FALSE POSITIVE REDUCTION IN ABNORMALITY DETECTION SYSTEM MODELS

• US 20200134629A1
• Filed: 12/23/2019
• Published: 04/30/2020
• Est. Priority Date: 05/29/2015
• Status: Active Grant

• Current Assignee: Fair Isaac Corporation
• Original Assignee: Fair Isaac Corporation
• Inventors: Zoldi, Scott M., Griegel, David
• Granted Patent: US 11,373,190 B2
• Time in Patent Office: Days
• CPC Class Codes: G06Q 10/04 Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem" market predictions or forecasting for commercial activities G06Q30/0202
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing

Abstract

The subject matter disclosed herein provides methods, apparatus, systems, techniques, and articles for false positive reduction in abnormality detection models. A date and time of a first transaction by a transaction entity and associated with a transaction characteristic can be stored. Data representing subsequent transactions associated with the transaction characteristic can be stored. A history marker profile specific to the transaction characteristic and transaction entity can be generated and can include the transaction characteristic, the date and time of the first transaction, and maximum and mean abnormality scores. A date and time of a current transaction can be determined. A current abnormality score for the current transaction can be received. A tenure of the observed transaction characteristic can be computed. The current abnormality score can be recalibrated from the transaction entity abnormality detection system according to the maximum, mean, and current abnormality scores and a length of the tenure.

Claims

1. A method comprising:

receiving, from a transaction entity abnormality detection system, at least one abnormality score representing a likelihood of abnormality for a first transaction and one or more subsequent transactions by a transaction entity associated with at least one merchant characteristic, the abnormality score being recursively updated based on the first transaction and the one or more subsequent transactions;

determining, by at least one data processor, a date and time of a current transaction received via a network from the transaction entity, the current transaction associated with the at least one transaction characteristic;

receiving, by the at least one data processor from the transaction entity abnormality detection system, a current abnormality score representing a likelihood of abnormality for the current transaction;

computing, by the at least one data processor, a tenure of the at least one transaction characteristic by subtracting the date and time of the first transaction by the transaction entity with the at least one transaction characteristic from the date and time of the current transaction by the transaction entity with the at least one transaction characteristic; and

recalibrating, by the at least one data processor, the current abnormality score from the transaction entity abnormality detection system according to the at least one abnormality score, the current abnormality score, and a length of the tenure.

2. The method of claim 1, wherein the at least one abnormality score is a maximum fraud score representing a likelihood of fraud for the first transaction and the one or more subsequent transactions.

3. The method of claim 1, wherein the at least one abnormality score is a mean fraud score representing a likelihood of fraud for the first transaction and the one or more subsequent transactions.

4. The method of claim 1, wherein at least one of the at least one abnormality score from the transaction entity abnormality detection system is recursively updated based on the first transaction and the one or more subsequent transactions.

5. The method of claim 1, wherein the at least one transaction characteristic comprises one or more of a monetary amount, a city, a country, a zip code, a merchant category code and a range of monetary amounts, a device identifier, and an IP address.

6. The method of claim 1, wherein the transaction entity is a transaction device from a group of transaction devices that consists of:

a consumer, a credit card, a debit card, a prepaid card, a mobile computing device, a desktop computing device, and an automated teller machine.

7. The method of claim 1, wherein the transaction entity is an autonomous device from a group of transaction devices that consists of:

a client computer, a server computer, a network device, a switch, a router, a repeater, a domain name, an IP address, and an autonomous system number.

8. A system comprising:

at least one processor; and

at least one memory, wherein the at least one processor and the at least one memory are configured to perform operations comprising;

receiving, from a transaction entity abnormality detection system, at least one abnormality score representing a likelihood of abnormality for a first transaction and one or more subsequent transactions by a transaction entity associated with at least one merchant characteristic, the abnormality score being recursively updated based on the first transaction and the one or more subsequent transactions;

determining, by at least one data processor, a date and time of a current transaction received via a network from the transaction entity, the current transaction associated with the at least one transaction characteristic;

receiving, by the at least one data processor from the transaction entity abnormality detection system, a current abnormality score representing a likelihood of abnormality for the current transaction;

computing, by the at least one data processor, a tenure of the at least one transaction characteristic by subtracting the date and time of the first transaction by the transaction entity with the at least one transaction characteristic from the date and time of the current transaction by the transaction entity with the at least one transaction characteristic; and

recalibrating, by the at least one data processor, the current abnormality score from the transaction entity abnormality detection system according to the at least one abnormality score, the current abnormality score, and a length of the tenure.

9. The system of claim 8, wherein the at least one abnormality score is a maximum fraud score representing a likelihood of fraud for the first transaction and the one or more subsequent transactions.

10. The system of claim 8, wherein the at least one abnormality score is a mean fraud score representing a likelihood of fraud for the first transaction and the one or more subsequent transactions.

11. The system of claim 8, wherein at least one of the at least one abnormality score from the transaction entity abnormality detection system is recursively updated based on the first transaction and the one or more subsequent transactions.

12. The system of claim 8, wherein the at least one transaction characteristic comprises one or more of a monetary amount, a city, a country, a zip code, a merchant category code and a range of monetary amounts, a device identifier, and an IP address.

13. The system of claim 8, wherein the transaction entity is a transaction device from a group of transaction devices that consists of:

a consumer, a credit card, a debit card, a prepaid card, a mobile computing device, a desktop computing device, and an automated teller machine.

14. The system of claim 8, wherein the transaction entity is an autonomous device from a group of transaction devices that consists of:

a client computer, a server computer, a network device, a switch, a router, a repeater, a domain name, an IP address, and an autonomous system number.

15. A non-transitory computer-readable medium containing instructions to configure a processor to perform operations comprising:

receiving, from a transaction entity abnormality detection system, at least one abnormality score representing a likelihood of abnormality for a first transaction and one or more subsequent transactions by a transaction entity associated with at least one merchant characteristic, the abnormality score being recursively updated based on the first transaction and the one or more subsequent transactions;

determining, by at least one data processor, a date and time of a current transaction received via a network from the transaction entity, the current transaction associated with the at least one transaction characteristic;

receiving, by the at least one data processor from the transaction entity abnormality detection system, a current abnormality score representing a likelihood of abnormality for the current transaction;

computing, by the at least one data processor, a tenure of the at least one transaction characteristic by subtracting the date and time of the first transaction by the transaction entity with the at least one transaction characteristic from the date and time of the current transaction by the transaction entity with the at least one transaction characteristic; and

recalibrating, by the at least one data processor, the current abnormality score from the transaction entity abnormality detection system according to the at least one abnormality score, the current abnormality score, and a length of the tenure.

16. The non-transitory computer-readable medium of claim 15, wherein the at least one abnormality score is a maximum fraud score representing a likelihood of fraud for the first transaction and the one or more subsequent transactions.

17. The non-transitory computer-readable medium of claim 15, wherein the at least one abnormality score is a mean fraud score representing a likelihood of fraud for the first transaction and the one or more subsequent transactions.

18. The non-transitory computer-readable medium of claim 15, wherein at least one of the at least one abnormality score from the transaction entity abnormality detection system is recursively updated based on the first transaction and the one or more subsequent transactions.

19. The non-transitory computer-readable medium of claim 15, wherein the at least one transaction characteristic comprises one or more of a monetary amount, a city, a country, a zip code, a merchant category code and a range of monetary amounts, a device identifier, and an IP address.

20. The non-transitory computer-readable medium of claim 15, wherein the transaction entity is a transaction device from a group of transaction devices that consists of:

a consumer, a credit card, a debit card, a prepaid card, a mobile computing device, a desktop computing device, and an automated teller machine.

21. The non-transitory computer-readable medium of claim 15, wherein the transaction entity is an autonomous device from a group of transaction devices that consists of:

a client computer, a server computer, a network device, a switch, a router, a repeater, a domain name, an IP address, and an autonomous system number.