Certain aspects of the present disclosure provide techniques for training decision trees representing users of a software application. An example method generally includes generating, from a transaction history data set for a plurality of users of a software application, a plurality of grouped data sets including transactions grouped by counterparty. A plurality of feature vectors are generated from the plurality of grouped data sets. Each feature vector generally corresponds to a user of the plurality of users and includes a plurality of features describing relationships between the user and a plurality of counterparties in a transaction history associated with the user. A decision tree is trained based on the plurality of feature vectors. The decision tree generally includes a plurality of paths terminating in a similar or different classification, and the plurality of paths distinguishes a user associated with the decision tree from other users of the software application.