DEEP BEHAVIORAL NETWORKS FOR FRAUD DETECTION

A transaction processing system includes a transaction processing module configured to receive first information associated with a first proposed transaction, retrieve second information associated with at least one prior transaction that is associated with the first proposed transaction, and calculate a time-decayed algorithm using the second information to generate third information. The transaction processing system also includes a weighting module communicably coupled to the transaction processing module, wherein the weighting module is configured to receive the third information from the neural-based processing module, apply a weighting factor to the third information to generate fourth information, and calculate at least one processing algorithm using the first information and the fourth information to generate an output. The output of the weighting module is used by an additional transaction processing module to determine whether the first proposed transaction is fraudulent.

TECHNICAL FIELD

Embodiments described herein relate generally to fraud detection, and more particularly to systems, methods, and devices for using deep behavioral networks to detect fraud.

BACKGROUND

Fraud is a crime, and financial institutions are obliged to take reasonable steps to prevent it. One of these steps is the interruption and cessation of a transaction while it is in-flight. This prevents financial losses for either of the genuine parties in the transaction. Some decision process is needed to determine if the transaction is valid, and those decision processes use risk scores as one data point for that decision. Consumers and merchants, and commerce in general is disrupted when transactional fraud is falsely detected (a “false positive”) or fails to be detected, leading to a reduction in credit availability and disputed transactions or financial loss.

While risk scoring and evaluation methodologies for fraud have existed for decades, they have been of limited predictive quality. More and more accurate risk scores are actively sought by parties to transactions, as the accuracy of these scores directly impacts their financial well-being, confidence in transacting business electronically or in person, and the effectiveness of crime prevention strategies.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

The example embodiments discussed herein are directed to systems, methods, and devices for deep behavioral networks to detect fraud. Example embodiments can be used to detect fraud in any of a number of circumstances, including but not limited to credit card charges, automated payments (e.g., as from a checking account), electronic (non-credit card) money transfers, and applications for credit. Example embodiments (or portions thereof) can also be used in cyber-security to detect malicious actors, and in financial crime to detect money laundering. Further, example embodiments can be used to detect fraud in real time (as for pending transactions) and historically (e.g., by analyzing information associated with past transactions as a “look-back”).

Example embodiments accurately evaluate and weigh behavioral anomalies present in sequences of individual actions (e.g., transactions, user mouse clicks), where those actions are irregularly spaced in time rather than occurring at regular intervals. With this irregularly spaced data, the behavioral context of neighboring actions, or the lack of such neighboring actions, in a sequence changes depending on the time gap between the actions. For example, two purchases within a second mean something quite different to two purchases separated by a day.

Current deep learning methods may not accurately measure such differences, which leads to errors and suboptimal results in application of machine learning to these data sets. A deep behavioral network measures the differences more accurately than the current deep learning methods. Example embodiments use a machine learning architecture that seeks to identify and make inferences from behavioral anomalies so that there is an appropriate awareness of the intervals and densities of individual actions of different types, and how these recent measures compare to the established long-term trends of the individual. Example embodiments use the deep behavioral network, which is a neural architecture that allows for representations of behavioral norms and anomalies to be learned from data, including evaluating the semantic interpretation, actual and expected frequency, sequencing, and temporal distance between actions and behavior. In some cases, one or more functions performed by example embodiments described herein are performed using other types of architecture aside from neural architectures.

In transactional processing, some preliminarily valid transactions will later be reported as fraud, where a third party fraudulently initiated a transaction in the name of one of the participants to the transaction, such as an account holder or merchant. Financial institutions spend a great deal of resources to implement solutions for real-time fraud prediction for in-flight transactions, often against a constantly evolving set of threat vectors. Fraud prediction through behavioral analysis, as used in example embodiments, is an important application of the measurement of transactional and account norms and anomalies in this type of data.

In certain example embodiments, fraud detection systems are subject to meeting certain standards and/or requirements. Examples of entities that create such standards and regulations include, but are not limited to, the Association of Certified Fraud Examiners (ACFE), the Securities and Exchange Commission (SEC), and the Professional Risk Managers' International Association (PRMIA).

If a component of a figure is described but not expressly shown or labeled in that figure, the label used for a corresponding component in another figure can be inferred to that component. Conversely, if a component in a figure is labeled but not described, the description for such component can be substantially the same as the description for the corresponding component in another figure. The numbering scheme for the various components in the figures herein is such that each component is a three-digit number and corresponding components in other figures have the identical last two digits. For any figure shown and described herein, one or more of the components may be omitted, added, repeated, and/or substituted. Accordingly, embodiments shown in a particular figure should not be considered limited to the specific arrangements of components shown in such figure.

Further, a statement that a particular embodiment (e.g., as shown in a figure herein) does not have a particular feature or component does not mean, unless expressly stated, that such embodiment is not capable of having such feature or component. For example, for purposes of present or future claims herein, a feature or component that is described as not being included in an example embodiment shown in one or more particular drawings is capable of being included in one or more claims that correspond to such one or more particular drawings herein.

Example embodiments of using deep behavioral networks to detect fraud will be described more fully hereinafter with reference to the accompanying drawings, in which example embodiments of using deep behavioral networks to detect fraud are shown. Using deep behavioral networks to detect fraud may, however, be embodied in many different forms and should not be construed as limited to the example embodiments set forth herein. Rather, these example embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of using deep behavioral networks to detect fraud to those of ordinary skill in the art. Like, but not necessarily the same, elements (also sometimes called components) in the various figures are denoted by like reference numerals for consistency.

Terms such as “first”, “second”, “on”, “upon”, “outer”, “inner”, “top”, “bottom”, and “within” are used merely to distinguish one component (or part of a component or state of a component) from another. Such terms are not meant to denote a preference or a particular orientation. Also, such terms are not meant to limit embodiments of using deep behavioral networks to detect fraud. In the following detailed description of the example embodiments, numerous specific details are set forth in order to provide a more thorough understanding of the invention. However, it will be apparent to one of ordinary skill in the art that the invention may be practiced without these specific details. In other instances, well-known features have not been described in detail to avoid unnecessarily complicating the description.

FIG. 1shows a system diagram of a system100in accordance with certain example embodiments. In this case, the system100includes one or more clients195, one or more users150, a network manager180, and a transaction processing system190. The transaction processing system190can include one or more components. In this case, the transaction processing system190includes a controller104, a neural-based transaction processing module160(sometimes more simply called a transaction processing module160herein), a weighting module170, one or more other transaction processing modules165, and a storage repository130.

The controller204can include one or more of a number of components. Such components can include, but are not limited to, a control engine, a communication module, a timer, an energy metering module, a power module, a hardware processor, a memory, a transceiver, an application interface, an energy storage device, one or more switches, and, a security module. The components shown inFIG. 1are not exhaustive, and in some embodiments, one or more of the components shown inFIG. 1may not be included in an example system100. Any component of the example system100can be discrete or combined with one or more other components of the system100.

A user150can be any person that interacts with the one or more clients195, the network manager180, and the transaction processing system190. Examples of a user150may include, but are not limited to, an executive, security personnel, a risk manager, an engineer, a consultant, a law enforcement officer, a contractor, and a manufacturer's representative. As sometimes described herein, a user150can be a human being, an organization, or a computer. The user150can be or include a user system (not shown), which may include a display (e.g., a GUI), a mouse, a keyboard, and/or other I/O components. Such a user system can correspond to a computer system as described below with regard toFIG. 2. The user150interacts with (e.g., sends data to, receives data from) the one or more clients195, the network manager180, and/or the transaction processing system190(or components thereof).

Interaction between each user150, the network manager180, the one or more clients195, and the transaction processing system190(or components thereof) is conducted using communication links105. Each communication link105can include wired (e.g., Class 1 electrical cables, Class 2 electrical cables, electrical connectors, power line carrier, DALI, RS485) and/or wireless (e.g., Wi-Fi, visible light communication, cellular networking, Bluetooth, Bluetooth Low Energy (BLE), Ultra Wideband (UWB)) technology. Similarly, communication between components of the transaction processing system190can be facilitated by communication links105. The communication link105can transmit signals (e.g., power signals, communication signals, control signals, data) between the users150, the network manager180, the client(s)195, and/or transaction processing system190(including components thereof).

The network manager180is a device or component that controls all or a portion of the system100, which can include the controller104of the transaction processing system190. The network manager180can be substantially similar (e.g., in terms of components, in terms of functionality) to the controller104. Alternatively, the network manager180can include one or more of a number of features in addition to, or altered from, the features of the controller104of the transaction processing system190. The network manager180can be called by other names, including but not limited to master controller, network controller, and enterprise manager.

The client(s)195of the system100provide transaction information to the transaction processing system190. Examples of a client195can include, but are not limited to a merchant, a vendor, a bank, and a financial institution. The transaction information sent by a client195to the transaction processing system190can include, but is not limited to, an account number (e.g., a credit card number), an account owner, a day and time of a potential transaction, an amount of the transaction, a location of where the transaction is occurring, a vendor seeking authorization of the charge, and manner (e.g., in person, over the phone, on a website) in which the transaction is executed. A single client can transmit transaction information to the transaction processing system190at any given point in time or over a range of time. A client195can include one or more components (e.g., a transceiver, an application interface, a controller) that allow the client195to communicate with and/or follow instructions from a user150, the controller104of the transaction processing system190, and/or the network manager180. The transaction processing system190can correspond to a computer system as described below with regard toFIG. 2.

In certain example embodiments, the neural-based transaction processing module160of the transaction processing system190is configured to receive one or more inputs (e.g., transaction information) from one or more other components (e.g., the clients195) of the system100. In this case, the neural-based transaction processing module160receives inputs in the form of payment (e.g., credit card) transaction information in real time from one or more clients195at a given point in time. Upon receiving the payment card transaction information (or other transactional data) from a client195, the neural-based transaction processing module160can immediately process the payment transaction information to generate an output.

Alternatively, upon receiving the payment transaction information from a client195, the neural-based transaction processing module160can use at least some of the payment transaction information to generate a query for additional information. For example, the neural-based transaction processing module160can initiate a request, through the controller104, to obtain records (files) for the 5 (or some other number) most recent transactions by that account (e.g., credit card) with that client195and/or similar vendors. The details of such an inquiry can be based, for example, on one or more protocols and/or algorithms, as stored in the storage repository130, at least some of which can be adjusted based on actual results over time.

The neural-based transaction processing module160is configured to send one or more outputs to one or more other components of the system100. In this case, the neural-based transaction processing module160sends outputs to the weighting module170. In alternative embodiments, the neural-based transaction processing module160can additionally or alternatively send its outputs to one or more of the other transaction processing modules165of the transaction processing system190.

The neural-based transaction processing module160can have any of a number of configurations. For example, in this case, the neural-based transaction processing module160is a layer of neural cells with local memory where the memory is time-decayed prior to state update upon processing of a new sample. In this case, a sample, also sometimes called an input, is a transaction that may or may not be fraudulent. The neural cells of the neural-based transaction processing module160are updated additively when a new sample is processed. The pre-existing state may be time-decayed (e.g., exponentially, by a custom created factor) based on the time interval between the previous sample in the sequence and the current sample.

The purpose of the neural-based transaction processing module160is to compute a weighted summation of the new input relative to the prior inputs. The basis of the time-decay drives the contribution of past transactions to the summation. The basis of the time-decay can be purely a function of the time, since the transaction occurred independent of anything that happened in the intervening period. As a result, the significance of the basis for the time-decay is that it provides long-term storage for the contribution of prior transactions that are not the most recent transaction.

As an example of how the neural-based transaction processing module160can work, consider a case with three transactions. The first transaction (event A) occurs at midnight. The second transaction (event B) occurs at 3 a.m. (i.e., 3 hours after event A). The third transaction (event C) occurs at 9 a.m. (i.e., 6 hours after event B and 9 hours after event A). When the neural-based transaction processing module160determines the memory state S_{i} for the then-current event, the neural-based transaction processing module160decays the previous memory state S_{i-1} based on the interval between the then-previous event (i-1) and the then-current event (i), before adding it to the inputs X_i for the then-current event. For every update, the neural-based transaction processing module160calculates the memory state S_{i}=X_{i}+f(t_{i}−t_{i-1})·S_{i-1}.

For event A in this example, the neural-based transaction processing module160calculates that S_a=X_a+0.

For event B in this example, the neural-based transaction processing module160calculates that S_b=X_b+f(3 hours)·S_a.

For event C in this example, the neural-based transaction processing module160calculates that S_c=X_c+f(6 hours)·S_b, which is equivalent to S_c=X_c +f(6 hours)·X_b+f(6 hours)·f(3 hours)·X_a.

When the time decay is exponential, f(a)·f(b)=f(a+b). In such a case, the memory state for event C can be expressed as S_c=X_c+f(6 hours)·S_b=X_c+f(6 hours)·X_b+f(6 hours)·f(3 hours)·X_a=X_c+f(6 hours)·X_b+f(9 hours)·X_a. As a result, the contribution of event A to S_c is dependent only on the 9 hour gap between event A and event C, and is independent of what occurred at event B (which has its own independent contribution).

The decay rate used by the neural-based transaction processing module160can be a parameter set by a user150(e.g., a data scientist) configuring the network (also called a “hyper-parameter” in machine learning). The decay rate can be chosen using a combination of intuition for the problem at hand, through trial-and-error experimentation (such as grid search), and/or based on any of a number of other factors. In certain example embodiments, the decay rate remains constant once it has been chosen during configuration.

In certain example embodiments, the neural-based transaction processing module160performs running aggregations over past actions within a set of time intervals that, in combination, encode observations of the transactional behavior of an entity (e.g., a credit card holder) within those time intervals and how they have changed. The changes in that transactional behavior can be categorized by the neural-based transaction processing module160as a fraudulent transaction.

As discussed above, an example of a time decay is an exponential time decay. For an exponential time-decay function f, the property f(a+b)=f(a)f(b) holds. In certain example embodiments, an exponential time-decay can ensure that the contribution of a past action to the cell memory in the neural-based transaction processing module160depends solely on the elapsed time since the more recent event took place. In other words, the elapsed time between events attributable to an entity using example embodiments can be completely independent of any other action that has been performed in the intervening time. The use of time decay in the neural-based transaction processing module160also permits long-term memory storage, which is a significant limitation of the current art. The duration of the long-term memory storage can be set, for example, by the half-life parameter of the exponential time decay. In such a case, cells with a range of half-lives can be used, which encourages the encoding of behavioral information and changepoints over different time periods.

In certain example embodiments, the weighting module170of the transaction processing system190is configured to receive one or more inputs from one or more other components of the system100. In this case, the weighting module170receives inputs in the form of payment (e.g., credit card) transactions in real time from one or more of the neural-based transaction processing module160. In addition, the weighting module170is configured to send one or more outputs to one or more other components of the system100. In this case, the weighting module170sends outputs to one or more clients195, which can be the same clients195that sent the transaction information and/or different clients195.

The weighting module170can have any of a number of configurations. For example, in this case, the weighting module170can be a multi-headed self-attention mechanism with unique treatment for irregularly spaced temporal data, such as what is output by the neural-based transaction processing module160. For example, the weighting module170is configured to receive the outputs of a neural-based transaction processing module160for a current sample and, if applicable, previous samples in the sequence. The weighting module170produces its own outputs using one or more of a number of functions, including but not limited to time-windowed masking and a relative positional encoding that is a function of time (typically weighted or modified through a decay or factored function).

In certain example embodiments, the function of the weighting module170is to extract relevant context from specific previous actions in the action sequence. This provides a richer context for understanding (and properly characterizing) the current transaction. For example, the weighting module170may learn to increase a risk score for a login action, if the login action comes soon after a password reset action. In this example, the weighting module170would have learned that recent password reset actions are a specific and relevant context that changes the risk associated with a login action. Put another way, the weighting module170weights the influence of past data samples using a function of a time interval between the past data sample and the present, as implemented in the neural-based transaction processing module160.

The extraction of relevant context is achieved by an attention mechanism of the weighting module170. The attention mechanism can be a self-learning or trained algorithm that learns how to create a vector of context for which to search, as well as a vector of context that the current transaction represents. The weighting module170compares the search vector for the current transaction to the context vectors previously calculated for past transactions, and information on any matches between the search vectors and the previous context vectors is output by the weighting module170.

In certain example embodiments, the neural-based transaction processing module160and/or the weighting module170can be sandwiched between one or more of the other transaction processing modules165, which can include traditional neural network architectures. Such a configuration can allow the neural-based transaction processing module160and/or the weighting module170to be used for inference in a prediction problem. The parameters of all the neural-based transaction processing module160and/or the weighting module170can be trained using, for example, a traditional combination of stochastic gradient descent and back-propagation algorithms, operating with a logistic log-loss objective function. The training of the neural-based transaction processing module160and/or the weighting module170can be achieved using labelled training data.

For the neural-based transaction processing module160and/or the weighting module170, the transaction stream can be discretized into separate sequences for the individual clients195involved in the transaction. Example embodiments, using the neural-based transaction processing module160and the weighting module170, show deep behavioral networks using a deep neural network machine learning architecture for solving sequential problems with native treatment for transactions (samples) spaced at arbitrary and irregular intervals in time.

The neural-based transaction processing module160and the weighting module170can be used in some situations independently of each other. The neural-based transaction processing module160and the weighting module170, as described herein, can provide greater accuracy and performance for anomalous behavior prediction in transactions and other similar commercial activities. Incorporating the example neural-based transaction processing module160and the example weighting module170into the more traditional and currently-used other transaction processing modules165creates a wider deep neural network architecture trained on transactional data. The neural-based transaction processing module160and the weighting module170compute indicators that capture behavioral norms, incorporate their changes over different time periods, and indicate the presence of behavioral anomalies. These indicators are learned and optimized by the algorithms, through the controller104, rather than conceived of by a data scientist. This produces stronger fraud prediction models.

The storage repository130of the transaction processing system190can be a persistent storage device (or set of devices) that stores software and data used to assist the controller104in communicating with the users150, the network manager180, and the client(s)195within the system200. In one or more example embodiments, the storage repository130stores one or more protocols, one or more algorithms, and stored data. The protocols can be any procedures (e.g., a series of method steps), logic steps, and/or other similar operational procedures that the controller104follows based on certain conditions at a point in time. The protocols can also include any of a number of communication protocols that are used to send and/or receive data between the controller104and the users150, the network manager180, the clients195, and one or more other components of the transaction processing system190.

The algorithms can be any formulas, mathematical models, forecasts, simulations, and/or other similar computational instruments that the controller104utilizes based on certain conditions at a point in time. One or more algorithms can be used in conjunction with, or as a result of following, one or more protocols. Stored data can be any data associated with the clients195, data associated with account holders, data associated with credit card or other account numbers, threshold values, user preferences, results of previously run or calculated algorithms232, and/or any other suitable data. Stored data can be any type of data, including but not limited to historical data, present data, and forecast data. The stored data can be associated with some measurement of time derived, for example, from the timer.

Examples of a storage repository130can include, but are not limited to, a database (or a number of databases), a file system, a hard drive, flash memory, cloud-based storage, some other form of solid state data storage, or any suitable combination thereof. The storage repository130can be located on multiple physical machines, each storing all or a portion of the protocols, the algorithms, and/or the stored data according to some example embodiments. Each storage unit or device can be physically located in the same or in a different geographic location.

The storage repository130can be operatively connected to the control engine206. In one or more example embodiments, the control engine206includes functionality to communicate with the user250, the network manager280, the client(s)195, and the sensor modules260in the system200. More specifically, the control engine206sends information to and/or receives information from the storage repository130in order to communicate with the user150, the network manager180, the client(s)195, and the sensor modules260. As discussed below, the storage repository130can also be operatively connected to the communication module208in certain example embodiments.

The controller104controls the operation of one or more components (e.g., the communication module208, the timer210, the transceiver224) of the transaction processing system190. The controller104can provide control, communication, and/or other similar signals to the users150, the network manager180, and the clients195. Similarly, the controller104can receive control, communication, and/or other similar signals from the users150, the network manager180, and the clients195. In certain embodiments, the controller104can communicate with one or more components of a system external to the system100.

FIG. 2illustrates one embodiment of a computing device218that implements one or more of the various techniques described herein, and which is representative, in whole or in part, of the elements described herein pursuant to certain exemplary embodiments. For example, the controller104ofFIG. 1and its various components (e.g., hardware processor120, memory122, control engine106) can be considered a computing device218as inFIG. 2. Computing device218is one example of a computing device and is not intended to suggest any limitation as to scope of use or functionality of the computing device and/or its possible architectures. Neither should computing device218be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the example computing device218.

Computing device218includes one or more processors or processing units214, one or more memory/storage components215, one or more input/output (I/O) devices216, and a bus217that allows the various components and devices to communicate with one another. Bus217represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. Bus217includes wired and/or wireless buses.

Memory/storage component215represents one or more computer storage media. Memory/storage component215includes volatile media (such as random access memory (RAM)) and/or nonvolatile media (such as read only memory (ROM), flash memory, optical disks, magnetic disks, and so forth). Memory/storage component215includes fixed media (e.g., RAM, ROM, a fixed hard drive, etc.) as well as removable media (e.g., a Flash memory drive, a removable hard drive, an optical disk, and so forth).

One or more I/O devices216allow a customer, utility, or other user to enter commands and information to computing device218, and also allow information to be presented to the customer, utility, or other user and/or other components or devices. Examples of input devices include, but are not limited to, a keyboard, a cursor control device (e.g., a mouse), a microphone, a touchscreen, and a scanner. Examples of output devices include, but are not limited to, a display device (e.g., a monitor or projector), speakers, outputs to a lighting network (e.g., DMX card), a printer, and a network card.

Various techniques are described herein in the general context of software or program modules. Generally, software includes routines, programs, objects, components, data structures, and so forth that perform particular tasks or implement particular abstract data types. An implementation of these modules and techniques are stored on or transmitted across some form of computer readable media. Computer readable media is any available non-transitory medium or non-transitory media that is accessible by a computing device. By way of example, and not limitation, computer readable media includes “computer storage media”.

“Computer storage media” and “computer readable medium” include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules, or other data. Computer storage media include, but are not limited to, computer recordable media such as RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which is used to store the desired information and which is accessible by a computer.

The computer device218is connected to a network (not shown) (e.g., a LAN, a WAN such as the Internet, cloud, or any other similar type of network) via a network interface connection (not shown) according to some exemplary embodiments. Those skilled in the art will appreciate that many different types of computer systems exist (e.g., desktop computer, a laptop computer, a personal media device, a mobile device, such as a cell phone or personal digital assistant, or any other computing system capable of executing computer readable instructions), and the aforementioned input and output means take other forms, now known or later developed, in other exemplary embodiments. Generally speaking, the computer system218includes at least the minimal processing, input, and/or output means necessary to practice one or more embodiments.

Further, those skilled in the art will appreciate that one or more elements of the aforementioned computer device218is located at a remote location and connected to the other elements over a network in certain exemplary embodiments. Further, one or more embodiments is implemented on a distributed system having one or more nodes, where each portion of the implementation (e.g., control engine106) is located on a different node within the distributed system. In one or more embodiments, the node corresponds to a computer system. Alternatively, the node corresponds to a processor with associated physical memory in some exemplary embodiments. The node alternatively corresponds to a processor with shared memory and/or resources in some exemplary embodiments.

FIG. 3shows a flowchart of a method391for detecting fraud in accordance with certain example embodiments. Specifically, referring toFIGS. 1 through 3, the method391shows an example of the functionality of the neural-based transaction processing module160. The method391starts at step321, where the neural-based transaction processing module160receives a record (e.g., information associated with a currently-attempted payment charge) from a client195. Here, the record may be a first information that the neural-based transaction processing module160received for the processing. The current iteration is indexed by i, and the previous iteration, as shown in step322, in the sequence is indexed by i-1. In step322, the neural-based transaction processing module160retrieves numbers and other information associated with the account used to make the current transaction are retrieved from, as stored in the storage repository130. In this example, the retrieved numbers and other information associated with the account used to make the current transaction may be a second information that the neural-based transaction processing module160received for the processing. The numbers and other information can summarize the state of the account. In certain example embodiments, the last time that this account state was updated was when the previous transaction for the account was processed. The state is a learned representation of the account's previous activities. This information may, or may not, include specific information about the previous transaction.

In step323, after the weighting module170receives the second information in step322(after the information is processed by the neural-based transaction processing module160), a weighting function ϕdis computed by the weighting module170from the time interval δti,i-1between the previous iteration and the current one. The computed weighting function ϕdmay perform as a time-decayed algorithm of the method391. In step324, the previous iteration memory is multiplied by ϕdby the controller104or the weighting module170, and then in step326the product of step324is added by the controller104or the weighting module170to the layer input Xifrom step321. In step327, the updated quantity, Ai, is output from the weighting module170to other transaction processing modules165(e.g., other neural components) in the transaction processing system190and saved to the storage repository130(e.g., cell memory) for use by the next iteration in the sequence. In this example, the updated quantity Ai, may be a third information generated by the neural-based transaction processing module160.

FIG. 4shows a flowchart of another method492for detecting fraud in accordance with certain example embodiments. Referring toFIGS. 1 through 4, the method492uses the neural-based transaction processing module160and the weighting module170. The architecture used to perform the method492ofFIG. 4is of a single self-attention head that is the building block of the weighting module170. At least some of the novel components of the method493are indicated in red, specifically in steps431through434and441. These components provide native support for irregular time spacing of the transaction sequence. In step431, the neural-based transaction processing module160and the weighting module170combine to read a vector of the relative time intervals δti,i-1. . . δti, 1between each of the previous iterations in the sequence (as shown in step429) and the current iteration i (as shown in step428).

From these, in step433, a vector of relative time encodings0, is computed for each of the previous samples from step431. In step434, the result of step433is concatenated with the vector of layer inputs Ai-1. . . A1from each of the previous transactions in the sequence of step429. In step432, the intervals δti,i-1. . . δti, 1to are also used to define a weighting ϕw. As usual in attention mechanisms, the scalar product of the key vector fk(in step437) and query vector fq(in step438) for each of the samples in the sequence is computed to produce a vector of attention scores, as in step439. In this example, the vector of attention scores may be a fourth information that is generated by applying the query vector fqon the received third information (in step428).

In step441, the weighting ϕwis then applied to this vector of attention scores. This is important because it encourages the architecture to attend more heavily to samples in some time intervals (e.g., around a week before the current sample) more than others. In step442, the modified attention scores are then normalized by a softmax layer (denoted by σ) to produce attention weights. In step444, these are in the end utilized to produce a context vector Biby appropriately weighting value vectors fvfrom the previous samples in the sequence, as shown in step443. Here, the multiplication of the weighting ϕwand the vector of attention scores in step441, as well as the calculation of the context vector Biin step443, are processing algorithms that are used to generate the output of the fraud detection method492.

The amount of time that example embodiments perform the method391ofFIG. 3and the method492ofFIG. 4is on the order of seconds, or even a fraction of a second. This timing is important in order to detect a fraudulent transaction in real time before the transaction can be approved and completed and to give the client and/or other relevant entities (e.g., law enforcement) a better chance of identifying and holding to account the person responsible for the fraud. As a result, in view of at least the above, the example embodiments described herein cannot reasonably be viewed as an abstract idea directed toward, for example, organizing human activity or a fundamental economic activity because the speed at which this activity must be performed is far too short for a human to implement.

FIG. 5shows a process flow diagram593of a system for detecting fraud in accordance with certain example embodiments. Referring toFIGS. 1 through 5, the other transaction processing modules565, the neural-based transaction processing module560, the weighting module570, and the communication links505are substantially similar to the other transaction processing modules165, the neural-based transaction processing module160, the weighting module170, and the communication links105ofFIG. 1above. The other transaction processing modules565, the neural-based transaction processing module560, the weighting module570, and the communication links505are part of a transaction processing system590, which is substantially similar to the transaction processing system190ofFIG. 1above.

Referring toFIG. 5, the work of the neural-based transaction processing module560and the weighting module570is divided into two layers: Layer A and layer B. Some information (e.g., transaction time, account number) associated with an imminent transaction is received (e.g., from a client195) by layer A, and information associated with the imminent transaction is received by part of (or one of) the other transaction processing modules565-1. The information received by layer A and the other transaction processing modules565-1can be the same or different than each other. The information is transmitted over communication links505.

The output of layer A, which includes involvement of the neural-based transaction processing module560and/or the weighting module570, can be sent, using communication links505, to layer B and/or to part of (or one of) the other transaction processing modules565-2. In addition to the output from layer A, layer B can receive information associated with the imminent transaction from the client195. The output of layer B, which includes involvement of the neural-based transaction processing module560and/or the weighting module570is sent, using communication links505, to the other transaction processing modules565-2. The output of the other transaction processing modules565-2in this case is a risk score that indicates to the client195whether the imminent transaction is fraudulent.

FIG. 6shows a flow of data within a system600used to detect fraud in accordance with certain example embodiments. Referring toFIGS. 1 through 6, the transaction processing system690, the controller604, the other transaction processing modules665, the neural-based processing module660, the weighting module670, the storage repository630, the client695, the user650, and the communication links605are substantially similar to the corresponding components ofFIG. 1above.

FIG. 6illustrates how example embodiments (in this case, the neural-based processing module660and the weighting module670) fit into a wider transaction fraud scoring system. The structure ofFIG. 6describes a transaction processing system that takes a data packet (a transaction) from the transaction processing system of a client695, runs internal operations where the storage repository630(which includes an entity state database) is queried and updated in the light of the new transaction information, a classification is performed, rules are executed and a decision is returned in a data packet sent to the client695. The system600also updates an analytics database (part of the storage repository630), which users650(e.g., fraud analysts working for the client695) can query via a user interface.

The whole process from receipt of the data packet from the client695to return of a decision packet to the client695is measured by the system latency, which is typically a matter of milli-seconds (“real-time, as defined herein). In this case, the transaction processing system690uses the output provided by the neural-based processing module660and the weighting module670to make a fraud/no-fraud classification, and to perform one or more actions based on customer-specified rule logic.

Example embodiments can provide, in real time, an output that is used as a factor by other components of a system or by another system to determine if a particular transaction is fraudulent. In addition, or in the alternative, example embodiments can provide, in real time, a determination as to whether a particular transaction is fraudulent. In some cases, as in the examples described herein, the example neural-based processing module and the example weighting module work in conjunction with each other. In alternative embodiments, one of the example neural-based processing module and the example weighting module are omitted from a system.