Rule optimization for classification and detection

Patent metadata

Field	Value
Publication number	US-9231979-B2
Application number	US-201414210314-A
Country	US
Kind code	B2
Filing date	Mar 13, 2014
Priority date	Mar 14, 2013
Publication date	Jan 5, 2016
Grant date	Jan 5, 2016

Abstract

This disclosure describes methods, systems, and computer-program products for determining classification rules to use within a fraud detection system The classification rules are determined by accessing distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables. Each of the transactional events is represented by data with respect to each of the variables, and the distributional data is organized with respect to multi-dimensional subspaces of the sample space. A classification rule that references at least one of the subspaces is accessed, and the rule is modified using local optimization applied using the distributional data. A pending transaction is classified based on the modified classification rule and the transactional data.

First claim

What is claimed is:

1. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, the storage medium comprising stored instructions configured to cause a data processing apparatus to perform operations including:
accessing distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables, wherein a transactional event is represented by data corresponding to a variable, wherein the distributional data is organized with respect to multi-dimensional subspaces of the sample space, wherein:
a transactional event is associated with a subspace based on one or more representative observations;
the distributional data specifies a number of the transactional events associated with each of the subspaces;
the transactional events include multiple unauthorized transactions and multiple authorized transactions; and
the distributional data further specifies, with respect to each of the subspaces, a percentage of the transactional events that are unauthorized transactions;

analyzing multiple candidate subspaces among the multi-dimensional subspaces of the sample space, wherein analyzing each of the candidate subspaces includes identifying a best one of the candidate subspaces, wherein the percentage specified with respect to the best one of the candidate subspaces is higher than the percentages specified for each of the other candidate subspaces;
accessing a classification rule that references at least one of the subspaces including the best one of the candidate subspaces to define the classification rule;
dynamically modifying the classification rule using local optimization applied using the distributional data;
accessing transactional data representing a pending transaction on process; and
classifying the pending transaction based on the modified classification rule and the transactional data.

2. The computer-program product of claim 1 , wherein the instructions are further configured to cause the processing apparatus to use the local optimization, wherein the local optimization is based on the percentage specified with respect to each of the referenced subspaces and the number of the transactional events associated with each of the referenced subspaces.

3. The computer-program product of claim 1 , wherein the instructions are configured to cause the processing apparatus to modify the classification rule wherein, after being modified, the classification rule references an additional one of the subspaces, and wherein the local optimization includes:
analyzing the percentage specified with respect to each of the referenced subspaces and the number of the transactional events associated with each of the referenced subspaces; and
analyzing the percentage specified with respect to at least one of the subspaces not referenced by the classification rule.

4. The computer-program product of claim 3 , wherein the instructions are further configured to cause the processing apparatus to use the local optimization wherein the local optimization further includes:
selecting one of the subspaces not referenced by the classification rule, wherein the selected subspace is selected based on analyzed percentages and numbers of transactional events, and wherein modifying the classification rule results in the classification rule further referring to the selected subspace.

5. The computer-program product of claim 4 , wherein the instructions are further configured to cause the processing apparatus to select the subspace not referenced by the classification rule based on the number of transactional events associated with the subspace not referenced by the classification rule.

6. The computer-program product of claim 5 , wherein the instructions are further configured to cause the processing apparatus to:
identify the multiple candidate subspaces from amongst the subspaces not referenced by the classification rule, wherein identifying is based on a sample space location of each of the candidate subspaces relative to the selected subspace.

7. The computer-program product of claim 4 , wherein the instructions are further configured to cause the processing apparatus to select the one of the subspaces based on a proximity of the one of the subspaces to the at least one of the subspaces referenced by the classification rule.

8. The computer-program product of claim 4 , wherein the instructions are further configured to cause the processing apparatus to modify the classification rule by expanding a scope of the classification rule.

9. The computer-program product of claim 4 , wherein the instructions are further configured to cause the processing apparatus to:
determine a first weighted average, wherein the first weighted average is an average of the percentages specified with respect to each of the subspaces referenced by the classification rule, wherein the percentages are adjusted based on the number of transactional events associated with each of the subspaces referenced by the classification rule;
evaluate a possible classification rule modification that would involve broadening the classification rule so that, in addition to the subspaces referenced by the classification rule, the classification rule would further reference the subspace not referenced by the classification rule; and
determine a second weighted average, wherein the second weighted average is an average of the percentages specified with respect to each of the subspaces which would be referenced subsequent to effectuating the possible classification rule modification, wherein the percentages are adjusted based on the number of transactional events associated with each of the subspaces which would be referenced subsequent to effectuating the possible classification rule modification.

10. The computer-program product of claim 1 , wherein subspaces represent a distribution of events in a historical sample, the events including at least one of an authorized or unauthorized event.

11. A computer-implemented method, comprising:
accessing distributional data on a computing device, the distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables, wherein a transactional event is represented by data corresponding to a variable, wherein the distributional data is organized with respect to multi-dimensional subspaces of the sample space, wherein:
a transactional event is associated with a subspace based on one or more representative observations;
the distributional data specifies a number of the transactional events associated with each of the subspaces;
the transactional events include multiple unauthorized transactions and multiple authorized transactions; and
the distributional data further specifies, with respect to each of the subspaces, a percentage of the transactional events that are unauthorized transactions;

analyzing multiple candidate subspaces among the multi-dimensional subspaces of the sample space, wherein analyzing each of the candidate subspaces includes identifying a best one of the candidate subspaces, wherein the percentage specified with respect to the best one of the candidate subspaces is higher than of the percentages specified for each of the other candidate subspaces;
accessing a classification rule that references at least one of the subspaces including the best one of the candidate subspaces to define the classification rule;
dynamically modifying the classification rule using local optimization applied on a computing device, using the distributiona

Assignees

• Sas Inst Inc

Inventors

• Duke Brian Lee
• Desai Vijay S
• Dulany Paul C
• Shah Kannan Shashank

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title