Rule optimization for classification and detection

• US 9,231,979 B2
• Filed: 03/13/2014
• Issued: 01/05/2016
• Est. Priority Date: 03/14/2013
• Status: Active Grant

• Current Assignee: SAS Institute Incorporated
• Original Assignee: SAS Institute Incorporated
• Inventors: Duke, Brian Lee, Desai, Vijay S., Dulany, Paul C., Shah, Kannan Shashank
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US14/210,314
• Publication Number:
  US 20140282856A1
• Time in Patent Office: 663 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

This disclosure describes methods, systems, and computer-program products for determining classification rules to use within a fraud detection system The classification rules are determined by accessing distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables. Each of the transactional events is represented by data with respect to each of the variables, and the distributional data is organized with respect to multi-dimensional subspaces of the sample space. A classification rule that references at least one of the subspaces is accessed, and the rule is modified using local optimization applied using the distributional data. A pending transaction is classified based on the modified classification rule and the transactional data.

Claims

1. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, the storage medium comprising stored instructions configured to cause a data processing apparatus to perform operations including:

accessing distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables, wherein a transactional event is represented by data corresponding to a variable, wherein the distributional data is organized with respect to multi-dimensional subspaces of the sample space, wherein;

a transactional event is associated with a subspace based on one or more representative observations;

the distributional data specifies a number of the transactional events associated with each of the subspaces;

the transactional events include multiple unauthorized transactions and multiple authorized transactions; and

the distributional data further specifies, with respect to each of the subspaces, a percentage of the transactional events that are unauthorized transactions;

analyzing multiple candidate subspaces among the multi-dimensional subspaces of the sample space, wherein analyzing each of the candidate subspaces includes identifying a best one of the candidate subspaces, wherein the percentage specified with respect to the best one of the candidate subspaces is higher than the percentages specified for each of the other candidate subspaces;

accessing a classification rule that references at least one of the subspaces including the best one of the candidate subspaces to define the classification rule;

dynamically modifying the classification rule using local optimization applied using the distributional data;

accessing transactional data representing a pending transaction on process; and

classifying the pending transaction based on the modified classification rule and the transactional data.

2. The computer-program product of claim 1, wherein the instructions are further configured to cause the processing apparatus to use the local optimization, wherein the local optimization is based on the percentage specified with respect to each of the referenced subspaces and the number of the transactional events associated with each of the referenced subspaces.

3. The computer-program product of claim 1, wherein the instructions are configured to cause the processing apparatus to modify the classification rule wherein, after being modified, the classification rule references an additional one of the subspaces, and wherein the local optimization includes:

analyzing the percentage specified with respect to each of the referenced subspaces and the number of the transactional events associated with each of the referenced subspaces; and

analyzing the percentage specified with respect to at least one of the subspaces not referenced by the classification rule.

4. The computer-program product of claim 3, wherein the instructions are further configured to cause the processing apparatus to use the local optimization wherein the local optimization further includes:

selecting one of the subspaces not referenced by the classification rule, wherein the selected subspace is selected based on analyzed percentages and numbers of transactional events, and wherein modifying the classification rule results in the classification rule further referring to the selected subspace.

5. The computer-program product of claim 4, wherein the instructions are further configured to cause the processing apparatus to select the subspace not referenced by the classification rule based on the number of transactional events associated with the subspace not referenced by the classification rule.

6. The computer-program product of claim 5, wherein the instructions are further configured to cause the processing apparatus to:

identify the multiple candidate subspaces from amongst the subspaces not referenced by the classification rule, wherein identifying is based on a sample space location of each of the candidate subspaces relative to the selected subspace.

7. The computer-program product of claim 4, wherein the instructions are further configured to cause the processing apparatus to select the one of the subspaces based on a proximity of the one of the subspaces to the at least one of the subspaces referenced by the classification rule.

8. The computer-program product of claim 4, wherein the instructions are further configured to cause the processing apparatus to modify the classification rule by expanding a scope of the classification rule.

9. The computer-program product of claim 4, wherein the instructions are further configured to cause the processing apparatus to:

determine a first weighted average, wherein the first weighted average is an average of the percentages specified with respect to each of the subspaces referenced by the classification rule, wherein the percentages are adjusted based on the number of transactional events associated with each of the subspaces referenced by the classification rule;

evaluate a possible classification rule modification that would involve broadening the classification rule so that, in addition to the subspaces referenced by the classification rule, the classification rule would further reference the subspace not referenced by the classification rule; and

determine a second weighted average, wherein the second weighted average is an average of the percentages specified with respect to each of the subspaces which would be referenced subsequent to effectuating the possible classification rule modification, wherein the percentages are adjusted based on the number of transactional events associated with each of the subspaces which would be referenced subsequent to effectuating the possible classification rule modification.

10. The computer-program product of claim 1, wherein subspaces represent a distribution of events in a historical sample, the events including at least one of an authorized or unauthorized event.

28. The system of claim 4, wherein the processor is configured to modify the classification rule, wherein modifying the rule expands a scope of the classification rule.

11. A computer-implemented method, comprising:

accessing distributional data on a computing device, the distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables, wherein a transactional event is represented by data corresponding to a variable, wherein the distributional data is organized with respect to multi-dimensional subspaces of the sample space, wherein;

a transactional event is associated with a subspace based on one or more representative observations;

the distributional data specifies a number of the transactional events associated with each of the subspaces;

the transactional events include multiple unauthorized transactions and multiple authorized transactions; and

the distributional data further specifies, with respect to each of the subspaces, a percentage of the transactional events that are unauthorized transactions;

analyzing multiple candidate subspaces among the multi-dimensional subspaces of the sample space, wherein analyzing each of the candidate subspaces includes identifying a best one of the candidate subspaces, wherein the percentage specified with respect to the best one of the candidate subspaces is higher than of the percentages specified for each of the other candidate subspaces;

accessing a classification rule that references at least one of the subspaces including the best one of the candidate subspaces to define the classification rule;

dynamically modifying the classification rule using local optimization applied on a computing device, using the distributional data;

accessing transactional data representing a pending transaction on process; and

classifying the pending transaction based on the modified classification rule and the transactional data.

12. The method of claim 11, wherein the local optimization is based on the percentage specified with respect to each of the referenced subspaces and the number of the transactional events associated with each of the referenced subspaces.

13. The method of claim 11, wherein modifying the classification rule is wherein, after being modified, the classification rule references an additional one of the subspaces, and wherein the local optimization includes:

analyzing the percentage specified with respect to each of the referenced subspaces and the number of the transactional events associated with each of the referenced subspaces; and

analyzing the percentage specified with respect to one of the subspaces not referenced by the classification rule.

14. The method of claim 13, wherein the local optimization further includes:

selecting one of the subspaces not referenced by the classification rule, wherein the selected subspace is selected based on the analyzed percentages and numbers of transactional events, and wherein modifying the classification rule results in the classification rule further referring to the selected subspace.

15. The method of claim 14, wherein the selected subspace is further selected based on the number of transactional events associated with the selected subspace.

16. The method of claim 15, wherein the local optimization further includes:

identifying the multiple candidate subspaces from amongst the subspaces not referenced by the classification rule, wherein identifying is based on a sample space location of each of the candidate subspaces relative to the selected subspace.

17. The method of claim 14, wherein the candidate subspaces are selected based on a proximity of the candidate subspaces to the subspaces referenced by the classification rule.

18. The method of claim 14, wherein modifying the classification rule includes expanding a scope of the classification rule.

19. The method of claim 14, wherein the local optimization further includes:

determining a first weighted average, wherein the first weighted average is an average of the percentages specified with respect to each of the subspaces referenced by the classification rule, wherein the percentages are adjusted based on the number of transactional events associated with each of the subspaces referenced by the classification rule;

evaluating a possible classification rule modification that would involve broadening the classification rule so that, in addition to the subspaces referenced by the classification rule, the classification rule would further reference the subspace not referenced by the classification rule; and

determining a second weighted average, wherein the second weighted average is an average of the percentages specified with respect to each of the subspaces which would be referenced subsequent to effectuating the possible classification rule modification, wherein the percentages are adjusted based on the number of transactional events associated with each of the subspaces which would be referenced subsequent to effectuating the possible classification rule modification.

20. The method of claim 11, wherein subspaces represent a distribution of events in a historical sample, the events including at least one of an authorized or unauthorized event.

21. A system comprising:

a computer processor configured to perform operations including;

accessing distributional data representing a distribution of historical transactional events over a multivariate observational sample space defined with respect to multiple transactional variables, wherein a transactional event is represented by data corresponding to a variable, wherein the distributional data is organized with respect to multi-dimensional subspaces of the sample space, wherein;

a transactional event is associated with a subspace based on one or more representative observations;

the distributional data specifies a number of the transactional events associated with each of the subspaces;

the transactional events include multiple unauthorized transactions and multiple authorized transactions; and

the distributional data further specifies, with respect to each of the subspaces, a percentage of the transactional events that are unauthorized transactions;

analyzing multiple candidate subspaces among the multi-dimensional subspaces of the sample space, wherein analyzing each of the candidate subspaces includes identifying a best one of the candidate subspaces, wherein the percentage specified with respect to the best one of the candidate subspaces is higher than the percentages specified for each of the other candidate subspaces;

accessing a classification rule that references at least one of the subspaces including the best one of the candidate subspaces to define the classification rule;

dynamically modifying the classification rule using local optimization applied using the distributional data;

accessing transactional data representing a pending transaction on process; and

classifying the pending transaction based on the modified classification rule and the transactional data.

22. The system of claim 21, wherein the processor is configured to perform the local optimization based on the percentage specified with respect to each of the referenced subspaces and the number of the transactional events associated with each of the referenced subspaces.

23. The system of claim 21, wherein the processor is configured to modify the classification rule wherein, after being modified, the classification rule references an additional one of the subspaces, and wherein the processor is configured to perform the local optimization by:

analyzing the percentage specified with respect to each of the referenced subspaces and the number of the transactional events associated with each of the referenced subspaces; and

analyzing the percentage specified with respect to one of the subspaces not referenced by the classification rule.

24. The system of claim 23, wherein the processor is configured to perform the local optimization by further:

selecting one of the subspaces not referenced by the classification rule, wherein the selected subspace is selected based on the analyzed percentages and numbers of transactional events, and wherein modifying the classification rule results in the classification rule further referring to the selected subspace.

25. The computer-program product of claim 24, wherein further, the processor is configured to perform the local optimization wherein the selected subspace is further selected based on the number of transactional events associated with it.

26. The system of claim 25, wherein the processor is further configured to:

identify the multiple candidate subspaces from amongst the subspaces not referenced by the classification rule, wherein identifying is based on a sample space location of each of the candidate subspaces relative to the selected subspace.

27. The system of claim 24, wherein the processor is configured to select the multiple candidate subspaces based on a proximity of the candidate subspaces to the subspaces referenced by the classification rule.

29. The system of claim 24, wherein the processor is further configured to perform the local optimization so as to include:

determining a first weighted average, wherein the first weighted average is an average of the percentages specified with respect to each of the subspaces referenced by the classification rule, wherein the percentages are adjusted based on the number of transactional events associated with each of the subspaces referenced by the classification rule;

evaluating a possible classification rule modification that would involve broadening the classification rule so that, in addition to the subspaces referenced by the classification rule, the classification rule would further reference the subspace not referenced by the classification rule; and

determining a second weighted average, wherein the second weighted average is an average of the percentages specified with respect to each of the subspaces which would be referenced subsequent to effectuating the possible classification rule modification, wherein the percentages are adjusted based on the number of transactional events associated with each of the subspaces which would be referenced subsequent to effectuating the possible classification rule modification.

30. The system of claim 21, wherein subspaces represent a distribution of events in a historical sample, the events including at least one of an authorized or unauthorized event.