## 3 Material and Methods
### Rule Engine Algorithm
#### 3.4.2 Step 2  
Grouping of patient records based on the specaility_id from where they availed service. Guassian based clustering is used for the identification of clusters as shown in Figure 4.  
\[Support(S_{h})=Count(S_{h})/cluster_{n} \tag{5}\]  
\[Confidence(S_{h}\cap D_{j})=Support(S_{h}\cap D_{j})/Support(S_{h}) \tag{6}\] \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Actual Center** & \multicolumn{1}{c}{**Technique**} & \multicolumn{1}{c}{**Computed Center**} & \multicolumn{1}{c}{**Difference**} \\ \hline
590 & 800.745 & Fuzzy Cmeans & 586.9281 & 977.215 & 3.071856 & \(-\)176.47 \\
590 & 800.745 & Xmeans & 476.5837 & 613.5539 & 113.4163 & \(-\)26.6258 \\
590 & 800.745 & Gmeans & 586.7819 & 968.0782 & 3.218119 & \(-\)167.333 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of Clustering Algorithms. where \(cluster_{n}\) is the total number of elements in clusters. Transaction \(c_{n}\) is representing transactions of the patients \(P_{k}\) who are identified as two separate cases namely \"Need to be Investigated\" and \"outliers\". All transactions which are identified with these labels are transferred for further analysis, to the rule engine. We computed confidence value for each service within clusters. We apply threshold on confidence values for all members within clusters and all members whose confidence values are on boundaries are identified as anomaly. The flowchart for second phase is shown in Figure 4 which shows how clusters are processed to generate rules. We find support count of each specialty \(D_{j}\) in all clusters and then find support count of each service \(S_{h}\) for this specialty \(D_{j}\). Finally, these support counts are used for computing confidence values. The last condition is for checking whether confidence values are computed for all specialties or not. Based on the computed confidence values, rules are generated which are stored in database for the third phase. Figure 5 describes the complete fraud detection system. In Figure 5, there are three main elements, and each element is receiving transactional data from different hospital servers. Each element (Patient, provider, service) has its own storage. Association scores are computed between each pair namely service with respect to doctor, service with respect to patient, patient with respect to doctor, and doctor with respect to patient. Once the association scores are computed and thresholds are applied, we get set of identified cases. Transactions are identified in two cases \"outliers\" or \"need to be investigated\". The rating of each element (Patient, provider, service) whose transactions are found to be suspicious will be decremented. These cases are used as an input to the rule engine. The Rule engine further analyzes the transactions and if these cases are detected as fraud then rating score of involved element, will remain same otherwise rating score will be updated. Basically set of rules are generated for each specialty_id. Whenever any patient visits the hospital for availing the particular set of services, system first checks  
Figure 4: The rule engine is computing confidence values for all services in all specialties. which specialty_id patient visits, and then evaluates according to the rules already computed for each specialty_id. The third phase of the proposed framework is shown in Figure 6, Similarity function is used for computation of similarity between current transaction c and generated rule R. Similarity bit is denoted by \(a\) and Similarity Function denoted by \(H\)  
\[Similarity\ function\ H=R\cap c \tag{7}\]  
Similarity bit is a equal to 1, if after the similarity computation the size of the input transaction \(c\) is equal to size of similarity function \(H\), and if after similarity computation the size of the input transaction c is not equal to size of similarity function H then similarity bit will be equal to zero. If the similarity bit is not 1, then transaction will be marked as a fraud. Otherwise it will be marked as normal.