units (ALUs); be a multi-core processor; or include one or more processors502. Although this disclosure describes and illustrates a particular processor, this disclosure contemplates any suitable processor.

In particular embodiments, memory504includes main memory for storing instructions for processor502to execute or data for processor502to operate on. As an example and not by way of limitation, computer system500may load instructions from storage506or another source (such as, for example, another computer system500) to memory504. Processor502may then load the instructions from memory504to an internal register or internal cache. To execute the instructions, processor502may retrieve the instructions from the internal register or internal cache and decode them. During or after execution of the instructions, processor502may write one or more results (which may be intermediate or final results) to the internal register or internal cache. Processor502may then write one or more of those results to memory504. In particular embodiments, processor502executes only instructions in one or more internal registers or internal caches or in memory504(as opposed to storage506or elsewhere) and operates only on data in one or more internal registers or internal caches or in memory504(as opposed to storage506or elsewhere). One or more memory buses (which may each include an address bus and a data bus) may couple processor502to memory504. Bus512may include one or more memory buses, as described below. In particular embodiments, one or more memory management units (MMUs) reside between processor502and memory504and facilitate accesses to memory504requested by processor502. In particular embodiments, memory504includes random access memory (RAM). This RAM may be volatile memory, where appropriate Where appropriate, this RAM may be dynamic RAM (DRAM) or static RAM (SRAM). Moreover, where appropriate, this RAM may be single-ported or multi-ported RAM. This disclosure contemplates any suitable RAM. Memory504may include one or more memories504, where appropriate. Although this disclosure describes and illustrates particular memory, this disclosure contemplates any suitable memory.

In particular embodiments, storage506includes mass storage for data or instructions. As an example and not by way of limitation, storage506may include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disc, a magneto-optical disc, magnetic tape, or a Universal Serial Bus (USB) drive or a combination of two or more of these. Storage506may include removable or non-removable (or fixed) media, where appropriate. Storage506may be internal or external to computer system500, where appropriate. In particular embodiments, storage506is non-volatile, solid-state memory. In particular embodiments, storage506includes read-only memory (ROM). Where appropriate, this ROM may be mask-programmed ROM, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), electrically alterable ROM (EAROM), or flash memory or a combination of two or more of these. This disclosure contemplates mass storage506taking any suitable physical form. Storage506may include one or more storage control units facilitating communication between processor502and storage506, where appropriate. Where appropriate, storage506may include one or more storages506. Although this disclosure describes and illustrates particular storage, this disclosure contemplates any suitable storage.