FR3057378A1 - SYSTEM FOR DETECTING FRAUD IN A DATA STREAM - Google Patents

Abstract

The present invention relates to a computer system for detecting fraud in a data stream comprising at least one data lake for storing large volumes of data, a platform containing at least one production environment comprising at least one hardware and software architecture. -adaptative comprising a plurality of stored fraud control templates, at least one data storage memory, at least one processor, a "real time" data processing layer, an online training set and a layer of service connected to the processing layer by a communication means, the set or each of the layers comprising at least hardware and software implementing a micro-service executed on the processor of the hardware hardware architecture to respectively enable checking and / or control in real time the flow of data, re-train and update in time It's the real control models and manage the processed data.

Description

(57) The present invention relates to a computer system for detecting fraud in a data flow comprising at least one data lake making it possible to store large volumes of data, a platform containing at least one production environment comprising at least one hardware architecture. and self-adaptive software comprising a plurality of stored fraud control models, at least one memory for storing data, at least one processor, a layer of “real-time” data processing, an e-learning set and a service layer connected to the processing layer by means of communication, the set or each of the layers comprising at least hardware and software implementing a micro-service executed on the processor of the computer hardware architecture to allow respectively check and / or control the data flow in real time, re-train and update control models in real time role and manage the data processed.

i

Fraud detection system in a data stream

TECHNICAL FIELD OF THE INVENTION

The present invention relates to the field of security of transfers of sensitive data and in particular the security of bank exchanges. More specifically, the present invention relates to a system for detecting fraud in a data flow.

TECHNOLOGICAL BACKGROUND OF THE INVENTION

Securing sensitive data is a major challenge for many sectors and in particular in the banking sector where the security of payments / transactions is constantly tested. If the technological evolution of IT infrastructures provides means to fight against fraud or hacking of sensitive data, it also allows hackers to develop new methods for illegal or fraudulent recovery of data.

Several methods combining complex mathematical techniques and models exist for the detection of fraud in a data flow. However, the portability or application of these models to constantly evolving data systems in real time is limited, thereby providing a means for hackers to recover sensitive information.

GENERAL DESCRIPTION OF THE INVENTION

The present invention aims to overcome certain drawbacks of the prior art by proposing a system for detecting fraud during an exchange of data during a banking transaction, in particular.

This objective is achieved by a computer system for detecting fraud in a data flow comprising at least one data lake making it possible to store large volumes of data with variable structures, in the form of a distributed database, for uses and various analyzes, a platform which contains at least one production environment comprising at least one self-adaptive hardware and software architecture comprising a plurality of stored fraud control models, a test and update engine for fraud control models , at least one memory for storing data, at least one processor, a “real time” processing layer for the data flow and a service layer, said layers being connected by means of communication, each of the layers comprising at least hardware and software implementing a micro-service executed on the processor of the computer hardware architecture to allow respecti vement to check and / or control the data flow in real time and manage the processed data from the "real time" processing in the service layer, said self-adapting architecture being characterized in that it also includes a set online learning linked to the "real time" processing layer to re-train and update in real time fraud control models stored in the "real time" processing layer.

According to another particular feature, an output of the “real time” layer is connected to the input of the online learning assembly and the output of the learning assembly is connected to an input of the processing layer in "Real time" to form a loop learning structure.

According to another particularity, the online learning set includes micro-services, each responsible for re-training fraud control models deployed in the processing layer in "real time", and a redeployment system for automatically redeploying the fraud control models re-trained and updated in the microservices of the “real-time” processing layer in charge of their use.

According to another particular feature, the “real time” processing layer comprises a configuration server for continuously updating the parameters of the fraud control models managed by the micro-services of said “real time” processing layer.

îo According to another particular feature, the redeployment system of the online learning set includes a central service capable of receiving a notification from a micro-service of said learning set when a model has been re-trained, said central service in turn notifying the micro-services of the processing layer in “real time” which are concerned by the update of the parameters, via a REST API which will reload the parameters in the configuration server of the processing layer in "Real time", said server then distributing the parameters to the micro-services concerned.

According to another particularity, the structuring of the self-adapting architecture into micro-services, communicating with one another by passing messages, makes it possible to split the processing chain of the data flows, into a given number N of micro-services, said number N corresponding to the number of types of processing to be performed to respond to a given request, and to multiply the number of instances of a given type of service to allow scaling up and ensure continuity of service in the event that a instance is interrupted to perform a given configuration.

According to another particular feature, the fraud detection system also includes an environment for developing new models for controlling and / or verifying fraud of the data flow in the production environment.

According to another particularity, that the development environment 5 includes a hardware and software deployment architecture composed of at least one modeling engine for developing and testing control models, said modeling engine being connected to a calculation engine. distributed "map / reduce" configured to load production data into the development environment îo and allow the evaluation in "real time" of new control models and, a data flow deployer in charge of deploying the models in the production environment.

According to another particular feature, the data flow deployor uses a file describing the data flows stored in the data lake to orchestrate the various micro-services of the platform.

According to another particularity, the deployment of the fraud control data models is ensured by means of a code repository controller which interrogates the modeling engine with respect to certain code repositories to detect the modifications made to the flow.

According to another particular feature, any continuous deployment of control models and algorithms from the development environment in the production environment is supervised by a person.

According to another particular feature, the data redeployment system includes means for implementing and configuring an e-learning set according to the data analysis model.

According to another particular feature, the fraud detection system comprises a control device for analyzing information, emitted by the “real time” processing layer and containing dated events relating to fraud cases, and activating an alarm signal in the event of fraudulent data being detected in order to alert an administrator or supervisor of the attempted fraud.

According to another particular feature, the fraud detection system is used for securing sensitive data in a system of services comprising at least one database and at least one platform for processing requests associated with sensitive data, said detection system. fraud acting as a secure interface between the database and the request processing platform.

DESCRIPTION OF ILLUSTRATIVE FIGURES

Other features and advantages of the present invention will appear more clearly on reading the description below, given with reference to the appended drawings, in which:

- Figure 1 shows the diagram of the structure of the fraud detection system in one embodiment;

- Figure 2 shows the diagram of the use of the structure of the fraud detection system in a system comprising a database and a platform for processing requests associated with sensitive data, according to one embodiment;

- Figures 3a and 3b respectively represent the diagrams of the structure of the platform of the fraud detection system and the development environment of the platform, according to one embodiment;

FIGS. 4a and 4b respectively represent the diagrams of the structure of the production environment of the platform and of the “real-time” processing layer and of the learning assembly, according to one embodiment;

DESCRIPTION OF THE PREFERRED EMBODIMENTS OF

THE INVENTION

The present invention relates to a system (1, FIG. 1) for detecting a fraudulent action in a data stream.

In certain embodiments, the system (1) for detecting fraud in a data stream comprises at least one data lake (4) making it possible to store large volumes of data with variable structures, in the form of a database distributed, for various uses and analyzes, a platform (10) which contains at least one production environment (3, FIG. 4a) comprising at least one self-adaptive hardware and software architecture comprising a plurality of stored fraud control models, an engine for testing and updating fraud control models, at least one memory for storing data, at least one processor, a layer (31, FIGS. 1, 2 and 4a for example) of processing in "time" data flow and a service layer (33), said layers being connected by means of communication, each of the layers comprising at least hardware and software implementing a micro-service executed on the processor of the computer hardware architecture to allow respectively to verify and / or control in real time the data flow and to manage in the service layer (33) the processed data, resulting from the "real time" processing, said self-adapting architecture being characterized in which it also includes an online learning set (32) linked to the “real time” processing layer (31) for re-training and updating in real time fraud control models stored in the layer ( 31) “real time” processing.

The data lake (4) is the repository or system where data from, for example and without limitation from a database is stored. Different sources, for example and without limitation, a telephone, a payment terminal or a bank continuously transmit a data flow towards the platform (10) of the fraud detection system which then proceeds to process, the flow of each source, to check whether said flow contains fraudulent data or not. In the event that fraudulent data is detected, the event is dated and contained in information sent by the processing layer (31) îo in "real time". Said information is then transferred to a control device which activates an alarm signal which can be, for example and without limitation, a sound or a message, to warn an administrator or a supervisor of an attempted fraud. In the event that no fraud is detected in the data flow, the data is transferred for processing.

The hardware hardware architecture of the self-adaptive architecture includes at least one distributed computing engine, preferably a computing cluster. Distributed computing consists of distributing a calculation or processing on several processors of a computer hardware architecture, for example a central computer unit. Independent instructions can thus be processed in parallel by the various microprocessors. Data is processed in real time in the production environment (3) of the self-adaptive architecture and more precisely in the "real time" layer. The micro-services (m) of said layer, see for example FIG. 4b, are small size autonomous functional applications with a functional perimeter (that is to say the complete list of functionalities and their exhaustive description) defined. The micro-services communicate with each other by exchanging data or messages via a message queue system, preferably a messaging middleware of the MQ type (for “message queue” in English). The messaging middleware can be with or without a broker. An MQ middleware with broker makes it possible to translate a message from the formal messaging protocol of the sending micro-service to the formal messaging protocol of the receiving micro-service of said message. In the case of an MQ without a broker, the message is transmitted from one micro-service to another without translation of said message. Preferably, the format of the messages exchanged between the micro-services is independent of the different formal messaging protocols of the micro-services, in order to allow the interpretation of said messages by the messaging protocols of said micro-services, and this, whatever the language used by these microservices. For example and in a nonlimiting manner, the formats JSON (Notation Object resulting from JavaScript) and / or XML (markup language îo extensible) can be used.

A programming interface, for example and without limitation a REST API interface, is used in the architecture for the orchestration of micro-services and for the support functions. The support functions, which are also micro-services, are functions implemented for the proper functioning of the control platform (10), for example and in a nonlimiting manner the configuration update or the update of the control model parameters. These support functions meet the non-functional needs of the platform and do not implement a given functional scope.

By non-functional need, we mean any need relating to the proper functioning of the platform.

The application programming interface (REST API) based on the REST architecture (Representational State Transfer in English) is suitable for distributed data systems. Architecture or API interface

REST:

• is client-server oriented, that is to say that responsibilities are separated between a client and a server. This allows the two entities (client and server) to evolve independently;

• is stateless, that is to say that each request from the client to the server must contain all the information necessary to allow the server to understand the request, without having to depend on a context stored on the server. This increases a client’s interactions with the server, but reduces the client’s adherence to a service instance;

• has a cache memory: the server sends a response which gives information on the propensity of this response to be cached, such as freshness, its creation date, if it must be kept in the future. This allows clients not to make unnecessary requests and also improves the extensibility of the servers;

• is a uniform interface, for which each data or resource is identified, each data or resource being manipulated through a defined representation which is associated with it and each message transmitted is self-descriptive, that is to say that it has the information that describe it;

• has a layered structure: the states of an application are identified by individual resources. Not all information is sent to a single, unique resource. The requests / responses between the client and the server increase and therefore can decrease performance hence the importance of caching. The layered structure thus makes the evolution of the system much more flexible;

• can be optional "code on demand" (code-ondemand in English), that is to say that clients have the possibility of executing scripts obtained from the server. This makes it possible to prevent processing being carried out only on the server side and therefore allows the functionality of the client to evolve over time.

The structuring of the self-adapting architecture, and in particular the “real time” processing layer (31) in micro-services (m) makes it possible to ίο cut the processing chain of data flows into a given number N micro-services (m), said number N corresponding to the number of types of processing to be carried out to respond to a request. For example and in a nonlimiting manner, if the type of processing to be carried out relates to the calculation of aggregates on the transactions of a card holder over the last twenty-four hours with a type of merchant, a single micro-service (m) is used to perform the calculation. If you want to calculate the aggregates over the last 48 hours, then a second microservice is called upon. This architecture of micro-service type (m), based on the passage of messages, makes it possible to multiply the number of instances of a given type of service to allow in particular the passage to scale, in the case where one wishes to interrupt an instance, that is to say the interruption of the data flow towards said instance, to perform a given configuration, for example to reload its parameters.

By micro-service type architecture, we mean a software architecture from which a complex set of applications is broken down into several independent and weakly coupled processes, called micro-services (m) and communicating with each other via a message system, by example an API.

By service instance is meant a fraud control or data analysis or calculation model.

Each micro-service is particularly, at least, in charge of the start-up and operation (for example of the support functions) of at least one fraud control model or program.

Learning or training models consists of estimating the parameters enabling a process to be correctly described based on the input data. For example and in a nonlimiting manner, the parameter to be estimated can be the weight or coefficient of the variables or input data. The weight of a variable or input data, defined by a real value, determines the importance of the input variable or data: the greater the weight of the variable or data the more the variable or data input is influential in the description of the process.

Several fraud control models exist, among which have mainly, for example and without limitation, found the Random Forest model, the model of neural networks, the model of expert rules or the model of 'graph mining (graph mining in English). In one embodiment, the random forest model can be used. Random forests are sets of decision trees, each tree being distinguished from the others by the sub-sample of data, coming from the data flow coming for example from a bank terminal or any other source and, on which it is trained. A decision tree or decision tree is a structure used to predict the values taken by a variable according to a set of variables called variables or input data. The decision tree is in the form of a hierarchy, each element of which is called a node, the initial node being called the root. Each node corresponds to a decision as to the value of the variable to be predicted, for example the weight of a data item in the detection of fraud, the decision being taken according to the value of the input data items. At the end of the training, an estimation of the parameters important for the detection of fraud in the case of the random forest model then consists, for example, in averaging the estimates from the different decision trees.

In another embodiment the neural network model can be used. Neural networks implement the principle of induction, that is to say by experience. By confrontation with specific situations, a neural network will infer an integrated decision system whose generic character is a function of the number of learning cases encountered and their complexity compared to the complexity of the problem encountered. Neural networks play an important role in several areas ranging from the classification of animal species or physical phenomena to the improvement of teaching techniques through the recognition of patterns in image processing. In particular, neural networks are widely used in the treatment of problems of a statistical nature, that is to say problems involving the processing of a very large amount of data. For example, and without limitation, neural networks can help in the decision regarding a stock purchase. The neural network is made up of a structure called formal neuron. Said formal neuron is designed as an automaton with at least one input, one output and one transfer function which transforms data into input into data into output according to precise rules. For example and in a nonlimiting manner, a neuron can sum the input data, compare the resulting sum with a threshold value, and respond by emitting a signal if this sum is greater than or equal to this threshold. The input data, for example from the terminals, are considered as input variables and arrive at the node, each with a given weight called the connection weight or synaptic coefficient. Said coefficient is an important parameter in describing the efficiency of signal transmission from one neuron to another. The learning phase in the case of a model based on neural networks will consist, for example, in determining the synaptic weights making it possible to obtain optimal efficiency. Once trained, the neural network is able to detect fraud according to the rules defining the criteria for fraud. If the neural network operates with real numbers, the response reflects a probability of certainty. For example and in a nonlimiting manner, if the process consists in determining whether a piece of data entered by a user is fraudulent, the result of the neural network can be: 1 for "the piece of data entered by the user is fraudulent", 0 for " the data is not fraudulent ”or 0.7 for“ the data is almost certainly fraudulent ”, in which case the model can be re-trained to be more precise.

In another embodiment, the expert rules model can be used for the detection of fraud. In this case, the model uses a facts database, essentially made up of events relating to fraud cases already encountered, for example, and a base of rules for reasoning in order to produce new facts or events up to fraud detection.

In another embodiment, the model used for fraud detection is the graph exploration model. A graph is a network or set of nodes, called vertices, linked together by at least one segment (called edge) or an arrow (called arc). A decision tree is for example a special case of a graph. The input data flow is distributed over all the nodes of the graph. Exploring the graph then involves passing the data through the graph by applying the to weight of each edge or arc as well as the activation functions, for example the sigmoid functions, associated with each node. The node activation function does the weighted sum of the input data and returns the output result. The exploration of the nodes is done step by step from an initial node by means of an algorithm in order to find patterns or characteristics according to criteria set beforehand and to extract the maximum amount of knowledge from which to detect the fraud.

The processed data which does not contain fraudulent information is then stored in at least one memory of the service layer (33) before being transferred for exploitation.

In some embodiments, an output of the "real time" layer (31) is connected to the input of the online learning assembly (32) and the output of the learning assembly (32) is connected to an input of the “real time” processing layer (31) to form a loop learning structure, as shown in FIGS. 1, 2 or 4a for example.

The use of a loop structure in the self-adaptive architecture allows adaptation of control models to data flows transmitted in real time and effectively reduces the risk that a model managed by a given micro-service (m) is not suitable for controlling the data contained in said flow. Such a situation can indeed make the system (1) more vulnerable to fraud. The self-adaptive architecture thus offers an advantage in comparison to an architecture of the "lambda-architecture" type. Indeed, a "lambda-architecture", like self-adaptive architecture, allows processing of massive data and is made up of three layers. Said architecture includes a "real time" processing layer, a service layer and a "batch processing" layer. The “batch processing” layer, in general connected to a data lake and to the service layer, plays the same role as the set (32) of learning îo control models, unlike learning of models is not done in real time. The models are, in fact, reconfigured or replaced once during a defined period, for example and without limitation once a day or once a month depending on requirements. The data on which these models have been configured is therefore not continuously updated. This is a disadvantage when we want, in real time, to adapt the control models to changes in the information contained in the data flow, to prevent fraudulent action.

In certain embodiments, the set (32) of e-learning comprises micro-services (m), as shown in FIG. 4b, each in charge of re-training fraud control models deployed in the layer (31 ) of processing in "real time", and a redeployment system (320) for automatically redeploying the fraud control models re-trained and updated in the micro-services (m) of the layer (31) of processing in "time real "in charge of their use.

When the parameters of a fraud control model, supported by a given micro-service of the “real time” processing layer (31), have to be updated, the real time redeployment system (320) is used rather than stopping the micro-service in order to be able to ensure processing within the time allowed. The redeployment system (320) comprises a central service which receives a notification from the micro-service, included in the training unit (32) and in charge of training a control model, when said model has been re-trained. The central service of the redeployment system (320) in turn notifies the micro-services (m) of the processing layer (32) in “real time” which are concerned, by updating the parameters, via a REST API. , which will reload the parameters in a configuration server (310), included in the "real time" processing layer. Said server (310) will then distribute the parameters to the micro-services (m) concerned. The parameters of the fraud control models managed by the micro-services (m) of the "real-time" processing layer (31) are thus continuously updated by the configuration server (310).

Thus, using the redeployment system (320), the unavailability of a service instance due to the updating of a model in a running microservice, goes from a few seconds to a few milliseconds, thus optimizing the management of messages. The data redeployment system (320) further includes means for implementing and configuring an online learning set (32) based on the data analysis model. For example and in a nonlimiting manner, if one or more fraud control models are used, for example the random forest and neural network models, the system (320) activates a program whose implementation on a processor of the hardware architecture allows you to split and configure two learning subsets, each consisting of the micro-services (m) of the main learning set, the microservices (m) being in charge of either learning the model of random forests or from learning the neural network model.

In certain embodiments, the fraud detection system (1) also comprises an environment (2) for real-time development of new models for controlling and / or verifying fraud of the data flow in the environment (3). production.

In general, the development environment is separate from the production environment. This configuration, even if it secures the system, lacks responsiveness. Indeed, the data used to test the fraud control models are not continuously updated, it is therefore not excluded that at least one model, developed in the environment (2) of failing to takes into account certain criteria to detect any fraud, once it is used in the production environment (3). The development environment (2) of the present invention thus makes it possible to have a secure system that is reactive to changes in the data flow, as we will see in the following description.

In certain embodiments, the development environment (2) comprises a hardware and software deployment architecture composed of at least one modeling engine (21) for developing and testing control models, said engine (21) modeling being connected to a distributed “map / reduce” calculation engine (20) configured to load production data into the development environment (2) and allow real-time evaluation of new control models and, a deployer (22) of data flow in charge of deploying models in the data flow supported in the production environment (3).

The distributed “map / reduce” calculation engine comprises at least one computer hardware cutting unit for cutting the flow of data read as input into small volumes and distributing them in a first series of computer hardware units capable of performing parallel calculations. . Each calculation unit of the first series implements a so-called “map” function which consists in transmitting the data read as input in the form of pairs (key, value). A key is an element included in the data. For example and without limitation, if the data item consists of a sentence, the words which make up the sentence can be defined as keys. The value is a number, for example 1 or 2. It can be used to define the quantity of element that makes up a key, for example. When the pairs (key, value) have been issued, they are transferred to a second series of parallel computing hardware units. The calculation units of this second series then implement a so-called “reduce” function which consists in grouping the pairs having identical keys and in storing them in a memory. The data are then loaded from said memory into the modeling engine, for the development of calculation models as a function of pairs (key, value).

In certain embodiments, the data flow deployor (22) uses a file describing the data flows, stored in the data lake, to orchestrate the various microservices of the platform (10). When a data flow is loaded into the data lake, for example from a database, the information relating to the data flow is automatically entered in the descriptive file of said data flow as well as their address, it that is to say the processing layer where said data is to be routed. The deployer (22) reads the various addresses entered in the description file and transfers the data to the corresponding micro-services.

In certain embodiments, the deployment of fraud control data models is ensured by means of a code repository controller which interrogates the modeling engine (21) with respect to certain code repositories to detect the modifications made to the flow.

In some embodiments, any continuous deployment of control models and algorithms from the development environment (2) in the production environment (3) can be supervised by a person depending on the use case of the detection system (1). This action can be performed to prevent a malicious model or code from being introduced into the production environment (3). For example and in a nonlimiting manner, when the detection system (1) is used for the control of information relating to a bank card and to its user, the control process can take place within the framework of a security standard such as the PCI DSS standard (security standard for the payment card industry). This standard increases the control of cardholder information in order to reduce the fraudulent use of payment instruments. In this context, a supervisor can carry out a check of the control models or codes in order to detect any attempt to modify the information relating to a particular user, for example.

In certain embodiments, the fraud detection system (1) for securing sensitive data in a service system (5) comprising at least one database (52) and at least one platform (53) for processing requests associated with sensitive data, said fraud detection system (1) acting as a secure interface between the database (52) and the request processing platform (53). For example and without limitation, the service system (5) (Figure 2), may include a client interface (50) by means of which a client enters data to gain access to a particular service included in a platform (51) Services. The data entered by the customer are recorded in a database (52) and then transferred to the data lake (4) of the fraud detection system (1). The data is then routed to the "real time" processing layer (31) for analysis. If the data contain fraudulent elements, the alarm system of the detection system (1) sends a signal to a supervisor to inform him of the attempted fraud. If, on the contrary, the data is not fraudulent, the result of the request is transferred to the service layer (33). The request processing platform (53) of the service system (5) makes a call to the result and proceeds to process the request from the client.

The present application describes various technical characteristics and advantages with reference to the figures and / or to various embodiments. Those skilled in the art will understand that the technical characteristics of a given embodiment can in fact be combined with characteristics of another embodiment unless the reverse is explicitly mentioned or it is obvious that these characteristics are incompatible or the combination does not provide a solution to at least one of the technical problems mentioned in the present application, îo Furthermore, the technical characteristics described in a given embodiment can be isolated from the other characteristics of this mode. unless the reverse is explicitly mentioned.

It should be obvious to those skilled in the art that the present invention allows embodiments in many other specific forms without departing from the scope of the invention as claimed. Therefore, the present embodiments should be considered by way of illustration, but may be modified in the field defined by the scope of the appended claims, and the invention should not be limited to the details given above.

i

Claims (16)

1. Computer system (1) for detecting fraud in a data stream comprising at least one data lake (4) making it possible to 5 storing large volumes of data with variable structures, in the form of a distributed database, for various uses and analyzes, a platform (10) which contains at least one production environment (3) comprising at least one hardware architecture and self-adaptive software comprising a plurality of stored fraud control models, a test and update engine for fraud control models, at least one memory for storing data, at least one processor, one layer (31) for “real time” processing of the data flow and a service layer (33), said layers being connected by means of communication, each of the layers 15 comprising at least hardware and software implementing a microservice executed on the processor of the computer hardware architecture to allow respectively to verify and / or control in real time the data flow and to manage in the service layer (33) processed data, resulting from "real time" processing, said adaptive auto20 architecture being characterized in that it also includes a set (32) of online learning linked to the "real time" processing layer (31) for re-training and updating in real time fraud control models stored in the "real time" processing layer (31). 25 2. System (1) for detecting fraud in a data flow according to claim 1, characterized in that an output of the “real time” layer (31) is connected to the input of the assembly (32) online learning and the output of the learning assembly (32) is connected to an input of the processing layer (31) in "real time" to form a 30 loop learning structure. 3. System (1) for detecting fraud in a data flow according to claim 1, characterized in that the set (32) of online learning comprises micro-services (m), each in charge of re-training Fraud control models deployed in the "real-time" processing layer (31), and a redeployment system (320) for automatically redeploying the re-trained and updated fraud control models in microservices (m) of the “real time” processing layer (31) in charge of their use. 4. A system (1) for detecting fraud in a data flow according to claim 1, characterized in that the “real time” processing layer comprises a configuration server (310) for continuously updating the parameters of the fraud control models managed by the micro-services (m) of said “real-time” processing layer (31). 5. System (1) for detecting fraud in a data flow according to claims 4 and 5, characterized in that the system (320) for redeployment of the set (32) of online learning comprises a central service capable to receive a notification from a microservice of said training unit (32) when a model has been re-trained, said central service in turn notifying the micro-services (m) of the processing layer (31) in " real time "which are concerned by the update of the parameters, via a REST API which will reload the parameters in the server (31) for configuring the layer (31) of treatment in" real time ", said server (310) distributing then the parameters to the micro-services (m) concerned. 6. System (1) for detecting fraud in a data flow according to claim 1, characterized in that the structuring of the self-adapting architecture into micro-services (m), communicating with one another by passing messages, allows to split the data flow processing chain into a given number N of micro-services (m), said number N corresponding to the number of types of processing to be carried out to respond to a given request, and to multiply the number of instances of a given type of service to allow scaling up and ensure continuity of service in the event that an instance is interrupted to perform a given configuration. 5 7. System (1) for detecting fraud in a data flow according to claim 1, characterized in that it also comprises an environment (2) for developing new models for controlling and / or verifying fraud of the data flow in the production environment (3). to 8. System (1) for detecting fraud in a data flow according to the preceding claim, characterized in that the development environment (2) comprises a hardware and software deployment architecture composed of at least one engine (21 ) modeling to develop and test control models, said 15 modeling engine (21) being connected to a distributed map / reduce engine (20) configured to load production data into the development environment (2) and allow real-time evaluation of new models and a data flow deployer (22) in charge of deploying the models in the environment (3) 20 production. 9. System (1) for detecting fraud in a data flow according to the preceding claim, characterized in that the data flow deployer (22) uses a file describing the data flows stored in the data lake to orchestrate the different micro25 services on the platform (10). 10. System (1) for detecting fraud in a data flow according to the preceding claims, characterized in that the deployment of the fraud control data models is ensured by means of a code repository controller which interrogates the engine (21) for modeling with respect to certain code repositories to detect modifications made to the flow. 11. System (1) for detecting fraud in a data flow according to the preceding claims, characterized in that all 5 continuous deployment of control models and algorithms from the development environment (2) in the production environment (3) is supervised by one person. 12. A system (1) for detecting fraud in a data flow according to claim 3, characterized in that the system (320) for redeploying data comprises means for implementing and configuring a learning assembly (32) in line depending on the data analysis model. 13. System (1) for detecting fraud in a data flow according to claim 1, characterized in that it comprises a device for 15 control to analyze information sent by the "real time" processing layer (31) and containing dated events relating to fraud cases, and activate an alarm signal in the event of detection of fraudulent data in order to alert an administrator or supervisor of the attempted fraud. 14. Use of the fraud detection system (1) according to one of claims 1 to 13, for securing sensitive data in a service system (5) comprising at least one database (52) and at least one platform (53) for processing requests associated with sensitive data, said fraud detection system (1) playing the role 25 of a secure interface between the database (52) and the request processing platform (53). 1/4 3057