FR3062504A1 - AUTOMATIC DETECTION OF FRAUD IN A NEURON NETWORK PAYMENT TRANSACTION STREAM INTEGRATING CONTEXTUAL INFORMATION - Google Patents

Abstract

The invention relates to a method for detecting fraudulent transactions in a set of payment transactions, comprising subjecting the transactions to a classification system trained on a training set and providing for each new transaction of said set a probability of being a Fraudulent transaction, characterized in that each transaction is associated with contextual information.

Description

Holder (s):

WORLDLINE Public limited company.

O Extension request (s):

® Agent (s): NOVAGRAAF TECHNOLOGIES.

FR 3 062 504 - A1 ® AUTOMATIC DETECTION OF FRAUD IN A PAYMENT TRANSACTION FLOW THROUGH NEURON NETWORKS INTEGRATING CONTEXTUAL INFORMATION.

@) The invention relates to a method of detecting fraudulent transactions in a set of payment transactions, comprising subjecting the transactions to a classification system trained on a training game and providing for each new transaction of said set a probability of be a fraudulent transaction, characterized in that contextual information is associated with each transaction.

AUTOMATIC DETECTION OF FRAUD IN A PAYMENT TRANSACTION STREAM BY NEURON NETWORKS INTEGRATING CONTEXTUAL INFORMATION

FIELD OF THE INVENTION

The present invention relates to a mechanism for detecting anomalies in a flow of banking transactions. It applies in particular to the detection of fraud.

BACKGROUND OF THE INVENTION

Fraud in banking transactions is a growing phenomenon, in particular due to the generalization of payment transactions via telecommunications networks.

When a payment transaction is authorized by a payment server, two mechanisms can be implemented: before authorization and.or after.

In the first case, we speak of real-time fraud detection. In the second case, it is near real-time fraud detection. The first case has the advantage of being able to block a fraudulent transaction before it takes place, but it is subject to a strong constraint on the processing time, since it delays the finalization of the payment transaction and therefore experience for the user. The second case makes it possible to have more time and therefore to be able to set up more complex and finer treatments.

In general, this problem is considered by techniques based on rule bases.

Solutions have been proposed, based on different classification mechanisms. It is however noted in the prior art that the detection of fraud in payment systems has specificities. Therefore, classical classification techniques are not applied directly and effectively.

First of all, the consequences of fraud are extremely significant and very sensitive. In addition, as the data relating to bank data and cards and other payment instruments are confidential, very little information is publicly available on the tools implemented for fraud detection. It is therefore difficult to be able to compare the solutions of the state of the art.

SUMMARY OF THE INVENTION

The object of the present invention is to provide a solution which at least partially overcomes the aforementioned drawbacks.

More particularly, the invention aims to provide a solution for automatically detecting fraudulent transactions in a set of transactions using contextual information, that is to say not contained in the transactions subject to processing.

To this end, the present invention provides a method of detecting fraudulent transactions in a set of payment transactions, comprising subjecting the transactions to a classification system trained on a training game and providing for each new transaction of said set a probability to be a fraudulent transaction, characterized in that contextual information is associated with each transaction.

Typically, this training game can form a disjoint set of all the transactions on which the generalization, or forecasting, is then carried out during the operating phase of the classifiers trained on the training game.

According to preferred embodiments, the invention comprises one or more of the following characteristics which can be used separately or in partial combination with one another or in total combination with one another:

- said classification system is a neural network;

- said classification system uses said contextual information by means of graph embeddings;

- said contextual information includes data relating to the country associated with the transaction;

- said contextual information includes data relating to days off;

- said classification system is based on the Word2Vec algorithm.

Another object of the invention relates to a device comprising means for implementing the method as previously described.

Other characteristics and advantages of the invention will appear on reading the following description of a preferred embodiment of the invention, given by way of example and with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 schematically represents experimental results obtained according to an embodiment of the invention.

DETAILED DESCRIPTION OF THE INVENTION

The number of frauds represents only a very small percentage of the volume of banking transactions: we consider that the average fraud rate is around 0.5%. Also, fraud detection corresponds to an anomaly detection problem, which is characterized by an unbalanced distribution between two populations (normal cases / anomalous cases). This type of problem is very poorly solved by learning mechanisms such as "machine leaming"

According to one embodiment of the invention, all of the transactions to be considered are modified by the elimination of the cases which can be considered a priori legitimate. Thus, we can increase the balance between the two populations. This mechanism increases the performance of the neural network.

Another specificity of frauds in payment transactions (by bank card) lies in the complex nature of the problem: frauds are difficult to distinguish from legitimate transactions, and there can be overlaps between the classes resulting from the classification process. In addition, different patterns of fraud can be practiced by fraudsters, causing various situations, and it is therefore difficult to detect fraud based on "signatures" of typical fraud cases.

The problem is to identify frauds among the set of payment transactions.

According to the invention, a classification system is implemented, using “machine learning” type techniques, in order to generate two classes: a class comprising legitimate transactions and a class comprising fraudulent transactions.

Typically, this type of mechanism is based on a learning phase and on a prediction phase which consists of a generalization of the training game on which the learning phase was based.

According to the invention, the prediction of the class of a transaction takes into account various attributes associated with the transaction, including contextual information. Taking this contextual information into account is an innovative idea compared to the state of the art.

It may for example be a date (including the time) of the transaction, its geographic location, calendar events (school holidays, public holidays, etc.).

Attributes can also more conventionally contain the owner of the credit card (or other payment instrument), etc.

The use of contextual information makes it possible to distinguish with more precision fraudulent transactions from legitimate transactions.

As with any classification mechanism, a classifier is first constructed from a training game during the learning phase. Then, this classifier is used during the prediction phase to classify new transactions.

Different types of classifiers are possible, but thanks to the use of contextual information, these can be based on a larger volume of data for each transaction and therefore enrich the possibilities of determining a discrimination model to form two well identified classes.

The invention therefore relies on the injection of contextual information into the classification mechanism.

More particularly, according to one embodiment of the invention, this contextual information is injected into a neural network.

Two sources of information can be considered to explain the mechanisms of the invention:

- a relational database D, representing the data of the internal application;

- a semantic graph G = {V, E} representing the contextual information.

It is also assumed that there is an attribute j in D, for which the set of values Aj = {dj: d G D] can be identified with a subset of vectors V * £ Vde G.

With such a semantic graph, it is possible to structure contextual information.

A graph or semantic network, or knowledge graph is a multi-relational oriented graph composed of entities such as nodes and links.

In the context of the invention, the integration of these graphs into neural networks is carried out by graph embeddings, or “graph embeddings” in English), that is to say vector representations of the nodes of the semantic network, which allow to capture the semantic properties of a particular node.

These embeddings are used to initialize a layer of embeddings in the neural network. During the learning phase, these embedding layers are adapted from contextual information.

For example, attributes like "country" or "year" can be found in an outside graph such as the DBpedia graph.

DBpedia is a university and community project for the automatic exploration and extraction of data derived from Wikipedia. Its principle is to offer a structured version and in the form of standardized data in the semantic web format of the encyclopedic contents of each encyclopedic record.

It is thus possible to take advantage of existing models structuring contextual information.

Without loss of generality, we can also assume that j = l and we identify the values for the first attribute with the vectors in V *. Each tuple of D has the form d = (v, d2,..., Dk) for v E V *

The problem of injecting semantic contextual information is then a combination of features: finding the dimension n> 0 and the vector representations u = vec (v) G R n for all vGV *.

That is to say that v “captures” the semantics of v and thus makes it possible to improve the mechanisms of the classifier of “machine leaming” on D * = {(d, d2, ..., dk): d GD }.

Embeddings are n-dimensional vectors associated with concepts.

These vectors inherit certain semantic properties of concerts, so that in particular similar concepts are associated with close vectors. These proximities can be easily expressed by cosine similarities.

Embeddings form a well-known area of research in the field of automatic language processing, in order to represent the semantics of words in a corpus.

For example "word embedding" or "lexical embedding" is a method of automatic learning resulting from deep learning (or "deep learning" in English) focusing on learning a representation of words. This technique makes it possible to represent the words of a dictionary by vectors in order to facilitate their semantic and syntactic analysis. Thus, each word will be represented by a vector of reals and the words appearing in similar contexts will have vectors closer than others appearing in different contexts. This new representation makes it possible to considerably reduce the dimensionality space (because we no longer store an entire dictionary but only a space of continuous vectors).

Probably the best known algorithm is the Word2Vec algorithm. A Wikipedia page is dedicated to this algorithm:

https://en.wikipedia.org/wiki/Word2vec

Word2Vec is a group of unsupervised learning algorithms for creating word embeddings from textual documents. In order to train its immersion, Word2Vec uses a two-layer neural network taking as input the raw documents, without labels. The architectural model of the neural network can be based on the “let's continue bag of words” (CBOW) model, or on a “skipgram” architecture.

In the first case (CBOW), the input of the model can be wi-2, wi-1, wi + 1, wi + 2, that is to say the preceding and following words of a current word wi. Network exit and the probability of wi being the correct word. This task can be described as predicting a word given its context.

In the second case (skip-gram), the model works in the opposite way: the network input is a word wi and Word2Vec predicts the context around this word: wi-2, wi-1, wi + 1, wi +2.

Unlike other neural networks for natural language processing Word2Vec is very fast and can be further accelerated using parallel learning techniques. Thus, training on the Wikipedia corpus can take around 90 minutes with a personal computer equipped with a quad-core i7 processor from the Intel brand operating at 4x3.4 GHz, and a memory of 16 GB.

An important property of the Word2Vec algorithm is that it groups the vectors of similar words together in the vector space. If the learning is done on a sufficient learning game, Word2Vec produces good results in predicting the meaning of a word based on previous occurrences.

In order to obtain embeddings preserving the semantics, we use an embedding algorithm developed to restrict ambiguity in the entities. Such an algorithm can be the algorithm described in the following article:

Zwicklbauer, S., Seifert, C., Granitzer, M .: Doser - a knowledge-baseagnostic framework for entity disambiguation using semantic embeddings. In: Sack, H., Blomqvist, E., d'Aquin, M., Ghidini, C., Ponzetto, S.P., Lange,

C. (eds.) The Semantic Web. Latest Advances and New Domains - 13th International Conference, ESWC 2016, Heraklion, Crete, Greece, May 29 June 2, 2016, Proceedings. Lecture Notes in Computer Science, vol. 9678, pp. 182-198. Springer (2016), http://dx.doi.org/10.1007/978-3-319-34129312

According to an implementation based on this algorithm Word2Vec obtains a vector representation for each word by predicting sequences of this motorcycle.

Since a given RDF graph does not contain such a type of sequence, a sequence of nodes vk G V is created by conducting a random walk from a node also chosen randomly. We consider that the ίο RDF graph is a non-oriented graph G = (V, E) in which the nodes V are resources of the knowledge base, and the links E are the properties of the knowledge base, and x, y EV, (x, y) GE <=> 3p: (x, p, y) V 3p: (y, p, x) is a triple RDF in the knowledge base.

Random walking can be performed within this graph G. When walking to meet a node x £ V, the identifier of this node x is added to the output result.

The node succ (x) of node x is chosen in a random and uniformly equitable way among the adjacent nodes, that is to say with a uniform probability equal to l / EdgesOf (x), with “EdgesOf (x)” a function returning the number of links in node x, i.e. the number of links in the vector vk.

We can also introduce a random variable Xx which determines the probability of jumping to a given node if a random jump is performed.

The probability of jumping from a first node to a second node x is calculated by normalizing the respective reverse link frequency IEF of node x, IEF (x). According to experimental studies carried out by the inventors, the parameter a = 0.1 is used to perform a random jump, but a range of values between 0.05 and 0.25 seems to be suitable and to provide a good Word2Vec model.

In addition, the parameter Θ indicates the number of random steps in the graph. It is possible to use for example 0 = 5 * | E |, which in the example of DBpedia provides approximately 50 million random walks. Higher values of this parameter do not seem to improve the embedding of the entities, but increases the time necessary for the learning phase.

According to one embodiment of the invention, the approach for creating the corpus for RDF knowledge bases can be according to the following algorithm:

This principle of using contextual information conveying semantic content can be applied to other classification mechanisms by learning than neural networks.

We can thus cite genetic algorithms, Bayesian networks, hidden Markov models, etc.

The curve of Figure 1 illustrates an experimental result of implementations of the invention.

It provides an overall score correlating the precision (ordinate axis) and a recall rate (abscissa axis), that is to say correctly classified fraudulent transactions.

These curves show 4 situations corresponding to different configurations of the embedding layers of the neural network:

- reference 1 - “no external datai”: no contextual information is taken into account

- reference 2 - “tx-holiday”: contextual information relating to days of leave is taken into account;

- reference 3 "country embed" contextual information relating to countries is taken into account

- reference 4 - “tx_holiday + country_embed” contextual information relating to days off and countries are taken into account.

It is thus noted that indeed the results are better due to the use of contextual information, in particular through the use of countries.

We can also see that the combined use of several types of contextual information is a delicate problem. In some cases, it appears that certain combinations may even degrade the general performance of the classifiers. The combination of semantic vector representations on countries and publicly known days off (public holidays, school holidays, etc.) seems to demonstrate good results experimentally, in particular on low values of the recall rate, for which an accuracy can be reached. Concretely, this means that a classifier in accordance with this embodiment of the invention obtains good results for the transactions most likely to be fraudulent, which in practice represents the most common situations.

Of course, the present invention is not limited to the examples and to the embodiment described and shown, but it is susceptible of numerous variants accessible to those skilled in the art.

Claims (7)

1. Method for detecting fraudulent transactions in a set of payment transactions, comprising subjecting the transactions to a classification system trained on a training game and providing for each new transaction of said set a probability of being a fraudulent transaction, characterized in that contextual information is associated with each transaction. 2. Method according to the preceding claim, wherein said classification system is a neural network. 3. Method according to one of the preceding claims, in which said classification system uses said contextual information by means of graph embeddings. 4. Method according to claim 1, in which said contextual information includes data relating to the country associated with the transaction. 5. Method according to one of the preceding claims, in which said contextual information includes data relating to days of leave. 6. Method according to one of the preceding claims, in which said classification system is based on the Word2Vec algorithm. 7. Device comprising means for implementing the method according to one of the preceding claims. Recall