JP7316984B2 - Information processing system and information processing method - Google Patents

Description

The present invention relates to an information processing system and an information processing method, and is particularly suitable for use in an information processing system and an information processing method for executing processing related to determination of fraudulent transactions.

2. Description of the Related Art Conventionally, determination of fraudulent transactions such as determination of fraudulent use of credit cards has been widely performed, and various techniques related to such determination have been proposed. Transactions are not limited to the use of credit cards, and broadly refer to transactions such as the use of debit cards and prepaid cards, for which it is required to determine whether or not the transaction is fraudulent. Under such circumstances, Patent Literature 1 proposes a system for detecting fraud using a model for judging fraud in the use of a credit card, which is a type of transaction. A model is equivalent to a known machine learning method (so-called AI) such as a linear algorithm, a decision tree algorithm, or deep learning. Generally, in this type of system, when a credit card is used, multiple types of feature values are derived using generated values (amount used, time of use, etc.) generated according to use, and each derived feature value is input to the model, and the information output by the model is used to determine whether or not it is fraudulent.

Japanese Patent Application Laid-Open No. 2007-207011

Generally, the feature values input to the model include those obtained by a statistical method using occurrence values occurring in a predetermined period going back from the present time. For example, the feature amount is the average value or standard deviation of the amount of usage generated in units of one day, one week, one month, etc. from the current time point. This is for the following reasons. Taking a case where the transaction is the use of a credit card as an example, the determination of unauthorized use of the credit card is basically made from the viewpoint of whether the credit card is being used in an unusual manner. However, by using such a feature value, the output value of the model can be a value that reflects the possibility that the current occurrence value corresponds to a statistical outlier, and the judgment considering the above viewpoint This is because

Here, regarding the model, it is better to input not only the feature values derived using the occurrence values that occurred in a short period of time, but also the feature values derived using the occurrence values that occurred in a long period of time. can be expected to improve the accuracy of the output of For example, it is better to include feature values related to occurrence values in units of one year, in addition to feature values related to occurrence values in units of one day, one week, and one month going back from the present time. In addition to this, it is expected that the accuracy of the output value of the model will be improved by including the feature amount related to the occurrence value in units of two years. This is because the output of the model can be a value that reflects the mode of trading in various periods including not only the short term but also the long term.

Conventionally, when a feature value related to a certain period is used as an input for a model, all occurrence values that occurred during that period are cumulatively registered in a database, and at the timing of deriving the feature value, the system extracts that value from the database. The occurrence value in the period is read, and the feature amount is derived based on the read occurrence value. For this reason, when attempting to use feature amounts related to a long period of time as one of the inputs of the model in order to improve the accuracy of the output of the model, the following problems have arisen.

That is, basically, the longer the period, the more generated values are generated. For this reason, if one tries to use feature values related to a long period of time as one of the inputs of the model, the number of generated values required to derive the feature values becomes large. In addition to reading the generated values from the database, it becomes necessary to derive the feature value using all the read generated values as elements. was there.

SUMMARY OF THE INVENTION The present invention has been made to solve such problems, and it is an object of the present invention to improve the accuracy of the output of a model while suppressing the lengthening of the time required for deriving feature values.

In order to solve the above-described problems, in the present invention, as a feature value to be input to the model, a corresponding feature value that can be derived by a statistical method using each occurrence value that occurred in a predetermined period going back from the present time When deriving the corresponding feature amount according to the transaction, the feature amount that was derived in advance by a statistical method for the group of occurrence values that occurred in the past and was stored in the storage unit is used as the group is used in place of the individual occurrence values belonging to , to derive the corresponding feature quantity.

According to the present invention configured as described above, when deriving the corresponding feature amount derived by a statistical method using each occurrence value occurring in a predetermined period retroactively from the present time, Instead of reading out all the generated values generated in a predetermined period and deriving them as objects to be processed, the following processing is performed. That is, a statistic is derived and stored in advance by a statistical method for a group of generated values that occurred in the past. Corresponding features are then derived using pre-stored statistics for the group instead of the individual occurrence values belonging to the group.

Therefore, when deriving the corresponding feature value, it is not necessary to grasp the individual occurrence values and derive the corresponding feature value using all the occurrence values as elements. However, it is sufficient to use these as elements, and the number of elements to be grasped when deriving the corresponding feature amount is reduced, and the number of elements to be used for actual calculation is reduced, and the time required for deriving the feature amount is lengthened. Time can be suppressed. Furthermore, it is possible to input the corresponding feature values using the generated values generated over a longer period of time to the model while suppressing the lengthening of the time required to derive the feature values. can improve the accuracy of the output of

1 is a network diagram showing a configuration example of an unauthorized use determination system according to an embodiment of the present invention; FIG. It is a block diagram showing an example of functional composition of an information processing server concerning one embodiment of the present invention. 4 is a table showing types (part of) of feature amounts; FIG. 4 is a diagram showing how basic data and stats data are stored in a storage unit; It is a figure which shows the content of credit card number stats data. 4 is a flowchart showing an operation example of an information processing server according to one embodiment of the present invention; 4 is a flowchart showing an operation example of an information processing server according to one embodiment of the present invention; 4 is a flowchart showing an operation example of an information processing server according to one embodiment of the present invention;

An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a network diagram showing a configuration example of an unauthorized use determination system 1 according to this embodiment. As shown in FIG. 1, an unauthorized use determination system 1 according to the present embodiment includes an information processing server 2 (corresponding to an "information processing system" in the claims) and a plurality of client devices 3. ing. The information processing server 2 and each of the plurality of client devices 3 are communicably connected via a network 4 including the Internet, a telephone network, and other communication networks.

The unauthorized use judgment system 1 is a system having at least a function of judging whether or not the use of the credit card is unauthorized use when the credit card is used. The client device 3 is a general term for devices that transmit request data (so-called authorization data; the details will be described later) to the information processing server 2 when a credit card is used. A dedicated payment terminal provided, a server device that executes processing related to payment performed by a dedicated machine such as a station ticket vending machine, a server device that executes processing related to payment of an EC site, and the like function as the client device 3 .

In the following description, a person who uses a credit card is referred to as a "user". In addition, the use of a credit card may be simply referred to as a "transaction", and in particular, the transaction that triggered the transmission of request data to be processed by the information processing server 2 may be referred to as a "current transaction". be. Also, the unauthorized use of a credit card may be simply referred to as "unauthorized use". Also, the use of a credit card and the transmission of request data in response to this may simply be expressed as "request data is generated".

Please note that unauthorized use of a credit card does not only mean that a credit card is used fraudulently with malicious intent. Including being used in a method. Further, in the present embodiment, "use of credit card" is defined as a transaction to be determined as fraudulent. However, this is only an example, and it goes without saying that other transactions may be included as targets for which fraud determination is performed. The transaction may be, for example, a trial of other payment means using credit (not necessarily involving the use of a card-type credit card), or the use of a debit card, prepaid card, etc. .

FIG. 2 is a block diagram showing a functional configuration example of the information processing server 2. As shown in FIG. As shown in FIG. 2, the information processing server 2 includes a communication section 10 and an information processing section 11 as functional configurations. Each of the functional blocks 10 and 11 can be configured by hardware, DSP (Digital Signal Processor), or software. For example, when configured by software, each of the functional blocks 10 and 11 is actually configured with a computer CPU, RAM, ROM, etc., and a program stored in a recording medium such as RAM, ROM, hard disk, or semiconductor memory. is realized by the operation of The communication unit 10 communicates with devices connected to the network 4 according to a predetermined communication standard. The information processing server 2 also includes a storage unit 12 as storage means.

Although the information processing server 2 is represented by one block in FIGS. 1 and 2, this does not mean that the information processing server 2 is composed of a single server device. The information processing server 2 may be composed of a plurality of devices, or may be part of a predetermined system. For example, the information processing server 2 may be configured by a plurality of server devices working together. In this case, a plurality of server devices cooperate to function as an "information processing system" in the scope of claims.

The information processing server 2 executes processing related to determination of unauthorized use in response to a request (transmission of request data) from the client device 3 when the user uses the credit card. The processing of the client device 3 and the information processing server 2 when the credit card is used by the user will be described in detail below.

When a user uses a credit card at a store, an EC site, or the like, the corresponding client device 3 generates request data, transmits the request data to the information processing server 2, and requests determination of unauthorized use. As will become clear later, the information processing server 2 judges whether or not the request data is unauthorized use, and if it is judged to be unauthorized use, to that effect, and if it is judged not to be unauthorized use, to that effect. response data. In this embodiment, the time from when the client device 3 transmits request data to when it receives response data is defined as “response time”. Response time affects user latency. Therefore, it is required that the response time be as short as possible. As will become apparent later, this embodiment achieves both a reduction in response time and an improvement in the accuracy of unauthorized use determination.

The request data includes information necessary for the information processing server 2 to execute processing related to determination of unauthorized use. In this embodiment, at least the following items exist as items related to request data, and the request data includes item values of each item. That is, in this embodiment, credit card number, user ID, date and time of occurrence, and usage amount are at least included as items related to the credit card.

A credit card number is a number uniquely assigned to a credit card. The item value of the credit card number is hereinafter referred to as "credit card number value". A user ID is identification information that identifies a user. Hereinafter, the item value of the user ID will be referred to as "user ID value". In some cases, the payment is made in a state where the user ID value can be obtained. For example, when making payments for services that require login using user IDs (electronic malls, internet auctions, etc.), or when making payments for services that can only be used by members with user IDs. . When payment is made in such a state that the user ID value can be acquired, the user ID value is included in the request data.

The date and time of occurrence is the date and time when the credit card was used (it can be paraphrased as the date and time when the request data was generated and transmitted. The date and time means date + time). Hereinafter, the item value of the date and time of occurrence will be referred to as "date and time of occurrence value". A usage amount is a price paid using a credit card. Hereinafter, the item value of the usage amount will be referred to as the “usage amount value”.

Note that the date and time of occurrence value and the usage amount value correspond to the "occurrence value" in the scope of claims. The generated value may be a value that is generated according to the use of the credit card, and is not limited to the values exemplified in this embodiment. In addition, the credit card number and user ID correspond to "individual identification information" in the scope of claims. It corresponds to individual identification information that identifies the executor of The items exemplified in the present embodiment are only a part extracted for the sake of simplification of explanation, and of course, items other than the exemplified items may exist. For example, with regard to individual identification information, when transactions are conducted using a user's terminal (assuming online payment using a browser on the user's terminal), some information for identifying the terminal (IP address of the access source , a terminal ID unique to the terminal (which may be a MAC address)), and information indicating the region where the transaction was made may be included. If information identifying the terminal used by the user for transactions or information indicating the area in which the transaction took place is included, such information shall be deemed to be "individual identification information for identifying the environment in which the transaction took place" in the scope of claims. Equivalent to

The information processing section 11 of the information processing server 2 receives the request data via the communication section 10 . In response to receiving the request data, the information processing unit 11 sequentially executes the first determination process, the feature value derivation process, the second determination process, the third determination process, and the data update process (however, as will become clear later, , the subsequent processing is not executed if the information processing unit 11 determines that the unauthorized use is made in any one of the first determination processing, the second determination processing, and the third determination processing. Each process will be described in order below.

In the following description, the request data received by the information processing server 2 to be processed is particularly referred to as "current request data". For convenience of explanation, it is assumed that the current request data includes a valid user ID value (that is, the user ID value is not null). In addition, the credit card number value of the current request data is called "current credit card number value", the user ID value is called "current user ID value", the occurrence date and time value is called "current occurrence date and time value", and the usage amount value is called " The amount used this time". Also, the day to which the request data is received this time is called "today", and the day before today is called "the day before".

<First determination process>
The first determination process is a process of determining whether or not the use is unauthorized by using information included in the current request data without deriving a feature amount (described later). In the first judgment process, when judging unauthorized use, it is clear from the information contained in the request data that unauthorized use is made without deriving a feature amount or using a model for unauthorized judgment (described later). This is done for the purpose of judging that what can be regarded as unauthorized use.

In the first determination process, the information processing section 11 performs, for example, the following processes. That is, a list (a so-called black list) is prepared in advance in which credit card number values, user ID values, and other item values to be determined as unauthorized use are recorded. Then, the information processing unit 11 determines that the current request data contains at least one item value recorded in the list as unauthorized use. Further, for example, if the current request data contains information indicating the area where the credit card was used, the information processing unit 11 identifies the area where the credit card was used based on the information, If the card is used in a prohibited area, the use of the credit card is determined as unauthorized use. According to this, when the use of a credit card in a country other than the country to which the user belongs (a foreign country for the user) is prohibited, it is possible to determine that the credit card is used in a foreign country as being illegally used. . Of the information used by the information processing section 11 in the first determination process, information other than the generated value corresponds to "accompanying information" in the scope of claims.

If the first determination process determines unauthorized use, the information processing section 11 transmits response data indicating that the unauthorized use has been determined to the client device 3 . In this case, the information processing section 11 terminates the process without executing the feature quantity derivation process. The client device 3 that has received the response data executes corresponding processing. For example, if the client device 3 is a dedicated payment terminal installed at a cash register in a physical store, the client device 3 displays information to the effect that there is a possibility of unauthorized use on a predetermined display to notify the user of the possibility. Tell the cashier. Further, for example, when the client device 3 is a server of an EC site, the client device 3 cancels payment by credit card after appropriately notifying the user in cooperation with other devices.

On the other hand, when it is determined in the first process that the use is not unauthorized, the information processing section 11 executes the feature value derivation process.

<Feature value derivation processing>
The feature value derivation process is a process of deriving a feature value to be input to the fraud determination model. However, as will become clear later, the feature amount derived in the feature amount deriving process is used in the second determination process prior to being input to the fraud determination model. The fraud determination model is a machine-learned model that inputs a plurality of feature values and outputs a fraud determination score. The fraud determination score is a score (numerical value) that increases as the likelihood of fraudulent use increases. The fraud determination score is used to determine whether or not it is fraudulent use. As will be described later, the information processing unit 11 compares the threshold value with the fraud determination score to determine whether or not it is fraudulent use. I do.

FIG. 3 is a table showing types (partially extracted) of feature amounts derived in this embodiment. In the table of FIG. 3, the target period means a certain period (predetermined period) going back from the present time. In this embodiment, the types of target periods are "5 minutes", "30 minutes", "1 hour", "6 hours", "1 day", "1 week", "1 month", "6 months", "1 year" and "2 years" are prepared. For example, a target period of "5 minutes" means a period of "5 minutes" going back from the current time (in other words, "last 5 minutes"). In the table of FIG. 3, the above-described credit card number <item> and user ID <item> are defined as the types of individual identification information.

As shown in the table of FIG. 3, in the present embodiment, two types of feature amounts are defined for each combination of the type of target period and the type of individual identification information: average usage amount and standard deviation usage amount. . The average usage amount corresponding to a combination of a certain target period type (for example, "5 minutes") and a credit card number is the number of transactions in which the credit card with the credit card number value was used this time during the target period. Means the average spend value. Therefore, if a transaction using a credit card with a credit card number value this time has been made three times during the target period, the average of the usage amount value for each of the three transactions will be the same for that type of target period and credit card number This is the average usage amount corresponding to the combination.

Also, the average usage amount value corresponding to a combination of a certain target period type and user ID means the average usage amount value of each transaction performed by the user of the current user ID value in the target period. Therefore, if the user with the current user ID value makes a transaction three times during the target period, the average of the usage amount value for each of the three transactions corresponds to the combination of that type of target period and user ID. This is the average usage amount.

For one user, the average usage amount related to the credit card number and the average usage amount related to the user ID in the common target period are not necessarily the same value. For example, if a certain user has multiple types of credit cards and uses one user ID value to make purchases using multiple different types of credit cards within the target period, credit The average usage amount related to the card number and the average usage amount related to the user ID of the user are different values. At present, it is very common for one person to have a plurality of different types of credit cards and to use each type of credit card properly.

In addition, the usage amount standard deviation value corresponding to the combination of the type of the target period and the credit card number is the standard of each usage amount value of the transaction in which the credit card with the credit card number value was used this time during the target period means deviation. Further, the usage amount standard deviation value corresponding to a combination of a certain type of target period and user ID means the standard deviation of each usage amount value of transactions made by the user of the user ID value this time in the target period. do.

In the following description, as shown in FIG. 3, "5 minutes", "30 minutes", "1 hour" and "6 hours" among the types of target periods are particularly referred to as "short-term types". The period covered by this is referred to as the "short-term type covered period." Further, regardless of the type of individual identification information, the feature amount corresponding to the short-term type is called "individual feature amount". In addition, among the types of target period, "one day", "one week", "one month", "half a year", "one year" and "two years" are particularly referred to as "long-term types". Such a target period is referred to as a "long-term type target period". Furthermore, regardless of the type of individual identification information, a feature amount corresponding to a long-term type is called a "corresponding feature amount". In the present embodiment, the boundary between the short-term type target period and the long-term type target period is between "6 hours" and "1 day", but this is only an example, and another position is set as the boundary. It goes without saying that Also, the types of the exemplified target period are merely examples, and for example, periods such as "12 hours", "two weeks", and "one and a half years" may be included in the target period. As will become clear later, in this embodiment, by performing unique processing, it is possible to include a long period of "2 years" or more in the target period while suppressing the lengthening of the response time. is.

In this embodiment, while at least the types of feature amounts illustrated in FIG. 3 are present as types of feature amounts, the storage unit 12 stores basic data 14 and stats data 15 in the following manner. FIG. 4 is a diagram schematically showing how the basic data 14 and the stats data 15 are stored in the storage section 12 in a manner suitable for explanation. As shown in FIG. 4, in this embodiment, there is basic data 14 for each value of individual identification information for each type of individual identification information.

Specifically, as shown in FIG. 4, the storage unit 12 stores basic data 14 for each credit card number value for credit card numbers. Each of the basic data 14 corresponding to the credit card number is hereinafter referred to as "credit card number basic data 14C". The credit card number basic data 14C corresponding to a certain credit card number value is data in which request data including the credit card number value generated in a period of at least 6 hours going back from the present time is cumulatively recorded. That is, in the credit card number basic data 14C corresponding to a certain credit card number value, the request data transmitted from the client device 3 in accordance with the use of the credit card with that credit card number value during a period of at least 6 hours going back from the present time. Recorded cumulatively. However, as will become clear later, strictly speaking, not all request data is recorded in the credit card number basic data 14C, but only request data related to transactions that have not been determined to be fraudulent use.

Assume that this time request data including a certain credit card number value occurred at "13:00" on January 15, 2020. In this case, from "07:00" on January 15 (6 hours before the current time) until the information processing server 2 receives the request data this time at "13:00", the credit card number with the same value When the information processing server 2 has received the request data including the value three times, at least the past three requests are recorded in the credit card number basic data 14C related to the credit card number value.

As shown in FIG. 4, in addition to credit card number basic data 14C, the storage unit 12 stores basic data 14 for user IDs for each user ID value. Each of the basic data 14 corresponding to the user ID is hereinafter referred to as "user ID basic data 14U". The user ID basic data 14U corresponding to a certain user ID value is data in which request data including that user ID value generated in a period of at least 6 hours going back from the present time is cumulatively recorded. However, as will become apparent later, strictly speaking, not all request data is recorded in the user ID basic data 14U, but only request data related to transactions that have not been determined to be unauthorized use.

Here, one request data is recorded in some credit card number basic data 14C and recorded in some user ID basic data 14U. For example, it is assumed that request data including credit card number value: X and user ID value: Y is input to the information processing server 2 according to the use of a credit card. In this case, this request data is recorded in the credit card number basic data 14C associated with the credit card number value X, and is also recorded in the user ID basic data 14U associated with the user ID value Y. As a result, the common request data is redundantly recorded in the credit card number basic data 14C related to the credit card number value X and the user ID basic data 14U related to the user ID value Y. In the present embodiment, the request data is recorded as it is in the basic data 14, but this is for the sake of convenience of explanation. processing may be performed.

As shown in FIG. 4, in this embodiment, there is stats data 15 for each value of individual identification information for each type of individual identification information. Hereinafter, the stats data 15 corresponding to the credit card number will be referred to as "credit card number stats data 15C", and the stats data corresponding to the user ID will be referred to as "user ID stats data 15U".

FIG. 5 is a diagram schematically showing the contents of the credit card number stats data 15C. As shown in FIG. 5, credit card number stats data 15C is composed of one or more stats records 16 . The stats record 16 has a unit period of "1 day" meaning 24 hours starting from "00:00", and has a corresponding date value, unit period average value, unit period standard deviation value and number of transactions. there is

The corresponding date value is information representing the date to which the stats record corresponds by year, month, and day.

The unit period average value of the stats record 16 related to a certain credit card number value corresponding to a certain corresponding date value is the transaction performed using the credit card of that credit card number value on the day indicated by the corresponding date value mean the average value of each usage amount value. For example, the unit period average value of the stats record 16 related to the credit card number value: X whose corresponding date value is “January 15, 2020” is the credit card number value of X on January 15, 2020. is the average value of the amount used for each of the transactions (each of the three transactions, if three transactions have been made) performed using . In addition, the unit period standard deviation value of the stats record 16 related to a certain credit card number value corresponding to a certain corresponding date value is the number of credit cards with that credit card number value used on one day indicated by that corresponding date value. means the standard deviation of the respective utilization values of the trades made.

Also, the number of transactions in the stats record 16 related to a certain credit card number value corresponding to a certain corresponding date value is the number of transactions made using the credit card of that credit card number value on the day indicated by the corresponding date value. means the number of times The unit period average value and the unit period standard deviation described above are statistical values derived based on the usage amount values of transactions for the number of transactions. Each of the unit period average value and the unit period standard deviation value corresponds to the "unit statistic" in the claims.

The credit card number stats data 15C registers stats records 16 for a unit period (1 day in this embodiment) belonging to a period 730 days before today (including today) at maximum. Also, in the credit card number stats data 15C related to a certain credit card number value, stats records 16 corresponding to each day on which the credit card related to that credit card number value was used are registered. Therefore, for the credit card number stats data 15C related to a certain credit card number value, today is August 1, 2020, and in the past 730 days, the credit card related to the credit card number value is May 1, 2020, June 1, 2020 If the credit card number stats data 15C was used on three days (days), July 1, 2020, the stat record 16 corresponding to May 1, 2020, and the stats corresponding to June 1, 2020 Three stat records 16 are registered, record 16 and stat record 16 corresponding to July 1st. Also, if the credit card associated with the credit card number value has been used every day in the past 730 days, stats records 16 for 730 days are registered in the credit card number stats data 15C.

Also, even if a credit card associated with a certain credit card number value is used multiple times (for example, 50 times) in a certain day, there is only one stats record 16 corresponding to that day. This is because one stat record is aggregated data for one or more credit card uses during the corresponding day. Therefore, the maximum number of stats records 16 registered in one credit card number stats data 15C is 730. It should be noted that 730 days corresponds to "two years" which is the longest period among the types of target periods.

The user ID stats data 15U, like the credit card number stats data 15C, is composed of one or more stats records 16, and each stats record 16 includes a corresponding date value, a unit period total value, a unit period average value, and the number of transactions. ing. The unit period average value of the stats record 16 related to a certain user ID value corresponding to a certain corresponding date value is the usage amount value of each transaction made by the user of that user ID value on the day indicated by that corresponding date value. , the unit period standard deviation value is the standard deviation of each usage amount value, and the number of transactions is the number of transactions.

While the basic data 14 and the stats data 15 are stored in the storage unit 12 in the manner described above, the information processing unit 11 derives feature amounts by the following method in the feature amount derivation process. Regarding the derivation of the feature amount, the information processing section 11 derives the individual feature amount corresponding to the short-term type and the corresponding feature amount corresponding to the long-term type by different methods. Hereinafter, the process for deriving the individual feature amount and the process for deriving the corresponding feature amount will be described in order.

(Processing when deriving individual feature amount (feature amount corresponding to short-term type))
When deriving the individual feature amount, the information processing section 11 refers to the storage section 12 and specifies the basic data 14 corresponding to the value of the individual identification information for each individual identification information included in the current request data. For example, if the credit card number value included in the request data is "X" and the user ID value is "Y", the information processing unit 11 specifies the credit card number basic data 14C related to the credit card number value: X, User ID value: Specify the user ID basic data 14U related to Y.

Next, the information processing section 11 selects the specified credit card number basic data 14C and the specified user ID basic data 14U for each of the short-term types (“5 minutes”, “30 minutes”, “1 hour” and “6 hours”). ”) to generate corresponding period data. That is, the information processing section 11 generates period data for each short-term type based on the credit card number basic data 14C, and generates period data for each short-term type based on the user ID basic data 14U.

For example, when generating period data corresponding to the target period: 5 minutes based on the identified credit card number basic data 14C, the information processing section 11 executes the following process. That is, in the credit card number basic data 14C specified by the information processing unit 11, the request data including the current credit card number generated during a period including at least a period of 6 hours going back from the present time is cumulatively recorded. Based on this, the information processing unit 11 refers to the date and time of occurrence value of the request data recorded in the basic credit card number data 14C (item value of date and time of occurrence), and out of the request data recorded in the basic credit card number data 14C, Target period: Identify request data that occurred in 5 minutes. If the credit card is not used during the target period: 5 minutes, the specified request data is "0". Then, the information processing section 11 generates data consisting of a set of specified request data as period data. In the generated period data, the request data including the current credit card number value that occurred during the target period: 5 minutes is cumulatively recorded.

The processing of the information processing unit 11 when generating the period data related to the target period “5 minutes” has been described above. do. For example, if the target period is "6 hours", the information processing unit 11 identifies request data generated in the most recent 6 hours from the identified credit card number basic data 14C, and generates period data consisting of a set of identified request data. Generate. Note that the period data related to a certain short-term type includes all of the request data included in the period data related to the short-term type shorter than the short-term type.

The information processing unit 11 generates period data for each of the short-term types based on the specified credit card number basic data 14C, and further generates short-term type data based on the user ID basic data 14U specified by the same method. Generate period data for each. As a result, period data is generated for each combination of the type of individual identification information (credit card number and user ID) and the short-term type. After that, the information processing section 11 derives each of the individual feature amounts based on the period data.

When deriving an individual feature amount (usage amount average value and usage amount standard deviation value) corresponding to a combination of a certain short-term type target period and a certain type of individual identification information, the information processing unit 11 The individual feature amount is derived based on the period data. For example, when deriving the individual feature amount corresponding to the combination of the target period: 5 minutes and the individual identification information: credit card number, the information processing unit 11 derives the individual feature amount based on the period data corresponding to the combination. do. As an example, the processing of the information processing unit 11 when deriving the individual feature amount corresponding to the combination of the target period: 5 minutes and the individual identification information: credit card number will be described below. In the description of the processing of the information processing unit 11 when deriving the individual feature amount corresponding to the following combination of the target period: 5 minutes and the individual identification information: credit card number, the period data corresponding to the combination is referred to as the "target period data", and among the individual feature values corresponding to the combination, the average usage amount is referred to as the "target usage amount average value" and the usage amount standard deviation value is referred to as the "target usage amount standard deviation value".

When deriving the target usage amount average value, the information processing unit 11 refers to each request data recorded in the target period data. In the target period data, the request data including the credit card number value this time and occurring within five minutes from the present time are cumulatively recorded. In other words, the target period data does not record any request data outside the five-minute period preceding the current time. Next, the information processing section 11 derives the average value of the usage amount values of the respective records referred to, and sets this as the target usage amount average value. Further, when deriving the target usage amount standard deviation value, the information processing unit 11 refers to each record of the target period data, calculates the standard deviation of the usage amount value of each referenced record, and uses it as the target usage amount standard deviation value. and

In the above, the processing of the information processing unit 11 when deriving the individual feature amount corresponding to the combination of the target period: 5 minutes and the individual identification information: credit card number has been described. is also derived in a similar manner based on the period data corresponding to the combination.

(Process for deriving corresponding feature amount (feature amount corresponding to long-term type))
Next, the process of deriving feature values (corresponding feature values) for long-term types (“one day,” “one week,” “one month,” “half a year,” “one year,” and “two years”) will be described. do. First, the information processing section 11 refers to the storage section 12 and specifies the stats data 15 corresponding to the value of the individual identification information for each individual identification information included in the current request data. For example, if the credit card number value included in the request data is "X" and the user ID value is "Y", the information processing unit 11 specifies the credit card number stats data 15C related to the credit card number value: X, User ID value: Specify the user ID stats data 15U related to Y.

Then, when deriving the corresponding feature amount corresponding to one type of individual identification information, the information processing section 11 derives the corresponding feature amount based on the stats data 15 corresponding to the type of individual identification information. More specifically, the information processing unit 11 derives the corresponding feature amount corresponding to the credit card number based on the specified credit card number stats data 15C regardless of the long-term type, and derives the corresponding feature amount corresponding to the user ID. The corresponding feature amount is derived based on the specified user ID stats data 15U regardless of the long-term type.

The processing of the information processing unit 11 when deriving the corresponding feature amount corresponding to the combination of the long-term type: one year and the individual identification information: credit card number based on the specified credit card number stats data 15C will be described below. . In the following explanation, among the corresponding feature values corresponding to the combination of long-term type: 1 year and individual identification information: credit card number, the average usage amount is the "average average usage amount", and the standard deviation of the usage amount is is referred to as the “notable usage amount standard deviation value”.

As described above, the credit card number stats data 15C records stats records 16 for a maximum of 730 days going back from today, and one stats record 16 contains It contains the unit period mean value and the unit period standard deviation value based on each of the request data. The information processing section 11 refers to the corresponding date value of each stats record 16 in the credit card number stats data 15C, and identifies each of the stats records 16 belonging to the target period ("1 year" in this example). do. For each long-term type, the number of days to go back from today is set in advance. , Long-term type: 1 month is 30 days, Long-term type: Half a year is 183 days, Long-term type: 1 year is 365 days, Long-term type: 2 years is 730 days there is In this example, the information processing section 11 identifies stats records 16 whose corresponding date values are within 365 days from today.

After specifying the stats records 16 belonging to the target period, the information processing section 11 derives the noted average usage amount based on each of the specified stats records 16 by the following method. That is, the unit period average value included in the stats record 16 for a certain day is the average value of a group (group) of usage amount values (sample values) of one or more transactions (number of samples). A calculation method is known for deriving the average value of all samples of all groups based on the average value and the number of samples of each group for a plurality of groups. Based on this, a program that takes as input a set of the unit period average value and the number of transactions of one or more stats records 16, and outputs the average value of all usage amounts (= average usage amount as a feature value). are prepared in advance. The information processing section 11 inputs a set of the unit period average value and the number of transactions of each of the specified stats records 16 to this program, and sets the value output by the program as the noted usage amount average value.

Here, for a plurality of groups, the basic concept of calculation for deriving the mean value of all samples in all groups based on the mean value and the number of samples in each group will be described. The average value is expressed as "group total value" by multiplying the average value by the number of samples for one group. It is obtained by dividing by the summed value. That is, for N groups Gi (i=1, 2, . . . N), if Ai is the average value in the group Gi and Ki is the number of samples, the average value can be derived by the following formula.

The information processing section 11 also derives the standard deviation of interest by the following method based on each of the specified stats records 16 . That is, the unit period standard deviation value included in the stats record 16 for a certain day is the standard deviation of a group of usage amount values (sample values) of one or more transactions (number of samples). A calculation method is known for deriving the standard deviation of all samples of all groups based on the standard deviation of each group and the number of samples for a plurality of groups. Based on this, there is a program that takes as input a pair of the standard deviation of one or more stats records 16 and the number of transactions, and outputs the standard deviation of all usage amounts (= usage amount standard deviation value as a feature value). prepared in advance. The information processing section 11 derives a noteworthy usage amount standard deviation value by inputting a set of each unit period standard deviation value and the number of transactions of the identified stats records 16 to this program.

Here, for a plurality of groups, the basic idea of calculation for deriving the standard deviation of all samples of all groups based on the standard deviation of each group and the number of samples will be described. In the following description, for N groups Gi (i=1, 2, . . . N), let Ai be the average value in the group Gi, and Ki be the number of samples. A specific value of a sample is called a "sample value".

If the standard deviation of one group Gx is Sx and the variance is Dx, then Dx= ^Sx2 . Let Ax be the average of the group Gx. At this time, “Dx=<average of (the square of the sample value of each sample belonging to group Gx)>−Ax ² ”, that is, “<average of (the square of the sample value of each sample belonging to group Gx)>=Dx+Ax ² ” is established. For all groups, the standard deviation, the variance that can be derived from the standard deviation, and the mean are known values, so for all groups, <mean of (the square of the sample value of each sample belonging to the group)> is derived. can. Hereinafter, <average of (the square of the sample value of each sample belonging to group Gi)> is assumed to be Pi.

In addition, <average of (the square of the sample value of each sample belonging to the group)> for all groups is replaced by <the average of (the square of the sample value of all samples in all groups)> (hereafter, <total square mean >) can be derived from the following equation.

The variance of all samples belonging to all groups can be obtained by subtracting <square of (mean value of all samples in all groups)> from <total mean square>. (Average value of all samples of all groups) is obtained as described in the description of the average usage amount of interest. The standard deviation of all samples belonging to all groups can then be derived by taking the square root of the derived variance.

The processing of the information processing unit 11 when deriving the corresponding feature amount corresponding to the combination of the long-term type: one year and the individual identification information: credit card number has been described above. Similarly, the stats record 16 corresponding to the long-term type from the corresponding stats data 15 (for example, if the long-term type is "1 week", the stats record 16 for the past 7 days; the long-term type is "2 years"). Then, all the stats records 16 included in the stats data 15 are specified, and the corresponding feature amount is derived based on the specified stats records 16 .

In the above, only the feature amount (individual feature amount and corresponding feature amount) exemplified in FIG. 3 has been described and the method for deriving the feature amount. The significance and effect of deriving the individual feature amount and the corresponding feature amount by the above method will be described later. Note that the feature amounts exemplified in the present embodiment are merely exemplified excerpts that are convenient for explaining the processing of the information processing unit 11, and naturally other types of feature amounts may exist. . For example, the usage amount value and the occurrence date and time value itself are also usually used as feature amounts. Moreover, the number of transactions for each target period may be included in the feature quantity. In addition, the feature amount may include a value obtained using a statistical method other than the average and standard deviation (for example, total, weighted average, variance, etc.) for the usage amount and other generated values.

Also, the feature quantity may include a value derived using a value obtained by a statistical method and an occurrence value included in the current request data. The value derived using the value obtained by the statistical method and the generated value included in the current request data is, for example, the difference between the current usage amount for each target period and the average usage amount for each target period. Also, for example, it is the Z value derived based on the current usage amount value for each target period and the average usage amount value and standard deviation for each target period. Further, for example, the number of types of credit cards (=the number of credit cards with different credit card number values) used by the user with the current user ID value during a certain period of time going back from the present time may be used as one of the feature amounts. Further, when the terminal ID described above is included in the request data, the number of types of credit cards used for the same terminal ID value during a certain period may be used as one of the feature amounts.

The information processing section 11 executes the second determination process after executing the feature amount derivation process.

<Second determination process>
The second determination process is a process of determining whether or not the feature amount derived in the feature amount derivation process is fraudulently used by using the feature amount as it is without inputting it to the fraud determination model. The purpose of the second determination process is to select features that are clearly identified as fraudulent use from the contents of the feature values without using the fraud determination model.

In the second determination process, the information processing section 11 performs, for example, the following processes. That is, for example, the information processing unit 11 calculates the difference between the current usage amount value and the average usage amount value corresponding to the target period: 2 years and the credit card number, and if this difference is greater than the threshold, it is deemed to be unauthorized use. judge. According to this exemplified process, it can be determined that the card is used fraudulently when the purchase is going to be extremely expensive compared to the usual purchases. In addition, for example, the type of feature amount may include the number of types of credit cards used by the user with the current user ID value during a certain period of time (for example, 30 minutes or 1 hour) going back from the current time (=credit cards with different credit card number values). number of cards) is included, the information processing section 11 determines that it is an unauthorized use when this number of types is greater than the threshold. According to this exemplified process, when an abnormally large number of types of credit cards are used by a user with the same user ID in a short period of time, it can be determined that the card has been used fraudulently. Further, for example, when the number of transactions for each target period is included in the feature amount, the information processing unit 11 calculates the number of transactions equal to or greater than the threshold for a certain period of time (for example, 5 minutes or 30 minutes) retroactively from the present time. To determine fraudulent use when a card is used. According to this exemplified process, when a credit card is used an abnormally large number of times in a short period of time, it can be determined as unauthorized use.

If the second determination process determines unauthorized use, the information processing section 11 transmits response data indicating that unauthorized use has been determined to the client device 3 . In this case, the information processing section 11 terminates the process without executing the third determination process. On the other hand, if it is determined in the second determination process that the use is not unauthorized, the information processing section 11 executes the subsequent third determination process.

<Third determination process>
Next, the third determination processing will be explained. The third determination process corresponds to "model use process" in the scope of claims. In the third determination process, the information processing unit 11 inputs each of the feature amounts derived in the feature amount derivation process to the fraud determination model (corresponding to the "model" in the claims), and outputs the fraud determination model. A score for fraud determination (corresponding to "information used to determine fraudulent use of a credit card" in the scope of claims) is obtained. It should be noted that when inputting the feature amount to the fraud determination model, the feature amount is properly normalized.

The fraud determination score is a numerical value (score) that takes a value within a predetermined range (for example, "0" to "1000"), and the higher the value, the higher the possibility of fraudulent use. The unauthorized use determination model is learned by machine learning. Any method can be used for machine learning of the fraud determination model, and any of neural networks (including deep learning) and other existing techniques can be used. The fraudulent use judgment model does not have to be a single model (one model that inputs all feature values and outputs one fraud judgment model), and may be a combination of a plurality of models.

After acquiring the fraud determination score, the information processing section 11 determines whether or not the fraud determination score is equal to or greater than a predetermined threshold. If the score for fraud determination is equal to or greater than the threshold, the information processing section 11 determines that the current credit card use is fraudulent, and transmits response data indicating the fraudulent use to the client device 3 . In this case, the information processing section 11 ends the process without executing the data update process.

On the other hand, if the score for fraud determination is below the threshold, the information processing unit 11 determines that the current credit card use is not fraudulent use, and sends response data indicating that it is determined that the credit card is not fraudulent use to the client device 3. Send. The client device 3 that has received the response data indicating that it has been determined that the use is not unauthorized executes the corresponding process. For example, if the client device 3 is a dedicated payment terminal installed at a cash register in a physical store, the client device 3 displays information to the effect that there is a possibility of unauthorized use on a predetermined display to notify the user of the possibility. Inform the cashier and continue the payment in cooperation with other devices. When the information processing section 11 determines in the third determination process that the use is not unauthorized, the information processing section 11 executes the subsequent data update process.

<Data update process>
Next, data update processing will be described. In the data update process, the information processing unit 11 adds the current request data to the credit card number basic data 14C corresponding to the current credit card number value, and adds the current request data to the user ID basic data 14U corresponding to the current user ID value. do. Further, the information processing unit 11 updates the contents of the stats record 16 based on the current request data, if the current day's stats record 16 already exists for the credit card number stat data 15C corresponding to the current credit card number value, If it does not exist, a new stats record 16 is generated based on the current request data and added to the credit card number stats data 15C. Similarly, for the user ID stats data 15U corresponding to the current user ID value, if the current day's stats record 16 already exists, the information processing unit 11 updates the contents of the stats record 16 based on the current request data. If it does not exist, a new stats record 16 is generated based on the current request data and added to the user ID stats data 15U.

When updating the stats record 16, the information processing section 11 updates the unit period average value reflecting the current transaction based on the current unit period average value, the current number of transactions, and the current usage amount value. is newly derived, and the current unit period average value is updated. As a result, the unit period average value is the average value of the usage amounts of the transactions that occurred during the current day, including the current transaction. The information processing section 11 also updates the unit period standard deviation value by the same method. The information processing section 11 also increments the number of transactions. Also, when creating and adding a new stats record 16, the information processing unit 11 sets the unit period average value of the new stats record 16 to the current usage amount value, sets the unit period standard deviation value to zero, and sets the number of transactions to "1", and the corresponding date value is a value indicating today's date.

<Other processing>
Next, other processes of the information processing section 11 will be described. The information processing section 11 executes the following processes as batch processes at the start of the day. That is, the information processing section 11 accesses each of the stats data 15, and if there is a stats record 16 from 721 days before that point, deletes that record. In addition, although detailed description is omitted, when the information processing unit 11 accesses the basic data 14, request data more than 6 hours before the current time (=the date and time of occurrence is more than 6 hours ago) request data) exists, delete the request data.

The operation of the information processing server 2 has been described above. In this embodiment, since the feature amount (individual feature amount) related to the short-term type and the feature amount (corresponding feature amount) related to the long-term type are derived by the above-described method, the following effects are obtained.

Here, conventionally, the derivation of the feature amount was basically performed by the following method. That is, first, all request data that may be used for deriving feature values are centrally managed in one database. Therefore, if the average value of the amount of credit card usage (occurrence value) for the past two years is included in the feature amount, a database that records all the request data that occurred in the past two years is available. be prepared. Therefore, request data registered in the database is usually enormous. Then, when deriving the feature amount, the conventional system accesses the database each time for each feature amount, and specifies request data holding information necessary for deriving the one feature amount. Feature values were derived based on request data.

The conventional methods described above have the following problems. That is, as in the fraud determination model according to the present embodiment, for a model that outputs information related to the determination of fraudulent use, generated values generated in a short period of time (in this embodiment, the amount used is one of the generated values) It is expected that the accuracy of the output of the model will be improved if the model input includes not only the feature amount derived using the , but also the feature amount derived using the occurrence values that occurred over a long period of time. This is because the output of the model can be a value that reflects the mode of trading in various periods including not only the short term but also the long term.

Based on this, if the feature amount related to a long period is included in the feature amount type, it will be necessary to register all the request data that occurred in that long period in the database, and the number of request data registered in the database will be enormous. Become. Also, the longer the period of the feature amount, the more the number of generated values (request data) required to derive the feature amount, and the more generated values used when deriving the feature amount. For this reason, when deriving feature values, a large number of records are specified as necessary records from a database in which a huge amount of request data is registered, and a large number of generated values are used based on all the specified request data. Therefore, there is a problem that the time required for a series of processes for deriving the feature amount becomes long.

On the other hand, according to the present embodiment, the following effects are obtained regarding the derivation of the corresponding feature amount, which is the feature amount related to the long-term type. That is, in the present embodiment, the storage unit 12 stores in advance the stats data 15 for each value of the individual identification information for each type of individual identification information. The stats record 16 recorded in the stats data 15 is a statistic (unit period average value and unit period standard deviation). The number of stats records 16 corresponding to a certain day is one regardless of how many times the credit card was used on that day, and the maximum number of stats records 16 in the stats data 15 is 730.

Then, the information processing section 11 uses the statistics (unit period average value and unit period standard deviation) of the stats record 16 to derive the corresponding feature amount. That is, when deriving the corresponding feature amount for a certain target period, the information processing unit 11 does not derive the corresponding feature amount using all the usage amount values (incidence values) belonging to the target period, but rather A corresponding feature amount is derived using a statistic for each unit period belonging to the period. Therefore, according to this embodiment, when deriving the corresponding feature amount, it is not necessary to grasp each occurrence value and derive the corresponding feature amount using all the occurrence values as elements. It is sufficient to grasp the statistics for each and use them as elements, and the number of elements to be grasped when deriving the corresponding feature amount is reduced, and the number of elements to be used for actual calculation is reduced. Lengthening of the time required for derivation can be suppressed. More specifically, when deriving the corresponding feature amount, the information processing unit 11 identifies the necessary stats records 16 according to the type of the target period from a database in which at most 730 stats records 16 are registered. The unit statistic (unit period average or unit period standard deviation) of the stats record can be used as an element when deriving the corresponding feature amount, and a large number of request data can be identified from a database containing a huge number of records. However, there is no need to perform processing such as using occurrence values (usage amount values) of a large number of identified records as factors when deriving the corresponding feature amount.

For the unit period: 2 years, for the average usage amount (feature value), if we determine the occurrence value for each transaction and calculate the average usage amount based on each occurrence value, in the past 2 years , if 10 transactions are performed every day, it is necessary to grasp 7300 generated values and use each generated value to derive the average usage amount. On the other hand, according to the present embodiment, even in such a case, it is sufficient to use the stats records 16 for 730 cases, and the processing efficiency is very good compared to the conventional method, and the processing takes a long time. Shorten.

Furthermore, in this embodiment, the following effects are obtained in deriving the corresponding feature amount, which is the feature amount related to the long-term type. That is, in this embodiment, the stats data 15 for each value of individual identification information is prepared in advance for each type of individual identification information. When deriving the corresponding feature amount corresponding to the specific value of the one type of individual identification information, the stats data 15 corresponding to the specific value of the one type of individual identification information is referred to. The stats data 15 referred to at this time is the stats record 16 necessary for deriving the corresponding feature amount related to the maximum target period among the corresponding feature amounts corresponding to the specific value of the one type of individual identification information. (That is, 16 stats records for the past 730 days at most) are recorded in a minimum size database. In the present embodiment, the corresponding feature amount can be derived by accessing such a database, so the processing efficiency is high, the time required for deriving the corresponding feature amount can be shortened, and the response time can be shortened.

It should be noted that the feature that there is a feature amount for each type of individual identification information is not a feature unique to this embodiment, but a general feature amount to be input to the "model that outputs information used for judging unauthorized use". It is a feature. That is, at present, it is very common for one user to have multiple types of credit cards, and users often use credit cards in various environments. Therefore, in order to effectively detect unauthorized use, it is necessary to judge unauthorized use while reflecting the actual situation of credit card use for each credit card, user, and usage environment. This is because, inevitably, it becomes necessary to include a feature amount according to the type of individual identification information in the feature amount.

Further, according to the present embodiment, the following effects are obtained regarding the derivation of the individual feature amount, which is the feature amount related to the short-term type. That is, in this embodiment, the basic data 14 for each value of individual identification information is prepared in advance for each type of individual identification information. Then, when deriving the individual feature quantity (feature quantity related to the short-term type) corresponding to the specific value of the one type of individual identification information, the information processing unit 11 calculates the specific value of the one type of individual identification information. refer to the basic data 14 corresponding to . The basic data 14 referred to here is a database in which request data necessary for deriving the individual feature value corresponding to the specific value of the one type of individual identification information is recorded without excess or deficiency. Since the individual feature amount can be derived by accessing the database, the processing efficiency is high, the time required for deriving the individual feature amount can be shortened, and the response time can be shortened.

Furthermore, in this embodiment, the following effects can be obtained regarding the derivation of the individual feature amount, which is the feature amount related to the short-term type. That is, in this embodiment, there are a plurality of short-term types of "5 minutes," "30 minutes," "1 hour," and "6 hours." In addition, in this embodiment, there are a plurality of types of feature amounts (usage amount average value and usage amount standard deviation) derived by different methods for each short-term type. Then, when deriving the individual feature amount related to a certain type of individual identification information, first, period data for each short-term type is generated from the corresponding basic data 14 . Then, when deriving the individual feature amount of a certain short-term type, the information processing section 11 derives the individual feature amount based on the period data corresponding to the short-term type.

Here, the period data related to a certain short-term type is a database in which the minimum required request data for deriving the feature amount related to the short-term type is recorded. When deriving the individual features, a database in which such minimum required request data is recorded is calculated and derived, so that the processing efficiency is good and the time required for deriving the individual features can be shortened. As a result, the response time can be shortened. In addition, the period data need only be generated for each short-term type, and need not be generated for each feature amount type. Processing load is limited. That is, in the present embodiment, there are a plurality of types of short-term types, and a plurality of types of feature amounts derived by different methods for each short-term type are focused, and period data for each short-term type is calculated. By adopting the generating method, the processing efficiency is improved and the processing time is shortened.

Also, in the present embodiment, the first determination process, the feature value derivation process, the second determination process, the third determination process, and the data update process are executed in stages. Then, when the unauthorized use is determined in the first determination process, the second determination process, or the third determination process, the response data is returned without executing the subsequent processes. For this reason, if it can be clearly determined that unauthorized use has occurred based on the information available at each stage, the subsequent processing is not executed, and the response data is returned, thereby reducing the response time. . In particular, the second determination process is a unique process that utilizes the feature that effective determination of unauthorized use can be performed using the feature amount itself in the determination of unauthorized use of a credit card. In addition, this feature usually includes feature values that represent past usage patterns (average value, standard deviation, number of transactions, type of credit card used in a certain period of time, etc.). number, etc.), it is possible to detect an abnormality in the current usage pattern using the feature amount itself.

Note that in the present embodiment, all feature amounts are derived in the feature amount derivation process. Regarding this, the information processing section 11 may be configured to execute the following processes. That is, in the feature amount derivation process, the information processing section 11 first derives only the feature amount used for the second determination process in the feature amount derivation process, and executes the second determination process based on the derived feature amount. If the second determination process does not determine unauthorized use, the information processing section 11 derives the remaining feature amounts that were not derived in the feature amount derivation process, and executes the third determination process.

Next, an operation example of the information processing server 2 according to this embodiment will be described using a flowchart. FIG. 6 is a flow chart showing an example of the operation of the information processing server 2, and in particular shows an overview of the process executed in response to reception of request data.

As shown in FIG. 6, when the information processing unit 11 of the information processing server 2 receives the request data from the client device 3, it executes a first determination process (step SA1). When the information processing section 11 determines that the unauthorized use has occurred in the first determination process (step SA2: YES), the information processing section 11 responds to the client device 3 with response data to the effect that the unauthorized use has been determined (step SA3), and ends the process. do. When the information processing section 11 does not determine that the use is unauthorized in the first determination process (step SA2: NO), the information processing section 11 executes the feature value derivation process (step SA4).

Next, the information processing section 11 executes a second determination process (step SA5). When the information processing section 11 determines that the second determination process is unauthorized (step SA6: YES), the information processing section 11 responds to the client device 3 with response data to the effect that it is determined as unauthorized use (step SA3), and ends the process. do. When the information processing section 11 does not determine unauthorized use in the second determination process (step SA6: NO), the information processing section 11 executes the third determination process (step SA7).

When the information processing section 11 determines that the unauthorized use has occurred in the third determination process (step SA8: YES), the information processing section 11 sends the response data to the effect that the unauthorized use has been determined to the client device 3 (step SA3). When the information processing section 11 does not determine unauthorized use in the third determination process (step SA8: NO), the information processing section 11 responds to the client device 3 with response data indicating that unauthorized use has not been determined (step SA9). Further, the information processing section 11 executes data update processing (step SA10), and terminates the processing.

FIG. 7 is a flowchart showing an operation example of the information processing server 2 when deriving individual feature amounts (feature amounts corresponding to short-term types) in the feature amount deriving process. As shown in FIG. 7, the information processing unit 11 of the information processing server 2 refers to the storage unit 12 and specifies basic data 14 corresponding to the value of the individual identification information for each individual identification information included in the current request data. (step SB1). Next, the information processing section 11 selects the specified credit card number basic data 14C and the specified user ID basic data 14U for each of the short-term types (“5 minutes”, “30 minutes”, “1 hour” and “6 hours”). ”), corresponding period data is generated (step SB2). Next, the information processing section 11 derives each of the individual feature amounts based on the period data (step SB3).

FIG. 8 is a flowchart showing an operation example of the information processing server 2 when deriving a corresponding feature amount (a feature amount corresponding to a long-term type) in the feature amount deriving process. As shown in FIG. 8, the information processing unit 11 of the information processing server 2 refers to the storage unit 12 and specifies the stats data 15 corresponding to the value of the individual identification information for each individual identification information included in the current request data. (step SC1). Next, the information processing section 11 derives corresponding feature amounts based on the specified stats data 15 (step SC2).

Although one embodiment of the present invention has been described above, the above-described embodiment merely shows an example of specific implementation of the present invention. It should not be done. Thus, the invention may be embodied in various forms without departing from its spirit or essential characteristics.

For example, in the above-described embodiment, the information processing server 2 is described as a server device connected to the network 4, but a device (system) corresponding to the information processing system in the claims is a server connected to the network 4. Not limited to devices. For example, it may be a local server connected to the client device 3 via a local area network, a device (system) directly connected to the client device 3 via a cable, or the client device 3 itself. There may be.

Further, in the above-described embodiment, the information processing server 2 itself has the storage unit 12 . However, the storage unit 12 does not need to be provided in the information processing server 2 (device (system) corresponding to the information processing system in the scope of claims). Alternatively, another server that can communicate with the information processing server 2 via the network 4 may be provided.

Further, in the above-described embodiment, the information processing section 11 is configured to determine unauthorized use in the third determination process, but the following configuration may be used. That is, after the information processing unit 11 derives the fraud judgment score using the fraud judgment model, the fraud judgment score is returned to the client device 3 without judging whether or not the use is unauthorized. 3 may determine whether or not it is unauthorized use based on the score for fraud determination.

In the above embodiment, the fraud determination model outputs the fraud determination score, but the output of the fraud determination model is not limited to the fraud determination score. As an example, information indicating whether or not it is unauthorized use may be output, and a score different from the above embodiment (for example, taking a value between 0 and 1, and calculating the probability of whether or not it is unauthorized use) Also, for example, a value such that the smaller the value, the higher the possibility of unauthorized use) may be output.

Further, in the above-described embodiment, when deriving the individual feature amount related to the short-term type, the information processing unit 11 generates period data from the basic data 14 and uses this period data to derive the period data. The basic data 14 may be directly used to derive the individual feature amount without generating data.

Further, in the above embodiment, if the information processing unit 11 determines unauthorized use in any one of the first determination process, the second determination process, and the third determination process, the subsequent process is not executed. It may be configured to execute subsequent processing. In this configuration, for example, it is possible to output the result of each determination process to the client device 3 .

2 Information processing server (information processing system)
11 information processing unit 12 storage unit

Claims (8)

An information processing unit that derives one or more types of feature values to be input to a model that outputs information used to determine whether a transaction is fraudulent when a transaction is performed, using generated values that occur according to the transaction. ,
The feature amount includes a corresponding feature amount that can be derived by a statistical method using each of the occurrence values that occurred in a predetermined period going back from the current time,
When deriving the corresponding feature value according to a transaction, the information processing unit uses a statistic derived in advance by a statistical method for the group of generated values that occurred in the past and stored in the storage unit. , and deriving the corresponding feature amount by using instead of the individual generated values belonging to the group. The storage unit stores a unit statistic derived by a statistical method using each of the occurrence values generated within the unit period for each unit period in which the past is divided into certain units,
When deriving the corresponding feature amount according to the transaction, the information processing section acquires the unit statistics of each of the unit periods belonging to the predetermined period retroactively from the current time from the storage section, and acquires the acquired 2. The information processing system according to claim 1, wherein the corresponding feature amount is derived based on each unit statistic. When a transaction is carried out, a plurality of types of individual identification information values that identify the medium itself, the transaction executor, or the environment in which the transaction is carried out in the case where the medium is used for the transaction, and the generated value are associated with each other. and output to the information processing unit,
For each type of the individual identification information, the corresponding feature amount is associated with the individual identification information having the same value as the value of the individual identification information input to the information processing unit according to the current transaction, and has been stored in the past. The corresponding feature amount that can be derived by a statistical method using the input occurrence value is included,
In the storage unit, for each type of the individual identification information, for each value of the individual identification information, the Stores stats data in which unit statistics are cumulatively recorded,
When deriving the corresponding feature quantity corresponding to the individual identification information of a specific value of a specific type in accordance with the transaction, the information processing unit determines the statistic corresponding to the specific value of the specific type. 3. The information processing system according to claim 2, wherein the corresponding feature quantity is derived using data. When a transaction is carried out, a plurality of types of individual identification information values that identify the medium itself, the transaction executor, or the environment in which the transaction is carried out in the case where the medium is used for the transaction, and the generated value are associated with each other. and output to the information processing unit,
The characteristic amount includes, for each type of the individual identification information, associated with the individual identification information having the same value as the value of the individual identification information input to the information processing unit according to the current transaction, and An individual feature amount that can be derived by a statistical method using the generated value input during a period preceding the current time by a certain period shorter than the predetermined period related to the feature amount,
In the storage unit, for each type of the individual identification information, the generated value input to the information processing unit in association with the individual identification information of each value is accumulated for each value of the individual identification information. basic data recorded in the
When deriving the individual feature quantity corresponding to the individual identification information of a specific type and a specific value according to a transaction, the information processing unit is configured to obtain the basic value corresponding to the specific value of the specific type. 3. The information processing system according to claim 1, wherein the individual feature amount is derived using data. When a transaction is carried out, a plurality of types of individual identification information values that identify the medium itself, the transaction executor, or the environment in which the transaction is carried out in the case where the medium is used for the transaction, and the generated value are associated with each other. and output to the information processing unit,
A plurality of types of short-term type target periods with different lengths, which are shorter than the predetermined period related to the corresponding feature amount and are shorter than the predetermined period related to the corresponding feature amount, are determined as periods going back from the current time point,
The feature value includes the same value as the value of the individual identification information input to the information processing unit according to the current transaction for each combination of the type of the short-term type target period and the type of the individual identification information. In association with the individual identification information of, there is an individual feature amount derived based on the occurrence value input in the short-term type target period of the corresponding type retroactively from the current time, and one type of the As the individual feature amount corresponding to the short-term type target period, there are a plurality of types of the individual feature amount derived by different methods,
In the storage unit, for each type of the individual identification information, the generated value input to the information processing unit in association with the individual identification information of each value is accumulated for each value of the individual identification information. basic data recorded in the
When deriving the individual feature quantity corresponding to the individual identification information of a specific type and a specific value for each type of the short-term type target period according to the transaction, the information processing unit based on the basic data corresponding to the specific value of the type of, for each type of the short-term type target period, period data in which the occurrence value that occurred within the short-term type target period is recorded is generated. , when deriving the individual feature amount corresponding to the short-term type target period of a certain type, the individual feature amount is derived using the period data corresponding to the short-term type target period of that type 3. The information processing system according to claim 1 or 2. The information processing unit
Acquiring the accrued value and accompanying information in response to a transaction;
executing a first determination process for determining whether or not a transaction is fraudulent, using at least part of the generated value and the accompanying information without deriving the feature amount;
If the first determination process determines that the transaction is not fraudulent, the feature amount is derived using the generated value, and the feature amount is used without being input to the model to determine whether or not the transaction is fraudulent. Execute the second determination process,
6. The method according to any one of claims 1 to 5, characterized in that when it is determined that the second determination process is not fraudulent, the feature amount is input to the model, and a third determination process for obtaining information output by the model is executed. or the information processing system according to item 1. The information processing unit of the information processing system uses generated values generated according to the transaction as one or more types of feature values that are input to a model that outputs information used to determine whether the transaction is fraudulent when the transaction is performed. a first step of deriving by
a second step in which the information processing unit of the information processing system inputs the derived feature quantity into the model and obtains an output;
The feature amount includes a corresponding feature amount that can be derived by a statistical method using each of the occurrence values that occurred in a predetermined period going back from the current time,
In the first step, the information processing unit obtains a statistic derived in advance by a statistical method for the group of occurrence values that occurred in the past and stores the statistic in the storage unit, An information processing method, wherein the corresponding feature quantity is derived by using it in place of the generated value. An information processing unit of an information processing system acquires an accrued value and accompanying information generated in response to a transaction, and determines whether or not the transaction is fraudulent using at least a part of the accrued value and the accompanying information. a first step of executing a 1 determination process;
When the information processing unit of the information processing system determines that the transaction is not fraudulent in the first determination process, one or more types of feature values to be input to a model that outputs information used to determine whether the transaction is fraudulent are determined based on the generated value. a second step of performing a second determination process for determining whether or not a transaction is fraudulent by using the feature amount without inputting it to the model;
When the information processing unit of the information processing system determines that the second determination process is not fraudulent, the feature amount is input to the model, and a third determination process is performed to obtain information output by the model. and
The feature amount includes a corresponding feature amount that can be derived by a statistical method using each of the occurrence values that occurred in a predetermined period going back from the current time,
In the second step, the information processing unit obtains a statistic derived in advance by a statistical method for the group of occurrence values that occurred in the past and stores the statistic in the storage unit, An information processing method, wherein the corresponding feature quantity is derived by using it in place of the generated value.