Monitoring system, monitoring device, monitoring method and program

Abstract

This monitoring device (100) comprises: an input unit (102) that inputs past transaction information, customer information, which is information about customers, and account information, which is information about accounts, in financial transactions; a generation unit (104) that generates fraudulent transaction information, which is information about fraudulent transactions, using a trained model using the transaction information, customer information, and account information input by the input unit (102); and an output unit (106) that outputs the fraudulent transaction information generated by the generation unit (104), wherein the fraudulent transaction information includes at least one of an account fraudulent transaction score and a customer fraudulent transaction score.

Description

[Technical Field]

[0001] The present invention relates to a monitoring system, a monitoring device, a monitoring method, and a recording medium. [Background technology]

[0002] In recent years, there has been an increase in suspicious financial transactions, which has led to calls for strengthened monitoring of account transactions.

[0003] An example of a transaction monitoring system that monitors account transactions is described in Patent Document 1. The system in Patent Document 1 is equipped with an acquisition means, a calculation means, and a determination means, and supports accurate judgment of whether a transaction is suspicious even when the judgment is complex by having a highly skilled person make the judgment if the judgment is difficult.

[0004] Patent Document 2 describes a fraudulent financial transaction detection program for detecting fraudulent financial transactions. The program described in Patent Document 2 causes a computer to execute an information acquisition step of acquiring transaction information related to the transaction history of a bank account of a new person to be detected for fraudulent transactions, and a determination step of determining the possibility of fraudulent transactions by the new person to be detected based on the transaction information acquired in the information acquisition step, by referring to previously acquired reference transaction information related to the past transaction history of the bank account of the person to be detected and a degree of correlation of three or more levels between the possibility of fraudulent transactions by the past person to be detected. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2019-61548 [Patent Document 2] Patent Publication No. 2021-144355 Summary of the Invention [Problem to be solved by the invention]

[0006] The technology described in the above-mentioned patent documents calculates scores for "suspicious transactions" and "fraudulent financial transactions" and detects fraudulent financial transactions on a transaction-by-transaction basis. Therefore, the technology described in the above-mentioned patent documents does not anticipate detecting fraudulent financial transactions on an account-by-account or customer-by-customer basis. In response to this, the present inventors have considered detecting fraudulent financial transactions on an account-by-account or customer-by-customer basis, which cannot be detected on a transaction-by-transaction basis.

[0007] In view of the above-mentioned problems, one example of an object of the present invention is to provide a monitoring system, a monitoring device, a monitoring method, and a recording medium that solve the problem that fraud in financial transactions cannot be detected on a transaction-by-transaction basis. [Means for solving the problem]

[0008] According to one aspect of the present invention, input means for inputting past transaction information, customer information which is information about customers, and account information which is information about accounts in financial transactions; generation means for generating fraudulent transaction information, which is information relating to fraudulent transactions, using the transaction information, the customer information, and the account information input by the input means and a trained model; an output means for outputting the fraudulent transaction information generated by the generation means; and A monitoring device is provided in which the fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer.

[0009] According to one aspect of the present invention, input means for inputting past transaction information, customer information which is information about customers, and account information which is information about accounts in financial transactions; generation means for generating fraudulent transaction information, which is information relating to fraudulent transactions, using the transaction information, the customer information, and the account information input by the input means and a trained model; an output means for outputting the fraudulent transaction information generated by the generation means; and A monitoring system is provided in which the fraud information includes at least one of an account-specific fraud score and a customer-specific fraud score.

[0010] According to one aspect of the present invention, One or more computers Enter past transaction information, customer information, and account information for financial transactions. Using the input transaction information, customer information, and account information, and using a trained model, generate fraudulent transaction information that is information regarding fraudulent transactions; outputting the generated fraudulent transaction information; A monitoring method is provided in which the fraud information includes at least one of an account-specific fraud score and a customer-specific fraud score.

[0011] According to one aspect of the present invention, On the computer, A procedure for inputting past transaction information, customer information which is information about a customer, and account information which is information about an account in a financial transaction; said input Steps to do generating fraudulent transaction information, which is information regarding fraudulent transactions, using a trained model using the transaction information, customer information, and account information input by the method described above; The above-mentioned generation Steps to do and outputting the fraudulent transaction information generated by the program. The fraudulent transaction information includes at least one of a fraudulent transaction score for each account and a fraudulent transaction score for each customer. A computer-readable recording medium storing a program is provided.

[0012] Another aspect of the present invention may be a program that causes at least one computer to execute the method of the above aspect, or a computer-readable recording medium on which such a program is recorded. This recording medium includes a non-transitory tangible medium. The computer program comprises computer program code which, when executed by a computer, causes the computer to perform the monitoring method on a monitoring device.

[0013] Any combination of the above components, and any transformation of the present invention into a method, device, system, recording medium, computer program, etc., are also valid aspects of the present invention.

[0014] Furthermore, the various components of the present invention do not necessarily have to be independent entities, but may be formed as a single member by multiple components, one component may be formed from multiple components, one component may be part of another component, or part of one component may overlap with part of another component, etc.

[0015] Furthermore, although the method and computer program of the present invention describe a number of steps in a sequential order, the order in which the steps are described does not limit the order in which the steps are executed. Therefore, when implementing the method and computer program of the present invention, the order of the steps can be changed as long as it does not cause any problems in terms of the content.

[0016] Furthermore, the multiple steps of the method and computer program of the present invention are not limited to being executed at different times, and therefore, a step may occur while another step is being executed, or the execution timing of a step may partially or completely overlap with the execution timing of another step, etc. [Effects of the Invention]

[0017] According to one aspect of the present invention, it is possible to provide a monitoring system, a monitoring device, a monitoring method, and a recording medium that solve the problem of not being able to detect fraudulent financial transactions on a transaction-by-transaction basis. [Brief explanation of the drawings]

[0018] [Figure 1] 1 is a diagram illustrating an overview of a monitoring device according to an embodiment. [Figure 2] 4 is a flowchart illustrating an example of the operation of the monitoring device of the present embodiment. [Figure 3] 1 is a diagram conceptually illustrating a system configuration of a monitoring system according to an embodiment. [Figure 4] FIG. 2 is a block diagram illustrating an example of a hardware configuration of a computer that realizes the monitoring device. [Figure 5] FIG. 10 is a diagram illustrating an example of a data structure of transaction information. [Figure 6] FIG. 2 is a diagram illustrating an example of a data structure of customer information. [Figure 7] FIG. 10 is a diagram illustrating an example of the data structure of account information. [Figure 8] FIG. 10 is a diagram illustrating an example of a data structure of a fraudulent transaction score. [Figure 9] FIG. 10 is a diagram showing an example of an output screen for fraudulent transaction information. [Figure 10] FIG. 10 is a diagram illustrating an example of a basis information output screen. [Figure 11] 1 is a diagram illustrating an overview of a model generation device according to an embodiment. [Figure 12] 10 is a flowchart illustrating an example of the operation of the model generating device of the present embodiment. [Figure 13] 1 is a diagram conceptually illustrating a system configuration of a monitoring system according to an embodiment. [Figure 14] FIG. 10 is a diagram showing an example of data of transaction information within a period, which is an example of secondary information. [Figure 15] FIG. 2 is a functional block diagram illustrating an example of a logical configuration of a model generating device according to an embodiment. [Figure 16] FIG. 10 is a diagram showing an example of data of transaction information within a period. [Figure 17]FIG. 10 is a diagram showing an example of data of transaction information within a period indicating operation result information within a period. [Figure 18] FIG. 10 is a diagram showing an example of a data structure of secondary information including location comparison information. [Figure 19] FIG. 10 is a diagram illustrating an example of a data structure of secondary information including transaction amount ratio information. [Figure 20] 10 is a flowchart illustrating an example of the operation of the model generating device according to the embodiment. [Figure 21] 1 is a diagram illustrating an overview of a model generation device according to an embodiment. [Figure 22] 10 is a flowchart illustrating an example of the operation of the model generating device according to the embodiment. [Figure 23] 1 is a diagram conceptually illustrating a system configuration of a monitoring system according to an embodiment. [Figure 24] FIG. 10 is a diagram illustrating a data structure of template information. [Figure 25] FIG. 10 is a diagram illustrating an example of an import screen. [Figure 26] FIG. 10 is a diagram illustrating an example of an input information selection screen. [Figure 27] FIG. 10 is a diagram showing an example of a secondary information selection screen. [Figure 28] FIG. 10 illustrates an example data structure of template information. [Figure 29] FIG. 10 is a diagram illustrating an example of a template selection screen. [Figure 30] 10 is a flowchart illustrating an example of the operation of the model generating device according to the embodiment. [Figure 31] FIG. 10 illustrates an example data structure of template information. [Figure 32] 1 is a flowchart illustrating a main part of an example of the operation of the model generating device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0019] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In all drawings, similar components are designated by similar reference numerals, and their description will be omitted as appropriate. In addition, in the following drawings, configurations of parts that are not related to the essence of the present invention are omitted and are not shown.

[0020] In the embodiments, "acquisition" includes at least one of the following: a device going to retrieve data or information stored in another device or storage medium (active acquisition), and inputting data or information output from another device into the device (passive acquisition). Examples of active acquisition include making a request or inquiry to another device and receiving a reply, and accessing and reading information from another device or storage medium. An example of passive acquisition is receiving information that is distributed (or transmitted, pushed, etc.). Furthermore, "acquisition" may also mean selecting and acquiring data or information from received data or information, or selecting and receiving distributed data or information.

[0021] (First embodiment) <Minimum configuration example> 1 is a diagram showing an overview of a monitoring device 100 according to an embodiment. The monitoring device 100 includes an input unit 102, a generation unit 104, and an output unit 106. The input unit 102 receives input of past transaction information, customer information that is information about a customer, and account information that is information about an account in a financial transaction. The generation unit 104 uses the transaction information, customer information, and account information input by the input unit 102 and the trained model to generate fraudulent transaction information, which is information related to fraudulent transactions. The output unit 106 outputs the fraudulent transaction information generated by the generation unit 104. The fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer. <Example of operation> FIG. 2 is a flowchart showing an example of the operation of the monitoring device 100 of this embodiment. First, the input unit 102 inputs past transaction information, customer information, which is information about customers, and account information, which is information about accounts, in financial transactions (step S101). Then, the generation unit 104 uses the transaction information, customer information, and account information input by the input unit 102 to generate fraudulent transaction information, which is information about fraudulent transactions, using a trained model (step S103). The output unit 106 outputs the fraudulent transaction information generated by the generation unit 104 (step S105). Here, the fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer.

[0022] In this monitoring device 100, the input unit 102 inputs past transaction information for financial transactions, customer information that is information about customers, and account information that is information about accounts. The generation unit 104 uses the transaction information, customer information, and account information input by the input unit 102 to generate fraudulent transaction information that is information about fraudulent transactions using a trained model. The output unit 106 outputs the fraudulent transaction information generated by the generation unit 104. The fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer.

[0023] In this way, the monitoring device 100 solves the problem of not being able to detect fraud in financial transactions on a transaction-by-transaction basis, and provides a monitoring system, monitoring device, monitoring method, and recording medium that can detect fraud in financial transactions on an account-by-account or customer-by-customer basis.

[0024] A detailed example of the monitoring device 100 will be described below.

[0025] (Second embodiment) <System Overview> FIG. 3 is a diagram conceptually showing the system configuration of a monitoring system 1 according to an embodiment. The monitoring system 1 is a system that uses a monitoring device 100 to monitor financial transactions.

[0026] The monitoring system 1 includes a monitoring device 100. The monitoring device 100 monitors fraudulent financial transactions. The monitoring device 100 is connected to a financial transaction server 30 via a communication network 3a.

[0027] The communication network 3a may be configured by combining multiple networks, but each network must be secure against unauthorized access from outside. Furthermore, the financial transaction server 30 is connected to multiple ATMs 20 via the communication network 3b. The communication network 3b is a dedicated line for connecting to the financial transaction server 30, and is a network with advanced security measures in place.

[0028] The monitoring device 100 includes a storage device 120. The storage device 120 stores various data that are input and processed by the monitoring device 100. The monitoring device 100 further includes a storage device (not shown) that stores a model 110. The model 110 is a trained model for detecting fraud in financial transactions. The storage device that stores the model 110 and the storage device 120 may be provided inside or outside the monitoring device 100. In other words, both the storage device of the model 110 and the storage device 120 may be hardware that is integrated with the monitoring device 100, or may be hardware that is separate from the monitoring device 100.

[0029] The model 110 is generated by a model generation device 200 (or a model generation device 300) of an embodiment described later.

[0030] The financial transaction server 30 may be provided for each financial institution and manages information relating to financial transactions of that financial institution. The financial transaction server 30 includes a storage device 40 that stores information relating to financial transactions of that financial institution. The storage device 40 may be provided inside the financial transaction server 30 or may be provided externally. In other words, the storage device 40 may be hardware that is integrated with the financial transaction server 30, or may be hardware that is separate from the financial transaction server 30.

[0031] Information relating to financial transactions at the multiple ATMs 20 is transmitted via the communication network 3b to the financial transaction server 30 of the financial institution associated with the financial transaction, and stored in the storage device 40.

[0032] The monitoring device 100 is realized by a personal computer or a server computer. The financial transaction server 30 may also be realized by a server computer, but since the financial transaction server 30 is a system on the side of a financial institution, the present invention is not particularly limited to such a system.

[0033] Furthermore, the monitoring system 1 may include an operation terminal 10. The operation terminal 10 is connected to the monitoring device 100 via a communication network 3a. The operation terminal 10 is a terminal used by a financial institution or an official at an institution that monitors financial transactions. The operation terminal 10 is a personal computer or the like. The monitoring device 100 can cause the operation terminal 10 to output the results of monitoring financial transactions by the monitoring device 100, such as the results of detecting fraudulent transactions.

[0034] <Hardware configuration example> 4 is a block diagram illustrating an example of the hardware configuration of a computer 1000 that realizes the monitoring device 100. The financial transaction server 30 and the operation terminal 10 in FIG.

[0035] The computer 1000 includes a bus 1010 , a processor 1020 , a memory 1030 , a storage device 1040 , an input / output interface 1050 , and a network interface 1060 .

[0036] The bus 1010 is a data transmission path for transmitting and receiving data among the processor 1020, memory 1030, storage device 1040, input / output interface 1050, and network interface 1060. However, the method of connecting the processor 1020 and the like to each other is not limited to bus connection.

[0037] The processor 1020 is implemented by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), or the like.

[0038] The memory 1030 is a main storage device realized by a RAM (Random Access Memory) or the like.

[0039] The storage device 1040 is an auxiliary storage device realized by a hard disk drive (HDD), a solid state drive (SSD), a memory card, a read-only memory (ROM), or the like. The storage device 1040 stores program modules that realize each function of the monitoring device 100 (e.g., the input unit 102, the generation unit 104, the output unit 106, etc. in FIG. 1 ), each function of the model generation device 200 (described later) (e.g., the secondary information generation unit 202, the model generation unit 204, the input unit 206 in FIG. 11 , etc. in FIG. 15 ), and each function of the model generation device 300 (e.g., the template information acquisition unit 302, the input information acquisition unit 304, the control unit 306, the model generation unit 308, etc. in FIG. 21 ). The processor 1020 loads each of these program modules into the memory 1030 and executes them, thereby realizing each function corresponding to the program module. The storage device 1040 may also store data from the storage device 120 of the monitoring device 100, the storage devices of the models 110 of the monitoring device 100, the model generating device 200, and the model generating device 300, and the storage device 40 of the financial transaction server 30.

[0040] The program module may be recorded on a recording medium. The recording medium on which the program module is recorded may include a non-transitory, tangible medium usable by the computer 1000, and the program code readable by the computer 1000 (processor 1020) may be embedded in the medium.

[0041] The input / output interface 1050 is an interface for connecting the computer 1000 with various input / output devices. The input / output interface 1050 also functions as a communication interface for performing short-range wireless communication such as Bluetooth (registered trademark) and NFC (Near Field Communication).

[0042] The network interface 1060 is an interface for connecting the computer 1000 to a communication network. This communication network is, for example, a LAN (Local Area Network) or a WAN (Wide Area Network). The method for connecting the network interface 1060 to the communication network may be a wireless connection or a wired connection.

[0043] The computer 1000 is then connected to necessary equipment (e.g., a display of the monitoring device 100 or the operation terminal 10, an operation unit (keyboard, mouse, touch panel, touchpad, etc.), speaker, microphone, printer, etc.) via the input / output interface 1050 or the network interface 1060.

[0044] The components of the monitoring device 100 of each embodiment in Fig. 1, the model generation device 200 of each embodiment in Fig. 11 and Fig. 15, and the model generation device 300 of Fig. 21 are realized by any combination of hardware and software of the computer 1000 of Fig. 4. Those skilled in the art will understand that there are many variations in the realization methods and devices. The functional block diagrams showing the monitoring device 100, model generation device 200, and model generation device 300 of each embodiment show logical functional unit blocks rather than hardware unit configurations.

[0045] <Example of functional configuration> An example of the functional configuration of the monitoring device 100 according to the embodiment will be described below with reference to FIG. The input unit 102 receives input of past transaction information 400, customer information 410, which is information about a customer, and account information 420, which is information about an account, in relation to financial transactions.

[0046] FIG. 5 is a diagram showing an example of the data structure of the transaction information 400. Transaction information 400 includes, for example, for each transaction, the branch number (branch code) of the branch holding the account, the account code indicating the account (savings deposit, current account, etc.), and account number, which can identify the account where the transaction occurred, the customer number of the customer holding the account where the transaction occurred, a transaction detail number that can identify the transaction, the transaction type of the transaction (e.g., cash withdrawal, transfer withdrawal, etc.), the transaction channel indicating the channel of the transaction (e.g., branch counter, ATM, Internet banking, etc.), the date the transaction was carried out (transaction date), the time, the transaction amount of the transaction, the post-transaction balance of the account where the transaction occurred, the payable balance indicating the payment limit applied to the transaction account, and the counterparty financial institution code, counterparty branch code, and counterparty account number, which can identify the account to which the transaction is to be transferred.

[0047] FIG. 6 is a diagram showing an example of the data structure of the customer information 410. The customer information 410 includes the branch number (branch code) of the branch holding the account where the transaction included in the transaction information 400 occurred, the customer number of the customer holding the account where the transaction occurred, a personality code indicating the personality of the customer (individual, corporation, financial institution, public fund, sole proprietor, etc.), the date of birth of the customer holding the account, the nationality of the customer holding the account, etc.

[0048] FIG. 7 is a diagram showing an example of the data structure of the account information 420. Account information 420 includes the branch number (store code) of the branch where the account held at which the transaction included in transaction information 400 occurred, an account code indicating the account type (savings deposit, current deposit, etc.), the account number of the account, the customer number of the customer who holds the account, and the date the account was opened.

[0049] The timing at which input unit 102 accepts input of each piece of information may be, for example, accepting input for one day at a predetermined timing between the end of business hours and the start of business hours, or accepting input for a predetermined number of days up to the previous business day (or for a predetermined period) at a predetermined timing including business hours. The information entered by input unit 102 is stored in storage device 120 as transaction information 400, customer information 410, and account information 420, respectively.

[0050] The generation unit 104 uses the transaction information 400, customer information 410, and account information 420 input by the input unit 102 and the trained model 110 to generate fraudulent transaction information 430, which is information regarding fraudulent transactions.

[0051] The fraudulent transaction information 430 includes a score indicating a fraudulent transaction. At least one of a score per transaction, per account, and per customer is generated. In particular, the fraudulent transaction information 430 preferably includes at least one of a fraudulent transaction score per account and a fraudulent transaction score per customer. The generated fraudulent transaction information 430 is stored in the storage device 120.

[0052] The score is at least one of a value indicating whether the transaction is fraudulent or not and a value indicating the likelihood of fraud, and may be expressed as a number ranging from 0 to 100, for example, indicating that the closer to 0 the number is, the lower the likelihood of fraud, and that the closer to 100 the number is, the higher the likelihood of fraud. Alternatively, the score may be a positive or negative value, with a negative value indicating a higher likelihood of fraud and a positive value indicating a lower likelihood of fraud.

[0053] The criteria for fraudulent transaction scoring may vary depending on whether the account or customer from which the transaction occurred is a corporation or an individual. For example, separate corporate transactions and individual transactions, and sort the scores for each population in descending order. In this case, the scores obtained when extracting a predetermined percentage (N%) of the top transactions for corporations and individuals will be different. The values ​​obtained in this way can be used as the reference values ​​for fraudulent transaction scores for corporations and individuals, respectively.

[0054] "Fraudulent financial transactions" include, for example, financial transactions with prohibited counterparties or financial transactions with fraudulent purposes. One example of such transactions is financial transactions for the purpose of money laundering or financing terrorism. In such transactions, accounts in other people's names may be purchased and used for fraudulent transactions. In such cases, the deposit and withdrawal situation may change suddenly before and after the account is bought and sold. The amount of deposits and withdrawals may suddenly increase, or the number of deposits and withdrawals may suddenly increase. Alternatively, accounts used for fraudulent transactions may have characteristics such as repeated deposits and withdrawals in short periods of time.

[0055] The monitoring device 100 predicts and scores the presence or absence of fraud in financial transactions using a trained model that has learned and modeled the characteristics of such fraudulent transactions. Here, "learning" includes machine learning, deep learning, etc.

[0056] Figure 8 shows an example of the data structure of each fraudulent transaction score. Figure 8(a) shows an example of the data structure of fraudulent transaction information 430 by transaction, Figure 8(b) shows an example of the data structure of fraudulent transaction information 430 by account, and Figure 8(c) shows an example of the data structure of fraudulent transaction information 430 by customer.

[0057] 8(a) includes at least a transaction detail number that can identify the transaction and a fraudulent transaction score linked to it. The fraudulent transaction information 430 may further include the branch number of the store that holds the account where the transaction occurred, the account code of the account, the account number of the account, and the customer number of the customer who holds the account.

[0058] 8(b), the fraudulent transaction information by account 430 at least links the account number of the account where the transaction occurred to the fraudulent transaction score. The fraudulent transaction information by account 430 may further include the branch number of the store that holds the account where the transaction occurred, the account code of the account, and the customer number of the customer that holds the account.

[0059] 8(c) includes at least a fraudulent transaction score linked to the customer number of the customer who holds the account where the transaction occurred. The fraudulent transaction information 430 for each customer may further include the branch number of the store that holds the account where the transaction occurred, the account code of the account, and the account number of the account.

[0060] When identifying customer-specific fraudulent transaction information 430, customers with the same customer number as the customer holding the account where the transaction occurred are considered to be the same person. However, when identifying transactions related to a customer, transactions may be identified as related to the same customer when not only the customer number of the customer holding the account where the transaction occurred but also all or at least some of the customer's attributes, such as the customer's date of birth and nationality, match. Alternatively, accounts may be identified as related to the same customer when not only the customer number of the customer holding the account but also all or at least some of the customer's attributes, such as the customer's date of birth and nationality, match among multiple accounts.

[0061] The output unit 106 outputs the fraudulent transaction information 430 generated by the generation unit 104. For example, the output unit 106 may cause a screen 500 showing the fraudulent transaction information 430 to be displayed on the display of the monitoring device 100 or the display of the operation terminal 10.

[0062] The operation terminal 10 is given authority to use the monitoring system 1 in advance, and the person in charge using the operation terminal 10 acquires in advance account information (e.g., a user name and password) for logging in to the monitoring system 1. In addition, an application program for using the services provided by the monitoring system 1 is installed in advance on the operation terminal 10, and after starting the program, the person in charge can log in to the monitoring system 1 using the account information and select "View fraudulent transaction information 430" from the menu screen of the monitoring system 1 to display screen 500.

[0063] FIG. 9 is a diagram showing an example of an output screen 500 for each fraudulent transaction information 430. FIG. 9(a) shows the output screen 500 for the fraudulent transaction information 430 for each transaction, which outputs, for example, a list of information about transactions with scores above a threshold. The list includes, for example, at least the transaction detail number of the transaction with a score above a threshold and the value of the fraudulent transaction score. The list may further include the account number of the account in which the transaction occurred and the customer number of the customer who holds the account, and may also include the counterparty account number, counterparty customer number, etc. In addition, the list may include, for example, the account number of the account in which the transaction occurred and the customer number of the customer who holds the account. list may be sorted by highest fraudulent transaction score.

[0064] FIG. 9(b) is an output screen 500 of the fraudulent transaction information 430 by account, which includes, for example, at least the account numbers of accounts with scores above a threshold and the fraudulent transaction scores. The list may further include the customer numbers of the customers who hold the accounts, the store numbers of the stores that hold the accounts, etc. list may be sorted by highest fraudulent transaction score.

[0065] FIG. 9(c) is an output screen 500 of the fraudulent transaction information 430 for each customer, which includes, for example, at least the customer numbers of customers who have scores above a threshold and the fraudulent transaction scores. The list may further include the account numbers of the accounts held by the customers and the branch numbers of the stores that hold the accounts. list may be sorted by highest fraudulent transaction score.

[0066] Furthermore, the output unit 106 outputs the basis information that is the basis for generating each piece of fraudulent transaction information 430.

[0067] Figure 10 is a diagram showing an example of a basis information output screen 510. Figure 10(a) shows an example of the basis information output screen 510 including the basis information of the account-specific fraudulent transaction information 430. This basis information output screen 510 includes a fraudulent transaction account information display section 512 that displays the account number of an account whose fraudulent transaction score is equal to or greater than a threshold, a score display section 514 that displays the fraudulent transaction score value for each account, a basis information display section 516 that displays the basis information for the fraud, and a source information display section 518 that displays the information that is the source of the basis information.

[0068] In this example, the basis information display section 516 displays basis information indicating that the number of transactions in the account has increased sharply since February 2022.

[0069] 10(b) shows an example of a basis information output screen 510 including the basis information of the fraudulent transaction information 430. This basis information output screen 510 includes, in place of the fraudulent transaction account information display section 512 on the basis information output screen 510 in FIG. 10(a), a customer information display section 519 that displays, for customers whose fraudulent transaction score per customer is equal to or exceeds a threshold, the customer number of the customer and information on at least one account held by the customer, such as the account branch number, account number, and account number, as well as a score display section 514, a basis information display section 516, and a raw information display section 518.

[0070] In this example, the basis information display section 516 displays basis information indicating that the transaction amount in the account held by the customer has increased sharply since February 2022.

[0071] In this way, the output unit 106 outputs the basis information that served as the basis for generating each fraudulent transaction information 430, allowing the person in charge to specifically confirm the validity of the judgment regarding a transaction that has been output as suspected to be fraudulent, thereby reducing the burden of the person in charge's confirmation work.

[0072] <Example of operation> An example of the operation of the monitoring device 100 according to the embodiment will be described below with reference to FIG. First, the input unit 102 inputs, at a predetermined timing, past transaction information 400, customer information 410, which is information about the customer, and account information 420, which is information about the account, in a financial transaction (step S101). The input transaction information 400, customer information 410, and account information 420 are stored in the storage device 120.

[0073] The generation unit 104 then uses the transaction information 400, customer information 410, and account information 420 input by the input unit 102 and the trained model 110 to generate fraudulent transaction information 430, which is information related to fraudulent transactions (step S103). The fraudulent transaction information 430 includes at least one of fraudulent transaction information 430 by customer and fraudulent transaction information 430 by account. The fraudulent transaction information 430 may further include fraudulent transaction information 430 by transaction. Each piece of fraudulent transaction information 430 is stored in the storage device 120.

[0074] The output unit 106 then outputs the fraudulent transaction information 430 generated by the generation unit 104 (step S105). The output unit 106, for example, causes the display of the operation terminal 10 to display at least one of screens 500 shown in Figures 9(a) to 9(c). Furthermore, the output unit 106 may cause the display of the operation terminal 10 to display at least one of the basis information output screens 510 shown in Figures 10(a) and 10(b).

[0075] For example, when the output unit 106 receives a selection operation for the account number column while the screen 500 of Figure 9(b) is being displayed on the display of the operation terminal 10, it may transition the display screen from the screen 500 to the basis information output screen 510 of the fraudulent transaction information by account 430 of Figure 10(a). Similarly, when the output unit 106 receives a selection operation for the customer number column while the screen 500 of Figure 9(c) is being displayed on the display of the operation terminal 10, it may transition the display screen from the screen 500 to the basis information output screen 510 of the fraudulent transaction information by customer 430 of Figure 10(b).

[0076] As described above, according to this embodiment, the monitoring device 100 includes an input unit 102, a generation unit 104, and an output unit 106. The input unit 102 inputs past transaction information in financial transactions, customer information which is information about customers, and account information which is information about accounts. The generation unit 104 uses the transaction information, customer information, and account information input by the input unit 102 to generate fraudulent transaction information which is information about fraudulent transactions using the trained model 110. The output unit 106 outputs the fraudulent transaction information generated by the generation unit 104. The fraudulent transaction information includes at least one of a fraudulent transaction score for each account and a fraudulent transaction score for each customer.

[0077] In this way, the monitoring device 100 solves the problem that fraud in financial transactions cannot be detected on a transaction-by-transaction basis, and can detect fraud in financial transactions on an account-by-account or customer-by-customer basis.

[0078] Furthermore, the fraudulent transaction information can also include fraudulent transaction information 430 for each transaction, so that fraudulent financial transactions can be detected without omission.

[0079] (Third embodiment) Fig. 11 is a diagram illustrating an overview of a model generation device 200 according to an embodiment. The model generation device 200 of this embodiment generates a trained model 110 used by the monitoring device 100 of Fig. 1. First, an example of the minimum configuration of the model generation device 200 will be described.

[0080] <Minimum configuration example> The model generating device 200 includes a secondary information generating unit 202 and a model generating unit 204 . The secondary information generator 202 generates secondary information that contributes to improving the performance of the model 110 for detecting fraudulent transactions in financial transactions. The model generation unit 204 generates the model 110 using the secondary information generated by the secondary information generation unit 202 .

[0081] <Example of operation> FIG. 12 is a flowchart showing an example of the operation of the model generating device 200 of this embodiment. First, the secondary information generation unit 202 generates secondary information that contributes to improving the performance of the model 110 that detects fraudulent transactions in financial transactions (step S201). Then, the model generation unit 204 generates the model 110 using the secondary information generated by the secondary information generation unit 202 (step S203).

[0082] This model generation device 200 includes a secondary information generation unit 202 and a model generation unit 204. The secondary information generation unit 202 generates secondary information that contributes to improving the performance of the model 110 that detects fraudulent transactions in financial transactions. The model generation unit 204 generates the model 110 using the secondary information generated by the secondary information generation unit 202.

[0083] In this way, the model generation device 200 can generate a high-performance model 110 that meets the purpose of detecting fraud in financial transactions.

[0084] A detailed example of the model generating device 200 will be described below.

[0085] (Fourth embodiment) <System Overview> Fig. 13 is a diagram conceptually illustrating the system configuration of a monitoring system 1 according to an embodiment. The monitoring system 1 in Fig. 13 further includes a model generation device 200 in addition to the configuration of the monitoring system 1 in Fig. 3. The model generation device 200 is connected to a financial transaction server 30 via a communication network 3a. However, the configuration of this embodiment may be combined with at least one of the configurations of other embodiments to the extent that no contradiction occurs.

[0086] The model generation device 200 includes the storage device 220, and may also include a storage device (not shown) that stores the model 110. The storage device of the model 110 and the storage device 220 may be provided inside or outside the model generation device 200. In other words, both the storage device of the model 110 and the storage device 220 may be hardware that is integrated with the model generation device 200, or may be hardware that is separate from the model generation device 200.

[0087] The model generating device 200 is realized by a personal computer, a server computer, or the like.

[0088] <Example of functional configuration> The functional configuration of the model generation device 200 will be described below with reference to FIG. The secondary information generation unit 202 generates secondary information that contributes to improving the performance of the model 110, which detects fraudulent financial transactions. The secondary information includes information that serves as explanatory variables for the model 110, whose objective variables are the presence or absence of fraudulent financial transactions and the likelihood of fraudulent transactions. For example, as described above, accounts used in fraudulent transactions have characteristics such as repeated deposits and withdrawals in a short period of time. Therefore, secondary information generated includes the time difference between deposits and withdrawals within a specified period, the number of deposits per day, the number of withdrawals per day, and other information that indicate transactions characterized by repeated deposits and withdrawals in a short period of time. The model generation unit 204 generates the model 110 based on the secondary information generated as explanatory variables for the model 110, whose objective variables are the presence or absence of fraudulent financial transactions and the likelihood of fraudulent transactions, thereby improving the fraudulent transaction detection performance of the model 110.

[0089] The secondary information 440 includes transaction information within a period 442 relating to transaction details for a predetermined period. FIG. 14 is a diagram showing an example of data for within-period transaction information 442, which is an example of secondary information 440. The within-period transaction information 442 is, for example, an example of the number of days in a predetermined period, and includes the number of days elapsed since the last processing date for transaction information for a certain account or a certain customer, as well as the following information for that period: The processing date is the date on which the processing to generate the secondary information 440 was performed. The within-period transaction information 442 includes at least one of the following: the deposit / withdrawal time difference, which indicates the time (minutes) from the deposit time to the withdrawal time, the number of deposits per day, the number of withdrawals per day, the number of deposits per month, the number of withdrawals per month, the cumulative daily deposit amount, the cumulative daily withdrawal amount, the minimum monthly deposit amount, the minimum monthly withdrawal amount, the maximum monthly deposit amount, the maximum monthly withdrawal amount, and the difference between daily deposits and withdrawals.

[0090] The model generation unit 204 generates a model using the secondary information 440 generated by the secondary information generation unit 202. For example, the model generation unit 204 generates a model using the secondary information 440 including transaction information 442 within a period.

[0091] As described above, the model 110 is a model that detects whether or not a financial transaction is fraudulent and the likelihood that the transaction is fraudulent. In other words, the secondary information 440 includes information that serves as an explanatory variable for effectively learning fraudulent patterns in financial transactions. Various other types of secondary information 440 are possible, and these variations will be described in detail in the embodiments described below.

[0092] <Example of operation> The operation of the model generating device 200 according to the embodiment will be described below with reference to FIG. First, the secondary information generator 202 generates secondary information 440 that contributes to improving the performance of a model for detecting fraudulent financial transactions (step S201). The secondary information generator 202 generates, for example, within-period transaction information 442 shown in FIG. 14 as the secondary information 440. The secondary information generator 202 can generate within-period transaction information 442, for example, by using the transaction information 400 (FIG. 5) described in the above embodiment.

[0093] Then, the model generation unit 204 generates the model 110 using the secondary information 440 generated by the secondary information generation unit 202 in step S201 (step S203). The model 110 is generated using the transaction information within a period 442 that indicates the characteristics of the transaction pattern of fraudulent transactions, and therefore the performance of fraud detection in financial transactions using this model 110 can be improved.

[0094] As described above, according to this embodiment, the model generation device 200 includes the secondary information generation unit 202 and the model generation unit 204. The secondary information generation unit 202 generates secondary information that contributes to improving the performance of the model 110 that detects fraudulent transactions in financial transactions. The model generation unit 204 generates the model 110 using the secondary information generated by the secondary information generation unit 202.

[0095] In this way, the model generation device 200 can generate a high-performance model 110 that meets the purpose of detecting fraud in financial transactions.

[0096] Furthermore, since the secondary information 440 includes transaction information regarding the details of transactions during a specified period, it becomes possible to detect suspicious fraudulent events that cannot be detected from a single transaction alone. For example, cases in which deposits and withdrawals are frequently repeated in a short period of time can be detected as fraudulent transactions.

[0097] (Fifth embodiment) 15 is a functional block diagram showing an example of the logical configuration of a model generation device 200 according to an embodiment. This embodiment is the same as the fourth embodiment except that it has a configuration for inputting primary information used to generate secondary information. The configuration of this embodiment may be combined with at least one of the configurations of the other embodiments to the extent that no contradiction occurs.

[0098] <Example of functional configuration> The model generating device 200 includes the same secondary information generating unit 202 and model generating unit 204 as the model generating device 200 in FIG. The input unit 206 receives input of past transaction information 400, customer information 410, which is information about the customer, and account information 420, which is information about the account. The secondary information generation unit 202 generates secondary information 440 based on the transaction information 400 , customer information 410 , and account information 420 input by the input unit 206 . The model generation unit 204 generates the model 110 using the transaction information 400, customer information 410, and account information 420 input by the input unit 206, as well as the secondary information 440 generated by the model generation unit 204.

[0099] The transaction information 400, customer information 410, and account information 420 are the same as those in FIGS. 5, 6, and 7 of the second embodiment.

[0100] The secondary information generation unit 202 generates secondary information 440 based on at least two or more pieces of information among the transaction information 400 , the customer information 410 , and the account information 420 input by the input unit 206 .

[0101] The secondary information generation unit 202 generates the secondary information 440 based on two or more pieces of information rather than one piece of information, and therefore, by using secondary information 440 that has more characteristics of fraudulent transaction patterns for training the model 110, the fraud detection performance of the model 110 can be improved.

[0102] Other examples of the secondary information 440 will be described below.

[0103] <Example 1: Period business partner information> The intra-period transaction information 442 of the secondary information 440 may include periodic customer information indicating whether the customer of a transaction is different from the group of customers for a predetermined period.

[0104] <Example 2: Period transaction difference information> The intra-period transaction information 442 of the secondary information 440 may include inter-period transaction difference information indicating how much a certain transaction content differs from a group of transaction contents for a predetermined period.

[0105] FIG. 16 is a diagram showing an example of data of the in-period transaction information 442. 16(a) shows an example of within-period transaction information 442 indicating period transaction difference information. This within-period transaction information 442 is an example of the number of days in a predetermined period, and includes at least one of the number of days elapsed since the last processing date for transaction information for a certain account, the difference between the average deposit amount per transaction during that period and the deposit amount of a certain transaction, and the difference between the average withdrawal amount per transaction during that period and the withdrawal amount of a certain transaction.

[0106] That is, the model generation unit 204 trains the model 110 to learn that, for example, if the difference between the average deposit amount per transaction is equal to or greater than a threshold, the transaction is likely to be fraudulent. Then, by using this trained model 110 in the monitoring device 100 of the above embodiment, if the difference between the average deposit amount per transaction is equal to or greater than a threshold, a fraud score indicating that the transaction is likely to be fraudulent can be output.

[0107] Figure 16(b) shows an example of period transaction information 442 indicating period customer information. This period transaction information 442 is an example of the number of days in a predetermined period for a certain account, and includes the number of days elapsed since the last processing date for transaction information for a certain account, and a flag indicating whether the customers of the account during that period, for example, the transfer destinations from that account, include the same account (transfer to same account flag). For example, if there was a transfer to the same account within the predetermined period, the flag may be set to 1, and if there was no transfer to the same account within the predetermined period, the flag may be set to 0.

[0108] For example, the model generation unit 204 makes the model 110 learn that if there is a transfer to the same account (i.e., the transfer to same account flag is set to 1), the transaction to the trading partner at that account is likely to be a fraudulent transaction.

[0109] <Example 3: Operation result information within the period> The transaction information within a period 442 is operation result information within a period that indicates the results of operations on a transaction device within a predetermined period. The transaction device is the ATM 20. The results of the operation of the transaction device may include, for example, the number of times an operation on the ATM 20 resulted in an error.

[0110] 17 is a diagram showing an example of data of within-period transaction information 442, which indicates within-period operation result information. This within-period transaction information 442 includes at least one of the number of days elapsed since the last processing date for transaction information of a certain account, which indicates the number of days in a predetermined period, and the number of times per day that an operation at the ATM 20 resulted in an error during that period, and the number of times per month that an operation at the ATM 20 resulted in an error.

[0111] For example, the model generation unit 204 trains the model 110 to learn that if the number of errors occurring in operations at the ATM 20 in transactions for a certain account is greater than a threshold, the account is likely to be used for fraudulent transactions. Then, by using this trained model 110 in the monitoring device 100 of the above embodiment, if the number of errors occurring in operations at the ATM 20 is greater than a threshold, a fraud score indicating that the account is likely to be used for fraudulent transactions can be output.

[0112] <Example 4: Location comparison information> The secondary information 440 is location comparison information that indicates the results of comparing information indicating locations. The information indicating the location is the location where the transaction was made; for example, if the transaction was made at a counter in a store, it is the branch number of that store, and if the transaction was made at ATM 20, it is the branch number of the store that manages ATM 20. The location comparison information can be indicated by comparing the branch number of the store where the transaction was made with the branch number of the store that holds the account where the transaction was made, and indicating whether the branch numbers are the same or different using a different branch processing flag. In other words, if the transaction was made at a store different from the store where the account is held, the different branch processing flag is set to 1, and if the transaction was made at the same store as the store where the account is held, the different branch processing flag is set to 0.

[0113] FIG. 18 is a diagram showing an example of the data structure of secondary information 440 including location comparison information. This secondary information 440 includes transaction identification information that can identify the transaction and a separate branch processing flag for the transaction. This secondary information 440 may also include information that can identify the account through which the transaction was made (e.g., the branch number of the store that holds the account, the account code for the account, and the account number for the account).

[0114] That is, the model generation unit 204 causes the model 110 to learn that, for example, if the separate store processing flag for a certain transaction is set to 1, the transaction is likely to be fraudulent. Then, by using this trained model 110 in the monitoring device 100 of the above embodiment, if the separate store processing flag for a certain transaction is set to 1, the monitoring device 100 can output a fraud score indicating that the transaction is likely to be fraudulent.

[0115] <Example 5: Transaction amount percentage information> The secondary information 440 may be transaction amount ratio information indicating the ratio of the transaction amount to a predetermined amount. The predetermined amount is at least one of the balance of the account in which the transaction occurred, the monthly deposit amount (or the amount of salary transfer, etc.), and the average transaction amount per transaction in the previous month. If the ratio of the transaction amount to the predetermined amount exceeds a threshold, the transaction is considered fraudulent.

[0116] 19 is a diagram showing an example of the data structure of secondary information 440 including transaction amount ratio information. This secondary information 440 includes transaction identification information that can identify the transaction and transaction amount ratio information for the transaction. This secondary information 440 may further include information that can identify the account through which the transaction was made (e.g., the branch number of the store that holds the account, the account code for the account, and the account number for the account).

[0117] That is, the model generation unit 204 trains the model 110 to learn that, for example, if the ratio of a transaction amount to a predetermined amount exceeds a threshold, the transaction is likely to be fraudulent. Then, by using this trained model 110 in the monitoring device 100 of the above embodiment, if the ratio of a transaction amount exceeds a threshold, a fraud score indicating that the transaction is likely to be fraudulent can be output.

[0118] <Example of operation> FIG. 20 is a flowchart showing an example of the operation of the model generating device 200 according to the embodiment. Figure 20 This flow has the same steps S201 and S203 as the flow of FIG. 12, and also has step S205 before step S201.

[0119] First, the input unit 206 inputs past transaction information 400, customer information 410, which is information about the customer, and account information 420, which is information about the account (step S205). The secondary information generation unit 202 generates secondary information 440 based on the transaction information 400, customer information 410, and account information 420 input by the input unit 206 in step S205 (step S201). The model generation unit 204 generates a model 110 (step S203) using the transaction information 400, customer information 410, and account information 420 input by the input unit 206 in step S205, and the secondary information 440 generated by the model generation unit 204 in step S201.

[0120] As described above, according to this embodiment, the model generation device 200 further includes an input unit 206 in addition to the configuration of the above embodiment. The input unit 206 receives input of past transaction information 400, customer information 410, which is information about customers, and account information 420, which is information about accounts. The secondary information generation unit 202 generates secondary information 440 based on the transaction information 400, customer information 410, and account information 420 input by the input unit 206, and the model generation unit 204 generates a model 110 using the transaction information 400, customer information 410, and account information 420 input by the input unit 206, as well as the secondary information 440 generated by the model generation unit 204.

[0121] As described above, the model generation device 200 of this embodiment not only produces the same effects as the above-described embodiment, but also generates secondary information 440 based on the input transaction information 400, customer information 410, and account information 420. Therefore, the secondary information 440 can be used as an explanatory variable for effectively learning fraudulent patterns of various financial transactions. Use This allows the model 110 to be generated. Therefore, the performance of detecting fraud in financial transactions using the generated model 110 can be further improved.

[0122] (Sixth embodiment) 21 is a diagram showing an overview of a model generation device 300 according to an embodiment. 300 11 and 15 in that it generates a trained model to be used by the monitoring device 100 in FIG. 1. The model generation device 300 of this embodiment differs from the model generation device 200 described above in that it has a configuration in which a template is used to generate the model 110. In other words, the model generation device 300 uses a template to generate the model 110. 300 This makes it possible to easily generate the model 110 in the future, thereby improving the performance of detecting fraud in financial transactions. Note that the configuration of this embodiment may be combined with at least one of the configurations of other embodiments to the extent that no contradiction occurs.

[0123] <Minimum configuration example> The model generating device 300 includes a template information acquiring unit 302 , an input information acquiring unit 304 , a control unit 306 , and a model generating unit 308 . The template information acquisition unit 302 acquires template information used to generate the model 110 for detecting fraudulent financial transactions. The template information includes input information item definition information that specifies each item of input information used to generate the model 110, and secondary information generation definition information that specifies the content of secondary information to be generated that contributes to improving the performance of the model 110 based on the input information. The input information acquisition unit 304 acquires input information corresponding to each item specified by input information item definition information included in the template information. The control unit 306 controls the content of secondary information generation in accordance with secondary information generation definition information included in the template information. The model generation unit 308 generates the model 110 based on the controlled generation content of the secondary information.

[0124] <Example of operation> 22 is a flowchart showing an example of the operation of the model generation device 300 according to the embodiment. First, the template information acquisition unit 302 acquires template information used to generate a model 110 for detecting fraudulent financial transactions (step S301). Then, the input information acquisition unit 304 acquires input information corresponding to each item identified by input information item definition information included in the template information acquired in step S301 (step S303). The control unit 306 controls the generation content of secondary information according to the secondary information generation definition information included in the template information acquired in step S301 (step S305). The model generation unit 308 generates a model 110 based on the generation content of secondary information controlled in step S305 (step S307).

[0125] The model generation device 300 includes a template information acquisition unit 302, an input information acquisition unit 304, a control unit 306, and a model generation unit 308. The template information acquisition unit 302 acquires template information used to generate a model 110 for detecting fraudulent financial transactions. The template information includes input information item definition information that identifies each item of input information used to generate the model 110, and secondary information generation definition information that identifies the generation content of secondary information that contributes to improving the performance of the model 110 based on the input information. The input information acquisition unit 304 acquires input information corresponding to each item identified by the input information item definition information included in the template information. The control unit 306 controls the generation content of secondary information in accordance with the secondary information generation definition information included in the template information. The model generation unit 308 generates the model 110 based on the controlled generation content of secondary information.

[0126] This model generation device 300 can easily generate a high-performance model that meets the purpose of detecting fraud in financial transactions.

[0127] A detailed example of the model generating device 300 will be described below.

[0128] Seventh embodiment <System Overview> Fig. 23 is a diagram conceptually illustrating the system configuration of a monitoring system 1 according to an embodiment. The monitoring system 1 of Fig. 23 further includes a model generation device 300 in addition to the configuration of the monitoring system 1 of Fig. 3. That is, the model generation device 300 replaces the model generation device 200 of the monitoring system 1 of Fig. 13. The model generation device 300 is connected to the financial transaction server 30 via a communication network 3a. However, the configuration of this embodiment may be combined with at least one of the configurations of the other embodiments to the extent that no contradiction occurs.

[0129] The model generation device 300 includes a storage device 320 and may also include a storage device (not shown) that stores the model 110. The storage device of the model 110 and the storage device 320 may be provided inside or outside the model generation device 300. In other words, the storage device of the model 110 and the storage device 320 may be hardware that is integrated with the model generation device 300, or may be hardware that is separate from the model generation device 300.

[0130] The model generating device 300 is realized by a personal computer, a server computer, or the like.

[0131] The model generation device 300 generates a model 110 for detecting fraudulent financial transactions. The model generation device 300 acquires information from the financial transaction server 30 and uses it to generate the model 110. The monitoring device 100 uses the model 110 generated by the model generation device 300 to monitor financial transactions.

[0132] A program for generating the model 110 is installed in a computer 1000 that realizes the model generation device 300. Each function of each element of the model generation device 300 is realized by executing the program. Furthermore, the operation terminal 10 may function as the operation terminal of the model generation device 300, and the model generation device 300 may function as a server connected to each operation terminal 10 via a communication network 3a, and the operation terminal 10 may function as a client terminal.

[0133] As in the above embodiment, at least one of the model generation device 300 and the operation terminal 10 is granted in advance authority to use the monitoring system 1, and the person in charge of using the model generation device 300 and the operation terminal 10 acquires in advance account information (e.g., a user name and a password) for logging in to the monitoring system 1. In addition, an application program for using the services provided by the monitoring system 1 is installed in advance in the model generation device 300 and the operation terminal 10, and after starting the program, various operation screens can be displayed from a menu screen (not shown) of the monitoring system 1 by logging in to the monitoring system 1 using the account information. An operator can generate a model 110 by operating the various screens.

[0134] <Example of functional configuration> The functional configuration of the model generation device 300 will be described below with reference to FIG. The template information acquisition unit 302 acquires template information 380 used to generate the model 110 for detecting fraudulent transactions in financial transactions. 24 is a diagram showing the data structure of the template information 380. The template information 380 includes various information that defines the template 360. The template information 380 of the template 360 ​​is stored in the storage device 320.

[0135] The template information 380 includes at least input information item definition information 382 that specifies each item of input information used to generate the model 110, and secondary information generation definition information 384 that specifies the content of secondary information to be generated that contributes to improving the performance of the model 110 based on the input information.

[0136] The input information acquisition unit 304 acquires input information corresponding to each item specified by the input information item definition information 382 included in the template information 380.

[0137] For example, when importing data files such as transaction information 400, customer information 410, and account information 420 described in the above embodiment, the input information item definition information 382 specifies which item (column of one transaction record) of information to enter from each piece of information (data file).

[0138] When the model generation device 300 accepts the selection of "Import data file" on the menu screen, an import screen 520 is displayed on the display. Fig. 25 is a diagram showing an example of the import screen 520. The import screen 520 includes a file specification list 522, an OK button 528, and a cancel button 529.

[0139] The file specification list 522 includes a column for the name of the data to be imported and a column for specifying the file of that data. The file specification column includes a file selection button 524 and a selected file display section 526. When the file selection button 524 is pressed, the model generation device 300 opens a window for browsing the data folder and allows the operator to select a data file. The name of the selected data file is displayed in the selected file display section 526.

[0140] When the model generation device 300 receives a press of the OK button 528, it confirms the file designation of the import data and closes the menu. When the model generation device 300 receives a press of the Cancel button 529, it cancels the file designation of the import data and closes the menu.

[0141] Next, when the model generation device 300 accepts the selection of "Input Information Item Definition" on the menu screen, an input information selection screen 530 is displayed on the display. FIG. 26 is a diagram showing an example of the input information selection screen 530. Here, an example of the input information selection screen 530 is shown for selecting data items (columns in a record of one transaction) to be input from among the data items of the transaction information 400. In other words, the input information selection screen 530 can also be said to be a screen for accepting the selection of excluding data items from the data items of the transaction information 400 that are not to be used in generating the model 110.

[0142] The input information selection screen 530 is a screen for accepting a selection operation of a data item to be input acquired by the input information acquisition unit 304, generating input information item definition information 382, ​​including it in the template information 380, and storing it in the storage device 320. The input information selection screen 530 includes an import definition information list 532, an import source data list 534, a back button 544, and a next button 548.

[0143] The data items to be input and the import source data can be mapped using the import definition information list 532 and the import source data list 534. The data items in the import definition information list 532 are assumed to be already displayed in the same order as the data items in the import source data list 534.

[0144] When an operation of the scroll bar of one list is accepted, the other list may be scrolled together or may not be scrolled together, or it may be possible to selectively set which operation is to be performed.

[0145] Furthermore, if the data items in the import definition information list 532 and the import source data list 534 do not match, the model generation device 300 may first accept a selection (by the operator) of a cell in the mapping column of the import definition information list 532 for the data item to be input (a column in a transaction record), and then accept a selection (by the operator) of a data item (source data) in the data file of the import source (import source data list 534) that corresponds to the selected data item, and associate the data items of the import destination and the import source.

[0146] In the example of this figure, the description will be given assuming that the data items in the import definition information list 532 and the import source data list 534 are the same. The source data list 534 displays the data names (column names within a transaction record) of each item in the source data file (here, the data file "TON_INF.csv" specified for import as transaction information 400) (for example, store_num, sbj_cd, etc.).

[0147] The model generating device 300 can accept the selection of the data item (column name in a record of one transaction) to be input and acquired by the input information acquiring unit 304 by pressing a cell in the source data list 534 by the operator.

[0148] The cell of the selected data item is displayed as selected 538. The selected display 538 is not particularly limited as long as it is a display method that notifies the operator that the data item has been selected, but for example, the background color of the cell may be changed, the color of the characters in the cell may be changed, or the cell may be highlighted.

[0149] The input information selection screen 530 further includes a batch selection button 540 and a reflect button 542. When the model generation device 300 receives a press of the batch selection button 540, it collectively selects all data items in the source data file in the source data list 534, and displays the cells of all data items as selected 538. In other words, by pressing the batch selection button 540, the operator can omit the above-described selection operation for each data item. Furthermore, when the cells are collectively selected, the selection may be deselected for each cell for which the operator has pressed the button.

[0150] When the model generation device 300 receives a press of the Reflect button 542, it maps the data item of the cell marked as selected 538 in the import source data list 534 to the data item of the corresponding row in the import definition information list 532, and the data name is displayed in each cell in the mapping column of the import definition information list 532.

[0151] For example, the data name of an item selected in the import source data list 534, such as "store_num", is displayed in the mapping column of the data item "Store No." in the import definition information list 532 by pressing the reflect button 542. The example in this figure shows the state in which the top three data items have been selected as input targets and mapped to the import definition information list 532.

[0152] When the model generation device 300 accepts pressing of the back button 544, it cancels the data item selection operation accepted on the screen 530 (clears the selected display 538) and returns to the menu screen. When the model generation device 300 accepts pressing of the next button 548, it includes input information item definition information 382, ​​which defines the data item selected in the import source data list 534 as an input target, in the template information 380 based on the mapping information reflected in the import definition information list 532, and stores the input information item definition information 382 in the storage device 320.

[0153] In addition, the input information selection screen 530 can also select and specify customer information 410 and account information 420 in the same way, and template information 380 including the information defined in the input information item definition information 382 can be stored in the memory device 320.

[0154] The input information acquiring unit 304 uses the input information item definition information 382 defined in this way to acquire input information corresponding to each item specified by the input information item definition information 382.

[0155] Next, the control unit 306 controls the content of the secondary information 440 to be generated in accordance with the secondary information generation definition information 384 included in the template information.

[0156] For example, when importing the data files of each secondary information 440 described in the above embodiment, the secondary information generation definition information 384 defines which item (column of one transaction record) of information in each secondary information 440 data file should be generated (or not) for use as an explanatory variable.

[0157] In the model generation device 300, when the selection of "Secondary information generation definition" is accepted on the menu screen, a secondary information selection screen 550 is displayed on the display. FIG. 27 is a diagram showing an example of the secondary information selection screen 550. Here, an example of the secondary information selection screen 550 is shown for selecting data items (columns in one record) to be used as explanatory variables from the data items of the within-period transaction information 442 in FIG. 14 in the secondary information 440. In other words, the secondary information selection screen 550 can also be said to be a screen for accepting the selection of excluding data items from the data items of the secondary information 440 that are not to be used in generating the model 110.

[0158] The secondary information selection screen 550 is a screen for receiving a selection operation for the content of the secondary information 440 to be generated under the control of the control unit 306, in this case, the data items of the secondary information 440 to be used as explanatory variables, generating secondary information generation definition information 384, including it in the template information 380, and storing it in the storage device 320. The secondary information selection screen 550 includes the same buttons as the input information selection screen 530 in FIG. 26 : a cancel button 536, a batch selection button 540, a reflect button 542, a back button 544, and a next button 548.

[0159] The secondary information selection screen 550 further includes an import definition information list 552 and an import source data list 554. Using the import definition information list 552 and the import source data list 554, it is possible to map data items in the import source data list 554 to be imported as data items to be used as explanatory variables. It is assumed that the data items in the import definition information list 552 are already displayed in the same order as the data items in the import source data list 554.

[0160] When an operation of the scroll bar of one list is accepted, the other list may be scrolled together or may not be scrolled together, or it may be possible to selectively set which operation is to be performed.

[0161] Furthermore, if the data items in the import definition information list 552 and the import source data list 554 do not match, the model generation device 300 may first accept a selection (by the operator) of a cell in the mapping column of the import definition information list 552 for the data item to be input (a column in a transaction record), and then accept a selection (by the operator) of a data item (source data) in the data file of the import source (import source data list 554) that corresponds to the selected data item, and associate the data items of the import destination and the import source.

[0162] In the example of this figure, the description will be given assuming that the data items in the import definition information list 552 and the import source data list 554 are the same. The source data list 554 displays the data names (column names within one record) of each item in the source data file (here, the data file "TON_P_INF.csv" specified for import as secondary information 440) (for example, date_num, depwdl_time_dif, etc.).

[0163] When the operator presses a cell in the source data list 554, the model generating device 300 can accept the selection of a data item (column name in one record) from the secondary information 440 that is to be generated as an explanatory variable.

[0164] The cell of the selected data item is displayed as selected 556. The selected display 556 is not particularly limited as long as it is a display method that notifies the operator that the data item has been selected, but for example, the background color of the cell may be changed, the color of the characters in the cell may be changed, or the cell may be highlighted.

[0165] When the model generation device 300 receives a press of the Reflect button 542, it maps the data item of the cell that is displayed as selected 556 in the import source data list 554 to the data item of the corresponding row in the import definition information list 552, and the data name is displayed in each cell in the mapping column of the import definition information list 552.

[0166] For example, the data name of an item selected in the import source data list 554, such as "date_num," is displayed in the mapping column for the "number of days since the last processing date" data item in the import definition information list 552 by pressing the reflect button 542. The example in this figure shows a state in which four data items have been selected as targets for generating secondary information 440 and mapped to the import definition information list 552.

[0167] When the model generation device 300 receives a press of the Next button 548, it stores in the storage device 320 secondary information generation definition information 384, which includes secondary information item definition information that identifies the data item selected in the import source data list 554, in the template information 380 based on the mapping information reflected in the import definition information list 552.

[0168] In this way, the secondary information generation definition information 384 includes secondary information item definition information that specifies the items of the secondary information 440 to be generated.

[0169] The secondary information selection screen 550 can similarly select and specify other secondary information 440, and the template information 380 including the information defined in the secondary information generation definition information 384 can be stored in the storage device 320. Therefore, the secondary information item definition information of the secondary information generation definition information 384 may be information that defines data items for each data file indicating the different secondary information 440.

[0170] The control unit 306 controls the content of the secondary information 440 to be generated in accordance with the secondary information generation definition information 384 defined in this way.

[0171] Then, the model generation unit 308 generates the model 110 based on the content of the secondary information 440 generated under the control of the control unit 306. In other words, the model generation unit 308 generates the model 110 using the secondary information 440 defined in the secondary information generation definition information 384.

[0172] The model generation device 300 includes a template information acquisition unit 302, an input information acquisition unit 304, a control unit 306, and a model generation unit 308. The template information acquisition unit 302 acquires template information used to generate a model 110 for detecting fraudulent financial transactions. The template information includes input information item definition information that identifies each item of input information used to generate the model 110, and secondary information generation definition information that identifies the generation content of secondary information that contributes to improving the performance of the model 110 based on the input information. The input information acquisition unit 304 acquires input information corresponding to each item identified by the input information item definition information included in the template information. The control unit 306 controls the generation content of secondary information in accordance with the secondary information generation definition information included in the template information. The model generation unit 308 generates the model 110 based on the controlled generation content of secondary information.

[0173] This model generation device 300 can easily generate a high-performance model that meets the purpose of detecting fraud in financial transactions.

[0174] (Eighth embodiment) The model generation device 300 of this embodiment is similar to the seventh embodiment shown in Fig. 21, except that it has a configuration in which template information 380 is selected from template information 380 in which a plurality of different explanatory variables are defined, and generates a model 110. Since the model generation device 300 of this embodiment has the same configuration as that shown in Fig. 21, it will be described using Fig. 21.

[0175] <Example of functional configuration> When the template information acquisition unit 302 receives an input for selecting one of a plurality of pieces of template information 380 in which at least one of the generation content of secondary information 440 specified in secondary information generation definition information 384 and the items specified in input information item definition information 382 is different, the template information acquisition unit 302 acquires the selected template information 380.

[0176] For example, template information 380 in which at least one of the definition contents of the input information item definition information 382 and the secondary information generation definition information 384 defined in the model generation device 300 of the seventh embodiment is different can be stored with a name assigned to each.

[0177] 28 is a diagram showing an example data structure of template information 380. In addition to the input information item definition information 382 and secondary information generation definition information 384 of the template information 380 in Fig. 24, the template information 380 in Fig. 28 further includes a template ID that identifies the template 360 ​​and a template name. That is, in template information 380 in which at least one of the input information item definition information 382 and the secondary information generation definition information 384 defined in the seventh embodiment is different, the template ID, template name, input information item definition information 382, ​​and secondary information generation definition information 384 are each associated and stored.

[0178] When the model generation device 300 accepts the selection of "template selection" on the menu screen, a template selection screen 560 is displayed on the display. Figure 29 is a diagram showing an example of the template selection screen 560. The template selection screen 560 includes the same OK button 528 and cancel button 529 as in Figure 25, as well as a template list 562.

[0179] The template list 562 displays a list of the template IDs and template names of multiple pieces of template information 380. For example, it is possible to generate a model 110 that can perform analyses (in the figure, the template names are shown as "Analysis 1" or "Analysis 2") with different explanatory variables for detecting fraud in financial transactions, depending on the content of the secondary information 440 generated as specified by the secondary information generation definition information 384. Also, in the figure, a template 360 ​​whose template name includes "(Full)" indicates that it includes all data items in the secondary information 440 without excluding any of them.

[0180] When a template 360 ​​to be used to generate the model 110 is selected from the template list 562, the row of the selected template 360 ​​is displayed as selected 568. The selected display 568 is not particularly limited as long as it is a display method that notifies the operator that the template 360 ​​has been selected, but for example, the background color of the cell may be changed, the color of the text in the cell may be changed, or the cell may be highlighted.

[0181] The template selection screen 560 may also have a search key input section (not shown) and a search button (not shown). The model generation device 300 may be able to accept at least a part of the template ID or template name of the template input into the search key input section as a search key, and display the template information 380 obtained by searching among the registered template information 380 in the template list 562.

[0182] When the model generating device 300 receives a press of the OK button 528, it reads out the template information 380 of the selected template 360 ​​from the storage device 320. The model generating device 300 generates the model 110 using the template information 380.

[0183] Furthermore, the model generation unit 308 may generate the model 110 based on the input information acquired by the input information acquisition unit 304 .

[0184] <Example of operation> FIG. 30 is a flowchart showing an example of the operation of the model generating device 300 according to the embodiment. The flow in FIG. 30 includes the same steps S301 to S307 as the flow in FIG. 23, and further includes step S321 before step S301.

[0185] First, the template information acquisition unit 302 accepts the operator's selection of a template 360 ​​and pressing of the OK button 528 on the template selection screen 560 of Fig. 29 (step S321). Upon accepting the pressing of the OK button 528, the template information acquisition unit 302 reads and acquires, from the storage device 320, the template information 380 of the template 360 ​​that is displayed as selected 568 in the template list 562 (step S301). The processing from step S303 onwards is the same as in FIG.

[0186] The template information 380 may further include algorithm definition information 386 that specifies the algorithm for generating the model 110 . The model generation unit 308 generates the model 110 based on the generation algorithm specified by the algorithm definition information 386 .

[0187] FIG. 31 is a diagram showing an example of the data structure of the template information 380. The template information 380 in FIG. 31 includes algorithm definition information 386 in addition to the data items of the template information 380 in FIG.

[0188] The generation algorithm specified by the algorithm definition information 386 may be, for example, heterogeneous mixture, logistic regression, multilayer perceptron, gradient boosting, or the like, but may also be other algorithms.

[0189] When the model generation device 300 receives a selection of "algorithm selection" on the menu screen, it may display an algorithm selection screen (not shown) on the display. The algorithm selection screen includes a UI (User Interface) that receives an algorithm selection. When the model generation device 300 receives an algorithm selection by the operator, it defines the selected algorithm in algorithm definition information 386, includes it in template information 380, and stores it in the storage device 320. Template information 380 of algorithm definition information 386 in which a different algorithm is defined may be associated with a new template ID and template name and stored in the storage device 320 as different template information 380.

[0190] The model generation unit 308 generates the model 110 based on the algorithm defined in the algorithm definition information 386 .

[0191] The control unit 306 determines whether or not to generate secondary information 440 depending on the generation content of secondary information 440 specified by the secondary information generation definition information 384, and if it is determined that secondary information 440 should be generated, controls the generation of secondary information 440.

[0192] Specifically, when the generation content of the secondary information 440 is defined in the secondary information generation definition information 384 (when a data item of the secondary information 440 is selected on the secondary information selection screen 550 of Fig. 27), the template information 380 may include the secondary information generation definition information 384. In other words, when the generation content of the secondary information 440 is not defined on the secondary information selection screen 550 of Fig. 27, the template information 380 may not include the secondary information generation definition information 384.

[0193] The control unit 306 may determine that the generation of secondary information 440 is to be controlled if the template information 380 includes secondary information generation definition information 384, and may determine that the generation of secondary information 440 is not to be controlled if the template information 380 does not include secondary information generation definition information 384.

[0194] As another example, the secondary information generation definition information 384 may include a flag indicating whether the generation contents of the secondary information 440 have been defined on the secondary information selection screen 550 of Fig. 27. The control unit 306 may refer to the flag of the secondary information generation definition information 384, and determine to control the generation of the secondary information 440 if the flag indicates that the generation contents of the secondary information 440 have been defined, or determine not to control the generation of the secondary information 440 if the flag indicates that the generation contents of the secondary information 440 have not been defined.

[0195] The control unit 306 determines whether or not to generate secondary information 440 depending on the generation content of secondary information 440 specified in the secondary information generation definition information 384, and if it is determined that secondary information 440 should not be generated, it does not control the generation of secondary information 440.

[0196] <Example of operation> Fig. 32 is a flowchart showing essential parts of an exemplary operation of the model generating device 300 according to the embodiment. The flow of Fig. 32 is executed after step S303 of Fig. 22 or 30 by the model generating device 300 according to the embodiment. In step S303, the input information acquiring unit 304 acquires input information corresponding to each item specified by the input information item definition information included in the template information acquired in step S301. Then, the control unit 306 determines whether to generate secondary information 440 according to the generation content of the secondary information 440 specified by the secondary information generation definition information 384 (step S331).

[0197] If it is determined that the secondary information 440 should not be generated (NO in step S331), the control unit 306 does not perform control to generate the secondary information 440. In other words, step S305 is bypassed and the process proceeds to step S307. In this case, the model generation unit 308 does not generate the secondary information 440, but generates the model 110 based on the input information acquired by the input information acquisition unit 304 in step S303 (step S307).

[0198] On the other hand, if it is determined that the secondary information 440 is to be generated (YES in step S331), the control unit 306 controls the generation of the secondary information 440. That is, the process proceeds to step S305, where the control unit 306 controls the content of the secondary information generation in accordance with the secondary information generation definition information included in the template information acquired in step S301. That is, the control unit 306 generates the secondary information 440.

[0199] Then, the model generation unit 308 generates the model 110 using the secondary information 440 generated in step S305 (step S307). Note that even in this case, the model generation unit 308 may generate the model 110 based on the input information acquired by the input information acquisition unit 304 in step S303 in addition to the secondary information 440.

[0200] As described above, according to this embodiment, when the template information acquisition unit 302 receives an input for selecting one of a plurality of template information 380 in which at least one of the generation contents of secondary information 440 specified in secondary information generation definition information 384 and the items specified in input information item definition information 382 is different, the template information acquisition unit 302 acquires the selected template information 380.

[0201] As described above, the model generation device 300 of this embodiment not only achieves the same effects as the above-described embodiment, but also enables generation of model 110 by selecting template information 380 from template information 380 in which a plurality of different explanatory variables are defined, thereby enabling efficient detection of fraud in financial transactions by appropriately selecting pre-prepared template information 380 according to the detection target. Furthermore, since fraud in financial transactions can be detected using explanatory variables suited to the detection content, it is possible to generate model 110 that can further improve fraud detection performance.

[0202] Although the embodiments of the present invention have been described above with reference to the drawings, these are merely examples of the present invention, and various other configurations can also be adopted. For example, the secondary information generation definition information 384 not only specifies the items of the secondary information 440 but also performs logical sum or logical sum of a plurality of items of the secondary information 440. product It may also be possible to define it using a logical formula such as:

[0203] In addition, although the flowcharts used in the above description describe multiple steps (processes) in a sequential order, the execution order of the steps in each embodiment is not limited to the order described. In each embodiment, the order of the steps shown in the drawings can be changed to the extent that the content is not affected. Furthermore, at least one step may be performed by another operating entity, such as another device or person. Furthermore, the above-described embodiments can be combined to the extent that the content is not contradictory.

[0204] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. In the present invention, when information about users (customers of financial institutions and counterparties to financial transactions) is acquired and used, it is assumed that this is done lawfully.

[0205] Some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes. 1. An input means for inputting past transaction information, customer information which is information about customers, and account information which is information about accounts in financial transactions; generation means for generating fraudulent transaction information, which is information relating to fraudulent transactions, using the transaction information, the customer information, and the account information input by the input means and a trained model; an output means for outputting the fraudulent transaction information generated by the generation means; and The fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer. 2. In the monitoring device described in 1., The fraudulent transaction information further includes a fraudulent transaction score for each transaction. 3. In the monitoring device according to 1. or 2., The output means outputs grounds information that is the basis for generating the fraudulent transaction information.

[0206] 4. An input means for inputting past transaction information, customer information which is information about customers, and account information which is information about accounts in financial transactions; generation means for generating fraudulent transaction information, which is information relating to fraudulent transactions, using the transaction information, the customer information, and the account information input by the input means and a trained model; an output means for outputting the fraudulent transaction information generated by the generation means; and A monitoring system in which the fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer. 5. In the monitoring system described in 4., The fraudulent transaction information further includes a fraudulent transaction score for each transaction. 6. In the monitoring system according to 4. or 5., The output means outputs basis information that is the basis for generating the fraudulent transaction information.

[0207] 7. One or more computers: Enter past transaction information, customer information, and account information for financial transactions. Using the input transaction information, customer information, and account information, and using a trained model, generate fraudulent transaction information that is information regarding fraudulent transactions; outputting the generated fraudulent transaction information; A monitoring method, wherein the fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer. 8. In the monitoring method described in 7., The fraudulent transaction information further includes a fraudulent transaction score for each transaction. 9. In the monitoring method according to 7. or 8., the one or more computers: A monitoring method that outputs basis information that is the basis for generating the fraudulent transaction information.

[0208] 10. On your computer, A procedure for inputting past transaction information, customer information which is information about a customer, and account information which is information about an account in a financial transaction; a step of generating fraudulent transaction information, which is information regarding fraudulent transactions, using the transaction information, the customer information, and the account information input in the input step and a trained model; a program for executing a procedure for outputting the fraudulent transaction information generated by the generating procedure, The fraudulent transaction information includes at least one of a fraudulent transaction score by account and a fraudulent transaction score by customer. 11. In the program described in 10., The fraudulent transaction information further includes a fraudulent transaction score for each transaction. 12. In the program described in 10. or 11., In the outputting step, the program outputs basis information that is the basis for generating the fraudulent transaction information.

[0209] 13. On the computer, A procedure for inputting past transaction information, customer information which is information about a customer, and account information which is information about an account in a financial transaction; a step of generating fraudulent transaction information, which is information regarding fraudulent transactions, using the transaction information, the customer information, and the account information input in the input step and a trained model; a program for executing a procedure for outputting the fraudulent transaction information generated by the generating procedure, A computer-readable recording medium storing a program, wherein the fraudulent transaction information includes at least one of a fraudulent transaction score for each account and a fraudulent transaction score for each customer. 14. The recording medium according to 13., A computer-readable recording medium storing a program, wherein the fraudulent transaction information further includes a fraudulent transaction score for each transaction. 15. The recording medium according to 13. or 14., A computer-readable recording medium storing a program for outputting, in the output step, basis information that is the basis for generating the fraudulent transaction information. [Explanation of symbols]

[0210] 1. Surveillance System 3a, 3b Communication Network 10 Operation terminal 20 ATM 30 Financial Transaction Server 40 Storage device 100 Monitoring equipment 102 Input section 104 Generation part 106 Output section 110 model 120 Storage device 200 Model Generation Device 202 Secondary information generation section 204 Model Generation Unit 206 Input section 220 Storage device 300 Model Generation Device 302 Template information acquisition unit 304 Input information acquisition unit 306 Control Unit 308 Model Generation Unit 320 storage device 360 Templates 380 Template Information 382 Input information item definition information 384 Secondary information generation definition information 386 Algorithm definition information 400 Transaction Information 410 Customer information 420 Account Information 430 Fraudulent Transaction Information 440 Secondary information 442 Transaction information within the period 500 screens 510 Basis information output screen 530 Input information selection screen 550 Secondary information selection screen 560 Template selection screen 1000 computers 1010 Bus 1020 processor 1030 memory 1040 Storage Device 1050 Input / Output Interface 1060 Network Interface

Claims

1. input means for inputting past transaction information, customer information which is information about customers, and account information which is information about accounts in financial transactions; generation means for generating fraudulent transaction information, which is information relating to fraudulent transactions, using the transaction information, the customer information, and the account information input by the input means and a trained model; an output means for outputting the fraudulent transaction information generated by the generation means; and The fraudulent transaction information includes a fraudulent transaction score for each customer, The generation means is a monitoring device that, for each transaction included in the transaction information, identifies customers whose customer numbers match the customer number of the customer holding the account where the transaction occurred as the same person, identifies the transaction as a transaction related to the customer, and generates the fraudulent transaction score for each customer.

2. 2. The monitoring device according to claim 1, The generation means is a monitoring device that, for each transaction included in the transaction information, identifies customers who hold the account in which the transaction occurred and whose date of birth and nationality information matches in whole or in part as the same person, identifies the transaction as being related to the customer, and generates the customer-specific fraudulent transaction score.

3. In the monitoring device according to claim 1 or 2, The generation means is a monitoring device that identifies customers who hold multiple accounts and for whom all or at least some of the information indicating the customer's date of birth and nationality contained in the customer information of the customer who holds the account matches as the same person, identifies the account as an account related to the customer, and generates the fraudulent transaction score for each customer.

4. The monitoring device according to any one of claims 1 to 3, The output means outputs grounds information that is the basis for generating the fraudulent transaction information.

5. input means for inputting past transaction information, customer information which is information about customers, and account information which is information about accounts in financial transactions; generation means for generating fraudulent transaction information, which is information relating to fraudulent transactions, using the transaction information, the customer information, and the account information input by the input means and a trained model; an output means for outputting the fraudulent transaction information generated by the generation means; and The fraudulent transaction information includes a fraudulent transaction score for each customer, The generation means is a monitoring system that, for each transaction included in the transaction information, identifies customers whose customer numbers match the customer number of the customer holding the account where the transaction occurred as the same person, identifies the transaction as a transaction related to the customer, and generates the fraudulent transaction score for each customer.

6. One or more computers Enter past transaction information, customer information, and account information for financial transactions. Using the input transaction information, customer information, and account information, and using a trained model, generate fraudulent transaction information that is information regarding fraudulent transactions; outputting the generated fraudulent transaction information; The fraudulent transaction information includes a fraudulent transaction score for each customer, the one or more computers: When generating the fraudulent transaction information, for each transaction included in the transaction information, a customer whose customer number matches the customer holding the account in which the transaction occurred is identified as the same person, the transaction is identified as a transaction related to the customer, and a fraudulent transaction score for each customer is generated.

7. On the computer, A procedure for inputting past transaction information, customer information which is information about a customer, and account information which is information about an account in a financial transaction; a step of generating fraudulent transaction information, which is information regarding fraudulent transactions, using the transaction information, the customer information, and the account information input in the input step and a trained model; a program for executing a procedure for outputting the fraudulent transaction information generated by the generating procedure, The fraudulent transaction information includes a fraudulent transaction score for each customer, In the generating step, for each transaction included in the transaction information, the program identifies customers whose customer numbers match the customer number of the customer holding the account in which the transaction occurred as the same person, identifies the transaction as a transaction related to the customer, and generates the fraudulent transaction score for each customer.

Images