RU2728953C1 - Method and system for determining similarity of vector representations of transaction participants - Google Patents

Abstract

FIELD: data processing.

SUBSTANCE: invention relates to a method and system for determining similarity of vector representations of transaction participants. Method comprises steps of: obtaining transaction data and transaction device data; form chains of transactional activities, wherein each of the chains relates to transactions of one transaction participant; generating vector representations of devices for performing transactions by converting chains of transaction activities; determining a median among the obtained values of vector representations of devices for performing transactions for each participant of the transaction and forming its vector representation based on the averaged value of the vector representations of the chain of associated devices of the transaction; calculating cosine distance between averaged vector representations of transaction participants, wherein participants are associated sender and recipient of transaction; and determining the vector distance between said transaction participants based on the cosine adjacency value.

EFFECT: technical result consists in improvement of accuracy of location of clients based on transaction data without using geographical coordinates.

4 cl, 4 dwg, 2 tbl

Description

AREA OF TECHNOLOGY

[0001] The claimed solution relates generally to the field of data processing, and in particular to a method and system for determining the similarity of vector representations of participants in transactions.

LEVEL OF TECHNOLOGY

[0002] Currently, in the largest number of cases of fraud, transfers to payment cards (debit or credit) are used as a withdrawal channel. For effective counteraction to fraud, in particular, taking into account the dominant type of “self-translation” fraud, it is important to determine the spatial geo-positional proximity of clients making transactional transfers, i.e. analysis of their actual location in a particular geographic area.

[0003] Since in most cases the fraudsters do not know the territorial affiliation of the customer and cannot pick up fraudulent withdrawal cards from the same location, they withdraw funds to available "dropper" payment cards. At the same time, legitimate transfers mainly occur between clients from a close geolocation (purchase of goods, payment for rendered p2p services, transfer to friends, etc.). Information that allows you to determine how close the sender and receiver are in their geo-location will help improve the quality of fraud detection models.

[0004] Known approaches are based, for example, on linking clients to one or another geographically located bank and / or geodata of POS terminals / CS (ATMs) in which the client uses a payment card, and use them to determine the geolocation of the client. Such solutions, for example, are disclosed in the following patent documents: US 20120215701 A1 (Playspan Inc., 08/23/2012), US 20190043054 A1 (Capital One Services LLC, 02/07/2019), US 20120209773 A1 (PayPal Inc., 08/16/2012) ...

[0005] The known approach has the following disadvantages: \

Территориальная принадлежность банка - очень обширная территория, поэтому сильно возрастает шанс, что карта вывода мошенников окажется из того же территориального банка;

The territorial affiliation of the bank is a very vast territory, therefore, the chance that the withdrawal card of fraudsters will end up from the same territorial bank greatly increases;

POS - геоданные по POS терминалам отсутствуют, есть только информация по мерчанту-арендатору и его юридический адрес/индекс. Данная информация для крупных сетей не позволяет установить местонахождение POS-терминалов, также реально они могут самим мерчантом перемещаться в другие города/регионы без информирования об этом банка;

POS - there is no geodata for POS terminals, there is only information on the merchant-tenant and its legal address / zip code. This information for large networks does not allow to establish the location of POS terminals; also, in reality, they can move to other cities / regions by the merchant himself without informing the bank about it;

Банкомат - по данной категории информация представлена наиболее полно. Проблема заключается в том, что не все клиенты при осуществлении транзакций пользуются банкоматами.

ATM - information on this category is presented most fully. The problem is that not all customers use ATMs when making transactions.

[0006] Thus, it is necessary to develop an effective mechanism for determining the geo-location proximity of transaction participants without using geographic coordinates.

DISCLOSURE OF THE INVENTION

[0007] The technical problem or technical problem to be solved is to determine the geo-positional proximity between the participants in the transaction based on their vector representations.

[0008] The technical result is to provide the ability to determine the location of customers based on transaction data without using geographic coordinates.

[0009] The main objective of the claimed method is to represent the participants in the transaction in the form of vectors, allowing to determine the proximity / remoteness of the participants (senders and recipients of payments) by converting their data into vector form and determining the vector proximity (for example, cosine similarity) and using this information in models for assessing the risk of transactions.

[0010] The claimed result is achieved due to a computer-implemented method for determining the similarity of vector representations of transaction participants, performed using a processor and containing the steps at which:

- receive transaction data containing at least identification data of senders and recipients of transactions, and data of devices for carrying out transactions, including IDs of devices used by said participants in transactions;

- form on the basis of the received data chains of transactional activities, and each of the chains refers to the transactions of one participant in the transactions between the transaction devices;

- carry out the formation of vector entities by transforming said chains of transactional activities, and said entities contain representations of devices for carrying out transactions;

- determine the median among the values of the vector representation for each participant in the transaction and form its vector essence on the basis of the average value of the vector representations of the chain of associated transaction devices;

- the calculation of the cosine distance between the vector representation of the participants in the transactions is performed, and the participants are connected by the sender and receiver of the transaction; and

- determine the vector distance between the mentioned participants in the transactions based on the value of the cosine proximity.

[0011] In one particular embodiment of the method, the transaction devices are an ATM and / or POS terminal.

[0012] In another particular embodiment of the method, the transaction data is representative of p2p transfers.

[0013] The claimed result is also realized by a system for determining the similarity of vector representations of transaction participants, which contains at least one processor and memory storing machine-readable instructions, which, when executed by the processor, implement the above method.

BRIEF DESCRIPTION OF DRAWINGS

[0014] FIG. 1 illustrates flowcharts of a process for performing the claimed method.

[0015] FIG. 2 illustrates an example of validation of a test sample.

[0016] FIG. 3 illustrates a graph of the distribution of transaction types.

[0017] FIG. 4 illustrates an example of a computing system.

CARRYING OUT THE INVENTION

[0018] FIG. 1 shows the execution process of the claimed method (100) for determining the similarity of vector representations of transaction participants. Transaction participants are understood as persons making transactional transfers of the "client-to-client" (p2p) type.

[0019] At the first step (101) of the method (100), transaction data is collected, which contains information about the transactional activity of customers (purchases of goods, transfers, payment for services, cash withdrawals, etc.). Each transactional transfer, as a rule, is characterized by information identifying the sender of the transfer and the ID of the device for making the transaction, which can be a POS terminal or ATM. Additionally, information about the IP addresses of the transaction devices can be taken into account.

[0020] Then, based on the information obtained at step (101), chains of transactional activities are generated, each of the chains being related to transactions of one transaction participant between transaction devices (102). Based on the transaction information for each client, the sequence of devices for carrying out transactions is known, which are used to carry out operations, for example:

Client 1 - (POS_1, POS_2, POS_3, ATM_5);

Client 2 - (ATM_1, PO S_10, POES_2, ATM_4).

[0021] Next, using a machine learning model, device IDs are vectorized for each chain of transactional activity (103) to generate vector representations of device IDs that are used by clients during transactions.

[0022] This task uses the word2vec vector transformation family model, in particular Continuous Bag of Words (CBOW), which is widely used in NLP problems. The essence of the algorithm is that the context of a word is fed to the input of a neural network with one hidden layer and an output layer, and the target variable for optimization is the word itself. Thus, the model learns to predict the word from the given context.

[0023] The hidden layer of the trained model is used as an embedding, which in practice has shown a good ability to generalize the relationship between words in the corpus. In this case, the “words” are vector representations of devices for performing transactions: POS / CS (self-service devices), and “offers” are a sequence of devices used by one user. In this context, CA will mean ATMs.

[0024] For the training set of the machine learning model, operations in the CS and POS terminals were selected on a subsample of users for a certain time period, in particular, 1 month. Sampling was carried out by users, respectively, if a user is included in the sample, then all his CA and POS, which he used to perform transactions, are used to train the model. User points were ordered by time, and if a point was used two or more times in a row, then reuse was deleted, but if this point was used further, after another point, then it remained in the selection. For example:

Initial sequence of points: A -> A -> C -> A -> B -> B

The sequence after processing: A -> C -> A -> B

[0025] The above example of a chain of used device IDs in vector form would look like this:

POS_1 = (1,1,1);

POS_2 = (2,0,5);

POS_10 = (1,0,0);

ATM_1 = (3,3,3);

ATM_4 = (1,1,1);

ATM_5 = (0,1,4).

[0026] After converting the IDs of the transaction devices into vector form, at step (104), the median among the values of the vector representation for each participant in the transaction is determined and its vector representation is formed based on the average value of the vector representations of the chain of associated IDs of the transaction devices.

[0027] For each client, the corresponding chain of transactional activity takes the following form: Client 1 = ((1,1,1), (2,0,5), (1,1,1), (0,1,4)) ...

On the basis of the obtained vector representation in the form of a chain of transactional activity, coordinate-wise averaging through the median is carried out. For the above example, the average value will be represented as a vector (1,1,2.5).

[0028] Based on the formed chains, the representations (POS / ATM, IP addresses) are transformed into the space of latent variables, in which the cosine proximity of the vectors averaged over the median describing the clients determines their spatial proximity (105), i.e. proximity in vector space between senders and recipients of a transaction.

[0029] An example of calculating the corresponding vectors will be presented below.

Example:

Customer 1 = (1,1,2.5).

Client 2 = (1,1.2,2.1).

Customer 3 = (4,0,0.3)

cosine distance = 1 - cosine similarity

cosine distance Client 1 - Client 2 = 1- (1 * 1 + 1 * 1.2 + 2.5 * 2.1) / (2.87 * 2.62) = 1-0.99 = 0.01

cosine distance Client 1 - Client 3 = 1- (1 * 4 + 1 * 0 + 2.5 * 0.3) / (2.87 * 4.01) = 1-0.41 = 0.59.

[0030] From the above example, it can be seen that Client 1 and Client 2 in terms of cosine distance are located much closer to each other compared to Client 1 and Client 3. Therefore, the geo-positional proximity and behavior pattern of Client 1 and Client 2 are quite close, from which can be judged that transactions between them will be more legitimate compared to transactions between Client 1 and Client 3.

[0031] The algorithm for generating vector representations of users based on vector representations of devices for performing transactions allows calculating the embedding vectors of the user himself - the participant in the transaction so that the cosine proximity of the users' vectors corresponds to their geolocation proximity. Thus, this information can then be used to analyze transactional fraudulent activity.

[0032] Next, consider the process for validating a sample of a machine learning model shown in FIG. 2. For a quick validation of the trained vector representations, the following algorithm was used: a random US was taken (according to which coordinates are available), and the nearest neighbors of the US were searched for by the vector representation (embedding). The point and neighbors were visualized on the map by their geocoordinates. Similarly, the most distant RS were constructed using the same initial points. The process was repeated for several dozen points. This validation made it possible to visually assess how close the points on the geographic map lie to each other that are close to each other on the embedding.

[0033] The second verification option is the use of US / POS embedding to calculate the distance between users and calculating statistics on this distance to analyze false positives of the fraud monitoring system (legitimate transactions) and fraudulent transactions. The distance between users was calculated using the following algorithm:

1) The calculated embedding measurements were attached to all devices that the user used (if there was no embedding for some of the devices, then it was deleted);

2) The median for each user was taken according to the measurements of embedding;

3) The cosine distance between users was measured using the embedding median.

[0034] Further, according to the calculated distance, percentiles were taken with a step of 5 for operations marked F (fraud), G false positives (legitimate). For a given range of the validation period, for example, 1 month, the following statistics were obtained, presented in Table 1.

[0035] From the above example, it follows that if you set the threshold values for legitimate transactions, for example, a distance of 0.44, then 85% of fraudulent transactions will be blocked, but at the same time false positives can be reduced by more than 40%, which shows the good separating power of the given metric.

[0036] If the distances across the entire sample are divided into bins and then the ratio of fraudulent operations to legitimate ones (false positives) is analyzed, it will be seen that with increasing distance the number of fraudulent operations and their proportion in the bin increases (Table 2). An example of a graph is shown in FIG. 3.

[0037] As a result of the implementation of the claimed method (100), an effective principle of data presentation and processing was created to determine the geo-proximity of clients without using geo-coordinates. Also, the use of the received data can be used for the purposes of analysis and counteraction to fraudulent transactions.

[0038] FIG. 4 shows an example of a general view of a computing system (200) based on a computing device (200) that implements the claimed method or is part of a computer system, for example, a server that processes the necessary data to implement the method (100).

[0039] In the General case, the computing device (200) contains one or more processors (201) united by a common bus of information exchange, memory means such as RAM (202) and ROM (203), input / output interfaces (204), devices input / output (205), and a device for networking (206).

[0040] The processor (201) (or multiple processors, multi-core processor) can be selected from a range of devices currently widely used, for example, Intel ™, AMD ™, Apple ™, Samsung Exynos ™, MediaTEK ™, Qualcomm Snapdragon ™ and etc. Under the processor, it is also necessary to take into account a graphics processor, for example, an NVIDIA or ATI GPU, which is also suitable for complete or partial execution of the method (100). In this case, the memory means can be the available memory of the graphics card or graphics processor.

[0041] RAM (202) is a random access memory and is intended for storing machine-readable instructions executed by the processor (201) for performing the necessary operations for logical data processing. RAM (202), as a rule, contains executable instructions of the operating system and corresponding software components (applications, program modules, etc.).

[0042] ROM (203) is one or more persistent storage devices, such as a hard disk drive (HDD), solid state data storage device (SSD), flash memory (EEPROM, NAND, etc.), optical storage media ( CD-R / RW, DVD-R / RW, BlueRay Disc, MD), etc.

[0043] Various types of I / O interfaces (204) are used to organize the operation of the components of the device (200) and to organize the operation of external connected devices. The choice of the appropriate interfaces depends on the specific design of the computing device, which can be, but are not limited to: PCI, AGP, PS / 2, IrDa, FireWire, LPT, COM, SATA, IDE, Lightning, USB (2.0, 3.0, 3.1, micro, mini, type C), TRS / Audio jack (2.5, 3.5, 6.35), HDMI, DVI, VGA, Display Port, RJ45, RS232, etc. [0044] To ensure user interaction with the computing device (200), various means (205) of I / O information are used, for example, a keyboard, display (monitor), touch display, touch pad, joystick, mouse manipulator, light pen, stylus, touch panel, trackball, speakers, microphone, augmented reality, optical sensors, tablet, light indicators, projector, camera, biometric identification (retina scanner, fingerprint scanner, voice recognition module), etc.

[0045] The means of networking (206) allows the device (200) to transmit data via an internal or external computer network, for example, Intranet, Internet, LAN, etc. One or more means (206) may be used, but not limited to : Ethernet card, GSM modem, GPRS modem, LTE modem, 5G modem, satellite communication module, NFC module, Bluetooth and / or BLE module, Wi-Fi module, etc.

[0046] Additionally, satellite navigation aids can also be used as part of the device (200), for example, GPS, GLONASS, BeiDou, Galileo.

[0047] The presented application materials disclose preferred examples of the implementation of the technical solution and should not be construed as limiting other, particular examples of its implementation, not going beyond the scope of the claimed legal protection, which are obvious to specialists in the relevant field of technology.

Claims (10)

1. A computer-implemented method for determining the similarity of vector representations of transaction participants, performed using a processor and containing the stages at which:

receiving transaction data containing at least identification data of senders and recipients of transactions, and data of devices for carrying out transactions, including IDs of devices used by said participants in transactions;

forming on the basis of the received data a chain of transactional activities, and each of the chains refers to the transactions of one participant in the transactions between the transaction devices;

carry out the formation of vector representations of devices for carrying out transactions by transforming the above-mentioned chains of transactional activities;

determining the median among the obtained values of the vector representations of devices for carrying out transactions for each participant in the transaction and forming its vector representation based on the average value of the vector representations of the chain of associated transaction devices;

calculating the cosine distance between the averaged vector representations of the participants in the transactions, and the participants are associated sender and receiver of the transaction; and

determine the vector distance between the mentioned participants in the transactions based on the value of the cosine proximity. 2. A method according to claim 1, characterized in that the transaction device is an ATM and / or a POS terminal. 3. The method according to claim 1, characterized in that the transaction data characterize p2p transfers. 4. The system for determining the similarity of vector representations of participants in transactions, containing at least one processor and memory storing machine-readable instructions, which, when executed by the processor, implement the method according to any one of claims. 1-3.

Images