Monitoring system, model generation device, model generation method and program

Abstract

A model generation device (300) includes a template information acquisition unit (302) that acquires template information used in the generation of a model for detecting a fraudulent transaction in a financial transaction. The template information includes input information item definition information for identifying each input information item used in model generation, and secondary information generation definition information for identifying generated contents of secondary information that contributes to an improvement in the performance of the model based on the input information. In addition, the model generation device (300) includes: an input information acquisition unit (304) that, for each item identified by the input information item definition information included in the template information, acquires input information corresponding to the item; a control unit (306) that controls the generated contents of the secondary information, in accordance with the secondary information generation definition information included in the template information; and a model generation unit (308) that generates a model on the basis of the controlled secondary information generated contents.

Description

[Technical field]

[0001] The present invention relates to a monitoring system, a model generating device, a model generating method, and a recording medium. [Background technology]

[0002] In recent years, there has been an increase in financial transactions suspected to be fraudulent. For this reason, there is a need to strengthen the monitoring of account transactions.

[0003] An example of a transaction monitoring system that monitors account transactions is described in Patent Document 1. The system in Patent Document 1 is equipped with an acquisition means, a calculation means, and a determination means, and when the difficulty of the judgment is high, it allows a highly skilled person to make the judgment, thereby supporting accurate judgment even when the judgment of whether a transaction is suspicious is complicated.

[0004] Patent Document 2 describes a fraudulent financial transaction detection program for detecting fraudulent financial transactions. The program described in Patent Document 2 causes a computer to execute an information acquisition step of acquiring transaction information related to the transaction history in the bank account of a new person to be detected for fraudulent transactions, and a determination step of judging the possibility of fraudulent transactions by the new person to be detected based on the transaction information acquired in the information acquisition step by referring to previously acquired reference transaction information related to the past transaction history in the bank account of the person to be detected and a degree of correlation of three or more levels between the possibility of fraudulent transactions by the past person to be detected. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-61548 A [Patent Document 2] Patent Publication No. 2021-144355 Summary of the Invention [Problem to be solved by the invention]

[0006] The technology described in the above-mentioned patent documents also describes using learning technologies such as machine learning and deep learning to generate learning data based on past data, etc., and using the data for fraud detection. In addition, in the technology described in the above-mentioned patent documents, scores for "suspicious transactions" and "fraudulent financial transactions" are calculated for each transaction to detect fraudulent financial transactions. For this reason, the technology described in the above-mentioned patent documents does not anticipate detecting fraudulent financial transactions on an account or customer basis. In response to this, the present inventor focused on the fact that, when generating a model used to detect fraudulent financial transactions, although there is a huge amount of information related to financial transactions, generating a model based on all of that information does not necessarily result in a model with high performance in detecting fraudulent transactions.The present inventor then considered what information to use when generating the model and what explanatory variables to generate in order to generate a high-performance model that meets the purpose.

[0007] In view of the above-mentioned problems, one example of the object of the present invention is to provide a monitoring system, a model generation device, a model generation method, and a recording medium that are capable of generating a high-performance model that meets the purpose of detecting fraud in financial transactions. [Means for solving the problem]

[0008] According to one aspect of the present invention, A template information acquisition means for acquiring template information used for generating a model for detecting fraudulent transactions in financial transactions, The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, an input information acquiring means for acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a control means for controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; a model generating means for generating the model based on the controlled generation content of the secondary information; A model generating apparatus is provided, comprising:

[0009] According to one aspect of the present invention, A model generating device for generating a model for detecting fraudulent transactions in financial transactions; a monitoring device for monitoring the financial transactions using the model generated by the model generating device, The model generating device comprises: A template information acquisition means for acquiring template information used for generating a model for detecting fraudulent transactions in financial transactions, The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, an input information acquiring means for acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a control means for controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; a model generating means for generating the model based on the controlled generation content of the secondary information; A monitoring system is provided, comprising:

[0010] According to one aspect of the present invention, One or more computers Obtaining template information to be used in generating a model for detecting fraudulent transactions in financial transactions; The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, Furthermore, the one or more computers For each item specified by the input information item definition information included in the template information, the input information corresponding to that item is acquired; Controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; A model generation method is provided for generating the model based on controlled generation of the secondary information.

[0011] According to one aspect of the present invention, On the computer, obtaining template information to be used in generating a model for detecting fraudulent transactions in financial transactions; The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, The computer includes: A step of acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a step of controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; A computer-readable recording medium storing a program for executing a procedure for generating the model based on the controlled generation content of the secondary information is provided.

[0012] Another aspect of the present invention may be a program for causing at least one computer to execute the method of the above aspect, or a computer-readable recording medium having such a program recorded thereon. The recording medium includes a non-transitory tangible medium. The computer program comprises computer program code which, when executed by a computer, causes the computer to perform the model generation method on a model generation device.

[0013] Any combination of the above components, and any transformation of the present invention into a method, device, system, recording medium, computer program, etc., are also effective as aspects of the present invention.

[0014] Furthermore, the various components of the present invention do not necessarily have to be independent entities, but may be formed as a single member by multiple components, one component may be formed from multiple components, one component may be a part of another component, or part of one component may overlap with part of another component, etc.

[0015] In addition, although the method and computer program of the present invention describe a number of steps in a sequential order, the order does not limit the order in which the steps are executed. Therefore, when implementing the method and computer program of the present invention, the order of the steps can be changed as long as it does not affect the content.

[0016] Furthermore, the steps of the method and computer program of the present invention are not limited to being executed at different timings, and therefore a step may occur while another step is being executed, or the execution timing of a step may overlap partially or entirely with the execution timing of another step, etc. Effect of the Invention

[0017] According to one aspect of the present invention, it is possible to obtain a monitoring system, a model generation device, a model generation method, and a recording medium capable of generating a high-performance model that meets the purpose of detecting fraud in financial transactions. [Brief description of the drawings]

[0018] [Figure 1] 1 is a diagram showing an overview of a monitoring device according to an embodiment; [Diagram 2] 4 is a flowchart showing an example of the operation of the monitoring device of the present embodiment. [Diagram 3] 1 is a diagram conceptually illustrating a system configuration of a monitoring system according to an embodiment. [Figure 4] FIG. 2 is a block diagram illustrating a hardware configuration of a computer that realizes the monitoring device. [Diagram 5] FIG. 4 is a diagram illustrating an example of a data structure of transaction information. [Figure 6] FIG. 4 is a diagram illustrating an example of a data structure of customer information. [Figure 7] FIG. 4 is a diagram illustrating an example of a data structure of account information. [Figure 8] FIG. 13 is a diagram illustrating an example of a data structure of a fraudulent transaction score. [Figure 9] FIG. 13 is a diagram showing an example of an output screen for fraudulent transaction information. [Figure 10] FIG. 13 is a diagram showing an example of a basis information output screen. [Figure 11] 1 is a diagram showing an overview of a model generating device according to an embodiment; [Figure 12] 4 is a flowchart showing an example of the operation of the model generating device of the present embodiment. [Figure 13] 1 is a diagram conceptually illustrating a system configuration of a monitoring system according to an embodiment. [Figure 14] FIG. 13 is a diagram showing an example of data of transaction information within a period, which is an example of secondary information. [Figure 15] FIG. 2 is a functional block diagram illustrating an example of a logical configuration of a model generating device according to an embodiment. [Figure 16] FIG. 13 is a diagram showing an example of data of transaction information within a period. [Figure 17]FIG. 13 is a diagram showing an example of data of transaction information within a period indicating operation result information within a period. [Figure 18] FIG. 13 is a diagram showing an example of a data structure of secondary information including location comparison information. [Figure 19] FIG. 13 is a diagram showing an example of a data structure of secondary information including transaction amount ratio information. [Figure 20] 4 is a flowchart illustrating an example of the operation of the model generating device according to the embodiment. [Figure 21] 1 is a diagram showing an overview of a model generating device according to an embodiment; [Figure 22] 4 is a flowchart illustrating an example of the operation of the model generating device according to the embodiment. [Diagram 23] 1 is a diagram conceptually illustrating a system configuration of a monitoring system according to an embodiment. [Figure 24] FIG. 4 illustrates a data structure of template information. [Diagram 25] FIG. 13 illustrates an example of an import screen. [Figure 26] FIG. 13 is a diagram illustrating an example of an input information selection screen. [Figure 27] FIG. 13 is a diagram showing an example of a secondary information selection screen. [Figure 28] FIG. 4 illustrates an example of a data structure of template information. [Figure 29] FIG. 13 illustrates an example of a template selection screen. [Diagram 30] 4 is a flowchart illustrating an example of the operation of the model generating device according to the embodiment. [Diagram 31] FIG. 4 illustrates an example of a data structure of template information. [Diagram 32] 4 is a flowchart showing a main part of an operation example of the model generating device according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] Hereinafter, the embodiments of the present invention will be described with reference to the drawings. In all the drawings, the same components are given the same reference numerals, and the description will be omitted as appropriate. In addition, in the following drawings, the configuration of the parts that are not related to the essence of the present invention is omitted and is not shown.

[0020] In the embodiment, "acquisition" includes at least one of the following: a device goes to retrieve data or information stored in another device or storage medium (active acquisition), and inputs data or information output from another device to the device (passive acquisition). Examples of active acquisition include making a request or inquiry to another device and receiving a reply, and accessing and reading information from another device or storage medium. Examples of passive acquisition include receiving information that is distributed (or transmitted, push notification, etc.). Furthermore, "acquisition" may mean selecting and acquiring data or information from received data or information, or selecting and receiving distributed data or information.

[0021] (First embodiment) <Minimum configuration example> 1 is a diagram showing an overview of a monitoring device 100 according to an embodiment. The monitoring device 100 includes an input unit 102, a generation unit 104, and an output unit 106. The input unit 102 inputs past transaction information, customer information which is information about a customer, and account information which is information about an account in relation to a financial transaction. The generation unit 104 uses the transaction information, customer information, and account information input by the input unit 102 to generate fraudulent transaction information, which is information regarding fraudulent transactions, using the trained model. The output unit 106 outputs the fraudulent transaction information generated by the generation unit 104. The fraudulent transaction information includes at least one of an account-specific fraudulent transaction score and a customer-specific fraudulent transaction score. <Example of operation> FIG. 2 is a flowchart showing an example of the operation of the monitoring device 100 of this embodiment. First, the input unit 102 inputs past transaction information in financial transactions, customer information which is information about customers, and account information which is information about accounts (step S101). Then, the generation unit 104 uses the transaction information, customer information, and account information input by the input unit 102 to generate fraudulent transaction information which is information about fraudulent transactions using a trained model (step S103). The output unit 106 outputs the fraudulent transaction information generated by the generation unit 104 (step S105). Here, the fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer.

[0022] In this monitoring device 100, the input unit 102 inputs past transaction information in financial transactions, customer information which is information about customers, and account information which is information about accounts. The generation unit 104 uses the transaction information, customer information, and account information input by the input unit 102 to generate fraudulent transaction information which is information about fraudulent transactions, using a trained model. The output unit 106 outputs the fraudulent transaction information generated by the generation unit 104. The fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer.

[0023] In this way, the monitoring device 100 solves the problem of being unable to detect fraudulent financial transactions on a transaction-by-transaction basis, and provides a monitoring system, monitoring device, monitoring method, and recording medium that can detect fraudulent financial transactions on an account or customer basis.

[0024] A detailed example of the monitoring device 100 will be described below.

[0025] Second embodiment <System Overview> FIG. 3 is a diagram conceptually showing the system configuration of a monitoring system 1 according to an embodiment. The monitoring system 1 is a system that uses a monitoring device 100 to monitor financial transactions.

[0026] The monitoring system 1 includes a monitoring device 100. The monitoring device 100 monitors financial transactions for fraudulent activity. The monitoring device 100 is connected to a financial transaction server 30 via a communication network 3a.

[0027] The communication network 3a may be configured by combining multiple networks, but each network shall be secure against unauthorized access from outside. Furthermore, the financial transaction server 30 is connected to multiple ATMs 20 via the communication network 3b. The communication network 3b is a dedicated line for connecting to the financial transaction server 30, and is a network with high security measures.

[0028] The monitoring device 100 has a storage device 120. The storage device 120 stores various data that is input and processed by the monitoring device 100. The monitoring device 100 further has a storage device (not shown) that stores a model 110. The model 110 is a trained model for detecting fraud in financial transactions. The storage device that stores the model 110 and the storage device 120 may be provided inside the monitoring device 100 or may be provided externally. In other words, both the storage device of the model 110 and the storage device 120 may be hardware that is integrated with the monitoring device 100 or hardware that is separate from the monitoring device 100.

[0029] Moreover, the model 110 is generated by a model generating device 200 (or a model generating device 300) of an embodiment described later.

[0030] The financial transaction server 30 may be provided for each financial institution, and manages information regarding financial transactions of that financial institution. The financial transaction server 30 includes a storage device 40 that stores information regarding financial transactions of that financial institution. The storage device 40 may be provided inside the financial transaction server 30, or may be provided externally. In other words, the storage device 40 may be hardware that is integrated with the financial transaction server 30, or may be hardware that is separate from the financial transaction server 30.

[0031] Information regarding financial transactions at the multiple ATMs 20 is transmitted via the communications network 3b to the financial transaction server 30 of the financial institution related to the financial transaction, and stored in the storage device 40.

[0032] The monitoring device 100 is realized by a personal computer or a server computer. The financial transaction server 30 may be realized by a server computer or the like, but since the financial transaction server 30 is a system on the financial institution side, the present invention is not particularly limited thereto.

[0033] Furthermore, the monitoring system 1 may include an operation terminal 10. The operation terminal 10 is connected to the monitoring device 100 via a communication network 3a. The operation terminal 10 is a terminal used by a financial institution or an employee of an institution that monitors financial transactions. The operation terminal 10 is a personal computer or the like. The monitoring device 100 can cause the operation terminal 10 to output the results of monitoring the financial transactions in the monitoring device 100, for example, the results of detection of fraudulent transactions.

[0034] <Hardware configuration example> 4 is a block diagram illustrating an example of a hardware configuration of a computer 1000 that realizes the monitoring device 100. The financial transaction server 30 and the operation terminal 10 in FIG.

[0035] The computer 1000 has a bus 1010, a processor 1020, a memory 1030, a storage device 1040, an input / output interface 1050, and a network interface 1060.

[0036] The bus 1010 is a data transmission path for transmitting and receiving data among the processor 1020, memory 1030, storage device 1040, input / output interface 1050, and network interface 1060. However, the method of connecting the processor 1020 and the like to each other is not limited to a bus connection.

[0037] The processor 1020 is implemented by a central processing unit (CPU) or a graphics processing unit (GPU).

[0038] The memory 1030 is a main storage device realized by a RAM (Random Access Memory) or the like.

[0039] The storage device 1040 is an auxiliary storage device realized by a hard disk drive (HDD), a solid state drive (SSD), a memory card, a read only memory (ROM), or the like. The storage device 1040 stores program modules that realize each function of the monitoring device 100 (e.g., the input unit 102, the generation unit 104, the output unit 106, etc. in FIG. 1), each function of the model generating device 200 described later (e.g., the secondary information generating unit 202, the model generating unit 204, the input unit 206, etc. in FIG. 11, and the like in FIG. 15), and each function of the model generating device 300 described later (e.g., the template information acquiring unit 302, the input information acquiring unit 304, the control unit 306, the model generating unit 308, etc. in FIG. 21). The processor 1020 loads each of these program modules onto the memory 1030 and executes them, thereby realizing each function corresponding to the program module. The storage device 1040 may also store data for the storage device 120 of the monitoring device 100 , the storage devices of the models 110 of the monitoring device 100 , the model generating device 200 and the model generating device 300 , and the storage device 40 of the financial transaction server 30 .

[0040] The program module may be recorded in a recording medium. The recording medium for recording the program module may include a non-transitory tangible medium usable by the computer 1000, and the program code readable by the computer 1000 (processor 1020) may be embedded in the medium.

[0041] The input / output interface 1050 is an interface for connecting the computer 1000 to various input / output devices. The input / output interface 1050 also functions as a communication interface for performing short-range wireless communication such as Bluetooth (registered trademark) and NFC (Near Field Communication).

[0042] The network interface 1060 is an interface for connecting the computer 1000 to a communication network. This communication network is, for example, a LAN (Local Area Network) or a WAN (Wide Area Network). The method for connecting the network interface 1060 to the communication network may be a wireless connection or a wired connection.

[0043] The computer 1000 is then connected to necessary equipment (for example, a display of the monitoring device 100 or the operation terminal 10, an operation unit (keyboard, mouse, touch panel, touch pad, etc.), speaker, microphone, printer, etc.) via the input / output interface 1050 or the network interface 1060.

[0044] The components of the monitoring device 100 of each embodiment in Fig. 1, the model generating device 200 of each embodiment in Fig. 11 and Fig. 15, and the model generating device 300 of Fig. 21 are realized by any combination of hardware and software of the computer 1000 of Fig. 4. Those skilled in the art will understand that there are various modifications to the realization methods and devices. The functional block diagrams showing the monitoring device 100, the model generating device 200, and the model generating device 300 of each embodiment show blocks of logical function units, rather than configurations in hardware units.

[0045] <Example of functional configuration> An example of a functional configuration of the monitoring device 100 according to the embodiment will be described below with reference to FIG. The input unit 102 receives input of past transaction information 400, customer information 410 which is information about a customer, and account information 420 which is information about an account in relation to a financial transaction.

[0046] FIG. 5 is a diagram showing an example of the data structure of the transaction information 400. Transaction information 400 includes, for example, for each transaction, the branch number (branch code) of the branch holding the account, the account code indicating the account item (savings deposit, current deposit, etc.), and account number, which can identify the account where the transaction occurred, the customer number of the customer holding the account where the transaction occurred, a transaction detail number by which the transaction can be identified, the transaction type of the transaction (e.g., cash withdrawal, transfer withdrawal, etc.), the transaction channel indicating the channel of the transaction (e.g., branch counter, ATM, Internet banking, etc.), the date on which the transaction was carried out (transaction date), the time of the transaction, the transaction amount of the transaction, the post-transaction balance of the account where the transaction occurred, and the payable balance indicating the payment limit applied to the transaction account, as well as the counterparty financial institution code, counterparty branch code, and counterparty account number, which can identify the account to which the transaction is to be transferred.

[0047] FIG. 6 is a diagram showing an example of the data structure of the customer information 410. As shown in FIG. Customer information 410 includes the branch number (store code) of the branch where the account in the transaction included in transaction information 400 occurred, the customer number of the customer who holds the account in which the transaction occurred, a personality code indicating the personality of the customer (individual, corporation, financial institution, public fund, sole proprietor, etc.), the date of birth of the customer who holds the account, the nationality of the customer who holds the account, etc.

[0048] FIG. 7 is a diagram showing an example of the data structure of the account information 420. As shown in FIG. Account information 420 includes the branch number (store code) of the account where the transaction included in transaction information 400 occurred, an account code indicating the account category (savings deposit, current deposit, etc.), the account number of the account, the customer number of the customer who holds the account, and the date the account was opened.

[0049] The timing at which the input unit 102 accepts the input of each piece of information may be, for example, a day's worth of input at a predetermined timing between the end of business hours and the start of business hours, or a predetermined number of days' worth of input may be accepted all at once up to the previous business day (or during a predetermined period) at a predetermined timing including business hours. The information input by the input unit 102 is stored in the storage device 120 as transaction information 400, customer information 410, and account information 420, respectively.

[0050] The generation unit 104 uses the transaction information 400, customer information 410, and account information 420 input by the input unit 102, and the trained model 110 to generate fraudulent transaction information 430, which is information regarding fraudulent transactions.

[0051] The fraudulent transaction information 430 includes a score indicative of a fraudulent transaction. At least one of a score per transaction, a score per account, and a score per customer is generated. In particular, it is preferable that the fraudulent transaction information 430 includes at least one of a fraudulent transaction score per account and a fraudulent transaction score per customer. The generated fraudulent transaction information 430 is stored in the storage device 120.

[0052] The score is at least one of a value indicating whether the transaction is fraudulent or not and a value indicating the likelihood of fraud, and may be expressed as a number ranging from 0 to 100, for example, where the closer to 0 the number is, the lower the likelihood of fraud, and the closer to 100 the number is, the higher the likelihood of fraud. Alternatively, the score may be a positive or negative value, where a negative value indicates a higher likelihood of fraud and a positive value indicates a lower likelihood of fraud.

[0053] The fraudulent transaction score criteria may vary depending on whether the account or customer from which the transaction occurred is a business or an individual. For example, corporate transactions and individual transactions are separated, and the scores for each population are sorted in descending order. In this case, the scores obtained when extracting a certain percentage (N%) of transactions from the top for corporations and individuals will be different. The values ​​obtained in this way may be used as the standard values ​​for the fraudulent transaction scores for corporations and individuals, respectively.

[0054] "Fraudulent financial transactions" include, for example, financial transactions with prohibited counterparties or financial transactions with fraudulent purposes. One example of such a transaction is financial transactions with the purpose of money laundering or financing terrorism. In such transactions, an account in another person's name may be purchased and used for fraudulent transactions. In such cases, the deposit and withdrawal situation may change suddenly before and after the account is bought and sold. The amount of deposits and withdrawals may suddenly increase, or the number of deposits and withdrawals may suddenly increase. Alternatively, accounts used for fraudulent transactions may have characteristics such as repeated deposits and withdrawals in a short period of time.

[0055] The monitoring device 100 predicts the presence or absence of fraud in financial transactions and assigns a score to the transactions using a trained model that has learned and modeled the characteristics of such fraudulent transactions. Here, "learning" includes machine learning, deep learning, and the like.

[0056] Figure 8 shows an example of the data structure of each fraudulent transaction score. Figure 8(a) shows an example of the data structure of fraudulent transaction information 430 by transaction, Figure 8(b) shows an example of the data structure of fraudulent transaction information 430 by account, and Figure 8(c) shows an example of the data structure of fraudulent transaction information 430 by customer.

[0057] 8(a) is linked to at least a transaction detail number capable of identifying the transaction and a fraudulent transaction score. The fraudulent transaction information 430 may further include the branch number of the store holding the account where the transaction occurred, the account code of the account, the account number of the account, and the customer number of the customer holding the account.

[0058] 8(b), the fraudulent transaction information by account 430 at least links the account number of the account where the transaction occurred to the fraudulent transaction score. The fraudulent transaction information by account 430 may further include the branch number of the store that holds the account where the transaction occurred, the account code of the account, and the customer number of the customer who holds the account.

[0059] 8(c) is linked to at least the customer number of the customer who holds the account in which the transaction occurred and the fraudulent transaction score. The fraudulent transaction information 430 for each customer may further include the branch number of the store that holds the account in which the transaction occurred, the account code of the account, and the account number of the account.

[0060] When identifying fraudulent transaction information 430 by customer, customers with the same customer number as the customer holding the account in which the transaction occurred are considered to be the same person. However, when identifying transactions related to a customer, transactions may be identified as related to the same customer when not only the customer number of the customer holding the account in which the transaction occurred but also all or at least a portion of other customer attributes, such as the customer's date of birth and nationality, match. Alternatively, accounts may be identified as related to the same customer when not only the customer number of the customer holding the account but also all or at least a portion of other customer attributes, such as the customer's date of birth and nationality, match among multiple accounts.

[0061] The output unit 106 outputs the fraudulent transaction information 430 generated by the generation unit 104. For example, the output unit 106 may cause a screen 500 showing the fraudulent transaction information 430 to be displayed on the display of the monitoring device 100 or the display of the operation terminal 10.

[0062] The operation terminal 10 is given authority to use the monitoring system 1 in advance, and the person in charge of using the operation terminal 10 acquires in advance account information (e.g., a user name and a password) for logging in to the monitoring system 1. An application program for using the services provided by the monitoring system 1 is also installed in the operation terminal 10 in advance, and after starting the program, the person in charge can log in to the monitoring system 1 using the account information and select "View fraudulent transaction information 430" from the menu screen of the monitoring system 1 to display the screen 500.

[0063] FIG. 9 is a diagram showing an example of an output screen 500 for each fraudulent transaction information 430. FIG. 9(a) shows the output screen 500 for fraudulent transaction information 430 by transaction, which outputs, for example, a list of information on transactions having a score above a threshold. The list, for example, includes at least the transaction detail numbers of transactions having a score above a threshold and the value of the fraudulent transaction score. The list may further include the account number of the account in which the transaction occurred and the customer number of the customer who holds the account, and may further include the counterparty account number, counterparty customer number, etc. The risk may also be sorted in descending order of fraudulent transaction score.

[0064] 9(b) is an output screen 500 of fraudulent transaction information by account 430, which includes, for example, at least the account numbers of accounts having a score above a threshold and the fraudulent transaction score values. The list may further include the customer numbers of the customers who hold the accounts, the branch numbers of the stores that hold the accounts, etc. The risks may also be sorted in descending order of fraudulent transaction score.

[0065] 9(c) is an output screen 500 of fraudulent transaction information 430 by customer, which includes, for example, at least the customer numbers of customers who have a score above a threshold and the value of the fraudulent transaction score. The list may further include the account numbers of the accounts held by the customers and the branch numbers of the stores that hold the accounts. The risks may also be sorted in descending order of fraudulent transaction score.

[0066] Furthermore, the output unit 106 outputs basis information on which each piece of fraudulent transaction information 430 was generated.

[0067] Fig. 10 is a diagram showing an example of a basis information output screen 510. Fig. 10(a) shows an example of the basis information output screen 510 including basis information of the account-specific fraudulent transaction information 430. This basis information output screen 510 includes a fraudulent transaction account information display section 512 that displays the account number of an account whose account-specific fraudulent transaction score is equal to or greater than a threshold, a score display section 514 that displays the value of the account-specific fraudulent transaction score, a basis information display section 516 that displays basis information that is the basis of the fraud, and a source information display section 518 that displays the source information of the basis information.

[0068] In this example, the basis information display section 516 displays basis information indicating that the number of transactions in the account has increased sharply since February 2022.

[0069] 10(b) shows an example of a basis information output screen 510 including basis information for the fraudulent transaction information 430. This basis information output screen 510 includes a customer information display section 519 that displays, for a customer whose per-customer fraudulent transaction score is equal to or higher than a threshold, the customer number of that customer and information on at least one account held by that customer, such as the account branch number, item, and account number, in place of the fraudulent transaction account information display section 512 of the basis information output screen 510 in FIG. 10(a), and also includes a score display section 514, a basis information display section 516, and an original information display section 518.

[0070] In this example, the basis information display section 516 displays basis information indicating that the transaction amount in the account held by the customer has increased sharply since February 2022.

[0071] In this way, since the output unit 106 outputs the basis information on which each fraudulent transaction information 430 was generated, the person in charge can specifically check the validity of the judgment on a transaction that has been output as being suspected to be fraudulent, thereby reducing the burden of the person in charge on the confirmation work.

[0072] <Example of operation> An example of the operation of the monitoring device 100 according to the embodiment will be described below with reference to FIG. First, the input unit 102 inputs, at a predetermined timing, past transaction information 400 in a financial transaction, customer information 410 which is information about a customer, and account information 420 which is information about an account (step S101). The input transaction information 400, customer information 410, and account information 420 are stored in the storage device 120.

[0073] Then, the generation unit 104 uses the transaction information 400, customer information 410, and account information 420 input by the input unit 102, and the trained model 110 to generate fraudulent transaction information 430, which is information related to fraudulent transactions (step S103). The fraudulent transaction information 430 includes at least one of fraudulent transaction information 430 by customer and fraudulent transaction information 430 by account. The fraudulent transaction information 430 may further include fraudulent transaction information 430 by transaction. Each piece of fraudulent transaction information 430 is stored in the storage device 120.

[0074] The output unit 106 then outputs the fraudulent transaction information 430 generated by the generation unit 104 (step S105). The output unit 106, for example, causes at least one screen 500 of Figures 9(a) to 9(c) to be displayed on the display of the operation terminal 10. Furthermore, the output unit 106 may cause at least one of basis information output screens 510 of Figures 10(a) and 10(b) to be displayed on the display of the operation terminal 10.

[0075] For example, when the output unit 106 receives a selection operation for the account number column while the screen 500 of Fig. 9(b) is being displayed on the display of the operation terminal 10, it may shift the display screen from the screen 500 to the basis information output screen 510 of the fraudulent transaction information by account 430 of Fig. 10(a) upon receipt of a selection operation for the customer number column. Similarly, when the output unit 106 receives a selection operation for the customer number column while the screen 500 of Fig. 9(c) is being displayed on the display of the operation terminal 10, it may shift the display screen from the screen 500 to the basis information output screen 510 of the fraudulent transaction information by customer 430 of Fig. 10(b).

[0076] As described above, according to this embodiment, the monitoring device 100 includes an input unit 102, a generation unit 104, and an output unit 106. The input unit 102 inputs past transaction information in financial transactions, customer information which is information about customers, and account information which is information about accounts. The generation unit 104 uses the transaction information, customer information, and account information input by the input unit 102 to generate fraudulent transaction information which is information about fraudulent transactions, using the trained model 110. The output unit 106 outputs the fraudulent transaction information generated by the generation unit 104. The fraudulent transaction information includes at least one of a fraudulent transaction score for each account and a fraudulent transaction score for each customer.

[0077] In this way, the monitoring device 100 can solve the problem that fraudulent financial transactions cannot be detected on a transaction-by-transaction basis, and can detect fraudulent financial transactions on an account-by-account or customer-by-customer basis.

[0078] The fraudulent transaction information can also include transaction-specific fraudulent transaction information 430, making it possible to detect fraudulent financial transactions without omission.

[0079] Third embodiment Fig. 11 is a diagram illustrating an overview of a model generation device 200 according to an embodiment. The model generation device 200 of this embodiment generates a trained model 110 used by the monitoring device 100 in Fig. 1. First, an example of a minimum configuration of the model generation device 200 will be described.

[0080] <Minimum configuration example> The model generating device 200 includes a secondary information generating unit 202 and a model generating unit 204 . The secondary information generator 202 generates secondary information that contributes to improving the performance of the model 110 for detecting fraudulent transactions in financial transactions. The model generation unit 204 generates the model 110 using the secondary information generated by the secondary information generation unit 202 .

[0081] <Example of operation> FIG. 12 is a flowchart showing an example of the operation of the model generating device 200 of this embodiment. First, the secondary information generating unit 202 generates secondary information that contributes to improving the performance of the model 110 that detects fraudulent transactions in financial transactions (step S201). Then, the model generating unit 204 generates the model 110 using the secondary information generated by the secondary information generating unit 202 (step S203).

[0082] This model generation device 200 includes a secondary information generation unit 202 and a model generation unit 204. The secondary information generation unit 202 generates secondary information that contributes to improving the performance of the model 110 that detects fraudulent transactions in financial transactions. The model generation unit 204 uses the secondary information generated by the secondary information generation unit 202 to generate the model 110.

[0083] In this way, the model generating device 200 can generate a high-performance model 110 that meets the purpose of detecting fraud in financial transactions.

[0084] A detailed example of the model generating device 200 will be described below.

[0085] (Fourth embodiment) <System Overview> Fig. 13 is a diagram conceptually illustrating a system configuration of a monitoring system 1 according to an embodiment. The monitoring system 1 in Fig. 13 further includes a model generation device 200 in addition to the configuration of the monitoring system 1 in Fig. 3. The model generation device 200 is connected to a financial transaction server 30 via a communication network 3a. However, the configuration of this embodiment may be combined with at least one of the configurations of the other embodiments to the extent that no contradiction occurs.

[0086] The model generating device 200 includes the storage device 220, and may also include a storage device (not shown) that stores the model 110. The storage device of the model 110 and the storage device 220 may be provided inside or outside the model generating device 200. In other words, both the storage device of the model 110 and the storage device 220 may be hardware that is integrated with the model generating device 200, or may be hardware that is separate from the model generating device 200.

[0087] The model generating device 200 is realized by a personal computer, a server computer, or the like.

[0088] <Example of functional configuration> The functional configuration of the model generation device 200 will be described below with reference to FIG. The secondary information generating unit 202 generates secondary information that contributes to improving the performance of the model 110 that detects fraudulent financial transactions. The secondary information includes information that serves as explanatory variables of the model 110, which uses the presence or absence of fraudulent financial transactions and the likelihood of fraud as objective variables. For example, as described above, an account used for fraudulent transactions has characteristics such as repeated deposits and withdrawals in a short period of time. Therefore, as secondary information, the time difference between deposits and withdrawals within a specified period, which indicates a transaction characterized by repeated deposits and withdrawals in a short period of time, the number of deposits per day, the number of withdrawals per day, and the like are generated. The model generating unit 204 generates the model 110 based on the secondary information generated as explanatory variables of the model 110, which uses the presence or absence of fraud in financial transactions and the likelihood of fraud as objective variables, thereby improving the fraudulent transaction detection performance of the model 110.

[0089] The secondary information 440 includes transaction information within a period 442 relating to transaction details during a predetermined period. FIG. 14 is a diagram showing an example of data of within-period transaction information 442, which is an example of secondary information 440. Within-period transaction information 442 is, for example, an example of the number of days in a predetermined period, and includes the number of days elapsed since the last processing date for transaction information of a certain account or a certain customer, and the following information within the period. The processing date is the date on which the processing for generating secondary information 440 was performed. Within-period transaction information 442 includes at least one of the following: deposit / withdrawal time difference indicating the time (minutes) from the deposit time to the withdrawal time, the number of deposits per day, the number of withdrawals per day, the number of deposits per month, the number of withdrawals per month, the cumulative daily deposit amount, the cumulative daily withdrawal amount, the minimum monthly deposit amount, the minimum monthly withdrawal amount, the maximum monthly deposit amount, the maximum monthly withdrawal amount, and the difference between daily deposits and withdrawals.

[0090] The model generating unit 204 generates a model using the secondary information 440 generated by the secondary information generating unit 202. For example, the model generating unit 204 generates a model using the secondary information 440 including within-period transaction information 442.

[0091] As described above, the model 110 is a model that detects whether or not a financial transaction is fraudulent and the likelihood that the transaction is fraudulent. In other words, the secondary information 440 includes information that serves as an explanatory variable for effectively learning fraudulent patterns in financial transactions. There are various other possible secondary information 440 besides those described above, and these variations will be described in detail in the embodiments described below.

[0092] <Example of operation> The operation of the model generating device 200 according to the embodiment will be described below with reference to FIG. First, the secondary information generating unit 202 generates secondary information 440 that contributes to improving the performance of a model for detecting fraudulent transactions in financial transactions (step S201). The secondary information generating unit 202 generates, for example, within-period transaction information 442 shown in Fig. 14 as the secondary information 440. The secondary information generating unit 202 can generate within-period transaction information 442 by using, for example, the transaction information 400 (Fig. 5) described in the above embodiment.

[0093] Then, the model generation unit 204 generates the model 110 by using the secondary information 440 generated by the secondary information generation unit 202 in step S201 (step S203). Since the model 110 is generated using the transaction information within a period 442 that indicates the characteristics of the transaction pattern of fraudulent transactions, the performance of fraud detection in financial transactions using this model 110 can be improved.

[0094] As described above, according to this embodiment, the model generation device 200 includes the secondary information generation unit 202 and the model generation unit 204. The secondary information generation unit 202 generates secondary information that contributes to improving the performance of the model 110 that detects fraudulent transactions in financial transactions. The model generation unit 204 uses the secondary information generated by the secondary information generation unit 202 to generate the model 110.

[0095] In this way, the model generating device 200 can generate a high-performance model 110 that meets the purpose of detecting fraud in financial transactions.

[0096] In addition, since the secondary information 440 includes transaction information within a specified period, it becomes possible to detect suspicious fraudulent events that cannot be detected from a single transaction alone. For example, cases in which deposits and withdrawals are frequently repeated in a short period of time can be detected as fraudulent transactions.

[0097] Fifth embodiment 15 is a functional block diagram showing an example of a logical configuration of a model generating device 200 according to an embodiment. This embodiment is the same as the fourth embodiment, except that it has a configuration for inputting primary information used to generate secondary information. Note that the configuration of this embodiment may be combined with at least one of the configurations of the other embodiments to the extent that no contradiction occurs.

[0098] <Example of functional configuration> The model generating device 200 includes a secondary information generating unit 202 and a model generating unit 204 similar to those of the model generating device 200 in FIG. The input unit 206 receives input of past transaction information 400, customer information 410 which is information related to the customer, and account information 420 which is information related to the account. The secondary information generating unit 202 generates secondary information 440 based on the transaction information 400 , customer information 410 , and account information 420 input by the input unit 206 . The model generation unit 204 generates the model 110 using the transaction information 400, customer information 410, and account information 420 input by the input unit 206, as well as the secondary information 440 generated by the model generation unit 204.

[0099] The transaction information 400, customer information 410, and account information 420 are the same as those in FIGS. 5, 6, and 7 of the second embodiment.

[0100] The secondary information generating unit 202 generates secondary information 440 based on at least two or more pieces of information among the transaction information 400 , the customer information 410 , and the account information 420 input by the input unit 206 .

[0101] Since the secondary information generation unit 202 generates the secondary information 440 based on two or more pieces of information rather than one piece of information, the fraud detection performance of the model 110 can be improved by using secondary information 440 that has more characteristics of fraudulent transaction patterns for training the model 110.

[0102] Other examples of the secondary information 440 will be described below.

[0103] <Example 1: Periodic business partner information> The transaction information within a period 442 of the secondary information 440 may include transaction partner information for a period that indicates whether the transaction partner is different from the set of transaction partners for a given period.

[0104] <Example 2: Period transaction difference information> The intra-period transaction information 442 of the secondary information 440 may include inter-period transaction difference information indicating how much a certain transaction content differs from a group of transaction contents for a predetermined period.

[0105] FIG. 16 is a diagram showing an example of data of the in-period transaction information 442. 16(a) shows an example of within-period transaction information 442 indicating period transaction difference information. This within-period transaction information 442 is an example of the number of days in a specified period, and includes at least one of the number of days elapsed since the previous processing date for transaction information of a certain account, the difference between the average deposit amount per transaction during the period and the deposit amount of a certain transaction, and the difference between the average withdrawal amount per transaction during the period and the withdrawal amount of a certain transaction.

[0106] That is, the model generation unit 204 trains the model 110 to learn that, for example, if the difference from the average deposit amount per transaction is equal to or greater than a threshold, the transaction is likely to be a fraudulent transaction. Then, by using this trained model 110 in the monitoring device 100 of the above embodiment, if the difference from the average deposit amount per transaction is equal to or greater than a threshold, a fraud score can be output indicating that the transaction is likely to be a fraudulent transaction.

[0107] FIG. 16(b) shows an example of within-period transaction information 442 indicating period customer information. This within-period transaction information 442 is an example of the number of days in a specified period for a certain account, and includes the number of days that have passed since the previous processing date for transaction information for a certain account, and a flag indicating whether or not the customers of the account during that period, for example, the transfer destination from that account, include the same account (transfer to same account flag). For example, if there is a transfer to the same account within the specified period, the flag may be set to 1, and if there is no transfer to the same account within the specified period, the flag may be set to 0.

[0108] For example, the model generation unit 204 trains the model 110 to learn that if there is a transfer to the same account (i.e., the transfer to same account flag is set to 1), a transaction from that account to that trading partner is likely to be a fraudulent transaction.

[0109] <Example 3: Operation result information within the period> The transaction information within a period 442 is operation result information within a period that indicates the results of operations on a transaction device within a predetermined period. The transaction device is the ATM 20. The result of the operation of the transaction device may include, for example, the number of times an operation on the ATM 20 resulted in an error.

[0110] 17 is a diagram showing an example of data of transaction information within a period 442 indicating operation result information within a period. This transaction information within a period 442 includes at least one of the number of days elapsed since the previous processing date for transaction information of a certain account, which indicates the number of days in a predetermined period, and the number of times per day that an operation at the ATM 20 caused an error during the period, and the number of times per month that an operation at the ATM 20 caused an error.

[0111] For example, the model generation unit 204 trains the model 110 to learn that if the number of errors occurring in operations at the ATM 20 in a transaction for a certain account is greater than a threshold, the account is likely to be used for fraudulent transactions. Then, by using this trained model 110 in the monitoring device 100 of the above embodiment, it is possible to output a fraud score indicating that the account is likely to be used for fraudulent transactions when the number of errors occurring in operations at the ATM 20 is greater than a threshold.

[0112] <Example 4: Location comparison information> The secondary information 440 is location comparison information that indicates the result of comparing information indicating locations. The information indicating the location is the location where the transaction was made; for example, if the transaction was made at a counter in a store, it is the branch number of that store, and if the transaction was made at ATM 20, it is the branch number of the store that manages ATM 20. The location comparison information can be indicated by a different branch processing flag that indicates whether the branch numbers are the same or different by comparing the branch number of the store where the transaction was made with the branch number of the store that holds the account where the transaction was made. In other words, if the transaction was made at a store different from the store of the account, the different branch processing flag is set to 1, and if the transaction was made at the same store as the store of the account, the different branch processing flag is set to 0.

[0113] FIG. 18 is a diagram showing an example of the data structure of secondary information 440 including location comparison information. This secondary information 440 includes transaction identification information capable of identifying the transaction and a separate branch processing flag for the transaction. This secondary information 440 may further include information capable of identifying the account through which the transaction was made (e.g., the branch number of the store that holds the account, the account code for the account, and the account number for the account).

[0114] That is, the model generation unit 204 causes the model 110 to learn that, for example, when the separate branch processing flag for a certain transaction is set to 1, the transaction is highly likely to be a fraudulent transaction. Then, by using this trained model 110 in the monitoring device 100 of the above embodiment, when the separate branch processing flag for a certain transaction is set to 1, a fraud score indicating that the transaction is highly likely to be a fraudulent transaction can be output.

[0115] <Example 5: Transaction amount ratio information> The secondary information 440 may be transaction amount ratio information indicating the ratio of the transaction amount to a predetermined amount. The predetermined amount is at least one of the balance of the account in which the transaction occurred, the monthly deposit amount (or the amount of salary transfer, etc.), and the average transaction amount per transaction in the previous month. If the ratio of the amount of a certain transaction to the predetermined amount exceeds a threshold, the transaction is a fraudulent transaction.

[0116] 19 is a diagram showing an example of the data structure of secondary information 440 including transaction amount ratio information. This secondary information 440 includes transaction identification information capable of identifying the transaction, and transaction amount ratio information of the transaction. This secondary information 440 may further include information capable of identifying the account through which the transaction was made (for example, the branch number of the store that holds the account, the account code of the account, and the account number of the account).

[0117] In other words, the model generation unit 204 trains the model 110 to learn that, for example, if the ratio of a transaction amount to a specified amount exceeds a threshold, the transaction is likely to be a fraudulent transaction. Then, by using this trained model 110 in the monitoring device 100 of the above embodiment, if the ratio of a transaction amount exceeds a threshold, a fraud score can be output indicating that the transaction is likely to be a fraudulent transaction.

[0118] <Example of operation> FIG. 20 is a flowchart showing an example of the operation of the model generating device 200 according to the embodiment. The flow in FIG. 16 includes the same steps S201 and S203 as the flow in FIG. 12, and further includes step S205 before step S201.

[0119] First, the input unit 206 inputs past transaction information 400, customer information 410 which is information related to the customer, and account information 420 which is information related to the account (step S205). The secondary information generating unit 202 generates secondary information 440 based on the transaction information 400, customer information 410, and account information 420 input by the input unit 206 in step S205 (step S201). The model generation unit 204 generates a model 110 (step S203) using the transaction information 400, customer information 410, and account information 420 input by the input unit 206 in step S205, and the secondary information 440 generated by the model generation unit 204 in step S201.

[0120] As described above, according to this embodiment, the model generating device 200 further includes an input unit 206 in addition to the configuration of the above embodiment. The input unit 206 inputs past transaction information 400, customer information 410 which is information about customers, and account information 420 which is information about accounts. The secondary information generating unit 202 generates secondary information 440 based on the transaction information 400, customer information 410, and account information 420 input by the input unit 206, and the model generating unit 204 generates a model 110 using the transaction information 400, customer information 410, and account information 420 input by the input unit 206, as well as the secondary information 440 generated by the model generating unit 204.

[0121] In this way, the model generation device 200 of this embodiment not only produces the same effects as the above-mentioned embodiment, but also generates secondary information 440 based on the input transaction information 400, customer information 410, and account information 420, so that the secondary information 440 that serves as an explanatory variable for effectively learning fraudulent patterns of various financial transactions can be generated to generate the model 110. Therefore, the performance of fraud detection in financial transactions using the generated model 110 can be further improved.

[0122] Sixth embodiment FIG. 21 is a diagram showing an overview of a model generation device 300 according to an embodiment. The model generation device 200 of this embodiment is the same as the model generation device 200 of FIG. 11 and FIG. 15 in that it generates a trained model used by the monitoring device 100 of FIG. 1. The model generation device 300 of this embodiment differs from the above-described model generation device 200 in that it has a configuration in which a template is used to generate the model 110 when generating the model 110. In other words, the model generation device 300 uses a template to facilitate the generation of the model 110 in the model generation device 200, thereby enabling the performance of fraud detection in financial transactions to be improved. Note that the configuration of this embodiment may be combined with at least one of the configurations of the other embodiments within a range in which no contradiction occurs.

[0123] <Minimum configuration example> The model generating device 300 includes a template information acquiring unit 302 , an input information acquiring unit 304 , a control unit 306 , and a model generating unit 308 . The template information acquisition unit 302 acquires template information used to generate the model 110 for detecting fraudulent transactions in financial transactions. The template information includes input information item definition information that specifies each item of input information used to generate the model 110, and secondary information generation definition information that specifies the generation content of secondary information that contributes to improving the performance of the model 110 based on the input information. The input information acquisition unit 304 acquires input information corresponding to each item specified by input information item definition information included in the template information. The control unit 306 controls the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information. The model generation unit 308 generates the model 110 based on the controlled generation content of the secondary information.

[0124] <Example of operation> FIG. 22 is a flowchart showing an example of the operation of the model generating device 300 according to the embodiment. First, the template information acquiring unit 302 acquires template information used to generate a model 110 for detecting fraudulent transactions in financial transactions (step S301). Then, the input information acquiring unit 304 acquires input information corresponding to each item specified by the input information item definition information included in the template information acquired in step S301 (step S303). The control unit 306 controls the generation content of secondary information according to the secondary information generation definition information included in the template information acquired in step S301 (step S305). The model generating unit 308 generates the model 110 based on the generation content of secondary information controlled in step S305 (step S307).

[0125] The model generating device 300 includes a template information acquiring unit 302, an input information acquiring unit 304, a control unit 306, and a model generating unit 308. The template information acquiring unit 302 acquires template information used to generate a model 110 for detecting fraudulent transactions in financial transactions. The template information includes input information item definition information that identifies the items of each input information used to generate the model 110, and secondary information generation definition information that identifies the generation content of secondary information that contributes to improving the performance of the model 110 based on the input information. The input information acquiring unit 304 acquires input information corresponding to each item identified by the input information item definition information included in the template information. The control unit 306 controls the generation content of secondary information according to the secondary information generation definition information included in the template information. The model generating unit 308 generates the model 110 based on the generation content of the controlled secondary information.

[0126] This model generation device 300 can easily generate a high-performance model that meets the purpose of detecting fraud in financial transactions.

[0127] A detailed example of the model generating device 300 will now be described.

[0128] Seventh embodiment <System Overview> Fig. 23 is a diagram conceptually illustrating a system configuration of a monitoring system 1 according to an embodiment. The monitoring system 1 in Fig. 23 further includes a model generation device 300 in addition to the configuration of the monitoring system 1 in Fig. 3. That is, the model generation device 300 is provided instead of the model generation device 200 of the monitoring system 1 in Fig. 13. The model generation device 300 is connected to the financial transaction server 30 via a communication network 3a. However, the configuration of this embodiment may be combined with at least one of the configurations of the other embodiments to the extent that no contradiction occurs.

[0129] The model generating device 300 includes a storage device 320, and may also include a storage device (not shown) that stores the model 110. The storage device of the model 110 and the storage device 320 may be provided inside or outside the model generating device 300. In other words, both the storage device of the model 110 and the storage device 320 may be hardware that is integrated with the model generating device 300, or may be hardware that is separate from the model generating device 300.

[0130] The model generating device 300 is realized by a personal computer, a server computer, or the like.

[0131] The model generating device 300 generates a model 110 for detecting fraudulent financial transactions. The model generating device 300 acquires information from the financial transaction server 30 and uses the information to generate the model 110. The monitoring device 100 uses the model 110 generated by the model generating device 300 to monitor financial transactions.

[0132] A program for generating the model 110 is installed in the computer 1000 that realizes the model generating device 300. Each function of each element of the model generating device 300 is realized by executing the program. In addition, the operation terminal 10 may function as an operation terminal of the model generating device 300, and the model generating device 300 may function as a server connected to each operation terminal 10 via the communication network 3a, and the operation terminal 10 may function as a client terminal.

[0133] As in the above embodiment, at least one of the model generating device 300 and the operation terminal 10 is given authority to use the monitoring system 1 in advance, and the person in charge of using the model generating device 300 and the operation terminal 10 acquires account information (e.g., a user name and a password) for logging in to the monitoring system 1 in advance. In addition, an application program for using the services provided by the monitoring system 1 is installed in the model generating device 300 and the operation terminal 10 in advance, and after starting the program, various operation screens can be displayed from a menu screen (not shown) of the monitoring system 1 by logging in to the monitoring system 1 using the account information. An operator can generate a model 110 by operating various screens.

[0134] <Example of functional configuration> The functional configuration of the model generating device 300 will be described below with reference to FIG. The template information acquisition unit 302 acquires template information 380 used to generate the model 110 for detecting fraudulent transactions in financial transactions. 24 is a diagram showing the data structure of the template information 380. The template information 380 includes various information that defines the template 360. The template information 380 of the template 360 ​​is stored in the storage device 320.

[0135] The template information 380 includes at least input information item definition information 382 that identifies each item of input information used to generate the model 110, and secondary information generation definition information 384 that identifies the content of secondary information to be generated that contributes to improving the performance of the model 110 based on the input information.

[0136] The input information acquisition unit 304 acquires input information corresponding to each item specified by the input information item definition information 382 included in the template information 380.

[0137] For example, when importing data files such as the transaction information 400, customer information 410, and account information 420 described in the above embodiment, the input information item definition information 382 specifies which item (column of one transaction record) of information to input from each piece of information (data file).

[0138] When the model generating device 300 accepts the selection of "import data file" on the menu screen, an import screen 520 is displayed on the display. Fig. 25 is a diagram showing an example of the import screen 520. The import screen 520 includes a file specification list 522, an OK button 528, and a cancel button 529.

[0139] The file specification list 522 includes a column for the name of the data to be imported and a column for specifying the file of the data. The file specification column includes a file selection button 524 and a selected file display section 526. When the file selection button 524 is pressed, the model generating device 300 opens a window for referring to a data folder and allows the operator to select a data file. The name of the selected data file is displayed in the selected file display section 526.

[0140] When the model generation device 300 receives a press of the OK button 528, it confirms the file designation of the import data and terminates the menu. When the model generation device 300 receives a press of the Cancel button 529, it cancels the file designation of the import data and terminates the menu.

[0141] Next, in the model generation device 300, when the selection of "input information item definition" is accepted on the menu screen, an input information selection screen 530 is displayed on the display. FIG. 26 is a diagram showing an example of the input information selection screen 530. Here, an example of the input information selection screen 530 for selecting data items (columns in a record of one transaction) to be input from among the data items of the transaction information 400 is shown. In other words, the input information selection screen 530 can be said to be a screen for accepting the selection of excluding data items not to be used in generating the model 110 from among the data items of the transaction information 400.

[0142] The input information selection screen 530 is a screen for accepting a selection operation of a data item to be input acquired by the input information acquisition unit 304, generating input information item definition information 382, ​​including it in the template information 380, and storing it in the storage device 320. The input information selection screen 530 includes an import definition information list 532, an import source data list 534, a back button 544, and a next button 548.

[0143] The data items to be input and the source data can be mapped using the import definition information list 532 and the source data list 534. It is assumed that the data items in the import definition information list 532 are already displayed in the same order as the data items in the source data list 534.

[0144] When an operation of the scroll bar of one list is accepted, the other list may be scrolled together or may not be scrolled together, or it may be possible to selectively set which action to take.

[0145] In addition, if the data items in the import definition information list 532 and the import source data list 534 do not match, the model generation device 300 may first accept a selection (by the operator) of a cell in the mapping column of the import definition information list 532 for the data item to be input (a column in a record of a transaction), and then accept a selection (by the operator) of a data item (source data) in the data file of the import source (import source data list 534) that corresponds to the selected data item, and match the destination and source data items.

[0146] In the example of this figure, the description will be given assuming that the data items in the import definition information list 532 and the import source data list 534 are the same. The source data list 534 displays the data names (column names within a transaction record) of each item in the source data file (here, the data file “TON_INF.csv” specified for import as transaction information 400) (for example, store_num, sbj_cd, etc.).

[0147] The model generating device 300 can accept the selection of a data item (column name in a record of one transaction) to be input that the input information acquiring unit 304 should acquire by pressing a cell in the source data list 534 by the operator.

[0148] The cell of the selected data item is displayed as selected 538. The selected display 538 is not particularly limited as long as it is a display method that notifies the operator that the data item has been selected, but for example, the background color of the cell may be changed, the color of the characters in the cell may be changed, or the cell may be highlighted.

[0149] The input information selection screen 530 further has a batch selection button 540 and a reflection button 542. When the model generation device 300 accepts pressing of the batch selection button 540, it collectively selects all data items of the source data file in the source data list 534 as they are, and displays 538 the cells of all the data items as selected. In other words, by pressing the batch selection button 540, the operator can omit the above-mentioned selection operation for each data item. Also, in the collectively selected state, it may be possible to deselect each cell for which the operator's press has been accepted.

[0150] When the model generation device 300 receives a press of the Reflect button 542, it maps the data item of the cell indicated as selected 538 in the import source data list 534 to the data item of the corresponding row in the import definition information list 532, and the data name is displayed in each cell of the mapping column of the import definition information list 532.

[0151] For example, the data name of an item selected in the import source data list 534, for example, "store_num", is displayed in the mapping column of the data item "store number" in the import definition information list 532 by pressing the reflect button 542. The example in this figure shows the state in which the top three data items are selected as input targets and mapped to the import definition information list 532.

[0152] When the model generating device 300 accepts pressing of the back button 544, it cancels the selection operation of the data item accepted on the screen 530 (deletes the selected display 538) and returns to the menu screen. When the model generating device 300 accepts pressing of the next button 548, it causes the model generating device 300 to store in the storage device 320 the input information item definition information 382, ​​which defines the data item selected in the import source data list 534 as an input target, in the template information 380 based on the mapping information reflected in the import definition information list 532.

[0153] The input information selection screen 530 can similarly select and specify customer information 410 and account information 420, and template information 380 including the information defined in the input information item definition information 382 can be stored in the memory device 320.

[0154] The input information acquiring unit 304 uses the input information item definition information 382 defined in this manner to acquire input information corresponding to each item specified in the input information item definition information 382 .

[0155] Next, the control unit 306 controls the content of the secondary information 440 to be generated in accordance with the secondary information generation definition information 384 included in the template information.

[0156] For example, when importing the data files of each secondary information 440 described in the above embodiment, the secondary information generation definition information 384 defines which item (column of one transaction record) of information in the data files of each secondary information 440 should be generated (or not) for use as an explanatory variable.

[0157] In the model generating device 300, when the selection of "Secondary information generation definition" is accepted on the menu screen, a secondary information selection screen 550 is displayed on the display. Fig. 27 is a diagram showing an example of the secondary information selection screen 550. Here, an example of the secondary information selection screen 550 for selecting data items (columns in one record) to be used as explanatory variables from among the data items of the transaction information within the period 442 in Fig. 14 in the secondary information 440 is shown. In other words, the secondary information selection screen 550 can be said to be a screen for accepting the selection of excluding data items not to be used in generating the model 110 from among the data items of the secondary information 440.

[0158] The secondary information selection screen 550 is a screen for receiving a selection operation of the content of the secondary information 440 controlled by the control unit 306 to be generated, in this case, the data items of the secondary information 440 to be used as explanatory variables, generating secondary information generation definition information 384, including it in the template information 380, and storing it in the storage device 320. The secondary information selection screen 550 includes a cancel button 536, a batch selection button 540, a reflect button 542, a back button 544, and a next button 548, which are the same as those in the input information selection screen 530 in FIG.

[0159] The secondary information selection screen 550 further includes an import definition information list 552 and an import source data list 554. Using the import definition information list 552 and the import source data list 554, data items in the import source data list 554 to be imported as data items to be used as explanatory variables can be mapped. It is assumed that the data items in the import definition information list 552 are already displayed in the same order as the data items in the import source data list 554.

[0160] When an operation of the scroll bar of one list is accepted, the other list may be scrolled together or may not be scrolled together, or it may be possible to selectively set which action to take.

[0161] In addition, if the data items in the import definition information list 552 and the source data list 554 do not match, the model generation device 300 may first accept a selection (by the operator) of a cell in the mapping column of the import definition information list 552 for the data item to be input (a column in a record of a transaction), and then accept a selection (by the operator) of a data item (source data) in the data file of the import source (import source data list 554) that corresponds to the selected data item, and match the destination and source data items.

[0162] In the example of this figure, the description will be given assuming that the data items in the import definition information list 552 and the import source data list 554 are the same. The source data list 554 displays the data names (column names within one record) of each item in the source data file (here, the data file “TON_P_INF.csv” specified for import as secondary information 440).

[0163] When the operator presses a cell in the source data list 554, the model generating device 300 can accept the selection of a data item (column name in one record) from the secondary information 440 that is to be generated as an explanatory variable.

[0164] The cell of the selected data item is displayed as selected 556. The selected display 556 is not particularly limited as long as it is a display method that notifies the operator that the data item has been selected, but for example, the background color of the cell may be changed, the color of the characters in the cell may be changed, or the cell may be highlighted.

[0165] When the model generation device 300 receives a press of the Reflect button 542, it maps the data item of the cell indicated as selected 556 in the import source data list 554 to the data item of the corresponding row in the import definition information list 552, and the data name is displayed in each cell of the mapping column of the import definition information list 552.

[0166] For example, the data name of an item selected in the import source data list 554, for example, "date_num", is displayed in the mapping column of the data item "Number of days since last processing date" in the import definition information list 552 by pressing the reflect button 542. The example in this figure shows a state in which four data items have been selected as targets for generating secondary information 440 and mapped to the import definition information list 552.

[0167] When the model generation device 300 receives a press of the Next button 548, it causes the secondary information generation definition information 384, which includes secondary information item definition information that identifies the data item selected in the import source data list 554 based on the mapping information reflected in the import definition information list 552, to be included in the template information 380 and stored in the storage device 320.

[0168] In this way, the secondary information generation definition information 384 includes secondary information item definition information that specifies the items of the secondary information 440 to be generated.

[0169] The secondary information selection screen 550 can similarly select and designate other secondary information 440, and can store the template information 380 including the information defined in the secondary information generation definition information 384 in the storage device 320. Therefore, the secondary information item definition information of the secondary information generation definition information 384 may be information that defines data items for each data file indicating the different secondary information 440.

[0170] The control unit 306 controls the content of the secondary information 440 to be generated in accordance with the secondary information generation definition information 384 defined in this manner.

[0171] Then, the model generation unit 308 generates the model 110 based on the generation content of the secondary information 440 controlled by the control unit 306. In other words, the model generation unit 308 generates the model 110 using the secondary information 440 defined in the secondary information generation definition information 384.

[0172] The model generating device 300 includes a template information acquiring unit 302, an input information acquiring unit 304, a control unit 306, and a model generating unit 308. The template information acquiring unit 302 acquires template information used to generate a model 110 for detecting fraudulent transactions in financial transactions. The template information includes input information item definition information that identifies the items of each input information used to generate the model 110, and secondary information generation definition information that identifies the generation content of secondary information that contributes to improving the performance of the model 110 based on the input information. The input information acquiring unit 304 acquires input information corresponding to each item identified by the input information item definition information included in the template information. The control unit 306 controls the generation content of secondary information according to the secondary information generation definition information included in the template information. The model generating unit 308 generates the model 110 based on the generation content of the controlled secondary information.

[0173] This model generation device 300 can easily generate a high-performance model that meets the purpose of detecting fraud in financial transactions.

[0174] Eighth embodiment The model generation device 300 of this embodiment is similar to the seventh embodiment shown in Fig. 21, except that it has a configuration in which template information 380 is selected from template information 380 in which a plurality of different explanatory variables are defined, and generates a model 110. The model generation device 300 of this embodiment has the same configuration as that shown in Fig. 21, and will be described with reference to Fig. 21.

[0175] <Example of functional configuration> When the template information acquisition unit 302 receives an input for selecting one of a plurality of template information 380 in which at least one of the generation contents of secondary information 440 specified in secondary information generation definition information 384 and the items specified in input information item definition information 382 is different, the template information acquisition unit 302 acquires the selected template information 380.

[0176] For example, template information 380 in which at least one of the definition contents of the input information item definition information 382 and the secondary information generation definition information 384 defined in the model generating device 300 of the seventh embodiment is different can be stored with a name.

[0177] Fig. 28 is a diagram showing an example of the data structure of template information 380. The template information 380 in Fig. 28 includes a template ID for identifying the template 360 ​​and a template name, in addition to the input information item definition information 382 and secondary information generation definition information 384 of the template information 380 in Fig. 24. That is, in template information 380 in which at least one of the input information item definition information 382 and the secondary information generation definition information 384 defined in the seventh embodiment is different, the template ID, template name, input information item definition information 382, ​​and secondary information generation definition information 384 are stored in association with each other.

[0178] In the model generation device 300, when the selection of "template selection" is accepted on the menu screen, a template selection screen 560 is shown on the display. Fig. 29 is a diagram showing an example of the template selection screen 560. The template selection screen 560 includes the same OK button 528 and cancel button 529 as in Fig. 25, and also includes a template list 562.

[0179] The template list 562 displays a list of the template IDs and template names of multiple pieces of template information 380. For example, it is possible to generate a model 110 that can perform analyses (in the figure, the template names are shown as "Analysis 1" or "Analysis 2") with different explanatory variables for detecting fraud in financial transactions, depending on the generation content of the secondary information 440 specified by the secondary information generation definition information 384. Also, in the figure, a template 360 ​​whose template name includes "(Full)" indicates that, for example, the template does not exclude any data items in the secondary information 440 but includes all of them.

[0180] When a template 360 ​​used to generate a model 110 is selected from the template list 562, the row of the selected template 360 ​​is displayed as selected 568. The selected display 568 is not particularly limited as long as it is a display method that notifies the operator that the template 360 ​​has been selected, but for example, the background color of the cell may be changed, the color of the characters in the cell may be changed, or the cell may be highlighted.

[0181] Furthermore, the template selection screen 560 may have a search key input section (not shown) and a search button (not shown). The model generation device 300 may be able to accept at least a part of the template ID or template name of the template input in the search key input section as a search key, and display the template information 380 obtained by searching among the registered template information 380 in the template list 562.

[0182] When the model generating device 300 accepts pressing of the OK button 528, it reads out the template information 380 of the selected template 360 ​​from the storage device 320. The model generating device 300 generates the model 110 using the template information 380.

[0183] Furthermore, the model generation unit 308 may generate the model 110 based on the input information acquired by the input information acquisition unit 304 .

[0184] <Example of operation> FIG. 30 is a flowchart showing an example of the operation of the model generating device 300 according to the embodiment. The flow in FIG. 30 has the same steps S301 to S307 as the flow in FIG. 23, and further has step S321 before step S301.

[0185] First, the template information acquisition unit 302 accepts the operator's selection operation of a template 360 ​​and pressing of the OK button 528 on the template selection screen 560 of Fig. 29 (step S321). Upon accepting the pressing of the OK button 528, the template information acquisition unit 302 reads and acquires, from the storage device 320, the template information 380 of the template 360 ​​that is displayed as selected 568 in the template list 562 (step S301). The process from step S303 onwards is the same as in FIG.

[0186] Additionally, the template information 380 may further include algorithm definition information 386 that specifies the generation algorithm of the model 110 . The model generator 308 generates the model 110 based on a generation algorithm specified in the algorithm definition information 386 .

[0187] FIG. 31 is a diagram showing an example of the data structure of the template information 380. As shown in FIG. Template information 380 in FIG. 31 includes algorithm definition information 386 in addition to the data items of template information 380 in FIG.

[0188] The generating algorithm specified by the algorithm definition information 386 may be, for example, heterogeneous mixture, logistic regression, multi-layer perceptron, gradient boosting, or the like, but may also be other algorithms.

[0189] When the model generating device 300 receives a selection of "algorithm selection" on the menu screen, it may display an algorithm selection screen (not shown) on the display. The algorithm selection screen includes a UI (User Interface) that receives an algorithm selection. When the model generating device 300 receives an algorithm selection by the operator, it defines the selected algorithm in algorithm definition information 386, includes it in template information 380, and stores it in the storage device 320. The template information 380 of the algorithm definition information 386 in which a different algorithm is defined may be linked to a new template ID and template name and stored in the storage device 320 as different template information 380.

[0190] The model generation unit 308 generates the model 110 based on the algorithm defined in the algorithm definition information 386 .

[0191] The control unit 306 determines whether or not to generate secondary information 440 depending on the generation content of secondary information 440 specified by secondary information generation definition information 384, and controls the generation of secondary information 440 if it is determined that secondary information 440 is to be generated.

[0192] Specifically, when the generation contents of the secondary information 440 are defined in the secondary information generation definition information 384 (when a data item of the secondary information 440 is selected on the secondary information selection screen 550 of Fig. 27), the template information 380 may include the secondary information generation definition information 384. In other words, when the generation contents of the secondary information 440 are not defined on the secondary information selection screen 550 of Fig. 27, the template information 380 may not include the secondary information generation definition information 384.

[0193] The control unit 306 may determine that the generation of secondary information 440 is to be controlled if the template information 380 includes secondary information generation definition information 384, and may determine that the generation of secondary information 440 is not to be controlled if the template information 380 does not include secondary information generation definition information 384.

[0194] As another example, the secondary information generation definition information 384 may include a flag indicating whether the generation contents of the secondary information 440 have been defined on the secondary information selection screen 550 in Fig. 27. The control unit 306 may refer to the flag of the secondary information generation definition information 384, and determine to control the generation of the secondary information 440 if the flag indicates that the generation contents of the secondary information 440 have been defined, and may determine not to control the generation of the secondary information 440 if the flag indicates that the generation contents of the secondary information 440 have not been defined.

[0195] The control unit 306 determines whether or not to generate secondary information 440 depending on the generation content of secondary information 440 specified by secondary information generation definition information 384, and if it is determined that secondary information 440 is not to be generated, it does not control the generation of secondary information 440.

[0196] <Example of operation> Fig. 32 is a flowchart showing a main part of an operation example of the model generating device 300 of the embodiment. The flow of Fig. 32 is executed after step S303 of Fig. 22 or Fig. 30 of the model generating device 300 of the above embodiment. In step S303, the input information acquiring unit 304 acquires input information corresponding to each item specified by the input information item definition information included in the template information acquired in step S301. Then, the control unit 306 determines whether or not to generate secondary information 440 according to the generation content of secondary information 440 specified by secondary information generation definition information 384 (step S331).

[0197] Then, when it is determined that the secondary information 440 is not to be generated (NO in step S331), the control unit 306 does not perform control to generate the secondary information 440. In other words, the process bypasses step S305 and proceeds to step S307. In this case, the model generation unit 308 does not generate the secondary information 440, but generates the model 110 based on the input information acquired by the input information acquisition unit 304 in step S303 (step S307).

[0198] On the other hand, when it is determined that the secondary information 440 is to be generated (YES in step S331), the control unit 306 performs control to generate the secondary information 440. That is, the process proceeds to step S305, where the control unit 306 controls the generation content of the secondary information according to the secondary information generation definition information included in the template information acquired in step S301. That is, the control unit 306 generates the secondary information 440.

[0199] Then, the model generation unit 308 generates the model 110 using the secondary information 440 generated in step S305 (step S307). Note that even in this case, the model generation unit 308 may generate the model 110 based on the input information acquired by the input information acquisition unit 304 in step S303 in addition to the secondary information 440.

[0200] As described above, according to this embodiment, when the template information acquiring unit 302 accepts an input for selecting one of a plurality of template information 380 in which at least one of the generation contents of secondary information 440 specified in secondary information generation definition information 384 and the items specified in input information item definition information 382 is different, the template information acquiring unit 302 acquires the selected template information 380.

[0201] In this way, the model generation device 300 of this embodiment not only produces the same effects as the above embodiment, but also allows for generating the model 110 by selecting template information 380 from among template information 380 in which a plurality of different explanatory variables are defined, making it possible to efficiently detect fraud in financial transactions by appropriately selecting pre-prepared template information 380 according to the detection target. Also, since fraud in financial transactions can be detected using explanatory variables suited to the detection content, it is possible to generate the model 110 that can further improve the performance of fraud detection.

[0202] Although the embodiments of the present invention have been described above with reference to the drawings, these are merely examples of the present invention, and various configurations other than those described above can also be adopted. For example, the secondary information generation definition information 384 may be defined using a logical expression such as a logical sum or a logical OR for a plurality of items of the secondary information 440 in addition to identifying the items of the secondary information 440.

[0203] In addition, in the multiple flow charts used in the above description, multiple steps (processing) are described in order, but the order of execution of the steps performed in each embodiment is not limited to the order described. In each embodiment, the order of the steps shown in the figures can be changed to the extent that does not cause problems in terms of content. Also, at least one step may be performed by another operating subject, for example, another device or person. Also, each of the above-mentioned embodiments can be combined to the extent that the content is not contradictory.

[0204] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. In the present invention, when information about users (customers of financial institutions and counterparties to financial transactions) is acquired and used, this shall be done lawfully.

[0205] A part or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes. 1. A template information acquisition means for acquiring template information used to generate a model for detecting fraudulent transactions in financial transactions, The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, an input information acquiring means for acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a control means for controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; a model generating means for generating the model based on the controlled generation content of the secondary information; A model generating device having: 2. In the model generating device according to 1., The template information acquiring means, when receiving an input for selecting one of a plurality of pieces of template information in which at least one of the generation content of the secondary information specified in the secondary information generation definition information and the items specified in the input information item definition information is different, acquires the selected template information. 3. In the model generating device according to 1. or 2., The model generating means further generates a model based on the acquired input information. 4. In the model generating device according to any one of 1. to 3., The template information includes algorithm definition information that specifies a generation algorithm of a model, The model generation means generates the model based on the generation algorithm specified by the algorithm definition information. 5. In the model generating device according to any one of 1. to 4., The control means determines whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and controls the generation of the secondary information when it is determined that the secondary information is to be generated. 6. In the model generating device according to any one of 1. to 5., The control means determines whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and if it is determined that the secondary information will not be generated, does not control the generation of the secondary information. 7. In the model generating device according to any one of 1. to 6., A model generating device, wherein the secondary information generation definition information includes secondary information item definition information that specifies items of the secondary information to be generated.

[0206] 8. A model generating device for generating a model for detecting fraudulent transactions in financial transactions; a monitoring device for monitoring the financial transactions using the model generated by the model generating device, The model generating device comprises: A template information acquisition means for acquiring template information used for generating a model for detecting fraudulent transactions in financial transactions, The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, an input information acquiring means for acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a control means for controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; a model generating means for generating the model based on the controlled generation content of the secondary information; A monitoring system having: 9. In the monitoring system according to 8., a monitoring system in which, when the template information acquisition means of the model generation device accepts an input for selecting one of a plurality of pieces of template information in which at least one of the generation content of the secondary information specified in the secondary information generation definition information and the items specified in the input information item definition information is different, the template information acquisition means acquires the selected template information. 10. In the monitoring system according to 8. or 9., The model generating means of the model generating device further generates a model based on the acquired input information. 11. In the monitoring system according to any one of 8. to 10., The template information includes algorithm definition information that specifies a generation algorithm of a model, A monitoring system, wherein the model generation means of the model generation device generates the model based on the generation algorithm specified by the algorithm definition information. 12. In the monitoring system according to any one of 8. to 11., A monitoring system in which the control means of the model generation device determines whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and controls the generation of the secondary information when it is determined that the secondary information is to be generated. 13. In the monitoring system according to any one of 8. to 12., A monitoring system in which the control means of the model generation device determines whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and if it is determined that the secondary information should not be generated, does not control the generation of the secondary information. 14. In the monitoring system according to any one of 8. to 13., A monitoring system, wherein the secondary information generation definition information includes secondary information item definition information that specifies items of the secondary information to be generated.

[0207] 15. One or more computers Obtaining template information to be used in generating a model for detecting fraudulent transactions in financial transactions; The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, Furthermore, the one or more computers For each item specified by the input information item definition information included in the template information, the input information corresponding to that item is acquired; Controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; A model generation method, comprising: generating the model based on controlled generation content of the secondary information. 16. The model generation method according to claim 15, One or more computers a model generation method for receiving an input for selecting one of a plurality of pieces of template information in which at least one of the generation content of the secondary information specified in the secondary information generation definition information and the items specified in the input information item definition information is different, and acquiring the selected template information. 17. The model generation method according to 15. or 16., One or more computers A model generation method, wherein when generating the model, the model is further generated based on the acquired input information. 18. In the model generation method according to any one of 15 to 17, The template information includes algorithm definition information that specifies a generation algorithm of a model, One or more computers A model generation method, comprising: when generating the model, generating the model based on the generation algorithm specified by the algorithm definition information. 19. In the model generation method according to any one of claims 15 to 18, One or more computers A model generation method which determines whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and controls the generation of the secondary information when it is determined that the secondary information should be generated. 20. In the model generation method according to any one of 15 to 19, One or more computers A model generation method which determines whether or not to generate secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and if it is determined that the secondary information should not be generated, does not control the generation of the secondary information. 21. In the model generation method according to any one of claims 15 to 20, A model generation method, wherein the secondary information generation definition information includes secondary information item definition information that specifies an item of the secondary information to be generated.

[0208] 22. To the computer: obtaining template information to be used in generating a model for detecting fraudulent transactions in financial transactions; The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, The computer includes: A step of acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a step of controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; A program for executing a procedure for generating the model based on the controlled generation content of the secondary information. 23. In the program according to 22., when an input is received to select one of a plurality of pieces of template information in which at least one of the generation content of the secondary information specified in the secondary information generation definition information and the items specified in the input information item definition information is different, the selected template information is acquired. 24. In the program according to 22. or 23., The program further comprises, in the step of generating the model, generating a model based on the acquired input information. 25. In the program according to any one of 22. to 24., The template information includes algorithm definition information that specifies a generation algorithm of a model, A program for generating the model based on the generation algorithm specified by the algorithm definition information in the step of generating the model. 26. In the program according to any one of 22. to 25., A program for causing a computer to execute a procedure for determining whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and controlling the generation of the secondary information when it is determined that the secondary information should be generated. 27. In the program according to any one of 22. to 26., A program for causing a computer to execute a procedure for determining whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and not controlling the generation of the secondary information if it is determined that the secondary information should not be generated. 28. In the program according to any one of 22. to 27., A program, wherein the secondary information generation definition information includes secondary information item definition information that specifies items of the secondary information to be generated.

[0209] 29. To the computer, obtaining template information to be used in generating a model for detecting fraudulent transactions in financial transactions; The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, The computer includes: A step of acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a step of controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; A computer-readable recording medium storing a program for executing a procedure for generating the model based on the controlled generation content of the secondary information. 30. The recording medium according to 29., a step of acquiring the selected template information when an input is received to select one of a plurality of pieces of template information, the plurality of pieces of template information differing in at least one of the content of generation of the secondary information specified in the secondary information generation definition information and the items specified in the input information item definition information is received. 31. In the recording medium according to 29. or 30., A computer-readable recording medium storing a program, in the step of generating the model, further comprising generating a model based on the acquired input information. 32. In the recording medium according to any one of 29. to 31., The template information includes algorithm definition information that specifies a generation algorithm of a model, A computer-readable recording medium storing a program for generating the model based on the generation algorithm specified by the algorithm definition information in the procedure for generating the model. 33. In the recording medium according to any one of 29. to 32., A computer-readable recording medium storing a program for causing a computer to execute a procedure for determining whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and controlling the generation of the secondary information when it is determined that the secondary information should be generated. 34. In the recording medium according to any one of 29. to 33., A computer-readable recording medium storing a program for causing a computer to execute a procedure for determining whether or not to generate secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and not controlling the generation of the secondary information if it is determined that the secondary information will not be generated. 35. In the recording medium according to any one of 29. to 34., The secondary information generation definition information includes secondary information item definition information that specifies the items of the secondary information to be generated. The secondary information generation definition information includes secondary information item definition information that specifies the items of the secondary information to be generated. [Explanation of symbols]

[0210] 1. Surveillance System 3a, 3b Communication Network 10 Operation terminal 20 ATM 30 Financial Transaction Server 40 Storage device 100 Monitoring equipment 102 Input section 104 Generation part 106 Output section 110 Model 120 Storage device 200 Model Generator 202 Secondary information generation section 204 Model Generation Unit 206 Input section 220 Storage device 300 Model Generator 302 Template information acquisition unit 304 Input information acquisition unit 306 Control Unit 308 Model Generation Unit 320 storage device 360 Templates 380 Template Information 382 Input information item definition information 384 Secondary information generation definition information 386 Algorithm definition information 400 Transaction Information 410 Customer information 420 Account Information 430 Fraudulent Transaction Information 440 Secondary information 442 Transaction information within the period 500 screens 510 Basis information output screen 530 Input information selection screen 550 Secondary information selection screen 560 Template selection screen 1000 Computers 1010 Bus 1020 Processor 1030 Memory 1040 Storage Device 1050 Input / Output Interface 1060 Network Interface

Claims

1. A template information acquisition means for acquiring template information used for generating a model for detecting fraudulent transactions in financial transactions, The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, an input information acquiring means for acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a control means for controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; a model generating means for generating the model based on the controlled generation content of the secondary information; A model generating device having:

2. 2. The model generating device according to claim 1, The template information acquiring means, when receiving an input for selecting one of a plurality of pieces of template information in which at least one of the generation content of the secondary information specified in the secondary information generation definition information and the items specified in the input information item definition information is different, acquires the selected template information.

3. 3. The model generating device according to claim 1, The model generating means further generates a model based on the acquired input information.

4. 4. The model generating device according to claim 1, The template information includes algorithm definition information that specifies a generation algorithm of a model, The model generation means generates the model based on the generation algorithm specified by the algorithm definition information.

5. 5. The model generating device according to claim 1, The control means determines whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and controls the generation of the secondary information when it is determined that the secondary information is to be generated.

6. 6. The model generating device according to claim 1, The control means determines whether or not to generate the secondary information depending on the generation content of the secondary information specified in the secondary information generation definition information, and if it is determined that the secondary information will not be generated, does not control the generation of the secondary information.

7. 7. The model generating device according to claim 1, A model generating device, wherein the secondary information generation definition information includes secondary information item definition information that specifies items of the secondary information to be generated.

8. A model generating device for generating a model for detecting fraudulent transactions in financial transactions; a monitoring device for monitoring the financial transactions using the model generated by the model generating device, The model generating device comprises: A template information acquisition means for acquiring template information used for generating a model for detecting fraudulent transactions in financial transactions, The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, an input information acquiring means for acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a control means for controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; a model generating means for generating the model based on the controlled generation content of the secondary information; A monitoring system having:

9. One or more computers Obtaining template information to be used in generating a model for detecting fraudulent transactions in financial transactions; The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, Further, the one or more computers: For each item specified by the input information item definition information included in the template information, the input information corresponding to that item is acquired; Controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; A model generation method, comprising: generating the model based on controlled generation content of the secondary information.

10. On the computer, obtaining template information to be used in generating a model for detecting fraudulent transactions in financial transactions; The template information includes input information item definition information that identifies each item of input information used to generate the model, and secondary information generation definition information that identifies the content of secondary information to be generated that contributes to improving the performance of the model based on the input information, moreover, The computer includes: A step of acquiring the input information corresponding to each item specified by the input information item definition information included in the template information; a step of controlling the content of the secondary information to be generated in accordance with the secondary information generation definition information included in the template information; A program for executing a procedure for generating the model based on the controlled generation content of the secondary information.

Images