David Raab Article Archive

Tracking patterns of customer behavior seems like a great way to identify marketing opportunities, but sophisticated systems to do this have not been widely adopted. Products including Verbind (now owned by SAS), Harte-Hanks Allink Agent, and Elity Insight have been sold to just a handful of customers. Although many more firms have purchased generic pattern detection software, this is less likely to be the heart of a behavior-based marketing program.

But while marketers have been slow to apply behavior tracking, it has gained broad acceptance in operational systems to detect fraud, money laundering, insider trading, bankruptcy risk and other illicit activities. Vendors include Actimize, Atchley Systems, Magnify, and SearchSpace. The technology is now gaining a still higher profile as part of surveillance systems used in national security projects.

Whatever the application, pattern detection systems must meet three basic requirements. The first is to gather data. Typically these systems work with detailed transaction data, often in very large volumes and real time or near real time. A system to prevent credit card fraud, for example, might scan millions of credit card transactions an hour, taking just seconds to compare each transaction with previous transactions for the same and similar customers and return an authorization or rejection. Many applications must consolidate data from multiple sources, particularly in security screening, where travel, communication, financial and other types of information must be viewed together before suspicious patterns become apparent. Money laundering or insider trading detection also look at multiple accounts or individuals to find possible connections.

The second requirement is to identify relevant patterns. This itself has two components: defining patterns to look for, and finding when those patterns have occurred. Pattern definition is most often manual–that is, an analyst must pore through historical data and determine which patterns are significant. Usually the analyst has automated data mining tools to help. Some systems do offer completely automated pattern definition, typically using neural networks or rule induction technology. Automated systems are particularly helpful at identifying new patterns as these evolve. But even automated systems must be manually supervised to avoid too many false alarms.

Once a suspicious pattern is defined, the system must be able to search for it. Since many patterns involve multiple transactions over time, access to past information is required. Many systems generate and store summary measures to avoid reprocessing all past transactions each time a new search is conducted. For applications such as flagging identity theft or credit card fraud, patterns may be defined in terms of deviation from past behavior: if someone who never leaves home suddenly makes purchases in different cities on successive days, this is suspicious. The same behavior may be perfectly normal for a frequent traveller.

The third requirement is to react when significant behavior is detected. In marketing applications, the reaction is often no more than a message, such as a product offer or sales contact. It’s reasonable to generate this automatically–after all, the cost of an error is pretty small. But with detection applications the stakes are usually much higher: you are about to accuse someone of doing something illicit. So the response is likely to be a manual review of the situation before further action is taken. This brings its own set of requirements for assembling case information, routing it to an appropriate analyst, ensuring the most urgent cases are handled first, escalating or transferring cases that require additional review, making sure low-priority cases are not forgotten, recording resolutions and comments, and keeping an audit trail for legal and management reasons.

Mantas Behavior Detection Platform (Mantas, Inc., 866-462-6827, www.mantas.com) applies technology originally developed for the intelligence community and later applied to monitor trading compliance and best execution in the securities industry. The Behavior Detection Platform includes the core set of tools to load transactions, define and identify behavior patterns, and respond to alerts. The vendor also has a half-dozen prebuilt applications for specific applications such as fraud or money laundering detection.

Mantas loads data from external systems into its own database, which uses any standard relational database engine. The database is typically populated in a batch process although the system can handle real time feeds as well. Mantas relies primarily on third-party data-loading tools, although it does include its own text-mining tool for tasks such as extracting the recipient name from a money order. The system can also create calculated or summary values during the load.

Behavior patterns, which Mantas calls scenarios, are defined in advance by an analyst through a browser-based graphical user interface. Scenarios can identify specific activity sequences or find common attributes among separate entities. They can also incorporate lists of individuals or countries flagged for special treatment. The vendor has created hundreds of prebuilt scenarios, which are included with its applications. Users can define new scenarios or modify existing ones, using data analysis tools included with the system. Mantas itself continually updates the scenarios associated with each application, and many customers simply use what Mantas provides.

As data is loaded, the system generates a profile of actual behavior for each entity. It can compare the profile against past behavior, behavior of similar entities, or stated goals such as investment objectives. Significant behavior deviations or scenario matches can trigger alerts, which are prioritized and routed according to rules specified by the user. Analysts can view all alerts related to the same entity, see the specific data and scenario that generated each alert, run reports that show past alerts, profiles and transactions for the entity, specify a resolution, and record their comments in a case history. Managers can view the alert queue, see audit trails, and control the activities permitted for each user.

The Behavior Detection Platform runs on large, multi-processor servers. Clients are primarily large financial institutions, in some cases feeding the system more than 100 million transactions per day. The software was originally developed by SRA International, which spun off Mantas as a separate firm in May, 2001. It now has about fifteen installations.

* * *

David M. Raab is a Principal at Raab Associates Inc., a consultancy specializing in marketing technology and analytics. He can be reached at draab@raabassociates.com.