Hierarchical profiling inputs and self-adaptive fraud detection system

Patent metadata

Field	Value
Publication number	US-10552837-B2
Application number	US-201715711150-A
Country	US
Kind code	B2
Filing date	Sep 21, 2017
Priority date	Sep 21, 2017
Publication date	Feb 4, 2020
Grant date	Feb 4, 2020

Abstract

Embodiments disclosed herein are related determining a risk score for one or more data transactions. Current data transactions that are associated with one or more current attributes are received. Stored data transactions associated with stored attributes are accessed. A plurality of the stored attributes are selected. A first sliding window and a second sliding window are selected. A duration of the second sliding window is longer than a duration of the first sliding window and encompasses the duration of first sliding window. Risk information for those stored data transactions that are associated with the plurality of attributes is determined. The risk information is determined during the duration of both the first and second sliding windows and is indicative of a level fraud that is occurring. The determined risk information and the current attributes are used to generate a risk score for the current data transactions. The current data transactions are approved or rejected based on the risk score.

First claim

What is claimed is:

1. A computing system configured to determine a risk score associated with one or more data transactions, the computing system comprising:
at least one processor;
a computer readable hardware storage device having stored thereon computer-executable instructions which, when executed by the at least one processor, configure the at least one processor to:
receive one or more current data transactions, each current data transaction associated with one or more current attributes that provide information associated with the current data transaction;
access one or more stored data transactions, each stored data transaction associated with one or more stored attributes that provide information associated with the stored data transaction;
select a plurality of the one or more stored attributes;
select a first sliding window and a second sliding window, wherein a duration of the second sliding window is longer than a duration of the first sliding window and encompasses the duration of the first sliding window;
determine risk information for each stored data transaction that is associated with one or more of the plurality of selected stored attributes, the risk information determined during the duration of both the first and second sliding windows and indicative of a level of fraud that is occurring;
based at least on the determined risk information and the current attributes, generate a risk score for each current data transaction that is associated with one or more of the plurality of selected stored attributes; and
based at least on the determined risk score for the data transaction, approve or reject the data transaction.

2. The computing system of claim 1 , wherein the duration of the first sliding window is four weeks.

3. The computing system of claim 1 , wherein the duration of the second sliding window is eight weeks.

4. The computing system of claim 1 , wherein the risk information includes one of an overall fraud rate, an overall dollar fraud rate, a fraud rate or a dollar fraud rate for each data transaction that is associated with one or more of the selected attributes.

5. The computing system of claim 1 , wherein the risk information includes a Weight of Evidence (WoE) for each data transaction that is associated with one or more of the selected attributes.

6. The computing system of claim 1 , wherein determining the risk information comprises:
generating one or more profiles for the one or more of the plurality of selected stored attributes, each of the one or more profiles including at least some of the determined risk information.

7. The computing system of claim 6 , wherein a profile is generated for the risk information determined during the duration of the short term sliding window and for risk information determined during the duration of the long term sliding window.

8. The computing system of claim 1 , wherein generating a risk score for each current data transaction that is associated with one or more of the plurality of selected stored attributes s comprises:
using the risk information as an input into a risk determination model;
training the risk determination model based on the input risk information to update the risk determination model; and
based on the training, causing the updated risk determination model to determine an updated risk score.

9. A method for determining a risk score for one or more data transactions, the method comprising:
receive one or more current data transactions, each current data transaction associated with one or more current attributes that provide information associated with the current data transaction;
access one or more stored data transactions, each stored data transaction associated with one or more stored attributes that provide information associated with the stored data transaction;
select a plurality of the one or more stored attributes;
select a first sliding window and a second sliding window, wherein a duration of the second sliding window is longer than a duration of the first sliding window and encompasses the duration of the first sliding window;
determine risk information for each stored data transaction that is associated with one or more of the plurality of selected stored attributes, the risk information determined during the duration of both the first and second sliding windows and indicative of a level of fraud that is occurring;
based at least on the determined risk information and the current attributes, generate a risk score for each current data transaction that is associated with one or more of the plurality of selected stored attributes; and
based at least on the determined risk score for the data transaction, approve or reject the data transaction.

10. The method of claim 9 , wherein the duration of the first sliding window is four weeks.

11. The method of claim 9 , wherein the duration of the second sliding window is eight weeks.

12. The method of claim 9 , wherein the risk information includes one of an overall fraud rate or an overall dollar fraud rate.

13. The method of claim 9 , wherein the risk information includes one of a fraud rate or a dollar fraud rate for each stored data transaction that is associated with one or more of the selected stored attributes.

14. The method of claim 9 , wherein the risk information includes a Weight of Evidence (WoE) for each data transaction that is associated with one or more of the selected attributes.

15. The method of claim 9 ,
wherein generating a risk score for each current data transaction that is associated with one or more of the plurality of selected attributes comprises:
using the risk information as an input into a risk determination model;
training the risk determination model based on the input risk information to update the risk determination model; and
based on the training, causing the updated risk determination model to determine an updated risk score.

16. The method of claim 9 , wherein determining the risk information comprises:
generating one or more profiles for the one or more of the plurality of selected stored attributes, each of the one or more profiles including at least some of the determined risk information.

17. The method of claim 16 , wherein a profile is generated for the risk information determined during both the duration of the first sliding window and for risk information determined during the duration of the second sliding window.

18. A computing system for determining a risk score for a plurality of data transactions, the computing system comprising:
at least one processor;
a computer readable hardware storage device having stored thereon computer-executable instructions which, when executed by the at least one processor, cause the processor to instantiate in the hardware storage device the following:
a first module that is configured to:
receive one or more current data transactions, each current data transaction associated with one or more current attributes that provide information associated with the current data transaction;
access a plurality of stored attributes that are associated with one or more stored data transactions, the plurality of stored attributes providing information associated with each stored data transaction of the one or more stored data transactions;
select a first sliding window and a second sliding window, wherein a duration of the second sliding window is longer than a duration of the first sliding window and encompasses the duration of the first sliding window; and
determine risk information for each stored data transacti

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Jia Yuting
• Mao Huiying
• Wang Shoou-Jiun
• Marcjan Cezary
• Nanduri Jayaram N M

Classifications

• G06Q40/02 Primary

  Banking, e.g. interest calculation or account maintenance (credit or loans G06Q40/03) · CPC title

• G06F16/337

  Profile generation, learning or modification · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06N20/20

  Ensemble learning · CPC title

• G06N20/00

  Machine learning · CPC title