Welcome to Understanding Link Analysis. The purpose of my site is to discuss the methods behind leveraging visual analytics to discover answers and patterns buried within data sets.

Visual analytics provides a proactive response to threats and risks by holistically examining information. As opposed to traditional data mining, by visualizing information, patterns of activity that run contrary to normal activity surface within very few occurances.

We can dive into thousands of insurance fraud claims to discover clusters of interrelated parties involved in a staged accident ring.

We can examine months of burglary reports to find a pattern leading back to a suspect.

With the new generation of visualization software our team is developing, we can dive into massive data sets and visually find new trends, patterns and threats that would take hours or days using conventional data mining.

The eye processes information much more rapidly when information is presented as images, this has been true since children started learning to read. As our instinct develops over time so does our ability to process complex concepts through visual identification. This is the power of visual analysis that I focus on in my site.

All information and data used in articles on this site is randomly generated with no relation to actual individuals or companies.

Visualizing Financial Information

Performing anti-money laundering or financial investigations can be daunting depending on the number of accounts and transactions you have to review. In general, those involved in money laundering, embezzlement or conducting financial fraud mask important transactions under thousands of ambiguous ones to mask their activity.

Visual analysis can assist you in finding key transactions for your investigation by identifying transaction flow and account relationships. Visually you can follow the flow of commodity much easier then a manual method.

The relationships between accounts and entities associated with those accounts are also important in identifying key players in financial investigations. These associations create "clusters" of interrelated entities in your data and just in many other criminal activities that are visual analyzed, these clusters are indicators of non-standard activity.

If I were to perform a visual analysis on my bank information, which I am not certain could be construed as normal but for the purpose of this article we will assume it is, you would see a transaction flow of payments going out to my auto loan, my home loan and utilities. You would see money flowing in from my salary, interest from investments and the like. In a visualization perhaps it would look something like this.

Now lets pretend I am a drug dealer and have to launder the proceeds from my crime in order to avoid detection. First, I am going to have more then one checking account, one investment account and one savings account like I have now. I am going to need multiple accounts in order to wash the money I am making. Probably one of these accounts is going to be outside the U.S., they are not going to be under the same names and use a variety of identifying information.

Aside from the number of accounts, when I visualize this information, my transactions are going to behave very differently. Instead of outbound transactions like my house payment, and inbound transactions like my paycheck, they are going to have transactions bilaterally flowing through all of them. Instead of seeing one directional link from my checking account to my savings account for my vacation fund, we are going to see multiple transactions flowing between each of the accounts I own.

The key to visualizing financial information to discover criminal activity is to follow the money. As this is the objective for visual analysis, our data and import specification is going to be a bit different from other types of criminal analysis.

One of the main differences in importing financial data is that links are going to have their own identities, usually the transaction number or DUNS number if dealing with electronic transactions. I am going to want to create a new directional link line for each transaction between two accounts in order to analyze the flow of commodities between the accounts.

Starting with financial data in an excel spreadsheet, I am going to begin setting up my import specification.

Data Review:

Visual analysis needs all the information it can gets its hand on in order to better represent the activity. In financial analysis this is key to produce unique identifiers between accounts, account holders and transactions. When obtaining or downloading data for import its extremely important to capture all elements available in the transaction flow.

The following is an example of a download of transactional data for several accounts. Note that this data is randomized but the fields are a fairly accurate representation of what is captured. While I am analyzing multiple accounts, I have merged the information from each account into one spreadsheet for import. This data is from accounts conducting electronic transactions so the data I have captured represent international clearinghouse data fields required for electronic transactions.

The fields include the account and routing number of both the originating and destination accounts for my account entities; transaction or DUNS numbers for the electronic transactions for my link identifiers; the bank name derived from the routing number; the account holder of the originating and destination account received from the financial institution including unique identifiers such as SSN for my account holders entities and the transaction amounts, dates and times.

The import specification for this data is going to be a bit different from other visualizations I have covered because instead of simply confirming relationships between entities I need to visualize actual activity between each entity.

Visualization Import:

I will start with the easiest entities to set up, the originating and destination account holders. We have captured fields in our financial data of account holders name and social security number which will create the unique identifiers for those entities.

Next we move on to the originating and destination accounts which are linked to the account holders. For these entities we have captured the routing and account numbers which will create the unique identifiers for each account entity.

Finally we have create the identifiers for the links. As opposed to some of the other analysis we have done, such as insurance fraud, we are going to create multiple links between accounts based on each unique transaction number. In essence we are creating an identity to the link line to ensure that each transaction is visually represented by a link and contains the corresponding information we want to display.

Under multiplicity of connections I have selected "multiple" and assigned the link label the transaction number field. I have also included the transaction data in the link label and assigned the transaction amount to the description on the link line so that I can follow the transactions by amount.

Now its time to see what my data looks like in the visualization. I execute the import into the visualization software and look at the initial representation.

The visualization has established clusters of interrelated accounts and transactions placing the largest on the left working it's way to the smaller on the right. The more interrelated accounts, the larger the cluster and the more unusual is the activity it represents. Normal financial accounts do not have multiple cross directional relationships to each other so the I am going to focus on the larger cluster.

Here we can see how multiple accounts are sending large amounts of money between them, eventually making their way back to host accounts; a scenario which is typical in money laundering activity or at least Filipino politicians.

From my visualization I am now able to easily track the flow of commodity between accounts based on transaction amount and date. I can see which accounts are acting as pivot accounts and which ones are actually holding money simplifying my investigation. One of the things we forget in analysis is we are able to prioritize which accounts and holders to look at based on a review of their activity.

This particular import focused on a money laundering investigation, but the visualization principals are similar for the majority of financial fraud investigations like embezzlement, internal fraud, tax evasion and the like.

Being able to detail the information in this article is challenging so anyone wishing to see the entire demonstration chart for financial analysis I would be glad to forward it to you, just drop an email to linkanalysis@gmail.com.

(All Data Used In This Example Is Randomly Generated With No Relation To Actual Individuals Or Companies)