Machine learning system for detecting fraud in product warranty services
A method, system and computer-usable medium are disclosed for implementing a machine learning system for detecting fraud in product warranty services. In certain embodiments, a new dispatch request is subject to network analysis to determine the degree to which the new dispatch may be linked to known fraudulent dispatch requests. In certain embodiments, the new dispatch request may be subject to an outlier analysis to determine the degree of centrality of the new dispatch request with respect to outliers from historical dispatch requests. In certain embodiments, attributes and/or features, a degree to which the new dispatch request is linked to known fraudulent dispatches, and a degree of centrality of the new dispatch request are applied to an ensemble of machine learning models to determine the likelihood that the new dispatch request is fraudulent.
1. A computer-implemented method for detecting fraud in product warranty requests within a warranty dispatch center, the warranty dispatch center comprising a plurality of service center information processing systems, a fraud detection system and a datastore of warranty dispatch data, comprising:
receiving a dispatch request to the warranty dispatch center, wherein the dispatch request includes one or more attributes, wherein the one or more attributes include attributes related to the requester of the dispatch request, and attributes related to an asset that is a subject of the dispatch request;
executing a network analysis via the fraud detection system on the dispatch request to identify whether the one or more attributes can be linked to known fraudulent dispatch requests, wherein the network analysis provides an output corresponding to a degree to which the dispatch request may be linked to a known fraudulent dispatch request, the network analysis accessing the datastore of warranty dispatch data when executing;
executing an outlier analysis via the fraud detection system on the dispatch request to determine whether the one or more attributes can be linked to historical dispatch request outliers, wherein the outlier analysis provides an output indicative of a degree of centrality the dispatch request has with respect to the historical dispatch requests, the degree of centrality being based upon a number of outliers to which the dispatch request is linked;
applying a random forest model via the fraud detection system to the attributes of the dispatch request, the degree to which the dispatch request may be linked to a known fraudulent warranty request, and the output corresponding to the degree of centrality of the dispatch request to determine a first probability that the dispatch request is fraudulent, the random forest model being trained using historical dispatch requests;
applying a boost model via the fraud detection system to the attributes of the dispatch request, the degree to which the dispatch request may be linked to a known fraudulent warranty request, and the output indicative of the degree of centrality of the dispatch request to determine a second probability that the dispatch request is fraudulent, the boost model being trained using historical dispatch requests; and
using the first and second probabilities pursuant to determining the likelihood that the dispatch request is fraudulent.
2. The computer-implemented method of claim 1 , further comprising:
providing information at a user interface relating to whether a dispatch request is likely to be fraudulent, wherein the information provided at the user interface is based, at least in part, on the first and second probabilities.
3. The computer-implemented method of claim 1 , wherein:
the network analysis utilizes attributes including one or more of a phone number associated with the dispatch request, an email associated with the dispatch request, and a delivery address associated with the dispatch request.
4. The computer-implemented method of claim 1 , wherein:
the determination as to whether the dispatch request is likely to be fraudulent is based, at least in part, on the greater of the first and second probabilities.
5. The computer-implemented method of claim 1 , further comprising:
receiving attributes of the historical dispatch requests;
determining a mean distribution of attributes of the historical dispatch requests; and
identifying whether a historical dispatch request is an outlier by comparing attributes of the historical dispatch request with the mean distribution of the attributes of the historical dispatch requests, wherein a historical dispatch request is identified as an outlier if the historical dispatch request has a distance greater than a predetermined threshold from the mean distribution of the attributes of the historical dispatch requests.
6. The computer-implemented method of claim 1 , further comprising:
receiving a set of historical dispatch requests, wherein the set of historical dispatch requests includes one or more attributes, wherein the one or more attributes include attributes related to the requester of the warranty dispatch request and attributes related to the asset that is a subject of the warranty dispatch request, wherein the set of historical warranty dispatch requests includes historical warranty dispatch requests that are identified as fraudulent warranty dispatch requests; and
executing a synthetic minority over-sampling technique on the set of historical warranty dispatch requests to generate a subset of historical warranty dispatch requests having a higher proportion of fraudulent warranty dispatch requests than non-fraudulent warranty dispatch requests as compared to the set of historical warranty dispatch requests.
7. The computer-implemented method of claim 6 , further comprising:
training an ensemble of machine learning models, the ensemble of machine learning models comprising the random forest model and the boost model using the subset of historical dispatch requests, the training resulting in a more accurate model than would be generating using the original historical dispatch data sample population.
8. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code for detecting fraud in product warranty requests within a warranty dispatch center, the warranty dispatch center comprising a plurality of service center information processing systems, a fraud detection system and a datastore of warranty dispatch data, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
receiving a dispatch request to the warranty dispatch center, wherein the dispatch request includes one or more attributes, wherein the one or more attributes include attributes related to the requester of the dispatch request, and attributes related to an asset that is a subject of the dispatch request;
executing a network analysis on the dispatch request to identify whether the one or more attributes can be linked to known fraudulent dispatch requests, wherein the network analysis provides an output corresponding to a degree to which the dispatch request may be linked to a known fraudulent dispatch request, the network analysis accessing the datastore of warranty dispatch data when executing;
executing an outlier analysis on the dispatch request to determine whether the one or more attributes can be linked to historical dispatch request outliers, wherein the outlier analysis provides an output indicative of a degree of centrality the dispatch request has with respect to the historical dispatch requests, the degree of centrality being based upon a number of outliers to which the dispatch request is linked;
applying a random forest model via the fraud detection system to the attributes of the dispatch request, the degree to which the dispatch request may be linked to a known fraudulent warranty request, and the output corresponding to the degree of centrality of the dispatch request to determine a first probability that the dispatch request is fraudulent, the random forest model being trained using historical dispatch requests;
applying a boost model via the fraud detection system to the attributes of the dispatch request, the degree to which the dispatch request may be linked to a known fraudulent warranty request, and the output indicative of the degree of centrality of the dispatch request to determine a second probability that the dispatch request is fraudulent, the boost model being trained using historical dispatch requests; and
using the first and second probabilities pursuant to determining the likelihood that the dispatch request is fraudulent.
9. The system of claim 8 , wherein the instructions are further configured for:
providing information at a user interface relating to whether a dispatch request is likely to be fraudulent, wherein the information provided at the user interface is based, at least in part, on the first and second probabilities.
10. The system of claim 8 , wherein:
the network analysis utilizes attributes including one or more of a phone number associated with the dispatch request, an email associated with the dispatch request, and a delivery address associated with the dispatch request.
11. The system of claim 8 , wherein:
the determination as to whether the dispatch request is likely to be fraudulent is based, at least in part, on the greater of the first and second probabilities.
12. The system of claim 8 , wherein the instructions are further configured for:
receiving attributes of the historical dispatch requests;
determining a mean distribution of attributes of the historical dispatch requests; and
identifying whether a historical dispatch request is an outlier by comparing attributes of the historical dispatch request with the mean distribution of the attributes of the historical dispatch requests, wherein a historical dispatch request is identified as an outlier if the historical dispatch request has a distance greater than a predetermined threshold from the mean distribution of the attributes of the historical dispatch requests.
13. The system of claim 8 , wherein the instructions are further configured for:
receiving a set of historical dispatch requests, wherein the set of historical dispatch requests includes one or more attributes, wherein the one or more attributes include attributes related to the requester of the warranty dispatch request and attributes related to the asset that is a subject of the warranty dispatch request, wherein the set of historical warranty dispatch requests includes historical warranty dispatch requests that are identified as fraudulent warranty dispatch requests; and
executing a synthetic minority over-sampling technique on the set of historical warranty dispatch requests to generate a subset of historical warranty dispatch requests having a higher proportion of fraudulent warranty dispatch requests than non-fraudulent warranty dispatch requests as compared to the set of historical warranty dispatch requests.
14. The system of claim 13 , wherein the instructions are further configured for:
training an ensemble of machine learning models, the ensemble of machine learning models comprising the random forest model and the boost model using the subset of historical dispatch requests, the training resulting in a more accurate model than would be generating using the original historical dispatch data sample population.
15. A non-transitory, computer-readable storage medium embodying computer program code for detecting fraud in product warranty requests within a warranty dispatch center, the warranty dispatch center comprising a plurality of service center information processing systems, a fraud detection system and a datastore of warranty dispatch data, the computer program code comprising computer executable instructions configured for:
receiving a dispatch request to the warranty dispatch center, wherein the dispatch request includes one or more attributes, wherein the one or more attributes include attributes related to the requester of the dispatch request, and attributes related to an asset that is a subject of the dispatch request;
executing a network analysis on the dispatch request to identify whether the one or more attributes can be linked to known fraudulent dispatch requests, wherein the network analysis provides an output corresponding to a degree to which the dispatch request may be linked to a known fraudulent dispatch request, the network analysis accessing the datastore of warranty dispatch data when executing;
executing an outlier analysis on the dispatch request to determine whether the one or more attributes can be linked to historical dispatch request outliers, wherein the outlier analysis provides an output indicative of a degree of centrality the dispatch request has with respect to the historical dispatch requests, the degree of centrality being based upon a number of outliers to which the dispatch request is linked;
applying a random forest model via the fraud detection system to the attributes of the dispatch request, the degree to which the dispatch request may be linked to a known fraudulent warranty request, and the output corresponding to the degree of centrality of the dispatch request to determine a first probability that the dispatch request is fraudulent, the degree of centrality being based upon a number of outliers to which the dispatch request is linked;
applying a boost model via the fraud detection system to the attributes of the dispatch request, the degree to which the dispatch request may be linked to a known fraudulent warranty request, and the output indicative of the degree of centrality of the dispatch request to determine a second probability that the dispatch request is fraudulent, the random forest model being trained using historical dispatch requests; and
using the first and second probabilities pursuant to determining the likelihood that the dispatch request is fraudulent.
16. The non-transitory, computer-readable storage medium of claim 15 , wherein the instructions are further configured for:
providing information at a user interface relating to whether a dispatch request is likely to be fraudulent, wherein the information provided at the user interface is based, at least in part, from the first and second probabilities.
17. The non-transitory, computer-readable storage medium of claim 15 , wherein:
the network analysis utilizes attributes including one or more of a phone number associated with the dispatch request, an email associated with the dispatch request, and a delivery address associated with the dispatch request.
18. The non-transitory, computer-readable storage medium of claim 15 , wherein:
the determination as to whether the dispatch request is likely to be fraudulent is based on the greater of the first and second probabilities.
19. The non-transitory, computer-readable storage medium of claim 15 , wherein the instructions are further configured for:
receiving attributes of the historical dispatch requests;
determining a mean distribution of attributes of the historical dispatch requests; and
identifying whether a historical dispatch request is an outlier by comparing attributes of the historical dispatch request with the mean distribution of the attributes of the historical dispatch requests, wherein a historical dispatch request is identified as an outlier if the historical dispatch request has a distance greater than a predetermined threshold from the mean distribution of the attributes of the historical dispatch requests.
20. The non-transitory, computer-readable storage medium of claim 15 , wherein the instructions are further configured for:
receiving a set of historical dispatch requests, wherein the set of historical dispatch requests includes one or more attributes, wherein the one or more attributes include attributes related to the requester of the warranty dispatch request and attributes related to the asset that is a subject of the warranty dispatch request, wherein the set of historical warranty dispatch requests includes historical warranty dispatch requests that are identified as fraudulent warranty dispatch requests; and
executing a synthetic minority over-sampling technique on the set of historical warranty dispatch requests to generate a subset of historical warranty dispatch requests having a higher proportion of fraudulent warranty dispatch requests than non-fraudulent warranty dispatch requests as compared to the set of historical warranty dispatch requests.