WO2020242337A1

WO2020242337A1 - Method and system for determining the similarity of vector representations of transaction participants

Info

Publication number: WO2020242337A1
Application number: PCT/RU2019/000376
Authority: WO
Inventors: Дмитрий Андреевич АНДРЕЕВ; Андрей Михайлович ПИНЧУК
Original assignee: Публичное Акционерное Общество "Сбербанк России"
Priority date: 2019-05-28
Filing date: 2019-05-28
Publication date: 2020-12-03
Also published as: EA201991626A1; RU2728953C1

Abstract

The invention relates to the field of data processing, in particular to a method and a system for determining the similarity of vector representations of transaction participants. The method comprises steps in which: data regarding transactions and data regarding devices for carrying out the transactions are obtained; chains of transaction activities are generated, wherein each of the chains relates to the transactions of one transaction participant; vector representations of the devices for carrying out the transactions are generated by conversion of the chains of transaction activities; a median of the obtained values of the vector representations of the devices for carrying out the transactions is determined for each transaction participant and a vector representation of said participant is generated on the basis of the average value of the vector representations of the chain of the devices for carrying out the transactions that are associated with said participant; a cosine distance between the average vector representations of the transaction participants is calculated, wherein the participants are an associated sender and receiver of a transaction; and the vector distance between said transaction participants is determined on the basis of the value of the cosine proximity. The invention makes it possible to determine the location of clients on the basis of data regarding a transaction without using geographic coordinates.

Description

METHOD AND SYSTEM FOR DETERMINING THE SIMILARITY OF VECTOR

REPRESENTATIONS OF TRANSACTION PARTICIPANTS

FIELD OF TECHNOLOGY

[0001] The claimed solution relates generally to the field of data processing, and in particular to a method and system for determining the similarity of vector representations of transaction participants.

LEVEL OF TECHNOLOGY

[0002] Currently, in the largest number of cases of fraud, transfers to payment cards (debit or credit) are used as a withdrawal channel. For effective counteraction to fraud, in particular, taking into account the dominant type of “self-translation” fraud, an important task is to determine the spatial geo-positional proximity of clients making transactional transfers, i.e. analysis of their actual location in a particular geographic area.

[0003] Since in most cases the fraudsters do not know the territorial affiliation of the customer and cannot pick up fraudulent withdrawal cards from the same location, they withdraw funds to available "dropper" payment cards. At the same time, legitimate transfers mainly occur between clients from a close geolocation (purchase of goods, payment for rendered p2p services, translation to friends, etc.). Information that allows you to determine how close the sender and the recipient are in their geo-location will help improve the quality of fraud detection models.

[0004] Known approaches are based, for example, on linking clients to one or another geographically located bank and / or geodata of POS terminals / CS (ATMs) in which the client uses a payment card, and use them to determine the geolocation of the client. Such solutions, for example, are disclosed in the following patent documents: US 20120215701 A1 (Playspan Inc., 08/23/2012), US 20190043054 A1 (Capital One Services LLC, 02/07/2019), US 20120209773 A1 (PayPal Inc., 08/16/2012) ...

[0005] The known approach has the following disadvantages: \ • The territorial affiliation of the bank is a very vast territory, therefore, the chance that the card for withdrawing fraudsters will end up from the same territorial bank greatly increases;

• POS - there is no geodata for POS terminals, there is only information on the merchant-tenant and its legal address / zip code. This information for large networks does not allow to establish the location of POS-terminals; also, in reality, they can move to other cities / regions by the merchant themselves without informing the bank about it;

• ATM - information on this category is presented most fully. The problem is that not all customers use ATMs when making transactions.

[0006] Thus, it is necessary to develop an effective mechanism for determining the geo-location proximity of transaction participants without using geographic coordinates.

DISCLOSURE OF THE INVENTION

[0007] The technical problem or technical problem to be solved is to determine the geo-positional proximity between the participants in the transaction based on their vector representations.

[0008] The technical result is to provide the ability to determine the location of customers based on transaction data without using geographic coordinates.

[0009] The main objective of the claimed method is to represent the participants in the transaction in the form of vectors, allowing to determine the proximity / remoteness of the participants (senders and recipients of payments) by converting their data into vector form and determining the vector proximity (for example, cosine similarity) and using this information in models for assessing the risk of transactions.

[0010] The claimed result is achieved due to a computer-implemented method for determining the similarity of vector representations of transaction participants, performed using a processor and containing the stages at which:

- receive transaction data containing at least identification data of senders and recipients of transactions, and data of devices for carrying out transactions, including III devices used by said participants in transactions; - form on the basis of the received data chains of transactional activities, and each of the chains refers to the transactions of one participant in the transactions between devices for transactions;

- carry out the formation of vector entities by transforming the mentioned chains of transactional activities, and said entities contain representations of devices for carrying out transactions;

- determine the median among the values of the vector representation for each participant in the transaction and form its vector essence on the basis of the average value of the vector representations of the chain of associated transaction devices;

- perform the calculation of the cosine distance between the vector representation of the participants in the transactions, and the participants are connected by the sender and receiver of the transaction; and

- determine the vector distance between the mentioned participants in the transactions based on the value of the cosine proximity.

[OOP] In one particular embodiment of the method, the transaction devices are an ATM and / or POS terminal.

[0012] In another particular embodiment of the method, the transaction data is representative of p2p transfers.

[0013] The claimed result is also realized due to the system for determining the similarity of vector representations of transaction participants, which contains at least one processor and memory storing machine-readable instructions, which, when executed by the processor, implement the above method.

BRIEF DESCRIPTION OF DRAWINGS

[0014] FIG. 1 illustrates flowcharts of a process for performing the claimed method.

[0015] FIG. 2 illustrates an example of validation of a test sample.

[0016] FIG. 3 illustrates a graph of the distribution of transaction types.

[0017] FIG. 4 illustrates an example of a computing system.

CARRYING OUT THE INVENTION

[0018] FIG. 1 shows the execution process of the claimed method (100) for determining the similarity of vector representations of transaction participants. Under Transaction participants are understood to be persons making transactional transfers of the "client-client" (p2p) type.

[0019] At the first stage (101) of the method (100), transactional data is collected, which contains information about the transactional activity of customers (purchases of goods, transfers, payment for services, cash withdrawals, etc.). Each transactional transfer is usually characterized information that identifies the sender of the transfer and the GO device for the transaction, which can be a POS terminal or ATM. Additionally, information about the IP addresses of the transaction devices can be taken into account.

[0020] Then, based on the information obtained at step (101), chains of transactional activities are formed, each of the chains relating to transactions of one transaction participant between transaction devices (102). Based on the transaction information for each client, the sequence of devices for carrying out transactions is known, which are used to carry out operations, for example:

Client 1 - (POS_l, POS_2, POS_3, ATM_5);

Client 2 - (ATM_1, POS O, POES_2, ATM_4).

[0021] Next, using a machine learning model, vectorization of GD devices is carried out for each chain of transactional activity (103) to form vector representations of GD devices that are used by clients during transactions.

[0022] This task uses the word2vec vector transformation family model, in particular Continuous Bag of Words (CBOW), which is widely used in NLP problems. The essence of the algorithm is that the context of a word is fed to the input of a neural network with one hidden layer and an output layer, and the target variable for optimization is the word itself. Thus, the model learns to predict the word from the given context.

[0023] The hidden layer of the trained model is used as word embedding, which in practice has shown a good ability to generalize the relationship between words in the corpus. In this case, the “words” are vector representations of devices for performing transactions: POS / CS (self-service devices), and “offers” are a sequence of devices that are used by one user. In this context, RS will mean ATMs. [0024] For the training set of the machine learning model, operations were selected in the CA and POS terminals on a subsample of users for a certain time period, in particular 1 month. Sampling was carried out by users, respectively, if a user is included in the sample, then all his RS and POS, which he used to perform transactions, are used to train the model. User points were ordered by time, and if a point was used two or more times in a row, then reuse was deleted, but if this point was used further, after another point, then it remained in the selection.

For instance:

Initial sequence of points: A -> A -> C -> A -> B -> B

The sequence after processing: A -> C -> A -> B

[0025] The above example of a chain of used device IDs in vector form would look like this:

POS_l = (1,1,1);

POS_2 = (2,0,5);

POS_10 = (1,0,0);

ATM_1 = (3,3,3);

ATM_4 = (1,1,1);

ATM_5 = (0,1,4).

[0026] After converting the ID of the transaction devices into a vector form, at step (104), the median among the values of the vector representation for each participant in the transaction is determined and its vector representation is generated based on the average value of the vector representations of the chain of W devices associated with it.

[0027] For each client, the corresponding chain of transactional activity takes the following form: Client 1 = ((1,1,1), (2,0,5), (1,1,1), (0,1,4)) ...

Based on the obtained vector representation in the form of a chain of transactional activity, coordinate-wise averaging is carried out through the median. For the example above, the average value will be represented as a vector (1,1, 2.5).

[0028] Based on the formed chains, the representations (POS / ATM, IP addresses) are transformed into the space of latent variables, in which the cosine proximity of the vectors averaged over the median describing clients, determines their spatial proximity (105), i.e. proximity in vector space between senders and recipients of a transaction.

[0029] An example of calculating the corresponding vectors will be presented below. Example:

Customer 1 = (1,1, 2.5).

Client 2 = (1,1.2, 2.1).

Customer 3 = (4, 0, 0.3)

cosine distance = 1 - cosine similarity

cosine distance Client 1 - Client 2 = 1 - (1 * 1 + 1 * 1.2 + 2.5 * 2, l) / (2.87 * 2.62) = 1 - 0.99 =

0.01

cosine distance Client 1 - Client 3 = 1 - (1 * 4 + 1 * 0 + 2.5 * 0.3) / (2.87 * 4.01) = 1 - 0.41 = 0.59.

[0030] From the above example, it can be seen that Client 1 and Client 2 in terms of cosine distance are located much closer to each other compared to Client 1 and Client 3. Therefore, the geo-positional proximity and behavior pattern of Client 1 and Client 2 are quite close, from which can be judged that transactions between them will be more legitimate compared to transactions between Client 1 and Client 3.

[0031] The algorithm for generating vector representations of users based on vector representations of devices for executing transactions allows calculating the embedding vectors of the user himself - the participant in the transaction so that the cosine proximity of the users' vectors corresponds to their geolocation proximity. Thus, this information can then be used to analyze transactional fraudulent activity.

[0032] Next, consider the process for validating a sample of a machine learning model shown in FIG. 2. For a quick validation of the trained vector representations, the following algorithm was used: a random US was taken (according to which coordinates are available), and the nearest neighbors of the US were searched for by the vector representation (embedding). The point and neighbors were visualized on the map by their geocoordinates. Similarly, the most distant RS were constructed using the same initial points. The process was repeated for several dozen points. This validation made it possible to visually assess how close the points on the geographic map lie to each other that are close on the embedding.

[0033] The second test option is to use US / POS embedding to calculate the distance between users and calculate statistics for this distance to analyze false alarms of the fraud monitoring system (legitimate transactions) and fraudulent operations. The distance between users was calculated using the following algorithm:

1) The calculated embedding measurements were attached to all devices that the user used (if for some of the devices the embedding was absent, then it was deleted);

2) The median for each user was taken according to the measurements of embedding;

3) The cosine distance between users was measured using the embedding median.

[0034] Further, according to the calculated distance, percentiles were taken with a step of 5 for operations marked F (fraud), G false positives (legitimate). For a given range of the validation period, for example, 1 month, the following statistics were obtained, presented in Table 1.

Table 1

[0035] From the above example, it follows that if you set the threshold values for legitimate transactions, for example, a distance of 0.44, then 85% of fraudulent transactions will be blocked, but false positives can be reduced by more than 40%, which shows the good separating power of this metric.

[0036] If the distances across the entire sample are divided into bins and then the ratio of fraudulent operations to legitimate ones (false positives) is analyzed, it will be seen that with increasing distance the number of fraudulent operations and their proportion in the bin increases (Table 2). An example of a graph is shown in FIG. 3.

table 2

[0037] As a result of the implementation of the claimed method (100), an effective principle of data presentation and processing was created to determine the geo-proximity of clients without using geo-coordinates. Also, the use of the obtained data can be used for the purposes of analysis and counteraction to fraudulent transactions.

[0038] FIG. 4 shows an example of a general view of a computing system (200) based on a computing device (200), which provides the implementation of the claimed method or is a part of a computer system, for example, a server that processes the necessary data to implement the method (100).

[0039] In the General case, a computing device (200) contains one or more processors (201) united by a common data exchange bus, memory means such as RAM (202) and ROM (203), input / output interfaces (204), devices input / output (205), and a device for networking (206).

[0040] The processor (201) (or multiple processors, multi-core processor) can be selected from a range of devices currently widely used, for example, Intel ™, AMD ™, Apple ™, Samsung Exynos ™, MediaTEK ™, Qualcomm Snapdragon ™ and etc. Under the processor, it is also necessary to take into account a graphics processor, for example, an NVIDIA or ATI GPU, which is also suitable for complete or partial execution of the method (100). In this case, the memory means can be the available memory of the graphics card or the graphics processor.

[0041] RAM (202) is a random access memory and is intended for storing machine-readable instructions executed by the processor (201) for performing the necessary operations for logical data processing. RAM (202), as a rule, contains executable instructions of the operating system and corresponding software components (applications, software modules, etc.).

[0042] ROM (203) is one or more persistent storage devices such as a hard disk drive (HDD), solid state data storage device (SSD), flash memory (EEPROM, NAND, etc.), optical storage media ( CD-R / RW, DVD-R / RW, BlueRay Disc, MD), etc.

[0043] Various types of I / O interfaces (204) are used to organize the operation of the components of the device (200) and to organize the operation of external connected devices. The choice of the appropriate interfaces depends on the specific version of the computing device, which can be, but are not limited to: PCI, AGP, PS / 2, IrDa, FireWire, LPT, COM, SATA, IDE, Lightning, USB (2.0, 3.0, 3.1, micro, mini, type C), TRS / Audio jack (2.5, 3.5, 6.35), HDMI, DVI, VGA, Display Port, RJ45, RS232, etc.

[0044] To ensure user interaction with the computing device (200), various I / O means (205) are used, for example, a keyboard, display (monitor), touch display, touch-pad, joystick, mouse manipulator, light pen, stylus, touch panel, trackball, speakers, microphone, augmented reality, optical sensors, tablet, light indicators, projector, camera, biometric identification (retina scanner, fingerprint scanner, voice recognition module), etc.

[0045] The networking means (206) allows the device (200) to transmit data via an internal or external computer network, for example, Intranet, Internet, LAN, and the like. One or more means (206) can be used, but not limited to: Ethernet card, GSM modem, GPRS modem, LTE modem, 5G modem, satellite communication module, NFC module, Bluetooth and / or BLE module, Wi-Fi module, and dr.

[0046] In addition, satellite navigation means can also be used as part of the device (200), for example, GPS, GLONASS, BeiDou, Galileo.

[0047] The presented application materials disclose preferred examples of implementation of the technical solution and should not be construed as limiting other, particular examples of its implementation, not going beyond the scope of the claimed legal protection, which are obvious to specialists in the relevant field of technology.

Claims

FORMULA

1. A computer-implemented method for determining the similarity of vector representations of transaction participants, performed using a processor and containing stages at which:

• receive transaction data containing at least the identification data of the senders and recipients of the transactions, and data of the transaction execution devices, including the GO of the devices used by the said participants in the transactions;

• form on the basis of the received data chains of transactional activities, and each of the chains refers to the transactions of one participant in the transactions between the transaction devices;

• carry out the formation of vector representations of devices for carrying out transactions by transforming the mentioned chains of transactional activities;

• determine the median among the obtained values of the vector representations of devices for carrying out transactions for each participant in the transaction and form its vector representation based on the average value of the vector representations of the chain of associated transaction devices;

• calculating the cosine distance between the averaged vector representations of the participants in the transactions, and the participants are the associated sender and receiver of the transaction; and

• determine the vector distance between the mentioned participants in the transactions based on the value of the cosine proximity.

2. A method according to claim 1, characterized in that the transaction device is an ATM and / or POS terminal.

3. The method according to claim 1, characterized in that the transaction data characterize p2p transfers.

4. A system for determining the similarity of vector representations of participants in transactions, containing at least one processor and memory storing machine-readable instructions, which, when executed by the processor, implement the method according to any one of claims. 1-3.