Systems and Methods for Self-Similarity Measure

• US 20150161611A1
• Filed: 12/01/2014
• Published: 06/11/2015
• Est. Priority Date: 12/10/2013
• Status: Abandoned Application

• Current Assignee: SAS Institute Incorporated
• Original Assignee: SAS Institute Incorporated
• Inventors: Duke, Brian, Muezzinoglu, Mehmet Kerem, Gupta, Ankur, Diev, Vesselin
• Application Number:
  US14/557,009
• Publication Number:
  US 20150161611A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing

Abstract

A computerized system that processes a fraud score for a financial transaction in connection with an account is computed from retrieved data to indicate a probability of the account being in a compromised condition. A self-similarity score is computed if the computed fraud score is above a predetermined threshold to indicate similarity of the received transaction to other transactions of the account in the set of prior transactions. A suggested action to authorize or decline the transaction is determined based on the computed fraud score and the computed self-similarity score.

Claims

1. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to be executed to cause a data processing apparatus to perform a method comprising:

retrieving data from data storage of the system in connection with a transaction received at the system relating to an account, wherein the data storage includes data relating to a plurality of accounts, each of which is associated with an account owner, and wherein the collection of accounts comprises an account population;

computing a fraud score in connection with the account to which the received transaction relates, wherein the computed fraud score indicates a probability of the account being in a compromised condition;

computing a self-similarity score in response to a computed fraud score that is above a predetermined threshold, the self-similarity score comprising a similarity measure of the received transaction relative to a set of prior transactions in the data storage relating to the account, wherein the computed self-similarity score indicates similarity of the received transaction to other transactions of the account in the set of prior transactions; and

determining the suggested action based on the computed fraud score and the computed self-similarity score.

2. The computer-program product of claim 1, wherein determining the suggested action comprises:

determining whether the computed fraud score comprises a high risk score or a low risk score relative to a predetermined threshold risk score value;

determining whether the computed self-similarity score comprises a high similarity score or a low similarity score relative to a predetermined threshold self-similarity score value; and

responsive to determining the fraud score as a high risk score or a low risk score and determining the self-similarity score as a high similarity score or a low similarity score, determining the suggested action.

3. The computer-program product of claim 1, wherein the determined suggested action comprises contacting a holder of the account without declining the received transaction in response to a computer fraud score that is above a predetermined fraud threshold and a self-similarity score that is above a predetermined similarity threshold.

4. The computer-program product of claim 1, wherein the determined suggested action comprises declining the transaction, in response to a computer fraud score that is above a predetermined fraud threshold and a self-similarity score that is below a predetermined similarity threshold.

5. The computer-program product of claim 1, wherein the determined suggested action comprises approving the received transaction, in response to a computer fraud score that is below a predetermined fraud threshold and a self-similarity score that is above a predetermined similarity threshold.

6. The computer-program product of claim 1, wherein the determined suggested action comprises approving the received transaction and monitoring the account for further activity, in response to a computer fraud score that is below a predetermined fraud threshold and a self-similarity score that is below a predetermined similarity threshold.

7. The computer-program product of claim 1, wherein computing the self-similarity score comprises utilizing an Alternating Decision Tree.

8. The computer-program product of claim 1, wherein a confidence margin is associated with the computed similarity score.

9. The computer-program product of claim 1, wherein the computed self-similarity score comprises a probability that the received transaction is a transaction likely to be initiated by the account holder, regardless of the computed fraud score.

10. The computer-program product of claim 1, wherein processing time for computing the self-similarity score is not greater than processing time for computing the fraud score.

11. The computer-program product of claim 1, wherein the computed self-similarity score comprises a measure of proximity of the received transaction relative to a set of prior transactions over a shared data space.

12. The computer-program product of claim 1, wherein the set of prior transactions in the data storage are included in the retrieved data.

13. The computer-program product of claim 1, further comprising instructions for providing the suggested action to a financial transaction processing system.

14. A risk assessment computer system, the risk assessment computer system comprising:

a processor; and

a non-transitory computer-readable storage medium that includes instructions that are configured to be executed by the processor such that, when executed, the instructions cause the risk assessment computer system to perform operations including;

retrieving data from data storage of the system in connection with a transaction received at the system relating to an account, wherein the data storage includes data relating to a plurality of accounts, each of which is associated with an account owner, and wherein the collection of accounts comprises an account population;

computing a fraud score in connection with the account to which the received transaction relates, wherein the computed fraud score indicates a probability of the account being in a compromised condition;

computing a self-similarity score in response to a computed fraud score that is above a predetermined threshold, the self-similarity score comprising a similarity measure of the received transaction relative to a set of prior transactions in the data storage relating to the account, wherein the computed self-similarity score indicates similarity of the received transaction to other transactions of the account in the set of prior transactions; and

determining the suggested action based on the computed fraud score and the computed self-similarity score.

15. The risk assessment computer system of claim 14, wherein the performed operation of determining comprises:

determining whether the computed fraud score comprises a high risk score or a low risk score relative to a predetermined threshold risk score value;

determining whether the computed self-similarity score comprises a high similarity score or a low similarity score relative to a predetermined threshold self-similarity score value; and

responsive to determining the fraud score as a high risk score or a low risk score and determining the self-similarity score as a high similarity score or a low similarity score, determining the suggested action.

16. The risk assessment computer system of claim 14, wherein the determined suggested action comprises contacting a holder of the account without declining the received transaction in response to a computer fraud score that is above a predetermined fraud threshold and a self-similarity score that is above a predetermined similarity threshold.

17. The risk assessment computer system of claim 14, wherein the determined suggested action comprises declining the transaction, in response to a computer fraud score that is above a predetermined fraud threshold and a self-similarity score that is below a predetermined similarity threshold.

18. The risk assessment computer system of claim 14, wherein the determined suggested action comprises approving the received transaction, in response to a computer fraud score that is below a predetermined fraud threshold and a self-similarity score that is above a predetermined similarity threshold.

19. The risk assessment computer system of claim 14, wherein the determined suggested action comprises approving the received transaction and monitoring the account for further activity, in response to a computer fraud score that is below a predetermined fraud threshold and a self-similarity score that is below a predetermined similarity threshold.

20. The risk assessment computer system of claim 14, wherein the performed operation of computing the self-similarity score comprises utilizing an Alternating Decision Tree.

21. The risk assessment computer system of claim 14, wherein a confidence margin is associated with the computed similarity score.

22. The risk assessment computer system of claim 14, wherein the computed self-similarity score comprises a probability that the received transaction is a transaction likely to be initiated by the account holder, regardless of the computed fraud score.

23. The risk assessment computer system of claim 14, wherein processing time for computing the self-similarity score is not greater than processing time for computing the fraud score.

24. The risk assessment computer system of claim 14, wherein the computed self-similarity score comprises a measure of proximity of the received transaction relative to a set of prior transactions over a shared data space.

25. The risk assessment computer system of claim 14, wherein the set of prior transactions in the data storage are included in the retrieved data.

26. The risk assessment computer system of claim 14, wherein the performed operations further comprise providing the suggested action to a financial transaction processing system.

27. A method of operating a risk assessment computer system, the method comprising:

retrieving data from data storage of the system in connection with a transaction received at the system relating to an account, wherein the data storage includes data relating to a plurality of accounts, each of which is associated with an account owner, and wherein the collection of accounts comprises an account population;

computing a fraud score in connection with the account to which the received transaction relates, wherein the computed fraud score indicates a probability of the account being in a compromised condition;

computing a self-similarity score in response to a computed fraud score that is above a predetermined threshold, the self-similarity score comprising a similarity measure of the received transaction relative to a set of prior transactions in the data storage relating to the account, wherein the computed self-similarity score indicates similarity of the received transaction to other transactions of the account in the set of prior transactions; and

determining the suggested action based on the computed fraud score and the computed self-similarity score.

28. The method of claim 27, wherein determining the suggested action comprises:

determining whether the computed fraud score comprises a high risk score or a low risk score relative to a predetermined threshold risk score value;

determining whether the computed self-similarity score comprises a high similarity score or a low similarity score relative to a predetermined threshold self-similarity score value; and

responsive to determining the fraud score as a high risk score or a low risk score and determining the self-similarity score as a high similarity score or a low similarity score, determining the suggested action.

29. The method of claim 27, wherein the determined suggested action comprises contacting a holder of the account without declining the received transaction in response to a computer fraud score that is above a predetermined fraud threshold and a self-similarity score that is above a predetermined similarity threshold.

30. The method of claim 27, wherein the determined suggested action comprises declining the transaction, in response to a computer fraud score that is above a predetermined fraud threshold and a self-similarity score that is below a predetermined similarity threshold.

31. The method of claim 27, wherein the determined suggested action comprises approving the received transaction, in response to a computer fraud score that is below a predetermined fraud threshold and a self-similarity score that is above a predetermined similarity threshold.

32. The method of claim 27, wherein the determined suggested action comprises approving the received transaction and monitoring the account for further activity, in response to a computer fraud score that is below a predetermined fraud threshold and a self-similarity score that is below a predetermined similarity threshold.

33. The method of claim 27, wherein computing the self-similarity score comprises utilizing an Alternating Decision Tree.

34. The method of claim 27, wherein a confidence margin is associated with the computed similarity score.

35. The method of claim 27, wherein the computed self-similarity score comprises a probability that the received transaction is a transaction likely to be initiated by the account holder, regardless of the computed fraud score.

36. The method of claim 27, wherein processing time for computing the self-similarity score is not greater than processing time for computing the fraud score.

37. The method of claim 27, wherein the computed self-similarity score comprises a measure of proximity of the received transaction relative to a set of prior transactions over a shared data space.

38. The method of claim 27, wherein the set of prior transactions in the data storage are included in the retrieved data.

39. The method of claim 27, further comprising providing the suggested action to a financial transaction processing system.