1. Score calculation

Pingwire calculates an entity's score based on the baseline scores of groups it's associated with and relevant pings.

2. Groups and Score computation

The score for an entity is derived from the risk levels of related groups. The risk of each group, the groupScore, ranges from 0 to 100 and is set by the Client during group creation. This number should reflect the probability that an entity belonging to the group is involved in criminal activity.

3. Pings and ping scores

In addition to group associations, an Entity's score is influenced by its pingScores. A pingScore is calculated by applying the rule's riskDecreaseTimeLine function to the time difference (timedelta) between the ping's controlDate and the time of score computation. At time 0, the pingScore equals the ruleScore (the score configured for the rule).

4. Entity score calculation formula 

The groupScores and pingScores are jointly named risk indicators. The scores of an entity is calculated using the formula:

Where

• i indexes entity groups; si denotes the groupScore for group i.
• k indexes entity pings and pk denotes the pingScore for ping k.

This formula represents the probability that the entity is involved in illegal activity, given that it has triggered rules indexed k and belongs to groups indexed i. While a simplification, the computational formula has some nice properties:

1. Conservative: It is always greater than the maximum of the risk indicators.
2. Increasing with number of risk indicators: The score increases with the number of pings and groups. This reflects the intuition that the risk associated with an entity should be higher the more risk indicators it has; and at least as high as the highest risk indicator.
3. Ranges between 0 and 1: The risk can be 0 at minimum, representing a 0% chance of the entity being involved in criminal activity. Similarly, the score can never be higher than 1, representing a 100% certainty of the entity being involved in criminal activity.