SYSTEM AND METHOD FOR INSTITUTIONAL RISK IDENTIFICATION USING AUTOMATED NEWS PROFILING AND RECOMMENDATION

Systems and methods for identifying institutional risks using automated news profiling and recommendations re news relevance are provided. The method includes: receiving textual information that relates to a potential risk; analyzing the received textual information to extract a trigger, an outcome, and an exposure vessel of the potential risk; retrieving news items from online news aggregators based on the extracted information; obtaining a metric that relates to a degree of relevance of each news item to the potential risk; and calibrating the metric based on user inputs. The metric may be obtained by using a Sentence-BERT neural network model in conjunction with a cosine similarity metric.

BACKGROUND

1. Field of the Disclosure

This technology generally relates to methods and systems for institutional identification, and more particularly, to methods and systems for identifying institutional risks using automated news profiling and recommendations re news relevance.

2. Background Information

Institutions around the world face an array of risks that affect their operations globally. These risks are not necessarily associated with their key functions but also cover other types of risks, such as operational risks associated with cyber security attacks. As an example, the COVID-19 pandemic was an unexpected risk that was not accounted for by governments and institutions around the world. The pandemic has highlighted the need for institutions to have a robust risk identification, qualification and assessment model that qualifies potential risks on a frequent basis.

Risk owners rely on multiple sources of information to identify, qualify, and assess risks. An important source of information is global news that is available via a vast array of news sources in many different languages. The sheer volume of events highlighted in the news globally and the variety of risks an institution faces necessitate an automated approach for identifying and assessing existing and new risks using news.

SUMMARY

The present disclosure, through one or more of its various aspects, embodiments, and/or specific features or sub-components, provides, inter alia, various systems, servers, devices, methods, media, programs, and platforms for identifying institutional risks using automated news profiling and recommendations re news relevance.

According to an aspect of the present disclosure, a method for identifying institutional risks based on news information is provided. The method is implemented by at least one processor. The method includes: receiving, by the at least one processor, textual information that relates to a potential risk; analyzing, by the at least one processor, the received textual information; retrieving, by the at least one processor, at least one news item based on a result of the analyzing; obtaining, by the at least one processor, a metric that relates to a degree of relevance of the retrieved at least one news item to the potential risk; and calibrating, by the at least one processor, the obtained metric based on at least one input received from a user.

The analyzing may include extracting, from the received textual information, at least one from among a trigger that relates to the potential risk, an outcome that relates to the potential risk, and an exposure vessel that relates to the potential risk.

The analyzing may further include using a deep bidirectional long short term memory (bi-LSTM) neural network sequence prediction model for performing the extracting.

The method may further include: constructing a knowledge graph based on the extracted at least one from among the trigger, the outcome, and the exposure vessel; and transmitting the knowledge graph to the user. The at least one input may be received from the user after the knowledge graph has been transmitted to the user.

The retrieving may include searching for the at least one news item online by using at least one news aggregator. The at least one news aggregator may include at least one from among Google News and Global Database of Events, Language and Tone (GDELT).

The method may further include: after the retrieving of the at least one news item and before the obtaining of the metric, performing a preprocessing operation with respect to each of the at least one news item that includes at least one from among a news deduplication operation, a news source filtering operation, a language filtering operation, and an exposure vessel filtering operation.

The obtaining of the metric that relates to the degree of relevance to the potential risk may include: using a neural network model to calculate contextual embeddings of the at least one news item; and rank ordering the calculated contextual embeddings by using a cosine similarity metric.

The neural network model may include a Sentence-bidirectional encoder representation from transformers (Sentence-BERT) neural network.

The calibrating may include using a machine learning algorithm to dynamically adjust the metric based on inputs received from a plurality of users.

According to another aspect of the present disclosure, a computing apparatus for identifying institutional risks based on news information is provided. The computing apparatus includes a processor; a memory; and a communication interface coupled to each of the processor and the memory. The processor is configured to: receive, via the communication interface, textual information that relates to a potential risk; analyze the received textual information; retrieve at least one news item based on a result of the analysis; obtain a metric that relates to a degree of relevance of the retrieved at least one news item to the potential risk; and calibrate the obtained metric based on at least one input received from a user.

The processor may be further configured to extract, from the received textual information, at least one from among a trigger that relates to the potential risk, an outcome that relates to the potential risk, and an exposure vessel that relates to the potential risk.

The processor may be further configured to use a deep bidirectional long short term memory (hi-LSTM) neural network sequence prediction model for performing the extraction.

The processor may be further configured to: construct a knowledge graph based on the extracted at least one from among the trigger, the outcome, and the exposure vessel; and transmit, via the communication interface, the knowledge graph to the user. The at least one input may be received from the user after the knowledge graph has been transmitted to the user.

The processor may be further configured to search for the at least one news item online by using at least one news aggregator. The at least one news aggregator may include at least one from among Google News and Global Database of Events, Language and Tone (GDELT).

The processor may be further configured to: after the at least one news item has been retrieved and before the metric has been obtained, perform a preprocessing operation with respect to each of the at least one news item that includes at least one from among a news deduplication operation, a news source filtering operation, a language filtering operation, and an exposure vessel filtering operation.

The processor may be further configured to obtain the metric that relates to the degree of relevance to the potential risk by: using a neural network model to calculate contextual embeddings of the at least one news item; and rank ordering the calculated contextual embeddings by using a cosine similarity metric.

The neural network model may include a Sentence-bidirectional encoder representation from transformers (Sentence-BERT) neural network.

The processor may be further configured to perform the calibrating by using a machine learning algorithm to dynamically adjust the metric based on inputs received from a plurality of users.

According to yet another aspect of the present disclosure, a non-transitory computer readable storage medium storing instructions for identifying institutional risks based on news information is provided. The storage medium includes executable code which, when executed by a processor, causes the processor to: receive textual information that relates to a potential risk; analyze the received textual information; retrieve at least one news item based on a result of the analysis; obtain a metric that relates to a degree of relevance of the retrieved at least one news item to the potential risk; and calibrate the obtained metric based on at least one input received from a user.

When executed by the processor, the executable code may further cause the processor to extract, from the received textual information, at least one from among a trigger that relates to the potential risk, an outcome that relates to the potential risk, and an exposure vessel that relates to the potential risk.

DETAILED DESCRIPTION

As described herein, various embodiments provide optimized methods and systems for identifying institutional risks using automated news profiling and recommendations re news relevance.

Referring toFIG. 2, a schematic of an exemplary network environment200for implementing a method for identifying institutional risks using automated news profiling and recommendations re news relevance is illustrated. In an exemplary embodiment, the method is executable on any networked computer platform, such as, for example, a personal computer (PC).

The method for identifying institutional risks using automated news profiling and recommendations re news relevance in a manner that is implementable in various computing platform environments may be implemented by an Institutional Risk Identification Using News (IRIUN) device202. The IRIUN device202may be the same or similar to the computer system102as described with respect toFIG. 1. The IRIUN device202may store one or more applications that can include executable instructions that, when executed by the IRIUN device202, cause the IRIUN device202to perform actions, such as to transmit, receive, or otherwise process network messages, for example, and to perform other actions described and illustrated below with reference to the figures. The application(s) may be implemented as modules or components of other applications. Further, the application(s) can be implemented as operating system extensions, modules, plugins, or the like.

The communication network(s)210may be the same or similar to the network122as described with respect toFIG. 1, although the IRIUN device202, the server devices204(1)-204(n), and/or the client devices208(1)-208(n) may be coupled together via other topologies. Additionally, the network environment200may include other network devices such as one or more routers and/or switches, for example, which are well known in the art and thus will not be described herein. This technology provides a number of advantages including methods, non-transitory computer readable media, and IRIUN devices that efficiently implement a method for identifying institutional risks using automated news profiling and recommendations re news relevance.

The server devices204(1)-204(n) may be hardware or software or may represent a system with multiple servers in a pool, which may include internal or external networks. The server devices204(1)-204(n) hosts the databases206(1)-206(n) that are configured to store data that relates to news and news sources and institution-specific data that relates to risk relevance and recommendations.

The client devices208(1)-208(n) may run interface applications, such as standard web browsers or standalone client applications, which may provide an interface to communicate with the IRIUN device202via the communication network(s)210in order to communicate user requests and information. The client devices208(1)-208(n) may further include, among other features, a display device, such as a display screen or touch screen, and/or an input device, such as a keyboard, for example.

One or more of the devices depicted in the network environment200, such as the IRIUN device202, the server devices204(1)-204(n), or the client devices208(1)-208(n), for example, may be configured to operate as virtual instances on the same physical machine. In other words, one or more of the IRIUN device202, the server devices204(1)-204(n), or the client devices208(1)-208(n) may operate on the same physical device rather than as separate devices communicating through communication network(s)210. Additionally, there may be more or fewer IRIUN devices202, server devices204(1)-204(n), or client devices208(1)-208(n) than illustrated inFIG. 2.

The IRIUN device202is described and shown inFIG. 3as including a news-based institutional risk identification module302, although it may include other fides, policies, modules, databases, or applications, for example. As will be described below, the news-based institutional risk identification module302is configured to implement a method for identifying institutional risks using automated news profiling and recommendations re news relevance in an automated, efficient, scalable, and reliable manner.

An exemplary process300for implementing a method for identifying institutional risks using automated news profiling and recommendations re news relevance by utilizing the network environment ofFIG. 2is shown as being executed inFIG. 3. Specifically, a first client device208(1) and a second client device208(2) are illustrated as being in communication with IRIUN device202. In this regard, the first client device208(1) and the second client device208(2) may be “clients” of the IRIUN device202and are described herein as such. Nevertheless, it is to be known and understood that the first client device208(1) and/or the second client device208(2) need not necessarily be “clients” of the IRIUN device202, or any entity described in association therewith herein. Any additional or alternative relationship may exist between either or both of the first client device208(1) and the second client device208(2) and the IRIUN device202, or no relationship may exist.

Further, IRIUN device202is illustrated as being able to access a news sources and news data repository206(1) and an institution-specific risk relevance and recommendations database206(2). The news-based institutional risk identification module302may be configured to access these databases for implementing a method for identifying institutional risks using automated news profiling and recommendations re news relevance.

Upon being started, the news-based institutional risk identification module302executes a process for identifying institutional risks using automated news profiling and recommendations re news relevance. An exemplary process for identifying institutional risks using automated news profiling and recommendations re news relevance is generally indicated at flowchart400inFIG. 4.

In the process400ofFIG. 4, at step S402, the news-based institutional risk identification module302receives textual information that relates to a potential risk, and at step S404, the news-based institutional risk identification module302analyzes the textual information. In an exemplary embodiment, the analysis includes extracting, from the textual information, a trigger that relates to the potential risk, an outcome that relates to the potential risk, and an exposure vessel that relates to the potential risk. For example, when the news-based institutional risk identification module302receives “cyber attacks targeting the retail banking business causing loss of customer data” as textual information that relates to a potential risk at step S402, then at step S404, the news-based institutional risk identification module302may extract “cyber attacks” as corresponding to the trigger of the risk, “the retail banking business” as the exposure vessel of the risk, and “causing loss of customer data” as the outcome of the risk.

At step S406, the news-based institutional risk identification module302constructs a knowledge graph based on the extracted information and sends the knowledge graph to users that may be interested in risk identification and/or assessment. A knowledge graph formally represents semantics by describing entities and their relationships. In an exemplary embodiment, the knowledge graph is designed for visualizing risks faced by an institution and for performing reasoning over data, thereby assisting risk owners in understanding how several risks are related to each other and what are the key triggers of risk. Further disclosure in relation to knowledge graphs is provided below with respect toFIG. 6.

At step S408, the news-based institutional risk identification module302retrieves news items based on an online search of news aggregator sources. In an exemplary embodiment, the news aggregator sources may include one or both of Google News and Global Database of Events, Language and Tone (GDELT).

At step S410, the news-based institutional risk identification module302obtains a metric that indicates a degree of relevance of each retrieved news item with respect to the potential risk. In an exemplary embodiment, the metric may be obtained by using a neural network model together with a cosine similarity metric. For example, a Bidirectional Encoder Representations Transformers (BERT) model, and/or a variant thereof, such as the Sentence-BERT model, may be used to calculate contextual embeddings of sentences included in a particular news item, and the cosine similarity metric may then be applied to the contextual embeddings in order to determine a rank ordering thereof with respect to a relevance to the potential risk.

At step S412, the news-based institutional risk identification module302calibrates the obtained metric based on user inputs. In an exemplary embodiment, users that may have received the knowledge graph constructed in step S406may provide feedback that relates to their own perceptions of how relevant a particular news item is to a potential risk, and the news-based institutional risk identification module302may apply a machine learning algorithm that uses such feedback as input in order to dynamically adjust the metric.

In an exemplary embodiment, a system and a method for identifying institutional risks using automated news profiling and recommendations re news relevance is designed to automatically match relevant news to risks identified by the institution. The system utilizes a neural embedding model known as Sentence-BERT (BERT=Bidirectional Encoder Representations from Transformers) to match the textual description of the text with global news. The system also implements a recommender system component to rank the news relevance for each user.FIG. 5is a system architecture diagram500that illustrates a system for identifying institutional risks using automated news profiling and recommendations re news relevance, according to an exemplary embodiment

The COVID-19 pandemic was an unexpected risk that was not accounted for by governments and institutions around the world. It highlighted the need for institutions to have a robust risk identification, qualification and assessment model that qualifies potential risks on a more frequent basis (e.g. daily). Coupled with multi-lingual news from across the globe, an automated system for news profiling and recommendation is deemed to be an important step to augment the risk qualification process.

Risk owners rely on multiple sources of information to identify, qualify, and assess risks. An important source of information is global news from a vast array of news sources in many different languages. Given the variety and volume of the various drivers of risk, in an exemplary embodiment, a human-in-the loop AI system using natural processing (NLP) methods is provided. Recent advances in deep learning for NLP applications allow for dealing with multilingual texts. They also offer the ability to translate these texts, filter them, and rank them according to their relevance to the end user. The vast amount of events highlighted in the news globally and the variety of risks an institution faces necessitate an automated approach for identifying and assessing existing and new risks using news.

In an exemplary embodiment, the system relies on an assumption that the risks have been identified by risk owners with expertise in specific domains. The risk owners are responsible for identifying and qualifying the impact of specific risks on the institution. These risks are usually reviewed periodically (e.g. on a quarterly basis) and highlighted to the operating committee of the institution for determining methods to reduce and overcome the impact of these risks.

Open information extraction: In an exemplary embodiment, given a textual description of the risk, the system attempts to decompose the text to several components: 1) trigger; 2) outcome; and 3) exposure vessel. The trigger explains the root cause of the risk. The outcome describes the specific impact of the given risk. Finally, the exposure vessel describes the vessel the risk impacts.

Several approaches were tested to decompose the text into the three aforementioned categories. One of these is based on a deep bidirectional long short term memory (bi-LSTM) neural network sequence prediction model that was originally developed for supervised open information extraction. The model breaks a given sentence (e.g., the risk text) into the relationships they express. In particular, the model extracts a list of propositions, each composed of a single predicate and an arbitrary number of arguments.

As an example, consider the following risk: “cyber attacks targeting the retail banking business causing loss of customer data”. The model breaks the sentence into the following components: A first argument “cyber attacks” precedes a first verb “targeting,” which precedes a second argument “the retail banking business,” which is followed by a second verb “causing” and a third argument “loss of customer data.” In this example, the first argument maps to the trigger of the risk, which in this case is cyber attacks. The outcome and exposure vessel typically follow the first verb in the sentence. In this example, the retail banking business is the exposure vessel, and the argument after the second verb, loss of customer data, is the outcome.

It has been found that the risk text descriptions are often entered by risk owners using a common sentence structure intended to improve the readability of the risks. This significantly helps in the risk information extraction process, allowing for breaking down the sentences using heuristic rules around these causal expressions. For example, text before the word causing usually refers to the trigger.

Knowledge graph: Once the triggers, outcomes and exposure vessels are identified, the extracted information is used to construct a knowledge graph. A knowledge graph formally represents semantics by describing entities and their relationships. In an exemplary embodiment, the knowledge graph is designed for visualizing the risks faced by the institution and for performing reasoning over data. This is intended to help risk owners understand how several risks are related to each other, what are the key triggers of risk facing the institution, etc. The knowledge graph utilized the information from the above-described example with the nodes of the graph describing the triggers, outcomes and exposure vessels and the edges describing the relationship between the three categories. In an exemplary embodiment, a trigger causes a given outcome and the outcome impacts a given exposure vessel.

As an example, consider the following set of risks: 1) Cyber attacks targeting the retail banking business causing loss of customer data. 2) U.S.-China trade war escalation affecting the corporate and investment banking business causing a decrease in revenues. 3) Employee misconduct in the investment banking business causing a reputational damage. 4) Technology infrastructure failure in the corporate and investment banking business causing a reputational damage and/or monetary losses. Referring toFIG. 6, a knowledge graph600constructed using the above risks is illustrated.

News crawler and data preprocessing: In this component of the system, the trigger information is used to search for news online. In an exemplary embodiment, the system utilizes two news aggregators: (1) Google News and (2) Global Database of Events, Language and Tone (GDELT). Google News is an aggregation service developed by Google monitoring news from thousands of publishers, newspapers and magazines online. GDELT is a real-time open source database that monitors the world's broadcast, print and web news from a vast range of countries covering over 100 languages.

In an exemplary embodiment, a news web craw-le collects articles from Google News with the keyword based on the trigger identified for each risk. For GDELT, the system may use an open-source python API to retrieve multi-lingual news from across the globe associated with the risk trigger.

In an exemplary embodiment, once the articles are retrieved, an optional data preprocessing stage is included in the system for (1) news deduplication, (2) news source filtering, (3) language filtering and (4) exposure vessel filters. These pre-processing steps allow for a custom solution tailored to any risk owner.

Text embeddings and news relevance ranking: In an exemplary embodiment, at this stage of the system, the news for each risk are retrieved based on the trigger identified. This, however, returns a large amount of news, including many items that are not relevant to the risk itself. To help filter the news retrieved, a neural network model is used in conjunction with a cosine similarity metric to identify the top relevant news for each risk. The model used is based on a bidirectional encoder representation from transformers (BERT) neural network, which is usable for predicting masked works in a sentence. In an exemplary embodiment, the system uses Sentence-BERT (S-BERT), which is an extension of a model that was originally used to compute contextual sentence embeddings. These embeddings are dense vector representations for sentences, and the model is tuned specifically to produce meaningful sentence embeddings such that sentences with similar meanings are close in the vector space.

In an exemplary embodiment, S-BERT is used to compute the contextual embeddings of the risk text and the news title text. Once the contextual embeddings vector is obtained for each risk and news, the vectors are ranked according to the cosine similarity metric. Given two vectors, r∈and h∈, the cosine similarity metric is defined as:

Recommender system: In an exemplary embodiment, a relevance ranker identifies headlines that are semantically similar to a risk item, but this does not guarantee that the headlines will be relevant to the particular risk owner. As an example, an article that is ranked as highly relevant to reputational risk may be considered irrelevant by the risk owners, perhaps because it is referencing an old legal dispute, is related to a different business function, or has been misclassified by the system.

In an exemplary embodiment, in order to ensure that the system properly adjusts itself to user preferences, a recommender engine is provided for each particular risk owner. Traditionally, recommender engines fall into one of two categories: content personalization systems and product recommendation engines. Personalization systems use signals provided by user behavior to profile users and predict the content that the users will be most interested in. Reinforcement learning is a common method in this domain, with growing popularity in advertisement targeting. Product recommendation engines commonly use cross-user behavioral signals to come up with a join understanding of products and user profiles. The most common method in this group of systems is collaborative filtering.

While these two paradigms can be a source of inspiration, the systems and methods in accordance with exemplary embodiments disclosed herein differ from them in fundamental ways. In this aspect, risk recommendation is not approached as a personalization system, because the risk owners are bound by industry and enterprise standards rather than personal preferences. Conversely, product recommendation engines often rely on large-scale, cross-user signals, but these are not reliably available. To further complicate the landscape, news is a uniquely unstable product, because its semantic representation can shift rapidly over time. As an example, the term “Donald Trump” might have been considered largely irrelevant to enterprise risk in 2014, but the landscape would have shifted massively in 2015.

To address these challenges, in an exemplary embodiment, the recommender engine is designed as an online learning model. Online learning is a paradigm that allows Machine Learning models to dynamically adjust their parameters. In traditional Machine Learning, a static set of training examples is provided, based on which a model is trained to estimate optimal parameters. After the training stage, the model is deployed with the optimal parameters, which are no longer adjusted. This is commonly referred to as the inference stage. In contrast to traditional models, online learning models do not have separate training and inference stages, but continually learn from new examples provided by end users. The learning mechanism needs to be sufficiently responsive to user feedback, but not to the point that it renders the model unstable,

In an exemplary embodiment, each headline is represented as a vector of size1024. Each risk item riis represented by a set of headlines {hi(1), . . . , hi(n)} that have passed the similarity filter. Online learning is approached as a real-time partitioning problem in which predictions are made regarding which headlines in this collection are relevant to riand which are not. In order o provide a venue for users to make corrections to the model's predictions, an interactive feedback mechanism is implemented, in order to allow users to tag each headline hi(j)as relevant or irrelevant to ri. Each hi(j)is initialized with a confidence score of 1.0, and the score is continually calibrated based on user feedback.

In an exemplary embodiment, at each timestamp t, one of the following events might occur: 1) User might tag hi(j)as irrelevant. In this case, the confidence of hi(j)is adjusted to 0.0. 2) User might tag hi(j)as relevant. In this case, the confidence of is adjusted to 1.0. 3) User might tag another headline hi(j′)as irrelevant. In this case, the confidence of hi(j)is adjusted as

where φ is a bounded function such as sigmoid, and d(j, j′) represents the cartesian or cosine distance between hi(f)and hi(j′). 4) User might tag another headline hi(j′)as relevant. In this case, the confidence of hi(j)is adjusted by

where φ is a bounded function such as sigmoid, and d(j,j′) represents the cartesian or cosine distance between hi(j)and hi(j′).

At the beginning of the exercise, the distribution parameter σ is initialized as the expected value of the cartesian or cosine distance between any given pair of headlines (σ0=E[d(x, x′)]; ∀x, x′∈{1, . . . n}; x≠x′), and subjected to exponential decay (i.e., σ(t)=σ0e−λtwhere λ is set using grid search). Confidence scores are continually adjusted by feedback and those remaining stable within a tolerance threshold ϵ after m steps are fixed against any further changes.

Any new headline that is added to the pool is assigned a confidence score of

where d(k, k′) represents the cartesian or cosine distance between the new incoming headline hi(k)and existing headlines in the pool {hik′}.

Accordingly, with this technology, an optimized process for identifying institutional risks using automated news profiling and recommendations re news relevance is provided.