# Boosting Fraud Detection in Mobile Payment with Prior Knowledge
## 3 Data and Features
### Extract Risk Features by Incorporating Prior Knowledge  
Massive human knowledge has been accumulated during daily system operation. This knowledge includes expert rules and blacklists. Traditional methods of risk identification  
\begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Time Period** & **Feature** & **X-axis** & **Y-axis** & **Z-axis** & **Acceleration** \\ \hline \multirow{8}{*}{**Whole Day**} & **Max** & 29.3 & 13.5 & 46.3 & 121.4 \\ \cline{2-6}  & **Min** & \(-\)78.3 & \(-\)83 & \(-\)8.8 & 0.1 \\ \cline{2-6}  & **Avg** & \(-\)7 & \(-\)10.1 & 5.6 & 19.2 \\ \cline{2-6}  & **SD** & 16 & 18.8 & 10.4 & 23.1 \\ \cline{2-6}  & **\#Peak** & 15 & 14 & 18 & 17 \\ \cline{2-6}  & **\#Bottom** & 21 & 23 & 17 & 20 \\ \hline \multirow{8}{*}{**Transaction Period**} & **Max** & 29.3 & 6.6 & 18.1 & 67.2 \\ \cline{2-6}  & **Min** & \(-\)29.5 & \(-\)60.3 & \(-\)8.8 & 0.4 \\ \cline{1-1} \cline{2-6}  & **Avg** & \(-\)4.8 & \(-\)15.2 & 5.8 & 21.5 \\ \cline{1-1} \cline{2-6}  & **SD** & 12.1 & 16.5 & 7 & 17.1 \\ \cline{1-1} \cline{2-6}  & **\#Peak** & 11 & 5 & 7 & 10 \\ \cline{1-1} \cline{2-6}  & **\#Bottom** & 11 & 12 & 5 & 10 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Features of Acceleration.  
are usually based on expert rules, and hundreds of expert rules are established in financial payments based on different transaction fields, such as transaction amount, trading address, device name, IP address, and so forth. A typical rule is that the risk of a transaction is high for small merchants if the transaction amount is higher than $100. Therefore, we can extract new risk features by incorporating prior knowledge of the expert rules. For example, concerning the transaction amount for small merchants, we add a new feature 'Transaction Amount', and calculate the risk value, as in  
\[F(\text{ amount a})=\left\{\begin{array}{ll}0,&\text{a}<\$100\\ 0.5,&\$100\leq\text{a}<\$200\\ 1,&\text{a}\geq 200\end{array}\right.. \tag{3}\]  
On the other hand, blacklists are widely implemented in many engineering projects to identify and prevent risks effectively. Typical blacklists include lists of mobile phone numbers, login mailboxes, IP addresses [43], device IDs, and so forth. We can extract new risk features by incorporating prior knowledge of blacklists. For example, concerning IP address blacklists, we add a new feature 'IP Address Risk,' and set the value to 1 if its IP address is in the blacklist; otherwise, it is set to 0. Blacklists can not only be accumulated from historical fraud transaction information, but lists can also be transferred from different domains; therefore, the training data shortage will be addressed. Based on prior knowledge, new risk features can be defined and calculated as shown in Algorithm 1.  
```
1:Raw data of the feature, \(RawData\); Prior knowledge of expert rule, \(RuleList\); Prior knowledge of blacklist, \(Blacklist\)
2:Risk value of the feature, \(RiskValue\)
3:Initialize \(RiskValue\) with 0
4:for each \(Rule\in RuleList\)do
5:if\(Rule\) is applicable to \(RawData\)then
6:if\(Rule.RiskValue>RiskValue\)then
7:\(RiskValue\) = \(Rule.RiskValue\)
8:endif
9:endif
10:endfor
11:for each \(ListItem\in Blacklist\)do
12:if\(ListItem.RawData\) = \(RawData\)then
13:if\(ListItem.RiskValue>RiskValue\)then
14:\(RiskValue\) = \(ListItem.RiskValue\)
15: break
16:endif
17:endif
18:endfor
19:return\(RiskValue\)
```  
**Algorithm 1** Calculating Risk Value of Feature  
For example, the risk value of the mobile phone number 199-123-45678 can be calculated according to the expert rule and blacklist. If the phone number is in a risk number segment [199-123-XXXX] with risk value 0.5, then the risk value of the phone number is set to 0.5. If the phone number is already in the blacklist, then the risk value is set to 1. The classification results of the machine learning model, after manual or automatic verification, can be fed back to the prior knowledge database as a new expert rule item or new blacklist item, thus forming a continuous improvement mechanism.