Modeling users for fraud detection and analysis
Systems and methods are provided for predicting expected behavior of a user in an account. The systems and methods automatically generate a causal model corresponding to a user. The systems and methods estimate a plurality of components of the causal model using event parameters of a first set of events undertaken by the user in an account of the user. The systems and methods predict expected behavior of the user during a second set of events using the causal model.
1. A method comprising:
automatically generating, with at least one processor, a predictive user model representing non-fraudulent activities undertaken by a user in multiple channels in association with an account of the user by transforming data representing the non-fraudulent activities of the user into relationships forming the predictive user model, wherein automatically generating the predictive user model comprises:
generating, with the at least one processor, a plurality of components of the predictive user model from event parameters associated with a first set of events undertaken by the user when the user electronically accesses information associated with the account of the user, wherein the event parameters comprise data associated with the non-fraudulent activities undertaken by the user when the user electronically accesses information associated with an account of the user via a plurality of channels of the multiple channels that is collected during the first set of events, wherein the event parameters comprise IP address data or HTTP data and information associated with an ATM, information associated with a call center system, or information associated with an offline interaction, and wherein
the IP address data or HTTP data comprises one or more of:
IP address data or HTTP data associated with a login event of a session involving the user,
IP address data or HTTP data associated with a termination event of a session involving the user,
IP address data or HTTP data associated with an account access event of a session involving the user,
IP address data or HTTP data associated with an activity event during a session involving the user,
or any combination thereof;
predicting, with the at least one processor and based on generating the plurality of components of the predictive user model, expected behavior of the user during a second set of events using the predictive user model, wherein the second set of events is associated with the non-fraudulent activities undertaken by the user when the user electronically accesses the account of the user, wherein predicting the expected behavior of the user during the second set of events comprises:
generating a statistical relationship between the event parameters associated with the first set of events and derived parameters, wherein the derived parameters include one or more of:
a geographic area from which a first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
a location within the geographic area of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
an identification of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
an electronic service provider of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events, or
any combination thereof;
generating, with the at least one processor and from data representing fraudulent activities of a plurality of fraudsters in a plurality of third party accounts, a predictive fraud model;
generating, with the at least one processor, data representing a prediction of expected behavior of a fraudster associated with a third set of events using the predictive fraud model, wherein the third set of events is associated with fraudulent activities undertaken by the fraudster in association with an additional account, wherein the predictive fraud model is independent of the predictive user model and is generated using the data representing the fraudulent activities of the plurality of fraudsters in the plurality of third party accounts; and
calculating, with the at least one processor, a risk score associated with at least one fourth event that is conducted in real-time, wherein the risk score comprises an indication that the at least one fourth event is performed by the user instead of the fraudster, where the at least one fourth event is associated with electronically accessing the account of the user, wherein calculating the risk score comprises:
calculating the risk score by comparing the expected behavior of the user during the second set of events predicted using the predictive user model, the data representing the prediction of expected behavior of the fraudster associated with the third set of events generated using the predictive fraud model, and IP address data or HTTP data of a second device conducting a session associated with the at least one fourth event; and
generating, with the at least one processor, an alert associated with the account of the user based on calculating the risk score associated with the at least one fourth event.
2. The method of claim 1 , wherein automatically generating the predictive user model includes generating statistical relationships between components of the plurality of components.
3. The method of claim 1 , comprising representing the predictive user model as a Bayesian network.
4. The method of claim 1 , wherein automatically generating the predictive user model includes generating a joint probability distribution that includes the plurality of components.
5. The method of claim 4 , wherein the plurality of components includes a plurality of probability distribution functions that represent the event parameters.
6. The method of claim 5 , wherein the event parameters are observable parameters collected during the first set of events.
7. The method of claim 1 , wherein the IP address data includes one or more of an IP address, IP address country, IP address city, IP network block, and internet service provider supporting an event of the first set of events.
8. The method of claim 1 , wherein the HTTP data includes one or more of data of an operating system, a user agent string, a referrer string, and internet browser of a computer used for an event.
9. The method of claim 1 , wherein predicting the expected behavior of the user includes generating expected event parameters of the second set of events.
10. The method of claim 9 , wherein generating the expected event parameters includes generating a first set of predicted probability distributions that represent the expected event parameters, wherein generating the first set of predicted probability distributions assumes the user is conducting the second set of events.
11. The method of claim 10 , comprising generating a second set of predicted probability distributions that represent expected fraud event parameters, wherein generating the second set of predicted probability distributions assumes the fraudster is conducting the second set of events, wherein the fraudster is any person other than the user, generating in real-time a risk score of an event of the second set of events using the expected event parameters and the expected fraud event parameters.
12. The method of claim 1 , comprising:
receiving the predictive fraud model; and
generating a second set of predicted probability distributions that represent expected fraud event parameters, wherein generating the second set of predicted probability distributions assumes the fraudster is conducting the second set of events, wherein the fraudster is any person other than the user.
13. The method of claim 12 , comprising automatically generating the predictive fraud model by estimating a plurality of fraud components of the predictive fraud model using fraud event parameters of previous fraudulent events undertaken in a plurality of accounts, wherein the previous fraudulent events are events suspected as having been conducted by the fraudster.
14. The method of claim 13 , wherein automatically generating the predictive fraud model includes generating statistical relationships between fraud components of the plurality of fraud components.
15. The method of claim 13 , wherein automatically generating the predictive fraud model includes generating statistical relationships between the fraud event parameters and derived fraud parameters.
16. The method of claim 15 , wherein the derived fraud parameters include one or more of a location of the device, identification of the device, and electronic service provider of the device.
17. The method of claim 1 , comprising generating an alert corresponding to an event of the second set of events when the expected behavior indicates a person other than the user is conducting the event.
18. The method of claim 1 , comprising automatically updating the predictive user model using a second set of event parameters collected during the second set of events.
19. The method of claim 18 , wherein the second set of event parameters are observable parameters collected during the second set of events.
20. The method of claim 18 , wherein automatically updating the predictive user model includes updating a joint probability distribution that includes the plurality of components.
21. The method of claim 18 , wherein automatically updating the predictive user model includes updating at least one of the plurality of components.
22. The method of claim 18 , wherein automatically updating the predictive user model includes updating at least one of a plurality of probability distribution functions that represent the event parameters, the updating modifying the at least one of the plurality of probability distribution functions by considering data of the second set of event parameters.
23. The method of claim 18 , comprising:
generating a probability distribution function for each of the event parameters of the first set of events; and
generating an updated probability distribution function for each of the event parameters by applying data of a second set of event parameters of the second set of events to the probability distribution function.
24. The method of claim 23 , comprising:
receiving a baseline predictive user model that corresponds to the user, the baseline predictive user model generated without using data of any event; and
generating the predictive user model by generating a joint probability distribution that includes the plurality of components, wherein the plurality of components includes the updated probability distribution function for any event parameter represented in the predictive user model.
25. The method of claim 1 , wherein the first set of events and the second set of events comprises at least one of online events, offline events, and multiple channel events.
26. The method of claim 25 , wherein online events are events undertaken via electronic access to the account.
27. The method of claim 1 , comprising:
determining probabilistically that the second set of events was conducted by the user; and
automatically updating the predictive user model using a second set of event parameters collected during the second set of events.
28. The method of claim 27 , comprising updating the predictive user model to include a trust factor, the trust factor representing a probability that the second set of events was in fact conducted by the user.
29. The method of claim 27 , comprising updating the predictive user model to include an accumulated trust factor, the accumulated trust factor representing a cumulative probability across a plurality of sets of events that an event parameter in the plurality of sets of events was in fact conducted by the user.
30. The method of claim 1 , wherein automatically generating the predictive user model comprises generating the predictive user model to include a decay parameter.
31. The method of claim 30 , wherein the decay parameter comprises an exponential decay function by which a relative weight of each event in a set of events in the account changes with passage of time since the event.
32. A system comprising:
one or more processors programmed or configured to:
automatically generate a predictive user model representing non-fraudulent activities undertaken by a user in multiple channels in association with an account of the user by transforming data representing the non-fraudulent activities of the user into relationships forming the predictive user model, wherein, when automatically generating the predictive user model, the one or more processors are programmed or configured to:
generate a plurality of components of the predictive user model from event parameters associated with a first set of events undertaken by the user when the user electronically accesses information associated with the account of the user, wherein the event parameters comprise data associated with the non-fraudulent activities undertaken by the user when the user electronically accesses information associated with an account of the user via a plurality of channels of the multiple channels that is collected during the first set of events, wherein the event parameters comprise IP address data or HTTP data and information associated with an ATM, information associated with a call center system, or information associated with an offline interaction and wherein
the IP address data or HTTP data comprises one or more of:
IP address data or HTTP data associated with a login event of a session involving the user,
IP address data or HTTP data associated with a termination event of a session involving the user,
IP address data or HTTP data associated with an account access event of a session involving the user,
IP address data or HTTP data associated with an activity event during a session involving the user, or
any combination thereof;
determine, based on generating the plurality of components of the predictive user model, expected behavior of the user during a second set of events using the predictive user model, wherein the second set of events is associated with non-fraudulent activities undertaken by the user when the user electronically accesses the account of the user, wherein when determining the expected behavior of the user during the second set of events, the one or more processors are programmed or configured to:
generate a statistical relationship between the event parameters associated with the first set of events and derived parameters, wherein the derived parameters include one or more of:
a geographic area from which a first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
a location within the geographic area of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
an identification of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
an electronic service provider of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events, or
any combination thereof;
generate, based on data representing fraudulent activities of a plurality of fraudsters in a plurality of third party accounts during a third time interval, a predictive fraud model;
generate data representing a prediction of expected behavior of a fraudster associated with a third set of events using the predictive fraud model, wherein the third set of events is associated with fraudulent activities undertaken by the fraudster in association with an additional account, wherein the predictive fraud model is independent of the predictive user model and is generated using the data representing the fraudulent activities of the plurality of fraudsters in the plurality of third party accounts;
calculate a risk score associated with at least one fourth event that is conducted in real-time, wherein the risk score comprises an indication that the at least one fourth event is performed by the user instead of the fraudster, where the at least one fourth event is associated with electronically accessing the account of the user, and wherein when calculating the risk score associated with the at least one fourth event, the one or more processors are programmed or configured to:
calculate the risk score by comparing the expected behavior of the user during the second set of events predicted using the predictive user model, the data representing the prediction of expected behavior of the fraudster associated with the third set of events generated using the predictive fraud model, and IP address data or HTTP data of a second device conducting a session associated with the at least one fourth event; and
generate an alert associated with the account of the user based on calculating the risk score associated with the at least one fourth event.
33. A computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to:
automatically generate a predictive user model representing non-fraudulent activities undertaken by a user in multiple channels in association with an account of the user by transforming data representing the non-fraudulent activities of the user into relationships forming the predictive user model, wherein the one or more instructions that cause the at least one processor to automatically generating the predictive user model cause the at least one processor to:
generate a plurality of components of the predictive user model from event parameters associated with a first set of events undertaken by the user when the user electronically accesses information associated with the account of the user, wherein the event parameters comprise data associated with the non-fraudulent activities undertaken by the user when the user electronically accesses information associated with an account of the user via a plurality of channels of the multiple channels that is collected during the first set of events, wherein the event parameters comprise IP address data or HTTP data and information associated with an ATM, information associated with a call center system, or information associated with an offline interaction and wherein
the IP address data or HTTP data comprises one or more of:
IP address data or HTTP data associated with a login event of a session involving the user,
IP address data or HTTP data associated with a termination event of a session involving the user,
IP address data or HTTP data associated with an account access event of a session involving the user,
IP address data or HTTP data associated with an activity event during a session involving the user, or
any combination thereof;
determine, based on generating the plurality of components of the predictive user model, expected behavior of the user during a second set of events using the predictive user model, wherein the second set of events is associated with non-fraudulent activities undertaken by the user when the user electronically accesses the account of the user, wherein, the one or more instructions that cause the at least one processor to determine the expected behavior of the user, cause the at least one processor to:
generate a statistical relationship between the event parameters associated with the first set of events and derived parameters, wherein the derived parameters include one or more of:
a geographic area from which a first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
a location within the geographic area of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
an identification of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events,
an electronic service provider of the first device having the IP address data or identified by the HTTP data, that is conducting a session involving the user during the first set of events, or
any combination thereof;
generate, based on data representing fraudulent activities of a plurality of fraudsters in a plurality of third party accounts during a third time interval, a predictive fraud model;
generate data representing a prediction of expected behavior of a fraudster associated with a third set of events using the predictive fraud model, wherein the third set of events is associated with fraudulent activities undertaken by the fraudster in association with an additional account, wherein the predictive fraud model is independent of the predictive user model and is generated using the data representing the fraudulent activities of the plurality of fraudsters in the plurality of third party accounts;
calculate a risk score associated with at least one fourth event that is conducted in real-time, wherein the risk score comprises an indication that the at least one fourth event is performed by the user instead of the fraudster, where the at least one fourth event is associated with electronically accessing the account of the user, and wherein the one or more instructions that cause the at least one processor to calculate the risk score cause the at least one processor to:
calculate the risk score by comparing the expected behavior of the user during the second set of events predicted using the predictive user model, the data representing the prediction of expected behavior of the fraudster associated with the third set of events generated using the predictive fraud model, and IP address data of a second device conducting a session associated with the at least one fourth event; and
generate an alert associated with the account of the user based on calculating the risk score associated with the at least one fourth event.