Patent Description:
Many enterprises have expansive networks that receive large quantities of data. One of the technical challenges that occurs in a network environment is ensuring integrity of the data received by the network environment. As an example, an enterprise may receive thousands of invoices. Without the ability to efficiently detect error in large quantities of data, the enterprise is vulnerable to allowing fraudulent data (e.g. fraudulent invoices) to escape detection.

<CIT> relates to the detection of fraudulent or erroneous invoices by comparing them with templates.

<CIT> relates to the classification of invoices for (human) auditing purposes.

<CIT> relates to fraud detection in healthcare claims using vector based text analysis.

<CIT> relates to the automatic detection of fraudulent invoices.

According to an embodiment, a network security system for fraud detection includes one or more processors and a memory communicatively coupled to the one or more processors. The memory includes instructions executable by the one or more processors. The processors are operable when executing the instructions to receive an invoice. The invoice includes invoice positions, each of the invoice positions including a position text. The processors are also operable to convert each word and number of the position text of each invoice position to a word embedding vector, sum the word embedding vectors for each invoice position to generate a word vector for each invoice position, and concatenate the word vector and a number vector of each invoice position to generate a position vector for each invoice position. The processors are further operable to generate a first combined position vector for a first invoice position by modifying the position vectors that neighbor a first position vector, condensing the neighboring position vectors of the first position vector to generate a first condensed position vector, and concatenating the first condensed position vector and the first position vector to generate the first combined position vector. Similarly, the processors are operable to generate a second combined position vector for a second invoice position by modifying the position vectors that neighbor a second position vector, condensing the neighboring position vectors of the second position vector to generate a second condensed position vector, and concatenating the second condensed position vector and the second position vector to generate the second combined position vector. The processors are further operable to generate an invoice vector by summing the first combined position vector and the second combined position vector, compare the invoice vector to a fraud detection parameter; and determine whether the invoice is indicative of fraud based on the comparison.

Technical advantages of certain embodiments may include providing a system and/or method of detecting fraud in large quantities of invoices by transforming the invoice to a vector representative of the entire invoice and comparing the invoice vector to sample invoice vectors that are determined to be free from fraud. Another technical advantage of certain embodiments may include providing a system and/or method for deriving information missing from a position text within an invoice by using the neighboring position texts. For example, a deep neural network may be trained to transform incomplete position text to complete position text by utilizing several (e.g., hundreds or thousands) common position texts. Other technical advantages will be readily apparent to one skilled in the art from the following figures, descriptions, and claims. Moreover, while specific advantages have been enumerated above, various embodiments may include all, some, or none of the enumerated advantages.

The embodiments disclosed above are only examples, and the scope of this disclosure is not limited to them. Particular embodiments may include all, some, or none of the components, elements, features, functions, operations, or steps of the embodiments disclosed above. Embodiments according to the invention are in particular disclosed in the attached claims directed to a method, a storage medium, a system and a computer program product, wherein any feature mentioned in one claim category, e.g. method, can be claimed in another claim category, e.g. system, as well. The dependencies or references back in the attached claims are chosen for formal reasons only. However any subject matter resulting from a deliberate reference back to any previous claims (in particular multiple dependencies) can be claimed as well, so that any combination of claims and the features thereof are disclosed and can be claimed regardless of the dependencies chosen in the attached claims. The subject-matter which can be claimed comprises not only the combinations of features as set out in the attached claims but also any other combination of features in the claims, wherein each feature mentioned in the claims can be combined with any other feature or combination of other features in the claims. Furthermore, any of the embodiments and features described or depicted herein can be claimed in a separate claim and/or in any combination with any embodiment or feature described or depicted herein or with any of the features of the attached claims.

To assist in understanding the present disclosure, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:.

One of the technical challenges that occurs in computer technology, such as a network environment, is ensuring data integrity when large quantities of data are received by the network environment. As an example, an enterprise (e.g., an insurance company) may receive thousands of invoices (e.g., car repair invoices and/or property damage invoices) and may be required to take action based on these invoices (e.g., distributing payment for damaged property). Conventional systems are typically unable to efficiently detect malicious activity (e.g., fraud) in the invoices. Without the ability to efficiently and quickly detect malicious activity in the invoices, the enterprise is vulnerable to fraudulent attacks.

The system described in the present application provides a technical solution to detect and prevent malicious activity and/or inaccuracies in information received by an enterprise. The ability to detect and prevent malicious activity improves the operation of the system and the security of the enterprise. For example, the system is able to identify malicious activity in a repair invoice before the system decides whether to approve the invoice. As another example, the system is able to identify errors in a repair invoice, which provides an opportunity for corrective action prior to processing the invoice for payment. Thus, the system provides an unconventional technical solution that allows the system to protect itself from malicious activity and errors that may hinder an enterprise's success.

<FIG> illustrates an example system <NUM> configured to implement fraud detection, according to certain embodiments. System <NUM> includes an administrative module <NUM>, a position conversion module <NUM>, and a fraud detection module <NUM> connected to each other by a network <NUM>. In general, system <NUM> facilitates implementing fraud detection through analysis by administrative module <NUM>, position conversion module <NUM>, and fraud detection module <NUM> of information stored in one or more databases.

System <NUM> or portions thereof may be associated with an entity, which may include any entity, such as a person, business, or company, that analyzes data for fraud detection. Throughout this description, this entity is referred to as the entity associated with system <NUM>. In one embodiment, administrative module <NUM>, position conversion module <NUM>, and fraud detection module <NUM> may be included within an entity and connected by network <NUM>. The elements of system <NUM> may be implemented using any suitable combination of hardware, firmware, and software.

Although <FIG> illustrates a particular arrangement of administrative module <NUM>, position conversion module <NUM>, fraud detection module <NUM>, and network <NUM>, this disclosure contemplates any suitable arrangement of administrative module <NUM>, position conversion module <NUM>, fraud detection module <NUM>, and network <NUM>. As an example and not by way of limitation, two or more of administrative module <NUM>, position conversion module <NUM>, and fraud detection module <NUM> may be connected to each other directly, bypassing network <NUM>. As another example, two or more of administrative module <NUM>, position conversion module <NUM>, and fraud detection module <NUM> may be physically or logically co-located with each other in whole or in part. Moreover, although <FIG> illustrates a particular number of administrative modules <NUM>, position conversion modules <NUM>, fraud detection modules <NUM>, and networks <NUM>, this disclosure contemplates any suitable number of administrative modules <NUM>, position conversion modules <NUM>, fraud detection modules <NUM>, and networks <NUM>. As an example and not by way of limitation, network environment <NUM> may include multiple administrative modules <NUM>, position conversion modules <NUM>, and fraud detection modules <NUM>.

This disclosure contemplates any suitable network <NUM>. As an example and not by way of limitation, one or more portions of network <NUM> may include an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), a portion of the Internet, a portion of the Public Switched Telephone Network (PSTN), a cellular telephone network, or a combination of two or more of these. Network <NUM> may include one or more networks <NUM>.

In some embodiments, administrative module <NUM> is a computer program for analyzing data to identify characteristics of the data (e.g., one or more positions of an invoice). In the illustrated embodiment, administrative module <NUM> includes an interface <NUM>, a memory <NUM>, and a processor <NUM>. Memory <NUM> of administrative module includes database <NUM> and invoice analyzer <NUM>. The elements of administrative module <NUM> may be implemented using any suitable combination of hardware, firmware, and software.

Administrative module <NUM> may be implemented using one or more computer systems at one or more locations. Each computer system may include any appropriate input devices, output devices, mass storage media, processors, memory, or other suitable components for receiving, processing, storing, and communicating data. For example, each computer system may include a personal computer, workstation, network computer, kiosk, wireless data port, PDA, one or more IP telephones, one or more servers, a server pool, switch, router, one or more processors within these or other devices, or any other suitable processing device. Administrative module <NUM> may be a stand-alone computer or may be a part of a larger network of computers associated with an entity.

Interface <NUM> of administrative module <NUM> represents any suitable computer element that can receive information from network <NUM>, transmit information through network <NUM>, perform suitable processing of the information, communicate to other components (e.g., position conversion module <NUM>) of system <NUM>, or any combination of the preceding. For example, interface <NUM> may receive a communication from a workstation, transmit information pertaining to the received communication to position conversion module <NUM>, receive responses from fraud detection module <NUM>, and/or communicate a response to the workstation. Interface <NUM> represents any port or connection, real or virtual, including any suitable combination of hardware, firmware, and software, including protocol conversion and data processing capabilities, to communicate through a Local Area Network ("LAN"), Wide Area Network ("WAN"), or other communication system that allows the entity associated with system <NUM> to exchange information between components of system <NUM>.

Memory <NUM> of administrative module <NUM> stores, permanently and/or temporarily, received and transmitted information, as well as system software, control software, other software for administrative module <NUM>, and a variety of other information. Memory <NUM> may store information for execution by processor <NUM>. In the illustrated embodiment, memory <NUM> stores database <NUM> and invoice analyzer <NUM> of administrative module <NUM>.

Memory <NUM> includes any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory <NUM> may include Random Access Memory ("RAM"), Read-only Memory ("ROM"), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices. Memory <NUM> may include any suitable information for use in the operation of administrative module <NUM>. Additionally, memory <NUM> may be a component external to (or may be partially external to) administrative module <NUM>. Memory <NUM> may be located at any location suitable for memory <NUM> to communicate with administrative module <NUM>.

Database <NUM> of administrative module <NUM> may be any database that stores data. Database <NUM> may store certain types of information for the entity associated with system <NUM>. For example, database <NUM> may store one or more invoices 128a-n, where n is any suitable integer. In certain embodiments, database <NUM> stores characteristics associated with invoices 128a-n. For example, database <NUM> may store one or more positions 130a-n associated with each invoice <NUM>. Each position 130a-n is a line item of an invoice describing a service or product added to the invoice. For example, invoice 128a may include five invoice positions 130a-e, wherein: position 130a includes position text describing a service (e.g., "move desks"), an associated unit (e.g., "flat" rate), an associated quantity (e.g., "<NUM>" flat rate), and an associated price per unit (e.g., "$<NUM>" per flat rate); position 130b includes position text describing a product (e.g., "white paint"), an associated unit (e.g., "gallon"), an associated quantity (e.g., "<NUM>" gallons), and an associated price per unit (e.g., "$<NUM>" per gallon); and so on. In certain embodiments, database <NUM> stores certain types of information received from one or more components of system <NUM>. For example, database <NUM> may store results generated by fraud detection module <NUM>. Database <NUM> may be one database in a collection of databases 126a-n. In some embodiments, each database 126a-n may store a particular type of information. For example, database 126a may store invoices 128a-n and database 126b may store results generated from fraud detection module <NUM>.

Database <NUM> includes any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, database <NUM> may include Random Access Memory ("RAM"), Read-only Memory ("ROM"), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices. While database <NUM> is shown in administrative module <NUM> in the illustrated embodiment of <FIG>, database <NUM> may be located in any location suitable for communication with administrative module <NUM>, position conversion module <NUM>, and/or fraud detection module <NUM>. For example, database <NUM> may be externally located from administrative module <NUM>, position conversion module <NUM>, and/or fraud detection module <NUM>. As another example, database 126a of databases 126a-n may be located in administrative module <NUM>, database 126b may be located in position conversion module <NUM>, database 126c may be located in fraud detection module <NUM>, and so on. Although described as a database, databases <NUM> may be implemented as any suitable type of volatile or non-volatile memory. Database <NUM> may include one or more interfaces and/or processors.

Processor <NUM> of administrative module <NUM> controls certain operations of administrative module <NUM> by processing information received from interface <NUM> and memory <NUM> or otherwise accessed by processor <NUM>. Processor <NUM> communicatively couples to interface <NUM> and memory <NUM>. Processor <NUM> includes any hardware and/or software that operates to control and process information. Processor <NUM> may be a programmable logic device, a microcontroller, a microprocessor, any suitable processing device, or any suitable combination of the preceding. Additionally, processor <NUM> may be a component external to administrative module <NUM>. Processor <NUM> may be located in any location suitable for processor <NUM> to communicate with administrative module <NUM>. Processor <NUM> controls the operation of invoice analyzer <NUM>.

Invoice analyzer <NUM> accesses information in database <NUM>, processes and analyzes the accessed information, and arranges this information for input into position conversion module <NUM>. For example, invoice analyzer may search database <NUM> for particular invoice 128a of invoices 128a-n, determine which information (e.g., positions 130a-n) to collect for input into position conversion module <NUM>, and arrange this collected information into a format so that interface <NUM> can transmit this collected information to position conversion module <NUM>. As another example, invoice analyzer may search database <NUM> for information (e.g., fraud results for invoice 128a) received from fraud detection module <NUM>, determine which information (e.g., fraud results for a certain invoice 128a) to collect in response to a request from a user (e.g., an insurance agent) of a workstation, and arrange this collected information into an intelligent view so that interface <NUM> can display this collected information to the user.

In the illustrated embodiment, position conversion module <NUM> is a computer program that receives information (e.g., positions 130a-n of invoice 128a) from administrative module <NUM> and converts this information to a vector (e.g., a vector representative of entire invoice 128a). In the illustrated embodiment, position conversion module <NUM> includes an interface <NUM>, a memory <NUM>, and a processor <NUM>. Memory <NUM> of position conversion module <NUM> includes position converter <NUM>. The elements of position conversion module <NUM> may be implemented using any suitable combination of hardware, firmware, and software.

Position conversion module <NUM> may be implemented using one or more computer systems at one or more locations. Each computer system may include any appropriate input devices, output devices, mass storage media, processors, memory, or other suitable components for receiving, processing, storing, and communicating data. For example, each computer system may include a personal computer, workstation, network computer, kiosk, wireless data port, PDA, one or more IP telephones, one or more servers, a server pool, switch, router, one or more processors within these or other devices, or any other suitable processing device. Position conversion module <NUM> may be a stand-alone computer or may be a part of a larger network of computers associated with an entity.

Interface <NUM> of position conversion module <NUM> represents any suitable computer element that can receive information from network <NUM>, transmit information through network <NUM>, perform suitable processing of the information, communicate to other components (e.g., fraud detection module <NUM>) of system <NUM>, or any combination of the preceding. For example, interface <NUM> may receive a communication from administrative module <NUM> and/or transmit information pertaining to the received communication to fraud detection module <NUM>. Interface <NUM> represents any port or connection, real or virtual, including any suitable combination of hardware, firmware, and software, including protocol conversion and data processing capabilities, to communicate through a Local Area Network ("LAN"), Wide Area Network ("WAN"), or other communication system that allows the entity associated with system <NUM> to exchange information between components of system <NUM>.

Memory <NUM> of position conversion module <NUM> stores, permanently and/or temporarily, received and transmitted information, as well as system software, control software, other software for position conversion module <NUM>, and a variety of other information. Memory <NUM> may store information for execution by processor <NUM>. In the illustrated embodiment, memory <NUM> stores position converter <NUM> of position conversion module <NUM>.

Memory <NUM> includes any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory <NUM> may include Random Access Memory ("RAM"), Read-only Memory ("ROM"), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices. Memory <NUM> may include any suitable information for use in the operation of position conversion module <NUM>. Additionally, memory <NUM> may be a component external to (or may be partially external to) position conversion module <NUM>. Memory <NUM> may be located at any location suitable for memory <NUM> to communicate with position conversion module <NUM>.

Processor <NUM> of position conversion module <NUM> controls certain operations of position conversion module <NUM> by processing information received from interface <NUM> and memory <NUM> or otherwise accessed by processor <NUM>. Processor <NUM> communicatively couples to interface <NUM> and memory <NUM>. Processor <NUM> includes any hardware and/or software that operates to control and process information. Processor <NUM> may be a programmable logic device, a microcontroller, a microprocessor, any suitable processing device, or any suitable combination of the preceding. Additionally, processor <NUM> may be a component external to position conversion module <NUM>. Processor <NUM> may be located in any location suitable for processor <NUM> to communicate with position conversion module <NUM>. Processor <NUM> controls the operation of position converter <NUM>.

Position converter <NUM> of position conversion module <NUM> accesses information received from administrative module <NUM>, processes and analyzes the accessed information, and arranges this information for input into fraud detection module <NUM>. For example, position converter <NUM> may receive positions 130a-n of invoice 128a from administrative module <NUM>, convert (see notation <NUM>) positions 130a-n to a combined position vectors <NUM>-n, and arrange this information into a format (e.g., invoice vector 167a) so that interface <NUM> can transmit this information to fraud detection module <NUM>. As another example, position converter <NUM> may receive positions 130a-n of each invoice 128a-n from administrative module <NUM>, convert positions 130a-n for each invoice 128a-n to combined position vectors 148a-n, respectively, and arrange this information into a format (e.g., n-dimensional hyperspace representation of invoice vectors 167a-n) so that interface <NUM> can transmit this information to fraud detection module <NUM>. In certain embodiments, position converter <NUM> is a neural network (e.g., a deep neural network). Position converter <NUM> is described in more detail in <FIG> below.

Fraud detection module <NUM> is a computer program for detecting fraud in data (e.g., invoices 128a-n). In the illustrated embodiment, fraud detection module <NUM> includes an interface <NUM>, a memory <NUM>, and a processor <NUM>. Memory <NUM> of fraud detection module <NUM> includes fraud detector <NUM>. The elements of fraud detection module <NUM> may be implemented using any suitable combination of hardware, firmware, and software.

Fraud detection module <NUM> may be implemented using one or more computer systems at one or more locations. Each computer system may include any appropriate input devices, output devices, mass storage media, processors, memory, or other suitable components for receiving, processing, storing, and communicating data. For example, each computer system may include a personal computer, workstation, network computer, kiosk, wireless data port, PDA, one or more IP telephones, one or more servers, a server pool, switch, router, one or more processors within these or other devices, or any other suitable processing device. Fraud detection module <NUM> be a stand-alone computer or may be a part of a larger network of computers associated with an entity.

Interface <NUM> of fraud detection module <NUM> represents any suitable computer element that can receive information from network <NUM>, transmit information through network <NUM>, perform suitable processing of the information, communicate to other components (e.g., administrative module <NUM>) of system <NUM>, or any combination of the preceding. For example, interface <NUM> may receive a communication from position conversion module <NUM> and/or transmit information pertaining to the received communication to administrative module <NUM>. Interface <NUM> represents any port or connection, real or virtual, including any suitable combination of hardware, firmware, and software, including protocol conversion and data processing capabilities, to communicate through a Local Area Network ("LAN"), Wide Area Network ("WAN"), or other communication system that allows the entity associated with system <NUM> to exchange information between components of system <NUM>.

Memory <NUM> of fraud detection module <NUM> stores, permanently and/or temporarily, received and transmitted information, as well as system software, control software, other software for fraud detection module <NUM>, and a variety of other information. Memory <NUM> may store information for execution by processor <NUM>. In the illustrated embodiment, memory <NUM> stores fraud detector <NUM> of fraud detection module <NUM>.

Memory <NUM> includes any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory <NUM> may include Random Access Memory ("RAM"), Read-only Memory ("ROM"), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices. Memory <NUM> may include any suitable information for use in the operation of fraud detection module <NUM>. Additionally, memory <NUM> may be a component external to (or may be partially external to) fraud detection module <NUM>. Memory <NUM> may be located at any location suitable for memory <NUM> to communicate with fraud detection module <NUM>.

Processor <NUM> of fraud detection module <NUM> controls certain operations of fraud detection module <NUM> by processing information received from interface <NUM> and memory <NUM> or otherwise accessed by processor <NUM>. Processor <NUM> communicatively couples to interface <NUM> and memory <NUM>. Processor <NUM> includes any hardware and/or software that operates to control and process information. Processor <NUM> may be a programmable logic device, a microcontroller, a microprocessor, any suitable processing device, or any suitable combination of the preceding. Additionally, processor <NUM> may be a component external to fraud detection module <NUM>. Processor <NUM> may be located in any location suitable for processor <NUM> to communicate with fraud detection module <NUM>. Processor <NUM> controls the operation of fraud detector <NUM>.

Fraud detector <NUM> of fraud detection module <NUM> analyzes information for fraud. In the illustrated embodiment, fraud detector <NUM> accesses information received from position conversion module <NUM>, processes and analyzes the accessed information, and arranges this information for input into administrative module <NUM>. For example, fraud detector <NUM> may receive combined position vectors 148a-n from position conversion module <NUM>, generate invoice vector 167a from combined position vectors 148a-n, compare (see notation <NUM>) invoice vector 167a to a fraud detection parameter 168a, and arrange (see notation <NUM>) the comparison results into a format (e.g., list <NUM>) so that interface <NUM> can transmit these results to administrative module <NUM>. As another example, fraud detector <NUM> may receive invoice vectors 167a-n from position conversion module <NUM>, compare invoice vectors 167a-n to fraud detection parameters 168a-n (where n represents any suitable integer), and arrange these comparison results into a format (e.g., list <NUM>) so that interface <NUM> can transmit these results to administrative module <NUM>.

Fraud detection parameters 168a-n of fraud detector <NUM> represent constraints for detecting fraud in combined position vectors 148a-n. For example, when invoice vector 167a is located within fraud detection parameter 168a, fraud is not detected in invoice 128a associated with invoice vector 167a, as indicated in list <NUM> by the word "NO". As another example, when invoice vector 167b is located within fraud detection parameter 168b, fraud is not detected in invoice 128b associated with invoice vector 167b, as indicated in list <NUM> by the word "NO". As still another example, when invoice vector 167n is not located within fraud detection parameter 168n, fraud is detected in invoice 128n associated with invoice vector 167n, as indicated in list <NUM> by the word "YES". While system <NUM> illustrates a list to indicate fraud results, any suitable format (e.g., a graph) may be utilized to indicate fraud in system <NUM>. Further, while list <NUM> indicates fraud in invoices using the terms "YES" and "NO", list <NUM> may utilize any notation suitable to indicate fraud (e.g., a check or an "x").

In certain embodiments, measurements are used to determine whether invoices 128a-n are indicative of fraud. For example, fraud detector <NUM> may measure a similarity between combined position vector 148a and one or more sample vectors determined to be free from fraud using cosine similarity. A high cosine similarity may represent similarities between combined position vector 148a and the one or more sample vectors, which may indicate that invoice 148a is fraudless. A low cosine similarity (e.g., a value close to <NUM>) may represent differences between combined position vector 148a and the one or more sample vectors, which may indicate that invoice 148a is fraudulent. As another example, fraud detector <NUM> may measure a similarity between combined position vector 148a and one or more sample vectors determined to be free from fraud using Euclidean distance similarity.

In response to fraud detection module <NUM> analyzing invoices 128a-n for fraud, fraud detection module <NUM> may take action based on the analysis. For example, fraud detection module <NUM> may accept the invoice, deny the invoice, execute further analysis (e.g., a further comparison), and/or trigger a business process (e.g., report fraud to one or more organizations).

<FIG> illustrates additional example details of position conversion module <NUM> of <FIG>, according to certain embodiments. As shown, position conversion module <NUM> receives (see notation <NUM>) position texts 210a-n of invoice 128a from administrative module <NUM> and converts position texts 210a-n to combined vectors 148a-n, generates invoice vector 167a from combined vectors 148a-n, and transmits (see notation <NUM>) invoice vector 167a to fraud detection module <NUM>.

Position conversion module <NUM> receives (see notation <NUM>) position text 210a of position 130a of invoice 128a from administrative module <NUM>. In response to receiving position text 210a from position 130a of invoice 128a, position converter <NUM> of position conversion module <NUM> converts (see notation 215a) position text 210a to a word vector 220a. The conversion is described in more detail in <FIG> below.

Position converter <NUM> of position conversion module <NUM> may concatenate (see notation 225a) word vector 220a with a number vector to generate a position vector 230a. The concatenation is described in more detail in <FIG> below. In certain embodiments, word vector 220a, the number vector, and position vector 230a have a predetermined dimensionality. For example, word vector 220a may have a predetermined dimensionality of <NUM>, the number vector may have a predetermined dimensionality of <NUM>, and position vector 230a may have a dimensionality of <NUM>+<NUM>. Position vector 230a is a vector representation of position text 210a from position 130a of invoice 128a.

In the illustrated embodiment of <FIG>, the above described process of converting position text 210a of invoice 128a to position vector 230a is repeated for neighboring position texts 210b-n (where n represents any suitable integer). For example, position conversion module <NUM> may receive (see notation <NUM>) position text 210b of invoice from position 130b of invoice 128a from administrative module <NUM>, convert (see notation 215b) position text 210b to word vector 220b, and concatenate (see notation 225b) word vector 220b with a number vector to generate a position vector 230b, and so on. In certain embodiments, position texts 210a-n represent all position texts included in invoice 128a.

Position conversion module <NUM> may include one or more networks. For example, position conversion module <NUM> may include a position level attention network <NUM>, a long short-term memory ("LSTM") network <NUM>, and a multilayer perceptron ("MLP") network <NUM>.

Position level attention network <NUM> of position conversion module <NUM> is any network that can receive position vectors 230b-n, which neighbor position vector 230a, from one or more components of system <NUM>. In certain embodiments, position level attention network <NUM> is a feed-forward MLP network. Position level attention network <NUM> may receive as input position vectors 230b-n from a database of memory <NUM> of position conversion module <NUM>, generate a scalar value associated with the position vectors 230b-n, and multiply each position vector 230b-n to the generated scalar value to generate modified position vectors 240b-n. Position level attention network may then transfer (see notation <NUM>) the modified position vectors 240b-n to LSTM network <NUM>.

LSTM network <NUM> of position conversion module <NUM> is any network that can receive neighboring position vectors 240b-n from one or more components of system <NUM>. For example, LSTM network <NUM> may receive (see notation 245b) as input modified position vectors 240b-n from a database of memory <NUM> of position conversion module <NUM> and condense information associated with modified position vectors 240b-n into a condensed position vector <NUM>. LSTM network <NUM> includes a hidden state <NUM>, which outputs condensed position vector <NUM>.

MLP network <NUM> is any network that can receive position vectors from one or more components of system <NUM>. For example, MLP network <NUM> may receive (see notation <NUM>) as input position vector 230a and condensed position vector <NUM> from memory <NUM> (e.g., a database) of position conversion module <NUM>. In certain embodiments, MLP network <NUM> concatenates position vector 230a and condensed position vector <NUM> to generate a combined position vector 148a. For example, MLP network <NUM> may combine information from position text 210a with information (e.g., contextual information) from position texts 210a-n to generate combined position vector 148a.

In certain embodiments, combined position vector 148a provides a complete description of the service or product of position text 210a. For example, position text 210a may read "technician". Based on information derived from position texts 210b-n (e.g., "roofing materials"), MLP network may generate a description that represents text "roof technician". In some embodiments, MLP network <NUM> may use information derived from one or more sources other than position text 210a-n. For example, position 130a of invoice 128a may include a units category indicating units (e.g., hours) for particular services, and MLP network <NUM> may generate a more complete description for position text 210a that reads "hourly roof technician".

In some embodiments, system <NUM> may train position conversion module <NUM> to generate a complete description for position text 210a by utilizing machine learning. For example, several sample invoice positions (e.g., over <NUM>,<NUM> invoice positions) may be input into position conversion module <NUM> alongside combined position vector 148a representing complete position text. System <NUM> may utilize the backpropagation method to learn neural network parameters of position conversion module <NUM> and map incomplete position text (e.g., "technician") to a complete position text (e.g., "HVAC technician"). The mapping of incomplete position text to complete position text that is used to train the neural network of position conversion module <NUM> may be performed by subject experts who identify and map together different linguistic forms and ways to express the same semantic meaning in the natural language.

The above process of converting position texts 210a-n to combined position vector 148a is repeated for position texts 210b-n to generate combined position vectors 148b-n, respectively. For example, position level attention network <NUM> may receive position vectors 230a and 230c-n, which neighbor position vector 230b, generate a scalar value associated with the position vectors 230a and 230c-n, and multiply each position vector 230a and 230c-n to the generated scalar value to generate modified position vectors 240a and 240c-n. Position level attention network <NUM> may then transfer the modified position vectors 240a and 240c-n to LSTM network <NUM>, which then condenses information associated with modified position vectors 240a and 240c-n into a condensed position vector <NUM> (representative of 240a and 240c-n). MLP network <NUM> then concatenates position vector 230b and condensed position vector <NUM> to generate a combined position vector 148b.

Combined position vectors 148a-n are numeric representations of position texts 210a-n, respectively. In addition to neighboring position text, the generation of combined position vectors 148a-n by position conversion module <NUM> (e.g., a deep neural network) may take into account position texts, units, amounts, and/or prices associated with positions 130a-n.

In certain embodiments, combined position vectors 148a-n are summed to generate an invoice vector 167a. Invoice vector 167a is a numeric representation of the entire invoice (e.g., invoice 128a). In some embodiments, MLP network <NUM> transfers combined position vectors 148a-n to a processor (e.g., processor <NUM> of <FIG>) of position conversion module <NUM>, which generates invoice vector 167a and then transfers (see notation <NUM>) invoice vector 167a to fraud detection module <NUM> of <FIG>. In certain embodiments, the processor that generates invoice vector 167a may be external to position conversion module <NUM>. This process of generating invoice vector 167a may be repeated for invoices 128b-n to generate invoice vectors 167b-n, respectively.

<FIG> illustrates additional example details of position conversion module <NUM> of <FIG>, according to certain embodiments. In particular, <FIG> illustrates an example conversion of position text 210c, as shown in <FIG>, to position vector 230c, as shown in <FIG>. In certain embodiments, an invoice (e.g., invoice 128a of administrative module <NUM>) includes position texts 210a-n, units 310a-n, amounts 320a-n, and price per unit 330a-n, where n represents any suitable integer. Position texts 210a-n can be any combination of words, numbers, and symbols representative of a service or product. For example, position text 210a of invoice position 130a reads "move furniture," position text 210b of invoice position 130b reads "white paint," position text 130c of invoice position 130c reads "paint <NUM> m2 wall," and position text 210n of invoice position 130n reads "clean room and dispose waste. " In certain embodiments, position texts 210a-n include an incomplete description of the associated service and or product. For example, position text 210d may read "technician," which could be interpreted as a roofing technician or an HVAC technician.

Units 310a-n represent any standard for which amounts can be measured. For example, "flat" unit 310a of invoice position 130a represents a flat rate to move furniture, "gallon" unit 310b of invoice position 130b represents a gallon of white paint, "hour" unit 130c of invoice position 130c represents an hour of painting <NUM> m2 wall, and "flat" unit 310n of invoice position 130n represents a flat rate to clean room and dispose waste. Units may be based on any measurement system (e.g., Metric or U. standard system).

Amounts 320a-n represent quantities of units. For example, amount 320a of invoice position 130a represents a single flat rate to move furniture, amount 320b of invoice position 130b represents <NUM> gallons of white paint, amount 320c of invoice position 130c represents <NUM> hours to paint <NUM> m2 wall, and amount 320n of invoice position 130n represents a single flat rate to clean room and dispose waste. Amount 320a-n may be represented by numbers (e.g., <NUM>) or words (e.g., ten).

Prices per unit 330a-n represent costs associated with a single unit 310a-n. For example, price per unit 330a of invoice position 130a represents a $<NUM> flat rate to move furniture, price per unit 330b of invoice position 130b represents a $<NUM> cost for each gallon of white paint, price per unit 330c of invoice position 130c represents a $<NUM> cost for each hour to paint <NUM> m2 wall, and price per unit 330n of invoice position 130n represents a $<NUM> flat rate to clean room and dispose waste.

In certain embodiments, position conversion module <NUM> converts position texts 210a-n to position vectors 230a-n, respectively. For example, as shown in <FIG>, position conversion module <NUM> may convert position text 210c to position vector 230c. In the illustrated embodiment, each word and/or number 340a, 340b, 340c, and 340d of position text 210c (i.e., "paint", "<NUM>", "m2", and "wall", respectively) is represented in table <NUM>. In instances where position text includes more than a certain number of words (e.g., <NUM> words), the words may be truncated so that table <NUM> includes a maximum number of words (e.g., <NUM> words). Each number in position text 210c may be replaced by a special token, in some embodiments. For example, number "<NUM>" in position text 210c is replaced by <number> (see notation 340b) in table <NUM>. Each word and number 340a-d of position text 210c is then converted to word embedding vectors 360a-d, respectively.

Position conversion module <NUM> may utilize one or more of the following known word embedding techniques to convert each word and number 340a-d of position text 210c to word embedding vectors 360a-d: Global Vectors for Word Representation ("GloVe"), word2vec, and fastText. For example, during a training phase, one of the word embedding techniques (e.g., GloVe) may generate a look-up table that maps individual words in vocabulary to vectors. This look-up-table is used to generate word embedding vectors 360a-d for each word 340a-d in position text 210c.

Each word embedding vector 360a-d of table <NUM> may have a predetermined dimensionality with a predetermined number of units. For example, word embedding vector 360a for the word "paint" may have a predetermined dimensionality of <NUM>, which is represented by <NUM> units that include units <NUM>, <NUM>, <NUM>. and so on, with a last unit of -<NUM>. As another example, word embedding vector 360b for special token <number> may have a predetermined dimensionality of <NUM>, which is represented by <NUM> units that include units <NUM>, <NUM>, -<NUM>. and so on, with a last unit of <NUM>.

In the illustrated embodiment, word embedding vectors 360a-360d are summed (see notation <NUM>) to generate word vector 220c. In some embodiments, word embedding vectors 360a-d and word vector 220c all have the same dimensionality (e.g., <NUM>). Word vector 220c is then concatenated with a number vector 380c to generate position vector 230c. Number vector 380c may include one or more numbers from the position text 210c multiplied by a predefined normalization factor (e.g., <NUM>/<NUM>,<NUM>). In the illustrated embodiment, number vector 380c may include number <NUM>, which represents the number "<NUM>" from position text 210c divided by predetermined number <NUM>,<NUM>. This predefined normalization factor may be selected to keep the median value of normalized numbers occurring in position texts of statistically large number of invoices (e.g., greater than <NUM>,<NUM>) at approximately <NUM>. Number <NUM> is located in a position (second unit from left) corresponding to a position of the number in position text 210c (second word or number from left). In other embodiments, the number from position text 210c may be divided by any other predetermined number and may be located in a position other than a position corresponding to the position of the number in position text 210c. All other units of number vector 380c not corresponding to a number in position text <NUM> may be set to a predetermined number (e.g., <NUM>).

Number vector 380c may have a dimensionality that is less than the dimensionality of word vector 220c. For example, word vector 220c may have a dimensionality of <NUM> and number vector 380c may have a dimensionality of <NUM>. Position converter <NUM> of system <NUM> may then concatenate word vector 220c and number vector 380c to generate position vector 230c. In some embodiments, position vector 230c may have a dimensionality of <NUM>+<NUM>. Position vector 230c may then be used to generate modified position vector 240c and ultimately invoice vector 167a, as described above in reference to <FIG>.

<FIG> illustrates an example method <NUM> for detecting fraud in invoices, according to certain embodiments. In some embodiments, method <NUM> begins at step <NUM>, where a computer system (e.g., position conversion module <NUM>) receives an invoice (e.g., invoice 128a). The invoice includes one or more invoice positions (e.g. invoice positions 130a-n). Each invoice position includes invoice information. For example, an invoice position may include position text, units, amount, and a price per unit. In certain embodiments, the computer system receives particular invoice information from an administrative module (e.g., administrative module <NUM>). For example, position conversion module <NUM> may receive position text 210a from administrative module <NUM>.

Method <NUM> then proceeds to step <NUM>, where the computer system converts each word and number of the position text of each invoice position to a word embedding vector (e.g., word embedding vectors 360a-d). In certain embodiments, converting each word and number of the position text of each invoice position to a word embedding vector includes truncating the words and the numbers of each position text to a predetermined number of words and numbers (e.g., <NUM> words and numbers). Converting each word and number of the position text of each invoice position to a word embedding vector may also include replacing the numbers with unique tokens. One of the following techniques may be utilized to convert each word and/or number of the position text to a word embedding vector: Global Vectors for Word Representation ("GloVe"); word2vec; and fastText.

Method <NUM> then advances to step <NUM>, where the word embedding vectors for each invoice position are summed to generate a word vector for each invoice position. The word vector and a number vector of each invoice position are concatenated at step <NUM> to generate a position vector for each invoice position (e.g., position vector 230a). Method <NUM> then moves to step <NUM>, where a combined position vector associated with each invoice position is generated using one or more neighboring position vectors. An invoice vector (e.g., invoice vector 167a) is then generated by the computer system at step <NUM> by summing the combined position vectors (e.g., combined position vectors 148a-n). At step <NUM>, the invoice vector is compared to a fraud detection parameter (e.g., fraud detection parameter 168a). In certain embodiments, fraud detection parameters 168a-n may be determined from historical data. For example, fraud detection parameters may be learned from invoices determined to be fraudulent and fraudless based on human expert knowledge. In some embodiments, learning may be realized using any suitable classification machine learning algorithm (e.g., linear classifier, support vector machine, or random forest).

At step <NUM>, the computer system determines whether the invoice is indicative of fraud based on the comparison. If the invoice is indicative of fraud, method <NUM> advances to step <NUM>, and the invoice is approved. If the invoice is indicative of fraud, method <NUM> moves to step <NUM>, and the invoice is denied. Method <NUM> then moves to step <NUM>, where the computer system determines whether another invoice (e.g., invoice 128b) has been received. If another invoice has been received, method <NUM> moves to step <NUM>, where the above described process is repeated. If another invoice has not been received, method <NUM> moves to step <NUM>, where method <NUM> ends.

Particular embodiments may repeat one or more steps of the method of <FIG>, where appropriate. Although this disclosure describes and illustrates particular steps of the method of <FIG> as occurring in a particular order, this disclosure contemplates any suitable steps of the method of <FIG> occurring in any suitable order. Moreover, although this disclosure describes and illustrates an example method for detecting fraud in invoices including the particular steps of the method of <FIG>, this disclosure contemplates any suitable method for detecting fraud in invoices including any suitable steps, which may include all, some, or none of the steps of the method of <FIG>, where appropriate. Furthermore, although this disclosure describes and illustrates particular components, devices, or systems carrying out particular steps of the method of <FIG>, this disclosure contemplates any suitable combination of any suitable components, devices, or systems carrying out any suitable steps of the method of <FIG>.

<FIG> illustrates an example computer system <NUM>. In particular embodiments, one or more computer systems <NUM> perform one or more steps of one or more methods described or illustrated herein. In particular embodiments, one or more computer systems <NUM> provide functionality described or illustrated herein. In particular embodiments, software running on one or more computer systems <NUM> performs one or more steps of one or more methods described or illustrated herein or provides functionality described or illustrated herein. Particular embodiments include one or more portions of one or more computer systems <NUM>. Herein, reference to a computer system may encompass a computing device, and vice versa, where appropriate. Moreover, reference to a computer system may encompass one or more computer systems, where appropriate.

In particular embodiments, processor <NUM> includes hardware for executing instructions, such as those making up a computer program. As an example and not by way of limitation, to execute instructions, processor <NUM> may retrieve (or fetch) the instructions from an internal register, an internal cache, memory <NUM>, or storage <NUM>; decode and execute them; and then write one or more results to an internal register, an internal cache, memory <NUM>, or storage <NUM>. In particular embodiments, processor <NUM> may include one or more internal caches for data, instructions, or addresses. This disclosure contemplates processor <NUM> including any suitable number of any suitable internal caches, where appropriate. As an example and not by way of limitation, processor <NUM> may include one or more instruction caches, one or more data caches, and one or more translation lookaside buffers (TLBs). Instructions in the instruction caches may be copies of instructions in memory <NUM> or storage <NUM>, and the instruction caches may speed up retrieval of those instructions by processor <NUM>. Data in the data caches may be copies of data in memory <NUM> or storage <NUM> for instructions executing at processor <NUM> to operate on; the results of previous instructions executed at processor <NUM> for access by subsequent instructions executing at processor <NUM> or for writing to memory <NUM> or storage <NUM>; or other suitable data. The data caches may speed up read or write operations by processor <NUM>. The TLBs may speed up virtual-address translation for processor <NUM>. In particular embodiments, processor <NUM> may include one or more internal registers for data, instructions, or addresses. This disclosure contemplates processor <NUM> including any suitable number of any suitable internal registers, where appropriate. Where appropriate, processor <NUM> may include one or more arithmetic logic units (ALUs); be a multi-core processor; or include one or more processors <NUM>. Although this disclosure describes and illustrates a particular processor, this disclosure contemplates any suitable processor.

In particular embodiments, memory <NUM> includes main memory for storing instructions for processor <NUM> to execute or data for processor <NUM> to operate on. As an example and not by way of limitation, computer system <NUM> may load instructions from storage <NUM> or another source (such as, for example, another computer system <NUM>) to memory <NUM>. Processor <NUM> may then load the instructions from memory <NUM> to an internal register or internal cache. To execute the instructions, processor <NUM> may retrieve the instructions from the internal register or internal cache and decode them. During or after execution of the instructions, processor <NUM> may write one or more results (which may be intermediate or final results) to the internal register or internal cache. Processor <NUM> may then write one or more of those results to memory <NUM>. In particular embodiments, processor <NUM> executes only instructions in one or more internal registers or internal caches or in memory <NUM> (as opposed to storage <NUM> or elsewhere) and operates only on data in one or more internal registers or internal caches or in memory <NUM> (as opposed to storage <NUM> or elsewhere). One or more memory buses (which may each include an address bus and a data bus) may couple processor <NUM> to memory <NUM>. Bus <NUM> may include one or more memory buses, as described below. In particular embodiments, one or more memory management units (MMUs) reside between processor <NUM> and memory <NUM> and facilitate accesses to memory <NUM> requested by processor <NUM>. In particular embodiments, memory <NUM> includes random access memory (RAM). This RAM may be volatile memory, where appropriate Where appropriate, this RAM may be dynamic RAM (DRAM) or static RAM (SRAM). Moreover, where appropriate, this RAM may be single-ported or multi-ported RAM. This disclosure contemplates any suitable RAM. Memory <NUM> may include one or more memories <NUM>, where appropriate. Although this disclosure describes and illustrates particular memory, this disclosure contemplates any suitable memory.

In particular embodiments, communication interface <NUM> includes hardware, software, or both providing one or more interfaces for communication (such as, for example, packet-based communication) between computer system <NUM> and one or more other computer systems <NUM> or one or more networks. As an example and not by way of limitation, communication interface <NUM> may include a network interface controller (NIC) or network adapter for communicating with an Ethernet or other wire-based network or a wireless NIC (WNIC) or wireless adapter for communicating with a wireless network, such as a WI-FI network. This disclosure contemplates any suitable network and any suitable communication interface <NUM> for it. As an example and not by way of limitation, computer system <NUM> may communicate with an ad hoc network, a personal area network (PAN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), or one or more portions of the Internet or a combination of two or more of these. One or more portions of one or more of these networks may be wired or wireless. As an example, computer system <NUM> may communicate with a wireless PAN (WPAN) (such as, for example, a BLUETOOTH WPAN), a WI-FI network, a WI-MAX network, a cellular telephone network (such as, for example, a Global System for Mobile Communications (GSM) network), or other suitable wireless network or a combination of two or more of these. Computer system <NUM> may include any suitable communication interface <NUM> for any of these networks, where appropriate. Communication interface <NUM> may include one or more communication interfaces <NUM>, where appropriate. Although this disclosure describes and illustrates a particular communication interface, this disclosure contemplates any suitable communication interface.

All structural and functional equivalents to the elements of the various aspects described throughout this disclosure that are known or later come to be known to those of ordinary skill in the art are intended to be encompassed by the claims. §<NUM>(f), unless the element is expressly recited using the phrase "means for" or, in the case of a method claim, the element is recited using the phrase "step for. " Furthermore, to the extent that the term "include," "have," or the like is used, such term is intended to be inclusive in a manner similar to the term "comprise" as "comprise" is interpreted when employed as a transitional word in a claim.

Claim 1:
A network security system for fraud detection comprising:
one or more processors (<NUM>, <NUM>, <NUM>, <NUM>); and
a memory (<NUM>, <NUM>, <NUM>) communicatively coupled to the one or more processors (<NUM>, <NUM>, <NUM>, <NUM>), the memory (<NUM>, <NUM>, <NUM>) comprising instructions executable by the one or more processors (<NUM>, <NUM>, <NUM>, <NUM>), the one or more processors (<NUM>, <NUM>, <NUM>, <NUM>) being operable when executing the instructions to:
receive an invoice (<NUM>) comprising a plurality of invoice positions (<NUM>), each of the invoice positions (<NUM>) comprising a position text (<NUM>);
characterized in that the one or more processors (<NUM>, <NUM>, <NUM>, <NUM>) further being operable when executing the instructions to:
convert each word and number of the position text (<NUM>) of each invoice position (<NUM>) to a word embedding vector;
sum the word embedding vectors for each invoice position (<NUM>) to generate a word vector (<NUM>) for each invoice position (<NUM>);
concatenate the word vector (<NUM>) and a number vector of each invoice position (<NUM>) to generate a position vector (<NUM>) for each invoice position (<NUM>);
generate a first combined position vector for a first invoice position by:
modifying the position vectors that neighbor a first position vector;
condensing the neighboring position vectors of the first position vector to generate a first condensed position vector; and
concatenating the first condensed position vector and the first position vector to generate the first combined position vector;
generate a second combined position vector for a second invoice position by:
modifying the position vectors that neighbor a second position vector;
condensing the neighboring position vectors of the second position vector to generate a second condensed position vector; and
concatenating the second condensed position vector and the second position vector to generate the second combined position vector;
generate an invoice vector (167a) by summing the first combined position vector and the second combined position vector, wherein the invoice vector (167a) is a numeric representation of the invoice (<NUM>);
compare the invoice vector (167a) to a fraud detection parameter (<NUM>); and
determine whether the invoice (<NUM>) is indicative of fraud based on the comparison.