Detection device

Abstract

This detection device (10) includes: a determination unit (11) that determines whether or not there is a possibility of fraud in settlement data by using lightweight supervised machine learning; and a detection unit (13) that detects whether or not the settlement data determined to be possibly fraudulent by the determination unit (11) is a fraudulent settlement on the basis of a difference from normal data using detailed information about the settlement.

Description

Detection device

[0001] The present invention relates to a detection device.

[0002] Damage caused by fraudulent use of cashless payments is becoming more serious. Specifically, there have been confirmed cases of stolen credit card information being misused and used for money laundering.

[0003] To prevent fraudulent use of cashless payments, it is necessary to detect fraudulent payments. A common method for detecting fraudulent payments is to use anomaly detection.

[0004] For example, supervised machine learning has traditionally been used as a fraud detection technique, while semi-supervised anomaly detection is a machine learning method that can be applied when there is a small amount of training data on fraudulent payments.

[0005] Dawei Cheng et al., “Spatio-Temporal Attention-Based Neural Network for Credit Card Fraud Detection”, AAAI, 2020.Lukas Ruff et al., “DEEP SEMI-SUPERVISED ANOMALY DETECTION”, ICLR, 2020.

[0006] However, supervised machine learning has the problem of reduced detection accuracy when sufficient training data on fraudulent payments is not available, while semi-supervised anomaly detection has the problem of high false positives and high computational complexity.

[0007] The present invention has been made in consideration of the above, and aims to provide a detection device that can detect fraudulent payments with a low false positive rate and low computational complexity, even if there are only a few known frauds.

[0008] In order to solve the above-mentioned problems and achieve the objectives, the detection device of the present invention is characterized by having a judgment unit that uses lightweight supervised machine learning to judge whether payment data is likely to be fraudulent, and a detection unit that uses detailed payment information to detect whether payment data that has been judged by the judgment unit to be likely to be fraudulent is a fraudulent payment based on differences from normal data.

[0009] According to the present invention, even if there are only a few known frauds, fraudulent payments can be detected with a low false positive rate and a low amount of calculation.

[0010] FIG. 1 is a diagram illustrating an overview of detection processing according to an embodiment. FIG. 2 is a diagram schematically illustrating an example of the configuration of a detection device according to an embodiment. FIG. 3 is a diagram illustrating an example of feature quantities extracted by a second feature extraction unit. FIG. 4 is a diagram illustrating a data format input to a hidden Markov model. FIG. 5 is a flowchart illustrating a processing procedure for learning processing according to an embodiment. FIG. 6 is a flowchart illustrating a processing procedure for detection processing according to an embodiment. FIG. 7 is a diagram illustrating an example of a computer on which a detection device is realized by executing a program.

[0011] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0012] [Embodiments] The embodiments relate to a technology for detecting fraudulent cashless payments. By combining lightweight supervised machine learning with anomaly detection using detailed payment information, it is possible to detect fraudulent payments with a low false positive rate and low computational complexity, even when there are only a small number of known frauds.

[0013] [Outline of Detection Process] Fig. 1 is a diagram showing an outline of the detection process according to an embodiment. As shown in Fig. 1, in this embodiment, lightweight supervised machine learning is performed in the first stage, and anomaly detection using detailed payment information is combined in the second stage.

[0014] In the first stage of processing, lightweight features are extracted from all payment data ((1) in FIG. 1), and the extracted features are quantized ((2) in FIG. 1). Then, in this embodiment, the quantized features are used to determine whether there is a possibility of fraud using lightweight supervised machine learning ((3) in FIG. 1). In the first stage, lightweight features are used and lightweight supervised machine learning is applied to reduce the computational complexity of the anomaly detection process.

[0015] In the embodiment, the second-stage anomaly detection is applied only to payment data that is determined to be possibly fraudulent in the first-stage determination, thereby reducing the amount of calculation required for the anomaly detection process.

[0016] In the second stage of processing, payment data that has been judged to be potentially fraudulent in the first stage is extracted, and features are extracted from the extracted payment data based on detailed payment information ((4) in Figure 1), and anomaly detection is performed to determine whether the payment is fraudulent based on differences from normal data ((5) in Figure 1). In the second stage, detailed payment information is used to make judgments, allowing for accurate detection of fraudulent payments.

[0017] [Detection Device] FIG. 2 is a diagram schematically illustrating an example of the configuration of a detection device according to an embodiment. The detection device 10 according to the embodiment is realized, for example, by loading a predetermined program into a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory), a CPU (Central Processing Unit), etc., and having the CPU execute the predetermined program. The detection device 10 also has a communication interface for transmitting and receiving various information to and from other devices connected via a network, etc. The detection device 10 is realized by a general-purpose computer such as a workstation or a personal computer. The detection device 10 includes a determination unit 11, an extraction unit 12, a detection unit 13, and a learning control unit 14.

[0018] The determination unit 11 uses lightweight supervised machine learning to determine whether or not there is a possibility of fraud in the payment data. The determination unit 11 makes a determination for all payment data.

[0019] The extraction unit 12 extracts payment data that has been determined by the determination unit to be possibly fraudulent, and outputs the extracted data to the detection unit 13 .

[0020] The detection unit 13 uses detailed payment information to detect whether payment data determined by the determination unit 11 to be possibly fraudulent is a fraudulent payment based on differences from normal data. The detection unit 13 outputs the detection result to, for example, a payment management device. The detection unit 13 performs detection using, for example, a machine learning model such as a neural network.

[0021] The learning control unit 14 uses the teacher data that the determination unit 11 has determined to be possibly fraudulent for learning by the detection unit 13. The learning control unit 14 uses the teacher data that the determination unit 11 has determined to be possibly fraudulent to update parameters of the machine learning model of the detection unit 13. The learning control unit 14 may perform learning on the determination unit 11.

[0022] [Determination Unit] The determination unit 11 includes a first feature extraction unit 111 , a quantization unit 112 , and a fraud determination unit 113 .

[0023] The first feature extraction unit 111 extracts summary information of all payment data as features. The first feature extraction unit 111 extracts summary information of payment data related to the user to be evaluated. For example, the first feature extraction unit 111 extracts the total payment amount, remittance amount, deposit / withdrawal amount, number of payments, number of remittances, and number of deposits / withdrawals for the past three weeks of the user to be evaluated. Here, by extracting summary information of payments rather than information on individual payments, the first feature extraction unit 111 can reduce the amount of calculations and can be applied to large amounts of data.

[0024] The quantization unit 112 quantizes the feature amounts extracted by the first feature extraction unit 111. For example, the quantization unit 112 approximates the total amount in units of 10,000 yen or 50,000 yen. The quantization unit 112 also approximates the number of times in units of 5 times or 10 times. In this way, by performing quantization by the quantization unit 112, overlearning by the fraud determination unit 113 (described below) can be prevented and false detections can be reduced even when there is a small amount of known fraudulent data.

[0025] The fraud determination unit 113 determines whether or not there is a possibility of fraud using lightweight supervised machine learning on the quantized features. Possible supervised machine learning methods that the fraud determination unit 113 applies include decision trees and logistic regression. By applying a lightweight machine learning method rather than a neural network or the like, the fraud determination unit 113 can reduce the amount of calculation compared to the detection unit 13.

[0026] [Detection Unit] The detection unit 13 has a second feature extraction unit 131 and an inference unit 132. The detection unit 13 performs anomaly detection only on payment data of users determined to be fraudulent by the determination unit 11. This allows the detection device 10 to reduce the amount of calculation required for feature extraction and learning.

[0027] The second feature extraction unit 131 extracts features from the detailed payment information for each payment data that the determination unit 11 has determined to be possibly fraudulent.

[0028] Based on the features extracted by the second feature extraction unit 131, the inference unit 132 infers whether the payment of the payment data corresponding to the features extracted by the second feature extraction unit 131 is a fraudulent payment.

[0029] The detection unit 13 uses a method of making inferences based on time series patterns of payment data and / or a method of making inferences based on co-occurrences of payment data.

[0030] First, we will explain the method by which the detection unit 13 makes inferences based on time series patterns of payment data. The detection unit 13 employs anomaly detection using a hidden Markov model as the method for making inferences based on time series patterns of payment data.

[0031] Fig. 3 is a diagram showing an example of feature quantities extracted by the second feature extraction unit 131. Fig. 4 is a diagram for explaining the format of data input to the hidden Markov model.

[0032] For example, the target is payment data for each user over the past two weeks or so. In the detection unit 13, the second feature extraction unit 131 extracts features for each target payment and associates them with nodes in a discrete Markov model. The features include the payment amount, the number of payments made by the payment recipient in a month, a flag indicating whether the payment is higher than the payment amount typically made by the payment recipient, a flag indicating whether the payment is made to the same payment recipient as the previous payment, and the time elapsed since the previous payment. In addition to payments, the features may also include deposits, withdrawals, remittances, etc. Figure 3 shows an example of features.

[0033] The inference unit 132 executes learning of a hidden Markov model using data of legitimate users and calculates the degree of anomaly of the data of the user to be judged. The inference unit 132 judges as fraudulent users those whose degree of anomaly is equal to or greater than a threshold, or those whose abnormal values ​​are ranked from 1st to a predetermined rank. The threshold may be the maximum abnormal value of normal users. The users with the highest abnormal values ​​may be, for example, the top five. When the degree of anomaly is calculated for each node, the inference unit 132 may use the average value of the degree of anomaly.

[0034] Next, a description will be given of a method for making inferences based on the co-occurrence of payment data by the detection unit 13. The detection unit 13 performs anomaly detection based on the co-occurrence of deposits and withdrawals and payments.

[0035] For example, the detection unit 13 targets each user's deposits, withdrawals, and settlements over the past two weeks or so. Co-occurrence of deposits and withdrawals is determined by identifying users with the same deposit / withdrawal date, deposit / withdrawal method, and amount. The detection unit 13 then targets, for example, users who have made two or more deposits and withdrawals. In this case, the detection unit 13 may quantize the deposit / withdrawal amounts into units of 1,000 yen or 10,000 yen. The detection unit 13 may also target remittances.

[0036] Next, the detection unit 13 calculates the similarity of payments between users. The Jaccard coefficient, for example, can be used as the similarity. The detection unit 13 determines that users whose calculated anomaly level is equal to or greater than a predetermined threshold, or whose anomaly values ​​are ranked from 1 to a predetermined rank, are fraudulent. In this case, the detection unit 13 may use the maximum anomaly value of normal users as the threshold. Furthermore, the users with the highest anomaly values ​​may be, for example, the top five.

[0037] [Learning Process] Fig. 5 is a flowchart showing the processing steps of the learning process in the embodiment. As shown in Fig. 5, the determination unit 11 receives input of payment data for learning as training data (step S11).

[0038] Next, in the determination unit 11, the first feature extraction unit 111 performs a first feature extraction process to extract summary information of the payment data for training as features (step S12). The quantization unit 112 performs a quantization process to quantize the features extracted in step S12 (step S13). The fraud determination unit 113 performs a fraud determination process to determine whether there is a possibility of fraud using lightweight supervised machine learning on the quantized features (step S14).

[0039] The extraction unit 12 extracts the payment data that the determination unit 11 has determined to be possibly fraudulent (step S15), and outputs the extracted payment data to the detection unit 13 as payment data for which anomaly detection is to be performed.

[0040] In the detection unit 13, the second feature extraction unit 131 performs a second feature extraction process to extract features for each payment data extracted in step S15 (step S16). The inference unit 132 infers whether the payment of the payment data corresponding to the features extracted in step S16 is fraudulent (step S17).

[0041] The learning control unit 14 uses the training data extracted in step S15 as possibly being fraudulent to update the parameters of the machine learning model of the detection unit 13 (step S18). The detection device 10 repeats the processes of steps S11 to S18 until the parameters of the machine learning model of the detection unit 13 are optimized.

[0042] [Detection Process] Fig. 6 is a flowchart showing the procedure of the detection process in the embodiment. As shown in Fig. 6, the determination unit 11 receives input of payment data to be processed (step S21).

[0043] Next, in the determination unit 11, the first feature extraction unit 111 performs a first feature extraction process to extract summary information of the payment data received in step S21 as features (step S22). The quantization unit 112 performs a quantization process to quantize the features extracted in step S22 (step S23). The fraud determination unit 113 performs a fraud determination process to determine whether there is a possibility of fraud using lightweight supervised machine learning on the quantized features (step S24).

[0044] The extraction unit 12 extracts the payment data that the determination unit 11 has determined to be possibly fraudulent (step S25), and outputs the extracted payment data to the detection unit 13 as payment data for which anomaly detection is to be performed.

[0045] In the detection unit 13, the second feature extraction unit 131 performs a second feature extraction process to extract features for each payment data extracted in step S25 (step S26). The inference unit 132 infers whether the payment of the payment data corresponding to the features extracted in step S16 is fraudulent (step S27). The detection unit 13 outputs a detection result for the payment data based on the inference result of step S27 (step S28).

[0046] [Example] For example, the embodiment can be applied to detecting fraudulent use of a payment application, which has functions for payment, deposit / withdrawal, and remittance.

[0047] The determination unit 11 uses data from the past two weeks at the time a payment, deposit, withdrawal, or remittance is made using the payment app to determine whether or not there is a possibility of fraud in the payment, deposit, withdrawal, or remittance made using the payment app.

[0048] The detection unit 13 applies anomaly detection to payment data that has been determined to be possibly fraudulent by the determination unit 11. The detection unit 13 applies both anomaly detection using a hidden Markov model and anomaly detection based on co-occurrence, and if fraud is determined by either method, the final determination result is fraud.

[0049] Effects of the embodiment In this way, the detection device 10 according to the embodiment can detect fraudulent payments with a low false positive rate and a low computational effort, even if there are only a few known frauds, by combining lightweight supervised machine learning with anomaly detection that uses detailed payment information.

[0050] That is, in the first stage, the detection device 10 first extracts summary information from the payment data as features and determines whether there is a possibility of fraud using lightweight supervised machine learning. In this case, the detection device 10 extracts summary information as features, rather than individual payment information. In this way, by using lightweight features, the detection device 10 can reduce the amount of calculation and become applicable to large amounts of data. Furthermore, by using summary information from payments, the detection device 10 can prevent overlearning even when there is a small amount of fraudulent data, thereby reducing false positives.

[0051] Next, the detection device 10 applies the second stage of anomaly detection only to payment data determined in the first stage to be potentially fraudulent. This allows the detection device 10 to reduce the amount of calculation required for feature extraction and inference. Furthermore, by performing anomaly detection using detailed payment information, the detection device 10 can accurately detect fraudulent payments based on differences from normal data. Furthermore, during training, the detection device 10 trains the detection unit 13 using only payment data determined in the first stage to be potentially fraudulent. This allows the detection device 10 to reduce the amount of calculation required for feature extraction and training.

[0052] [System Configuration of the Embodiment] The detection device 10 is a functional concept and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of the functions of the detection device 10 is not limited to that shown in the figure, and all or part of the detection device 10 can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0053] Furthermore, all or any part of the processes performed in the detection device 10 may be realized by a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and a program analyzed and executed by the CPU and the GPU (Graphics Processing Unit). Furthermore, each process performed in the detection device 10 may be realized as hardware using wired logic.

[0054] Furthermore, among the processes described in the embodiments, all or part of the processes described as being performed automatically can be performed manually. Alternatively, all or part of the processes described as being performed manually can be performed automatically using a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters described above and illustrated can be changed as appropriate unless otherwise specified.

[0055] 7 is a diagram showing an example of a computer in which the detection device 10 is realized by executing a program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0056] The memory 1010 includes a ROM 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0057] The hard disk drive 1090 stores, for example, an operating system (OS) 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the detection device 10 is implemented as a program module 1093 in which code that can be executed by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configuration of the detection device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD (Solid State Drive).

[0058] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary and executes them.

[0059] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0060] Although the present invention has been described above as an embodiment, the present invention is not limited to the descriptions and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0061] REFERENCE SIGNS LIST 10 Detection device 11 Determination unit 12 Extraction unit 13 Detection unit 14 Learning control unit 111 First feature extraction unit 112 Quantization unit 113 Fraud determination unit 131 Second feature extraction unit 132 Inference unit

Claims

1. A detection device comprising: a determination unit that uses lightweight supervised machine learning to determine whether payment data is likely to be fraudulent; and a detection unit that uses detailed payment information to detect whether payment data determined by the determination unit to be likely to be fraudulent is fraudulent based on differences from normal data.

2. The detection device described in claim 1, characterized in that the judgment unit comprises: a first feature extraction unit that extracts summary information of the payment data as features; a quantization unit that quantizes the features extracted by the first feature extraction unit; and a fraud judgment unit that uses lightweight supervised machine learning on the quantized features to judge whether or not there is a possibility of fraud; and the detection unit comprises: a second feature extraction unit that extracts features from detailed payment information for each piece of payment data judged by the judgment unit to be possibly fraudulent; and an inference unit that infers whether or not the payment of payment data corresponding to the features extracted by the second feature extraction unit is a fraudulent payment based on the features extracted by the second feature extraction unit.

3. The detection device described in claim 1, characterized in that the detection unit uses a method of making inferences based on the time series pattern of the payment data and / or a method of making inferences based on co-occurrence of the payment data.

4. The detection device according to claim 1, wherein training data determined by said determination unit to be possibly fraudulent is used for learning by said detection unit.

Images