Correlation of complex evidences

The classical statistical correlation is an efficient technique for linking simple numerical data sets via a single correlation coefficient R. Correlation of complex evidences that involves structured objects, text and data in a variety of discrete and continuous scales (nominal, order, absolute and so on) requires development of a new technique. Complexity of this task dictates the need to combine the statistical techniques with other mathematical techniques. This paper outlines design of such a new technique called Hybrid Evidence Correlation (HEC). Often any individual evidence does not reveal a suspicious pattern and does not guide investigation in forensic accounting and other forensic fields. In contrast correlation of two or more evidences with each other and background knowledge can reveal a suspicious pattern. A new area of Link Discovery (LD) emerged recently is a promising new area for such tasks. Potential applications of link discovery range from basic science to a variety of practical forensic tasks. Currently LD mostly relies on deterministic graphical techniques. Bayesian probabilistic and causal networks are another relevant techniques. Both techniques need further development to handle rare events. This paper combines firstorder logic (FOL) and probabilistic semantic inference (PSI) for designing HEC. The approach is illustrated with an example of discovery of suspicious patterns. Computational efficiency and completeness of the algorithm is justified by a computational experiment and a theorem. Main concepts of the approach are: (1) a set of evidences D described by a set of attributes {A} and predicates {P} with two or more arguments; (2) a domain ontology in the form of a hieratical taxonomy of terms starting from {A} and {P} as terminal nodes; (3) formalized definitions of normal patterns, {N} and suspicious patterns, {S} in terms of FOL and PSI; (4) classification of patterns (statistically significant vs. insignificant ones to capture important rare events), (5) a generator of potential suspicious patterns (hypotheses generator), G, (6) an evaluator of hypotheses/patterns E and (7) a selector of suspicious patterns L. The approach was successfully tested for detecting transactions fraud on synthesized data. Data contained 6 attributes of a transaction: seller, buyer, seller, buyer types, sold item, and amount, price and date. The data type is char (alphanumeric codes) for a seller, buyer, type of seller, type of buyer, and sold item.