Identification of anomalous transaction attributes in real-time with adaptive threshold tuning

1. A system, comprising:

a processor coupled to a memory that stores instructions that when executed by the processor cause the processor to:

systematically model one or more attributes of electronic transactions of a consumer included in a set of historical transactions, wherein the one or more attributes are based on at least the consumer's infrastructure for electronic transactions;

determine a ceiling threshold for one or more transaction level characteristics associated with the electronic transactions, wherein the one or more transaction level characteristics represent respective values beyond which a subsequent electronic transaction is considered anomalous for that characteristic;

adaptively tune the ceiling threshold on a rolling basis based on prior fraud, wherein the adaptively tuning includes a feedback loop that provides for adaptive learning and self-tuning; and

detect anomalous electronic transactions and non-anomalous electronic transactions in near real time, wherein respective alerts are output based on detection of the anomalous transactions.

2. The system of claim 1 , wherein the instructions further cause the processor to separate the electronic transactions included in the set of historical transactions into a first category and a second category.

3. The system of claim 2 , wherein the first category includes domestic transactions and the second category includes international transactions.

4. The system of claim 2 , wherein the instructions further cause the processor to perform a statistical evaluation on the electronic transactions included in the first category independent from another statistical evaluation on other electronic transactions included in the second category.

5. The system of claim 1 , wherein the instructions further cause the processor to perform Cook's D measure to remove from analysis a first set of electronic transactions of the set of historical transactions.

6. The system of claim 5 , wherein the instructions further cause the processor to calculate a probability distribution enabling a placement of newly observed transaction characteristics within the probability distribution.

7. The system of claim 6 , wherein the instructions further cause the processor to employ a non-parametric Kruskal-Wallis one-way analysis of variance.

8. The system of claim 6 , wherein the instructions further cause the processor to determine a number of standard deviations from a mean of the set of historical transactions.

9. The system of claim 8 , wherein the instructions further cause the processor to determine a business rule in terms of absolute dollar amount leaps from one electronic transaction to a second electronic transaction, or across multiple electronic transactions.

10. The system of claim 1 , wherein the instructions further cause the processor to refine a threshold and identify a new threshold that represents a material increase over a raw threshold.

11. The system of claim 10 , wherein the instructions further cause the processor to scale the new threshold as a function of a risk tolerance level.

12. The system of claim 1 , wherein each attribute of the one or more attributes carries a measure of standard practices or patterns associated with an identity of a customer.

13. A method, comprising:

executing, on a processor, instructions that cause the processor to perform operations comprising:

evaluating a set of electronic transactions of a consumer conducted during a defined time period;

systematically modeling one or more attributes of the set of electronic transactions, wherein the one or more attributes are based on at least the consumer's infrastructure for electronic transactions;

categorizing a set of consumer transactions within the set of electronic transactions into defined groups;

removing outlier transactions from the set of electronic transactions;

identifying ceiling thresholds as the highest value transaction after the outlier transactions are removed, wherein the thresholds represent values for a transaction characteristic beyond which any subsequent transaction is considered anomalous;

adaptively tuning the ceiling thresholds on a rolling basis based on prior fraud, wherein the adaptively tuning includes a feedback loop that provides for adaptive learning and self-tuning;

automatically rejecting a subsequent transaction based on the ceiling thresholds; and

outputting an alert for further analysis of the subsequent transaction based on a determination that the subsequent transaction is anomalous.

14. The method of claim 13 , wherein categorizing transactions comprises categorizing the transactions into a first group having a first transaction destination and a second group having a second destination.

15. The method of claim 14 , wherein removing the outlier transactions comprises removing a first set of outlier transactions from the first group and a second set of outlier transactions from the second group.

16. The method of claim 13 , wherein removing the outlier transactions comprises performing a Cook's D measure, a non-parametric Kruskal-Wallis one-way analysis of variance, a number of standard deviations from a mean of the set of transactions, a business rule, or combinations thereof.

17. The method of claim 13 , wherein the operations further comprise identifying a non-anomalous electronic transaction and permitting execution of the non-anomalous electronic transaction.

18. A computer-readable storage device that stores executable instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:

modeling one or more attributes of electronic transactions of a consumer included in a set of historical transactions, wherein the one or more attributes are based on at least the consumer's infrastructure for electronic transactions;

determining a ceiling threshold for one or more transaction level characteristics associated with the electronic transactions, the one or more transaction level characteristics represent respective values beyond which a subsequent transaction is considered anomalous for that characteristic;

adaptively refining the ceiling threshold on a rolling basis based on prior fraud, wherein the adaptively refining includes a feedback loop that provides for adaptive learning and self-tuning; and

detecting anomalous and non-anomalous transactions in near real time, wherein respective alerts are output based on detection of the anomalous transactions.

19. The computer-readable storage device of claim 18 , wherein the operations further comprise:

dividing the electronic transactions included in the set of historical transactions into a first category and a second category, wherein the first category includes domestic transactions and the second category includes international transactions; and

performing a statistical evaluation on the electronic transactions included in the first category independent from another statistical evaluation on other electronic transactions included in the second category.

20. The computer-readable storage device of claim 18 , wherein the operations further comprise:

performing at least one of a Cook's D measure, a non-parametric Kruskal-Wallis one-way analysis of variance, a number of standard deviations from a mean of the set of historical transactions, a business rule in terms of absolute dollar amount leaps from one transaction to a second transaction, or across multiple transactions.