SYSTEMS AND METHOD FOR CORRELATING TRANSACTION EVENTS
A method and system for correlating transaction events. Transaction events may be received that identify actions executed at a plurality of different types of source systems. For each transaction event, it may be determined whether or not the transaction event is equivalent to a previous transaction event using an equivalence relationship. The equivalence relationship may define events as being equivalent when each of the events has a subset of parameters that match exactly and a different subset of parameters that match approximately and not exactly. Equivalent transaction events may be correlated.
1 . A method, implemented using one or more processors and associated memories, for correlating transaction events, the method comprising:
receiving transaction events identifying actions executed at a plurality of different types of source systems;
for each transaction event, determining by a processor whether or not the transaction event is equivalent to a previous transaction event using an equivalence relationship, wherein the equivalence relationship defines events as being equivalent when each of the events has a subset of parameters that match exactly and a different subset of parameters that match approximately and not exactly; and
correlating equivalent transaction events.
2 . The method of claim 1 comprising:
grouping correlated transaction events into a transaction; and
detecting if fraud has taken place by analyzing a pattern of the correlated transaction events over a lifecycle of the transaction.
3 . The method of claim 1 comprising generating correlated data summarizing the correlation between the transaction events.
4 . The method of claim 1 , wherein the equivalence relationship includes an identity value function that defines events to be equivalent if their function values are exactly or approximately equal.
5 . The method of claim 1 , wherein the equivalence relationship includes an identity equality function that defines events to be equivalent if their compared function value is within a predetermined range.
6 . The method of claim 1 , wherein the equivalence relationship is defined by a correlation configuration set associated with the type of the source system at which each transaction event action is executed, wherein each of a plurality of correlation configuration sets is associated with a different type of source system.
7 . The method of claim 1 comprising representing transaction events using associated identity keys stored in a map data structure.
8 . The method of claim 1 , wherein the equivalence relationship defines an equivalence between repeated transaction events.
9 . The method of claim 1 , wherein the equivalence relationship defines an equivalence between an initial transaction event and an update thereof.
10 . The method of claim 1 , wherein the transaction events are correlated in real-time.
11 . A system for correlating transaction events, the system comprising:
one or more processors configured to provide a correlation engine to receive transaction events identifying actions executed at a plurality of different types of source systems, wherein for each transaction event the correlation engine determines whether or not the transaction event is equivalent to a previous transaction event using an equivalence relationship, wherein the equivalence relationship defines events as being equivalent when each of the events has a subset of parameters that match exactly and a different subset of parameters that match approximately and not exactly; and
a memory to store correlation data defining correlations between transaction events that are determined by the correlation engine to be equivalent.
12 . The system of claim 11 comprising a fraud detector, wherein the correlation engine groups correlated transaction events into a transaction and the fraud detector detects if fraud has taken place by analyzing a pattern of the correlated transaction events over a lifecycle of the transaction.
13 . The system of claim 11 , wherein the correlation engine generates data summarizing the correlation between the transaction events.
14 . The system of claim 11 , wherein the equivalence relationship includes an identity value function that defines events to be equivalent if their function values are exactly or approximately equal.
15 . The system of claim 11 , wherein the equivalence relationship includes an identity equality function that defines events to be equivalent if their compared function value is within a predetermined range.
16 . The system of claim 11 , wherein the equivalence relationship is defined by a correlation configuration set associated with the type of the source system at which each transaction event action is executed, wherein each of a plurality of correlation configuration sets is associated with a different type of source system.
17 . The system of claim 11 , wherein the correlation engine represents transaction events using associated identity keys stored in a map data structure.
18 . The system of claim 11 , wherein the equivalence relationship defines an equivalence between repeated transaction events.
19 . The system of claim 11 , wherein the equivalence relationship defines an equivalence between an initial transaction event and an update thereof
20 . The system of claim 11 , wherein the correlation engine correlates the transaction events in real-time.
21 . A method of correlating transaction events and detecting fraud implemented using one or more processors and associated memories, the method comprising:
receiving incoming transaction events identifying actions executed at a plurality of different types of source systems;
assigning using a processor each incoming transaction event to a correlation configuration set;
executing from said correlation configuration set, using the processor, an equivalence relation identity value function;
determining, using the processor, for each incoming transaction event a corresponding identity key by using said equivalence relation identity value function;
using the processor, using an equivalence relation to determine, for a set of events having matching identity keys, which events are correlated, wherein the equivalence relation defines events as being equivalent using exact criteria on a subset of event parameters and fuzzy criteria on a different subset of event parameters;
using the processor, using the results of the correlation to trigger a flag or alert when possibly fraudulent data is detected.
22 . A system for correlating transaction events, the system comprising:
one or more processors and associated memories configured to provide a correlation engine configured to:
receive incoming transaction events identifying actions executed at a plurality of different types of source systems;
assign each incoming transaction event to a correlation configuration set;
execute from said correlation configuration set an equivalence relation identity value function;
determine for each incoming transaction event a corresponding identity key by using said equivalence relation identity value function;
for the group of events that have matching identity keys, use an equivalence relation to determine which events are correlated, wherein the equivalence relation defines events as being equivalent using exact criteria on a subset of event parameters and fuzzy criteria on a different subset of event parameters;
use the results of the correlation to trigger a flag or alert when possibly fraudulent data is detected.