Artificial intelligence crime linking network

A computing system accesses crime incident data from two or more organization systems. The crime incident data includes a first set of inputs associated with a plurality of crime incident groupings and a second set of inputs associated with incident data for incidents associated with each of the two or more organization systems. The computing system preprocesses the crime incident data to remove incidents that include suspect identifiers not present in at least two or more organization system. The computing system analyzes the preprocessed crime incident data to identify links between incidents across two or more organization systems using a trained crime linking model. The computing system generates a link between a first incident at a first organization system of the two or more organization systems and a second incident at a second organization system based on the analyzing.

FIELD OF THE DISCLOSURE

The present disclosure generally relates to an artificial intelligence-based crime linking network and a method of operating the same.

BACKGROUND

For some companies, theft represent a sizable portion of losses such, it would be beneficial if linking incidents of theft was simple enough to render a proper return-on-investment. As it turns out, one might expect, serial offenders and crime organizations are responsible for a significant portion of these crimes. For this reason, there is a great incentive to stop an entity that is likely to continue committing crimes if left unchecked. However, given the time intensive nature of going through the massive amount of incident reports attempting to link them, it is simply not feasible for companies to assign human personnel to go through everything.

SUMMARY

In some embodiments, a method is disclosed herein. A computing system accesses crime incident data from two or more organization systems. The crime incident data includes a first set of inputs associated with a plurality of crime incident groupings and a second set of inputs associated with incident data for incidents associated with each of the two or more organization systems. The computing system preprocesses the crime incident data to remove incidents that include suspect identifiers not present in at least two or more organization system. The computing system analyzes the preprocessed crime incident data to identify links between incidents across two or more organization systems using a trained crime linking model. The computing system generates a link between a first incident at a first organization system of the two or more organization systems and a second incident at a second organization system based on the analyzing.

In some embodiments, a non-transitory computer readable medium. The non-transitory computer readable medium includes one or more sequences of instructions, which, when executed by one or more processors, causes a computing system to perform operations. The operations include accessing, by the computing system, crime incident data from two or more organization systems. The crime incident data includes a first set of inputs associated with a plurality of crime incident groupings and a second set of inputs associated with incident data for incidents associated with each of the two or more organization systems. The operations further include preprocessing, by the computing system, the crime incident data to remove incidents that include suspect identifiers not present in at least two or more organization system. The operations further include analyzing, by the computing system, the preprocessed crime incident data to identify links between incidents across two or more organization systems using a trained crime linking model. The operations further include generating, by the computing system, a link between a first incident at a first organization system of the two or more organization systems and a second incident at a second organization system based on the analyzing.

In some embodiments, a method is disclosed herein. A computing system captures a first snapshot of all elements of a plurality of databases at a first period in time. Each database of the plurality of database associated with an organization computing system. Each database includes data related to a plurality of criminal incidents. The data is related to the plurality of criminal incidents comprising a listing of incident/group pairs and a plurality of incidents. The computing system captures a second snapshot of all elements of the plurality of databases at a second period in time. The second snapshot includes at least one element that is different from the elements of the first snapshot. The computing system compares the second snapshot to the first snapshot to determine whether there was a change to the plurality of databases. Responsive to detecting the change, the computing system notifies an organization associated with the change.

DETAILED DESCRIPTION

Both law enforcement and retail companies create incident reports each time suspicious or illegal activity has taken place. Whether the incident reports pertain to the activity that occurs within a branch of a retail store, or a police report disclosing more general criminal activity, tens of millions of these reports are generated each year. However, due to the sheer volume of reports that are generated, many of the reports go unread or are not analyzed.

U.S. application Ser. No. 16/205,104, which is incorporated by reference herein, provides a system for automatically linking incidents related to criminal activity. At a high level, the disclosure utilizes one or more machine-learning algorithms to determine a similarity between at least two incident reports. The system automatically links related incident reports when the pairwise probability is above a predetermined threshold amount. In this manner, clusters of criminal enterprises may be identified.

The one or more techniques described herein continues to build upon the functionality of the foregoing crime-linking software by allowing organizations to share what would otherwise be sensitive criminal activity information. For example, organizations can share information regarding the clusters of criminal enterprises that were identified based on the incident reports generated and maintained by each organization. The sharing of such data across organizations may allow algorithms to further build out or identify members to a criminal enterprise or, in some embodiments, identify linked crimes that would otherwise not be linked by merely looking at the organizational level. Such processes can be done without the organization revealing certain sensitive information contained in their incident reports.

FIG.1is a block diagram illustrating a computing environment100, according to example embodiments. Computing environment100may include one or more organization systems102and a back-end computing system104communicating via network105.

Network105may be of any suitable type, including individual connections via the Internet, such as cellular or Wi-Fi networks. In some embodiments, network105may connect terminals, services, and mobile devices using direct connections, such as radio frequency identification (RFID), near-field communication (NFC), Bluetooth™, low-energy Bluetooth™ (BLE), Wi-Fi™ ZigBee™, ambient backscatter communication (ABC) protocols, USB, WAN, or LAN. Because the information transmitted may be personal or confidential, security concerns may dictate one or more of these types of connection be encrypted or otherwise secured. In some embodiments, however, the information being transmitted may be less personal, and therefore, the network connections may be selected for convenience over security.

Network105may include any type of computer networking arrangement used to exchange data or information. For example, network105may be the Internet, a private data network, virtual private network using a public network and/or other suitable connection(s) that enables components in computing environment100to send and receive information between the components of environment100.

One or more organization systems102may include organization system102a, organization system102b, and organization system102n(generally, “organization system102”). Generally, organization systems102may be representative of at least two distinct organization systems. Each organization system102may be associated with a distinct organization or entity. Generally, each organization system102may be representative of one or more computing systems. For example, each organization system102may be representative of one or more of a mobile device, a tablet, a desktop computer, or any computing system having the capabilities described herein.

Each organization system102may include a crime incident application110. For example, as shown, organization system102amay include crime incident application110a, organization system102bmay include crime incident application110b, and organization system102nmay include crime incident application110n. Crime incident application110may be representative a standalone application associated with back-end computing system104. In some embodiments, crime incident application110may be representative of a web browser that allows access to a website associated with back-end computing system104. Organization system102may access crime incident application110to access content or functionality associated with back-end computing system104.

In some embodiments, organization system102may communicate over network105to access crime or incident information associated with the organization. For example, via crime incident application110, organization system102may access individual incident reports as well as groups or clusters of incidents based on analysis from back-end computing system104. The content that is displayed to organization system102may be transmitted from web client application server114to organization system102, and subsequently processed by crime incident application110for display through a graphical user interface (GUI) of a computing system associated with organization system102.

Back-end computing system104may include at least a web client application server114and crime linking platform116. Crime linking platform116may be comprised of one or more software modules. The one or more software modules may be collections of code or instructions stored on a media (e.g., memory of back-end computing system104) that represent a series of machine instructions (e.g., program code) that implements one or more algorithmic steps. Such machine instructions may be the actual computer code the processor of back-end computing system104interprets to implement the instructions or, alternatively, may be a higher level of coding of the instructions that is interpreted to obtain the actual computer code. The one or more software modules may also include one or more hardware components. One or more aspects of an example algorithm may be performed by the hardware components (e.g., circuitry) itself, rather as a result of the instructions.

Crime linking platform116may be configured to identify and/or manage linked incidents related to criminal activity. For example, crime linking platform116may be configured to build investigations within an organization and across organizations. However, while conventionally, organizations would have had to share sensitive information across entities, which could result in data leakage of such sensitive information, crime linking platform116eliminates this susceptibility.

By identifying links between crimes or criminal entities across organizations, each individual organization may gain a better understanding of linked criminal entities at their individual locations. For example, John Doe and Jane Smith may both be determined to be member of Crime Syndicate One by crime linking platform116for organization system102a, but organization system102bis unaware of both John Doe's and Jane Smith's membership to Crime Syndicate One because, for example, organization system102bonly includes a single incident report naming John Doe and a separate single incident report naming Jane Smith, with no obvious connection between them. The sharing of information between entities will now provide a better picture of John Doe and Jane Smith to organization system102bby notifying organization system102bthat both John Doe and Jane Smith are members of Crime Syndicate One. This links their crimes and allows them to be investigated as a single criminal entity. This is only possible by analyzing information across organizations. The details of crime linking platform116may be found below in conjunction withFIG.2.

In some embodiments, crime linking platform116may interface with databases108a-108n(generally, “database108”). Each database108a-108nmay correspond to a respective organization system102a-102n. For example, database108amay be associated with organization system102a; database108bmay be associated with organization system102b; and database108nmay be associated with organization system102n.

Each database108may store two sets of information: a first set of data corresponding to a list of incident/group pairs detected at a respective organization system102and a second set of inputs corresponding to detailed data from all incidents detected at organization system102.

FIG.2is a block diagram illustrating back-end computing system104, according to example embodiments. As shown, back-end computing system104includes repository202and one or more computer processors204.

Repository202may be representative of any type of storage unit and/or device (e.g., a file system, database, collection of tables, or any other storage mechanism) for storing data. Further, repository202may include multiple different storage units and/or devices. The multiple different storage units and/or devices may or may not be of the same type or located at the same physical site. As shown, repository202includes at least crime linking platform116.

Crime linking platform116may include a handler206and a training module208. In some embodiments, crime linking platform116may further include pre-processing module210. Each of training module208and pre-processing module210may be comprised of one or more software modules. The one or more software modules are collections of code or instructions stored on a media (e.g., memory of back-end computing system104) that represent a series of machine instructions (e.g., program code) that implements one or more algorithmic steps. Such machine instructions may be the actual computer code the processor of back-end computing system104interprets to implement the instructions or, alternatively, may be a higher level of coding of the instructions that are interpreted to obtain the actual computer code. The one or more software modules may also include one or more hardware components. One or more aspects of an example algorithm may be performed by the hardware components (e.g., circuitry) itself, rather than as a result of the instructions.

Handler206may be configured to retrieve data from databases108a-108n. For example, handler206may be configured to retrieve two sets of inputs from databases108a-108n: a first set of inputs that includes incident/group pairs; and a second set of inputs corresponding to all detected incidents and their detailed information.

As briefly described above, the first set of inputs include a list of incident/group pairs. Each incident/group pair may include a unique incident number and a unique group number into which that incident has been partitioned. For example, handler206may retrieve, from database108a, a listing of all incident/group pairs. Exemplary incident/group pairs may include:

As shown, each incident/group pair includes a unique group number and a unique incident number. Considering the first entry for organization system102a, the incident/group pair includes “Group1” as the unique group number and “1234” as the unique incident number. As those skilled in the art understand, the unique group number and unique incident number are merely exemplary.

In operation, the unique group number may be a unique string of alphanumeric characters; similarly, the unique incident number may be a unique string of alphanumeric characters.

As provided above, pre-processing module210may concatenate an entry in each incident/group pair with an indication of the organization from which the incident/group pair originated. In this manner, incident/group pairs from organization system102amay be combined with incident group pairs from other organization systems102b-102n. Accordingly, by appending the organization name to the entry in each incident/group pair, pre-processing module210may ensure that the group IDs and incident IDs are unique after combining data from multiple organizations. Further, such process may allow organizations to be recovered from reading the incident numbers in the combined dataset.

For example, assume that handler206retrieves the following listing of incident/group pairs from database108bassociated with organization system102b:

Similarly, each incident/group pair includes a unique group number and a unique incident number. Considering the first entry for organization system102b, the incident/group pair includes “Group4” as the unique group number and “4321” as the unique incident number. Pre-processing module210may further preprocess the incident/group pairs retrieved from databases108b. For example, handler206may process Table 2 to output a set that includes:{<Group4 OrgB, 4321 OrgB>, <Group5 OrgB, 5321 OrgB>, <Group4 OrgB, 6321 OrgB>, <Group5 OrgB, 8321 OrgB>, <Group3 OrgB, 9999 OrgB>

Pre-processing module210may then further process the combined data set into a single list that captures the minimal link-representation of all groups across organization systems. This is a logically identical representation, but in the form of links, instead of the form of nodes with group designations. Note, in the case of singletons (groups of size1), this transformed representation requires a single link from the same node to itself. For example, pre-processing module210may generate a list that includes:{<1234 OrgA, 1236 OrgA>, <1236 OrgA, 1237 OrgA>, <1235 OrgA, 1238 OrgA>, <4321 OrgB, 6321 OrgB>, <5321 OrgB, 8321 OrgB>, <9999 OrgB, 9999 OrgB>}

In this manner, pre-processing module210may connect incidents within groupings. For example, <1234 OrgA, 1236 OrgA> are grouped because incident1234is associated with Group 1 at organization system102aand incident1236is associated with Group 1 at organization system102a. Because incident1237is also associated with Group 1 at organization system102a, another link is created, <1236 OrgA, 1237 OrgA>, to fully represent this group of size3.

The second set of inputs may include a list of triples of all suspect identifiers. In some embodiments, each triple may include the unique incident number, the identifier type, and the identifier value. For example, an example triple in the second set of inputs may include: <Identifier type, Identifier_value, and Incident ID>. Exemplary identifier types may include the following unique or quasi-unique representations, but are not limited to full name, date of birth, license plate number, driver's license number, address, credit card number, unique customer ID, customer loyalty number, fingerprint, retinal scan, face map, unique physical gait map, keyboard and mouse usage map, DNA, customer gift registry, social security number, email address, phone number, IP address, physical address, unique employee id, and the like.

For example, handler206may retrieve, from database108a, a listing of all triples. Exemplary triples may include:

As shown, each triple includes a suspect identifier value, a suspect identifier type, and a unique incident number. Considering the first entry for organization system102a, the triple includes “John Doe” as the suspect identifier value, “name” as the suspect identifier type, and “1234” as the unique incident number. As those skilled in the art understand, these values are merely exemplary.

As provided above, pre-processing module210may modify an entry in each triple to include an indication of the organization from which the incident/group pair originated. In this manner, the incident triples from organization system102amay be combined with incident triples from other organization systems102b-102n. For example, assume that handler206retrieves the following incident triples from database108bassociated with organization system102b:

Similarly, each incident triple includes a suspect identifier value, a suspect identifier type, and a unique incident identifier. Considering the first entry for organization system102b, the triple includes John Doe as the suspect identifier value, name as the suspect identifier type, and 4321 as the unique incident number. Pre-processing module210may further preprocess the triples retrieved from databases108b. For example, pre-processing module210may process Table 4 to output a set that includes:{<John Doe, name, 4321 OrgB>, <654321987, credit card, 4321 OrgB>, <Pete Doe, name, 5321 OrgB>, <John Doe, name, 6321 OrgB>, <987654321, credit card, 9999 OrgB>}

Based on this information, pre-processing module210may generate all cross-company pairs. In some embodiments, an empty dataset is created. The empty data set may be populated by iterating over every suspect identifier value, for each possible pair of organizations, appending all the unique pairs from the cartesian product of the two sets of all incidents, from each of the pairs of organizations, in which that particular suspect identifier value is present. For example, pre-processing module210may further generate the following data set:<John Doe, name, 1234 OrgA, 4321 OrgB>, <John Doe, name, 1234 OrgA, 6321 OrgB>, <John Doe, name, 1236 OrgA, 4321 OrgB>, <John Doe, name, 1236 OrgA, 6321 OrgB>, <987654321, credit card, 1235 OrgA, 9999 OrgB>

As those skilled in the art understand, the triples may include additional values relevant to the incident that can be used to compute distance measures between the cross-company pairs. These pairwise computed distances can be compared against known distance functions to determine if each cross-company pair meets the distance threshold. This is especially important in the case of “quasi-unique” identifiers, such as names. For example, distance measures may be computed to infer whether the same detected full name might truly be different actual people who happen to share that “quasi-unique” identifier. In some embodiments, an administrator, or machine learning model, may decide that for cross-company pairs matching on names, each pair must be within 100 miles and 100 days of each other, else they are discarded due to an elevated probability that the names are actually different people. For example, a triple may be extended to include, but not limited to, location information (e.g., latitudinal and longitudinal coordinates), date information, and the like. Using a particular example, a triple may be extended to include:<John Doe, name, 1234 Org1, Lat1, Long1, Date1><John Doe, name 4321 Org2, Lat2, Long2, Date2>

Continuing the above example, based on this information, assuming all cross-company pairs computed in the earlier example either meet the distance threshold or no such filter is applied to the cross-company pairs and they are all accepted by default, then the following become the cross-company groups below. As shown, Group1 from OrgA and Group4 from OrgB have merged to form Group11 in the Cross-Company Groups, due to the same suspect identifier name John Smith detected in incidents within both groups that created cross-company links between incidents in those groups. Similarly, Group2 from OrgA has merged with Group3 from OrgB due to the same suspect identifier credit card 987654321 being detected in incidents within both groups that created cross-company links between incidents in those groups. Finally, Group3 from OrgB has not been linked to any other organization. Accordingly, Group3 may remain the same group but may have a different arbitrary GroupID, Group13, assigned to it. Groups 11 and 12 are true cross-company groups, as they have at least 2 or more organizations' incidents within each group.

In some embodiments, if at least one link exists between groupings and the link meets the pairwise threshold, then those two groups may be merged. In some embodiments, a more complex threshold function that operates at the group-to-group level may be used. For example, the more complex threshold function may take, as input, a list of any or all possible links between those two groups. In some embodiments, the input may further include the details of incidents in each group. In some embodiments, the input may further include details about the other groups and the other links outside of those two groups. Based on the input, a more complex machine learning trained threshold could be applied to determine whether or not two cross-company groups may be merged.

In some embodiments, rather than handler206accessing information stored in databases108a-108n, each organization system102a-102nmay transmit the information to handler206. In such embodiments, an organization system102may choose to encrypt the data prior to transmission to handler. In such embodiments, crime linking model214may be configured to process the linked connections without actually being exposed to the suspect identifiers—only the encrypted value, where each organization encrypts using the same key.

Training module208may be configured to train a machine learning model212to identify related pairs of incidents across organization systems102. For example, based on the filtered input data from pre-processing module210(i.e., input data where each suspect identifier is present in at least two organization systems102), training module208may train machine learning model212to identify check if cross-company links meet a sufficient threshold to be accepted. This machine learning model can be dependent on the suspect identifier type, as some types, like social security numbers, are more unique than other types, like suspect full names. The less unique suspect identifier types would then require a more stringent threshold. In some embodiments, machine learning model212may be trained on obfuscated data (e.g., the first or second set of inputs are encrypted before being accessed by handler206). In some embodiments, machine learning model212may be trained on the raw data. In some embodiments, machine learning model212may be trained to evaluate possible related pairs across cross-company incidents, regardless of whether or not there were matching suspect identifiers. In some embodiments, machine learning model212may be trained to validate whether the cross-company links that were computed from shared suspect identifiers meet a sufficient threshold to be accepted. In some embodiments, this machine learning may not be used at all, hence all computed cross-company links, based on matching suspect identifiers, are accepted as valid by default.

Training machine learning model212is not a trivial task, however, as not all suspect identifiers are of equal value in determining links across organizations. For example, while a credit card number may be representative of a strongly unique suspect identifier (e.g., the same credit card number in two incidents is highly likely to be from related incidents), a name may be exemplary of a weakly unique suspect identifier (e.g., the name John Smith in two incidents is not certainly determinative of related incidents, as the name John Smith is common).

Instead, training module208may train machine learning model212to calculate pairwise similarity measures and thresholds between incidents using a plurality of distance and similarity variables. Such variables, also known as dimensions, include: time distance (in days), represented by the absolute values of the date difference; time of day difference, represented by the absolute values of the difference in the hour of the day in which each incident occurred; geographic distance, cosine similarity between two incident write-ups; a measure of gender similarity; a measure of ethnicity similarity; a measure of vehicle model similarity; a measure of eye color similarity; a measure of hair color similarity; a weekend indicator similarity; physical measurement similarity; height similarity; weight similarity; a maximum text quality score, a minimum text quality score, and age similarity. Such techniques are similar to that described in U.S. application Ser. No. 16/205,104, which is incorporated by reference in its entirety.

In some embodiments, the pairwise distance calculations may depend on the frequency of the identifier value (not just the identifier type), such as, for example, in the case of “quasi-unique” identifiers (e.g., full names). In the context of names, for example, this frequency may be found from census data. For example, assume there are two crimes with a detected suspect name that is very common, e.g., Michael Jones. It would be less likely that the two crimes refer to the same person, compared to two crimes with a detected suspect name that is very rare, such as Jebidiah Featheringham. The pairwise threshold function could be such that it is inversely proportional to the frequency of the particular ID that is responsible for the linking. For example, machine learning model212may utilize a threshold function like geo_dist*sqrt(frequency)<5,000, with 5,000 as the cutoff value chosen for this particular threshold function, which is the upper limit above which pairs may be discarded for not meeting the distance threshold.

To further this example, if the frequency of the name Michael Jones is 10,000 in the United States and the frequency of Jebidiah Featheringham is 100 in the United States, then using this formula, for any two crimes associated with Michael Jones to be linked, they must occur within 50 miles of each other. In comparison, for any two crimes in which Jebidiah Featheringham is detected, they must occur within 500 miles to be linked.

In some embodiments, machine learning model212may be representative of one or more of a binary regression model and/or a Siamese-trained pair of neural networks. In some embodiments, machine learning model212may be representative of one or more of machine learning models or algorithms that may include, but are not limited to, random forest model, support vector machines, neural networks, deep learning models, Bayesian algorithms, Temporal Convolutional Networks, and the like.

Once trained, crime linking model214may be deployed within crime linking platform116for analysis.

In some embodiments, crime linking platform116may further include graphical module216. Graphical module216may be configured to generate a graphical representation of the crime links determined by crime linking model214. In some embodiments, graphical module216may generate a connected graph that visually depicts how suspects are related to each other. In some embodiments, graphical module216may utilize one or more external services to generate the connected graph.

In some embodiments, crime linking platform116may further include notification service218. In some embodiments, notification service218may be configured to detect when changes are made to an intra-organization incidents. For example, notification service218may be configured to automatically detect changes to a grouping of criminal incidents within an organization. More broadly, in another example, notification service218may be configured to automatically detect any change to an organization's database. For example, notification service218may be configured to monitor database108(e.g., database108a, database108b, database108n, etc.) to identify any changes. In some embodiments, a change may be representative of a new incident, a new grouping of incidents, a new addition to a grouping of incidents, a merging of two or more previous groupings, a splitting of a previously intact grouping, a newly identified suspect identifier, and the like. In some embodiments, notification service218may be configured to automatically detect changes to the groupings of criminal incidents across organizations. For example, notification service218may automatically detect changes to the groupings of criminal incidents based on output from crime linking model214.

To identify changes to groupings of criminal incidents, notification service218may be configured to take a snapshot of all elements and their associated groupings at a first point in time. For example, notification service218may access databases108a-108nand take a snapshot of all elements related to a plurality of criminal incidents maintained by databases108a-108n. The elements related to the plurality of criminal incidents may include, for example, the first set of inputs that include a list of all incident numbers/their corresponding group identifier doubles at a prior timestamp and the second set of inputs corresponding to list of all incident numbers/their corresponding group id doubles at a later timestamp. This may additionally apply to the cross-organization groupings, as well as the individual intra-organization groupings.

At a later point in time (i.e., after the first snapshot), notification service218may capture a second snapshot of all elements and their associated groupings. For example, notification service218may re-access databases108a-108nand take a second snapshot of all elements related to a plurality of criminal incidents maintained by databases108a-108n. Following the second snapshot, notification service218may compare the second snapshot to the first snapshot to identify those groupings that have been changed. For example, notification service218may analyze the groupings information on an element-by-element basis to identify changes to databases108a-108n. Notification service218may discard those elements that have gone unchanged. This may additionally apply to the cross-organization groupings, as well as the individual intra-organization groupings.

In some embodiments, notification service218may further analyze a subset of grouping that have changed (i.e., the “changed groups”) between snapshots to: (1) determine whether the changed group is a strict subset of an existing group in the first snapshot; and (2) determine whether the changed group is a strict superset of at least one group. If, for example, notification service218determines that the changed group is a strict subset of an existing group in the first snapshot, then notification service218may conclude that the grouping has changed because a previous grouping has broken apart. This typically happens when previously erroneously detected and matching suspect identifiers are updated and no longer match across those same incidents, thus breaking apart the connections between the incidents in that group.

If, for example, notification service218determines that the changed group is a strict superset of at least one group, then notification service218may conclude that the change to the changed group should be stored for each underlying group.

In some embodiments, notification service218may allow for new incident data to enter the system over time, thus increasing the size of the set of total incidents which must be partitioned into groups, from one period to another. In some embodiments, notification service218may allow for some incident data to be deleted from the system over time, thus decreasing the size of the set of total incidents which must be partitioned into groups, from one period to another. In some embodiments, notification service218may allow for the omission of unchanged groups from being sent out as alerts. In some embodiments, notification service218may allow for the omission of groups of size1from being sent out as alerts. In some embodiments, notification service218may allow for the omission of groups of size less than an arbitrary small value, n, from being sent out as alerts. In some embodiments, notification service218allows for the omission of groups of some cumulative measure, for example sum of dollar value, less than an arbitrary small value, n, from being sent out as alerts.

Notification service218may be configured to send a message to each affected organization system102based on the detected change. In some embodiments, notification service218may alert affected organizations if, for example, such analysis detected a change between cross-organization investigations.

In some embodiments, service218allows for the selective subscription, by users of the system, to a subset of alerts, based on characteristics of the changed groups, such as location in which the groups struck or total size of groups.

FIG.3is a flow diagram illustrating a method300of identifying crime incident groupings across organizations, according to example embodiments. Method300may begin at step302.

At step302, back-end computing system104may retrieve or receive incident data across a plurality of organization systems102. In some embodiments, crime linking platform116may retrieve incident data across a plurality of organization systems102by accessing databases of each respective organization system102. For example, crime linking platform116may access each of database102a-102n.

In some embodiments, crime linking platform116may receive incident data from each of the plurality of organizations systems102. For example, each organization system102may upload incident data via one or more application programming interfaces (APIs) associated with back-end computing system104.

In some embodiments, crime linking platform116may receive obfuscated incident data from one or more organization systems102. For example, an organization system102may hash their incident data before uploading the hashed incident data to crime linking platform116for analysis.

In some embodiments, the incident data received or retrieved from each organization system102may include a first set of inputs that include a list of incidents and their corresponding group id membership pairs and a second set of inputs corresponding to all detected incidents and their details. The first set of inputs may include a list of incident/group pairs for each incident. Each incident/group pair may include a unique incident number and a unique group number that each incident has been partitioned into. The second set of inputs may include a plurality of triples for each detected suspect identifier and the incident number corresponding to the detected suspect identifier. In some embodiments, a particular unique suspect identifier may be detected in more than one incident. In such embodiments, there would be one entry for each incident in which the suspect identifier was detected. In some embodiments, a particular incident might not include any suspect identifiers. In such embodiments, an incident number would not appear in any entries. In some embodiments, a particular incident might include more than one unique detected suspect identifier. In such embodiments, that particular incident number would appear in an entry for each unique suspect identifier that was detected in that particular incident. In some embodiments, each triple may include the unique incident numbers, the identifier type, and the identifier value.

In some embodiments, method300may include step304. At step304, back-end computing system104may pre-process the incident data. For example, pre-processing module210may perform one or more pre-processing operations to the first set of inputs and the second set of inputs, such as those described in conjunction withFIG.2. Following modification to the first set of inputs and the second set of inputs, pre-processing module210may analyze inputs to remove those incidents that includes suspect identifiers not present in more than one organization system102.

At step306, back-end computing system104may analyze the first set of inputs and the second set of inputs to identify related incidents across organizations. For example, crime linking model214may receive, as input, the pre-processed first set of inputs and the pre-processed second set of inputs.

At step308, back-end computing system104may create or modify a grouping based on the analysis. For example, responsive to identifying a suspect identifier that is present across two or more organization systems102, crime linking model214may create a linkage between a first group associated with that particular suspect identifier at a first organization system (e.g., organization system102a) and a second group associated with that same particular suspect identifier at a second organization system (e.g., organization system102b).

FIG.4is a flow diagram illustrating a method400of generating crime linking notifications, according to example embodiments. Method400may begin at step402.

At step402, back-end computing system104may capture a first snapshot of all elements and their associated groupings in each database108at a first period in time. For example, notification service218may access databases108a-108nto take a snapshot of all elements related to a plurality of criminal incidents maintained therein. In some embodiments, the elements related to the plurality of criminal incidents may include, for example, the first set of inputs that include a list of doubles for the incident numbers and their corresponding unique group membership ID.

At step404, back-end computing system104may capture a second snapshot of all elements and their associated groupings in each database108at a second period in time. The second period in time is after the first period in time. Notification service218may re-access databases108a-108nto take a second snapshot of all elements related to a plurality of criminal incidents maintained therein at the second period in time.

At step406, back-end computing system104may compare the second snapshot captured at a second period in time to the first snapshot captured at a first period in time to determine whether there was a change to any of groupings108a-108n. For example, notification service218, may compare each unique grouping, and that groups set of incidents, in the second snapshot to each element unique grouping, and that groups set of incidents in the first snapshot to identify those groupings that have changed, have been added to, merged together, split apart, or the like. Using a specific example, notification service218may determine that a grouping at organization system102ahas grown based on a comparison between a second snapshot of database108aand a first snapshot of database108a. Using another example, notification service218may determine that a cross-organization system link has been created based on a comparison between a second snapshot of databases108a-108nto a first snapshot of databases108a-108n.

At step408, back-end computing system104may notify an organization of the detected change. In those embodiments in which there was an intra-organization change, notification service218may generate a notification that notifies the organization of the detected change and explains the identified change. For example, notification service218may notify organization system102athat Group1 has been expanded to include Incident6565based on the suspect identifier value “XYZ789, License Plate Number.” In those embodiments in which a cross-organization change was detected, notification service218may generate a notification that notifies each organization of the detected change. However, in some embodiments, because crime linking platform116obfuscates suspect identifiers from other organizations, notification service218may not include the suspect identifier value that triggered the cross-organization change. In this embodiment, for each cross-company detected group, the system will only share the incident numbers and the corresponding company name for each incident. In this way, the system ensures that no sensitive data is exchanged, while still allowing for the sharing of actionable intelligence.

FIG.5Aillustrates a system bus architecture of computing system500, according to example embodiments. System500may be representative of at least a portion of back-end computing system104. One or more components of system500may be in electrical communication with each other using a bus505. System500may include a processing unit (CPU or processor)510and a system bus505that couples various system components including the system memory515, such as read only memory (ROM)520and random access memory (RAM)525, to processor510. System500may include a cache of high-speed memory connected directly with, in close proximity to, or integrated as part of processor510. System500may copy data from memory515and/or storage device530to cache512for quick access by processor510. In this way, cache512may provide a performance boost that avoids processor510delays while waiting for data. These and other modules may control or be configured to control processor510to perform various actions. Other system memory515may be available for use as well. Memory515may include multiple different types of memory with different performance characteristics. Processor510may include any general purpose processor and a hardware module or software module, such as service1532, service2534, and service3536stored in storage device530, configured to control processor510as well as a special-purpose processor where software instructions are incorporated into the actual processor design. Processor510may essentially be a completely self-contained computing system, containing multiple cores or processors, a bus, memory controller, cache, etc. A multi-core processor may be symmetric or asymmetric.

To enable user interaction with the computing system500, an input device545may represent any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech and so forth. An output device535may also be one or more of a number of output mechanisms known to those of skill in the art. In some instances, multimodal systems may enable a user to provide multiple types of input to communicate with computing system500. Communications interface540may generally govern and manage the user input and system output. There is no restriction on operating on any particular hardware arrangement and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.

Storage device530may be a non-volatile memory and may be a hard disk or other types of computer readable media which may store data that are accessible by a computer, such as magnetic cassettes, flash memory cards, solid state memory devices, digital versatile disks, cartridges, random access memories (RAMs)525, read only memory (ROM)520, and hybrids thereof.

Storage device530may include services532,534, and536for controlling the processor510. Other hardware or software modules are contemplated. Storage device530may be connected to system bus505. In one aspect, a hardware module that performs a particular function may include the software component stored in a computer-readable medium in connection with the necessary hardware components, such as processor510, bus505, output device535(e.g., display), and so forth, to carry out the function.

FIG.5Billustrates a computer system550having a chipset architecture that may represent at least a portion of back-end computing system104. Computer system550may be an example of computer hardware, software, and firmware that may be used to implement the disclosed technology. System550may include a processor555, representative of any number of physically and/or logically distinct resources capable of executing software, firmware, and hardware configured to perform identified computations. Processor555may communicate with a chipset560that may control input to and output from processor555. In this example, chipset560outputs information to output565, such as a display, and may read and write information to storage device570, which may include magnetic media, and solid state media, for example. Chipset560may also read data from and write data to storage device575(e.g., RAM). A bridge580for interfacing with a variety of user interface components585may be provided for interfacing with chipset560. Such user interface components585may include a keyboard, a microphone, touch detection and processing circuitry, a pointing device, such as a mouse, and so on. In general, inputs to system550may come from any of a variety of sources, machine generated and/or human generated.

Chipset560may also interface with one or more communication interfaces590that may have different physical interfaces. Such communication interfaces may include interfaces for wired and wireless local area networks, for broadband wireless networks, as well as personal area networks. Some applications of the methods for generating, displaying, and using the GUI disclosed herein may include receiving ordered datasets over the physical interface or be generated by the machine itself by processor555analyzing data stored in storage device570or storage device575. Further, the machine may receive inputs from a user through user interface components585and execute appropriate functions, such as browsing functions by interpreting these inputs using processor555.

It may be appreciated that example systems500and550may have more than one processor510or be part of a group or cluster of computing devices networked together to provide greater processing capability.