Irregular links and relationships in a data set may relate to fraudulent actions or identify deception or risk assessment or knowledge generation but may be identified by simple superficially unlinked actions. Thus, for example a claimant may claim through an address using one telephone number but contact the insurer for that claim using a different telephone number. By pooling all the information received, including all telephone numbers, unusual or irregular or fraudulent leads can be identified by establishing telephone numbers or other gateway cluster nodes for each dataset such that supposedly unrelated claims can be matched and therefore be more closely scrutinized. The information processor arrangement may create a cascade of clusters for an as presented data set which can be configured through cluster nodes to allow better identification of suspect activity or for better analysis profiling.