Triangular Timestamp Transformation for Global Message Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing message traffic monitoring systems struggle to accurately detect abnormal or malicious behavior due to time-based differences caused by international message traffic, time zones, and time switchovers, leading to reduced accuracy in modeling and increased misclassification of fraudulent transactions.
Innovation Solution
Implement a timestamp triangular transformation method that shifts and transforms timestamps based on a portion of a time period, such as a day, week, or month, to generate a model of message traffic, allowing for more accurate detection of anomalies by considering time of day, day of week, and day of month patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional timestamp monitoring is used without time zone adjustment, then the system is simple to operate, but measurement precision of message traffic patterns deteriorates due to international time differences
Solution Approach 1:
The patent segments the timestamp into multiple components (time zone offset, time period portion, transformed time value) and processes each separately. The timestamp transformation system divides the processing into distinct modules: receiving historical messages with timestamps, shifting timestamps by time zone offsets, transforming based on time period portions, and generating models. This segmentation allows the system to handle complexity in a structured way while improving measurement precision for international message traffic.
2Measurement precision
If timestamps are shifted and transformed based on time period portions, then detection accuracy of abnormal behavior improves, but computational processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-processing historical messages with timestamp shifts and transformations before model generation. The system shifts timestamps by time zone offsets and transforms them based on time period portions (hours, days, weeks, months) in advance, creating a pre-processed dataset that improves subsequent detection accuracy while reducing real-time processing requirements.
Solution Approach 2:
The system changes parameters by applying different time period portions (hours of day, days of week, days of month, weeks of month, months of year) to transform timestamps. These parameter changes allow the model to capture temporal patterns at multiple granularities, improving abnormal behavior detection accuracy while the systematic approach manages computational complexity.
3Reliability
If the system accounts for international time zones and time period patterns, then reliability of fraud detection improves, but device complexity increases
Solution Approach 1:
The patent implements universality by creating a multi-functional timestamp transformation analysis system that handles multiple time zones, various time period portions (hours, days, weeks, months), and different message traffic patterns through a single integrated framework. The system can process historical messages, generate models, and detect abnormalities across diverse international scenarios, improving fraud detection reliability while consolidating complexity into a unified system.
Data Source
AI summary
A message traffic analysis system is provided. The message traffic analysis system includes a memory device and at least one processor. The at least one processor is programmed to receive a plurality of historical messages between a plurality of sources and a destination server, for each of the plurality of historical messages, time shift the corresponding timestamp by an amount, transform the plurality of time shifted timestamps based on a portion of an entire time period completed, generate a model of message traffic based on the plurality of historical messages with the transformed and time shifted timestamps, receive one or more real-time messages between a first source and the destination server, execute the model of message traffic using the one or more real-time messages as inputs, and determine whether or not to allow the one or more real-time messages based on the execution of the model.