Real-Time Anomaly Detection via Normalized Velocity Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting financial institution failure have high false positive rates, especially during busy periods, making them less effective due to the inability to handle increased transaction volumes and account for variations in transaction patterns across different regions and times.
Innovation Solution
A message tracking computing device that sorts transaction records into channels, computes normalized velocity scores by calculating streaming means and standard deviations, and analyzes these scores in real-time to detect anomalous activity, thereby reducing false positives and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional alert methods are used to detect financial institution failure, then detection capability is provided, but false positive rate increases during busy periods
Solution Approach 1:
The system dynamically changes the threshold parameter for anomaly detection based on the calculated velocity score, which itself is derived from normalized transaction velocities. This adaptive threshold adjustment allows the system to maintain high detection accuracy while reducing false positives during busy periods, as the threshold automatically scales with expected transaction volumes.
Solution Approach 2:
The system introduces dynamic normalization factors (velocity scores) that continuously adapt to changing transaction patterns. By calculating real-time velocity scores based on normalized transaction volumes across different channels, the system dynamically adjusts its detection sensitivity, maintaining reliability during both busy and quiet periods without generating excessive false positives.
2Measurement precision
If normalized velocity scoring is implemented, then false positives are reduced, but computational complexity increases
Solution Approach 1:
The system segments transaction data into distinct channels (e.g., different transaction types, time periods, or geographic regions) and calculates velocity scores independently for each channel. This segmentation reduces computational complexity by breaking down the overall calculation into smaller, manageable units while still achieving comprehensive false positive reduction through multi-channel normalization.
Solution Approach 2:
The system uses historical transaction data from the payment processing network itself to generate the normalization factors, eliminating the need for external reference data or manual calibration. The velocity scores are self-calculating based on the network's own transaction patterns, reducing computational overhead while maintaining precision.
3Speed
If real-time analysis is performed, then detection speed is improved, but processing load increases
Solution Approach 1:
The system extracts only the essential velocity information from transaction records, focusing on the rate of change rather than analyzing every transaction detail. By calculating velocity scores based on normalized transaction volumes over time windows, the system reduces processing load while maintaining real-time detection capability, as it processes aggregated velocity metrics rather than individual transaction data.
Solution Approach 2:
The system performs partial analysis by focusing on velocity changes rather than complete transaction verification. It calculates velocity scores using sampled time windows and normalized channels, processing only the necessary portion of data required for anomaly detection while maintaining real-time responsiveness to potential threats.
Data Source
AI summary
A message tracking computing device for identifying anomalous activity in real-time is provided. The message tracking computing device is programmed to receive real-time transaction data including a plurality of transaction records. Each transaction record associated with a payment transaction. The message tracking computing device is also programmed to sort the plurality of transaction records into a plurality of channels. The message tracking computing device is further programmed to compute, for each channel, a normalized velocity score by computing a streaming mean, computing a streaming standard deviation, and computing the normalized velocity score based on the streaming mean, the streaming standard deviation, and a transaction ratio. In addition, the message tracking computing device is programmed to analyze the computed normalized velocity score for each channel to detect anomalous activity, automatically generate an alert message identifying the anomalous activity, and transmit the alert message to a remote computing device.