e- Discovery through Text Mining

Size: px

Start display at page:

Download "e- Discovery through Text Mining"

Silas Stokes
7 years ago
Views:

1 e- Discovery through Text Mining Fraud Detec+on example Sergei Ananyan, Ph.D. Megaputer Intelligence Inc.

3 What is e- Discovery? Electronic Discovery is the process when electronic data is sought, located, secured, and searched with the intent of using it as evidence in a legal case

4 Electronic evidence Documents are increasingly produced and stored electronically Corporate li+ga+ons involve the produc+on and analysis of electronic evidence Li+ga+ons might involve different par+es: Company vs. Company Government vs. Company Person vs. Company

5 Who uses e- Discovery systems? Document Analyst Opposing Legal Team Li+ga+on Support Manager E- Discovery System AIorney Court

6 Text Mining Analytics & Reporting

7 Old approach to text analysis Data analysts perform searches based on: Key words and phrases with proximity Date ranges Known relevant documents seeking similar documents

8 Typical example US federal agency is inves+ga+ng a mortgage fraud case against a major bank Subpoenas all documents matching words: Apprais* w/25: correct*, target, increas*, chang*, second, Pric* w/25: change*, increas*, rais*, Receives over 3,000,000 matching documents This agency division has 4 data analysts and 3 aiorneys to work on the case

9 Time for document analysis 3 million docs 3 min per document 20 docs per hour Text Mining 2 month one analyst Manual Analysis 40K docs per year DONE! 75 years to check 3M docs Text Mining delivers results 450 times faster!

10 Encountered challenges Overwhelming # of documents Primarily irrelevant documents Repe++ve documents Numerous typos Missing informa+on about communica+ng par+es

11 Where Text Mining can help? Data normaliza+on Parsing and aggrega+ng data from disparate formats Cleansing data Feature extrac+on Data analysis Deep linguis+c parsing (context based) Searching for paierns

12 Use text/data mining techniques Language detec+on Spell- checking / correc+on Deep linguis+c parsing Part of speech detec+on context based Chunker: detect noun phrases, verb phrases, etc. Seman+c dic+onaries Auto- categoriza+on (PaIern Detec+on Language) En+ty Extrac+on Clustering Latent Seman+c Analysis De- duplica+on Inverse frequency analysis Social Network Analysis

13 Possible Analysis Scenarios Let us consider different scenarios: 1. We can formulate paierns we are searching for 2. We have a collec+on of documents with relevant evidence 3. We have a list of relevant custodians 4. We know only the +me interval when the problem occurred 5. We don t know anything except the keywords documents should contain

14 If we know relevant paierns Write paierns in a special language - capture Proximity (terms, sentences and paragraphs) Part of speech informa+on Seman+c similari+es Nega+ons Density of terms

15 If we know relevant documents Need to search for similar documents Use Latent Seman+c Analysis or similar techniques Iden+fy custodians associated with relevant documents Find addi+onal features of poten+al interest associated with these custodians

16 Know only custodians & +me range Search for unique features of their communica+ons with others Train the system on all available data Reveal anomalous terms & phrases Example: fruit language Lemon kickback: For this property we received from XYZ a lemon worth over 3M. They gave us significant lemons on both these transacgons.

17 Know only the problem +me range Look for spikes in communica+ons for all people Sudden changes in topics discussed Spikes in unusual lexicon terms

18 Know only theme & keywords Clustering of topics Analysis of pairwise communica+ons Unusual clusters & lexicon Group pairs of people with similar lexicon Gather ideas for further inves+ga+on

19 Data prepara+on Remove definitely irrelevant documents Junk mail Mass broadcasts Magazine ar+cles (post- factum documents) Split chains into individual messages Eliminate full and near duplicates Reconstruct addresses Find and adap+vely correct misspells

20 Reconstruct & extract features Extract fields of interest: Date To, From, CC and BCC Subject Names of people, companies and organiza+ons Addresses Telephone numbers Custom en++es: SSN, drug names with dosage, frequency, applica+on mode, etc.

21 Networks of related custodians Reveal & graphically present networks of people exchanging relevant documents Social Network Analysis performed on communica+ons

22 Present selected documents Obtain a small collec+on of highly relevant documents Summarize key findings in easy to comprehend interac+ve web reports Provide drill- down to original documents Have important paierns in text highlighted in the drill- down documents Export collec+ons of marked- up relevant documents

23 Case Descrip+on Data: 3,000,000 documents from a mortgage company, primarily notes ObjecDves: Detect signatures of poten+al fraud and abuse Iden+fy and visualize involved individuals

24 E- Discovery Methodology Step 1. Prepare and normalize data Step 2. Cleanse data Step 3. Extract en++es of interest: $ amounts, loan #s, postal addresses, etc. Step 4. PaIern Analysis: search for text paierns represen+ng fraud and abuse Step 5. Who is involved? Visualize networks of communica+ons of iden+fied suspects

25 Data analysis scenario

26 Step 1. Data Prepara+on and Normaliza+on

27 Data Prepara+on Objec+ves Remove non- documents Reconstruct addresses Convert chains of responses found in one leier into collec+ons of individual leiers Parse documents into structured fields: From, To, CC, BCC Subject Date body

28 Parsing Original Documents 1 Todd.Baur@homesite.com Dorothy.Shaw@homesite.com Lisa.KiPredge@homesite.com 2 Dorothy.Shaw@homesite.com Lisa.KiPredge@homesite.com Todd.Baur@homesite.com 3+

29 Reconstruc+ng and Parsing

30 3M Chains Parsed into 5.6M s

31 Step 2. Data Cleansing

32 Data Cleansing Objec+ves Iden+fy and correct misspells Iden+fy duplicates and near duplicates Remove magazine ar+cles and discussions of Jumbo loans

33 Auto- SpellChecker misspelled words Automa+cally iden+fied & corrected over 600,000 misspells

34 Detect Duplicates and Near- duplicates Automa+cally eliminated over 1,000,000 duplicates

35 Remove Magazine Ar+cles

36 Step 3. Extract En++es: Mul+ple Valua+on Homes?

37 En+ty Extrac+on Objec+ves Extract standard and custom en++es of poten+al interest Names of People and Companies Postal Addresses and Phones Currency amounts and Loan numbers, etc. Find documents discussing different values of the same home Remove discussions of revenue and salaries

38 Extract Names of People & Companies Automa+cally extract standard en++es

39 Extract $ Amounts and Loan #s Extract standard and custom en++es

40 Extract Notes w/mul+ple Home Prices

41 Remove Discussions of Revenue & Salary

42 Different Valua+ons for the Same Home

43 Step 4. Discover Signatures of Fraud and Abuse

44 Taxonomy: Distribu+on of Topics

45 Taxonomy- based Categoriza+on

46 Taxonomy Results: Value Opinions

47 Step 5. Who is involved? Social Network Analysis

48 People Discussing Mul+ple Values of Homes

49 Benefits of Text Mining Drama+c savings in +me and resources Smaller teams of inves+gators can complete large projects Elimina+on of tedious manual work BeIer precision: focus only on relevant documents Increased recall: find unexpected paierns of terms Convincing and consistent presenta+on of results Stronger case / defense posi+on Preventa+ve measures become possible

51 Ques+ons? Call (812) or W Bloomfield Rd, Suite E Bloomington, IN USA

UNIFIED, END- TO- END EDISCOVERY

ac.onable informa.on governance Partners Providing Excellence in: UNIFIED, END- TO- END EDISCOVERY 2011 IBM Corpora.on Meet the Presenters Amir Jaibaji Vice President, Product Management StoredIQ Kevin