Optimized execution of fraud detection rules
Systems, methods, devices, and computer readable media related to fraud detection. Fraud detection is achieved using a flexible scripting language and syntax that simplifies the generation of fraud detection rules. The rules are structured as conditional IF-THEN statements that include data objects referred to as Anchors and Add-Ons. The Anchors and Add-Ons used to generate the rules also correspond to a distinct data path for the retrieval data from any of a variety of data sources. The retrieval of data from the various data sources is optimized based on data dependencies within the rules. By knowing the data dependencies of each rule and utilizing parallelization of rule execution, the retrievals of data from the data sources is achieved efficiently so the rules can be executed quickly.
1. A fraud detection system comprising:
a database; and
a server including a processing unit and a memory, the server connected to the database and configured to:
generate a first fraud detection rule and a second fraud detection rule based on data points or data objects,
wherein the first fraud detection rule includes a first Anchor attribute and a first Add-On identifier, the first Anchor attribute and the first Add-On identifier corresponding to a first data path for retrieval of a first value related to the first Add-On identifier,
wherein the second fraud detection rule includes a second Anchor attribute and a second Add-On identifier, the second Anchor attribute and the second Add-On identifier corresponding to a second data path for retrieval of a second value related to the second Add-On identifier, the second value being dependent on the first value,
transpile the first fraud detection rule and the second fraud detection rule into a first native fraud detection rule and a second native fraud detection rule that are in a native language source code compared to a scripting language code of the first fraud detection rule and the second fraud detection rule, the native language source code and the scripting language code having a level of code abstraction, and the native language source code having a faster compilation by the processing unit to a lower-level code relative to the scripting language code,
control the database to store the first data path, the second data path, the first native fraud detection rule, and the second native fraud detection rule,
receive a request for a fraud risk determination from a client server, the request associated with a requested action,
retrieve the first data path, the second data path, the first native fraud detection rule, and the second native fraud detection rule in response to receiving the request for the fraud risk determination from the client server,
retrieve the first value using the first data path and the second value using the second data path and based on the dependency on the first value, retrieval of the first value using the first data path being prioritized over retrieval of the second value using the second data path,
execute the first native fraud detection rule,
execute the second native fraud detection rule,
generate a fraud risk score related to the requested action based on the executed first native fraud detection rule and the executed second native fraud detection rule, and
transmit the fraud risk score to the client server to cause permission or denial of the requested action,
wherein an execution of the first native fraud detection rule and the second native fraud detection rule by the processing unit is faster than an execution of the first fraud detection rule and the second fraud detection rule by the processing unit.
2. The fraud detection system of claim 1 , wherein:
a value for the first Anchor attribute is determined based on the request; and
a value for the second Anchor attribute is determined based on the request.
3. The fraud detection system of claim 1 , wherein the server is further configured to:
generate a first callable object that includes the first data path; and
generate a second callable object that includes the second data path.
4. The fraud detection system of claim 3 , wherein:
the first value is retrieved from a first data source using the first data path; and
the second value is retrieved from a second data source using the second data path.
5. The fraud detection system of claim 4 , wherein the server is further configured to:
populate the first callable object with the first value; and
populate the second callable object with the second value.
6. The fraud detection system of claim 1 , wherein:
the first Anchor attribute corresponds to a first token; and
the first Add-On identifier corresponds to a second token.
7. The fraud detection system of claim 6 , wherein the first data path is a dot-separated, alphanumeric string that includes the first token and the second token.
8. A computer-implemented fraud detection method, the method comprising:
generating, with an electronic processor, a first fraud detection rule and a second fraud detection rule based on data points or data objects,
wherein the first fraud detection rule includes a first Anchor attribute and a first Add-On identifier, the first Anchor attribute and the first Add-On identifier corresponding to a first data path for retrieval of a first value related to the first Add-On identifier,
wherein the second fraud detection rule includes a second Anchor attribute and a second Add-On identifier, the second Anchor attribute and the second Add-On identifier corresponding to a second data path for retrieval of a second value related to the second Add-On identifier, the second value being dependent on the first value;
transpiling, with the electronic processor, the first fraud detection rule and the second fraud detection rule into a first native fraud detection rule and a second native fraud detection rule that are in a native language source code compared to a scripting language code of the first fraud detection rule and the second fraud detection rule, the native language source code and the scripting language code having a level of code abstraction, and the native language source code having a faster compilation by the processing unit to a lower-level code relative to the scripting language code;
receiving, with the electronic processor, a request for a fraud risk determination from a client server, the request associated with a requested action;
retrieving, with the electronic processor, the first data path, the second data path, the first native fraud detection rule, and the second native fraud detection rule in response to receiving the request for the fraud risk determination from the client server;
retrieving, with the electronic processor, the first value using the first data path and the second value using the second data path and based on the dependency on the first value, retrieving the first value using the first data path being prioritized over retrieving the second value using the second data path;
executing, with the electronic processor, the first native fraud detection rule;
executing, with the electronic processor, the second native fraud detection rule;
generating, with the electronic processor, a fraud risk score related to the requested action based on the executing of the first native fraud detection rule and the second native fraud detection rule; and
transmitting, with the electronic processor, the fraud risk score to the client server to cause permission or denial of the requested action,
wherein the execution of the first native fraud detection rule and the second native fraud detection rule is faster than an execution of the first fraud detection rule and the second fraud detection rule.
9. The method of claim 8 , further comprising:
determining, with the electronic processor, a value for the first Anchor attribute based on the request; and
determining, with the electronic processor, a value for the second Anchor attribute based on the request.
10. The method of claim 8 , further comprising:
generating, with the electronic processor, a first callable object that includes the first data path; and
generating, with the electronic processor, a second callable object that includes the second data path.
11. The method of claim 10 , wherein:
the first value is retrieved from a first data source using the first data path; and
the second value is retrieved from a second data source using the second data path.
12. The method of claim 11 , further comprising:
populating, with the electronic processor, the first callable object with the first value; and
populating, with the electronic processor, the second callable object with the second value.
13. The method of claim 8 , wherein:
the first Anchor attribute corresponds to a first token; and
the first Add-On identifier corresponds to a second token.
14. The method of claim 13 , wherein the first data path is a dot-separated, alphanumeric string that includes the first token and the second token.
15. A non-transitory computer readable medium including computer executable instructions stored in the non-transitory computer readable medium for controlling a device to:
generating a first fraud detection rule and a second fraud detection rule based on data points or data objects,
wherein the first fraud detection rule includes a first Anchor attribute and a first Add-On identifier, the first Anchor attribute and the first Add-On identifier corresponding to a first data path for retrieval of a first value related to the first Add-On identifier,
wherein the second fraud detection rule includes a second Anchor attribute and a second Add-On identifier, the second Anchor attribute and the second Add-On identifier corresponding to a second data path for retrieval of a second value related to the second Add-On identifier, the second value being dependent on the first value;
transpiling the first fraud detection rule and the second fraud detection rule into a first native fraud detection rule and a second native fraud detection rule that are in a native language source code compared to a scripting language code of the first fraud detection rule and the second fraud detection rule, the native language source code and the scripting language code having a level of code abstraction, and the native language source code having a faster compilation by the processing unit to a lower-level code relative to the scripting language code;
receiving a request for a fraud risk determination from a client server, the request associated with a requested action;
retrieving the first data path, the second data path, the first native fraud detection rule, and the second native fraud detection rule in response to receiving the request for the fraud risk determination from the client server;
retrieving the first value using the first data path and the second value using the second data path and based on the dependency on the first value, retrieval of the first value using the first data path being prioritized over retrieval of the second value using the second data path;
executing the first native fraud detection rule;
executing the second native fraud detection rule;
generating a fraud risk score related to the requested action based on the executed first native fraud detection rule and the executed second native fraud detection rule; and
transmitting the fraud risk score to the client server to cause permission or denial of the requested action,
wherein the execution of the first native fraud detection rule and the second native fraud detection rule is faster than an execution of the first fraud detection rule and the second fraud detection rule.
16. The non-transitory computer readable medium of claim 15 , wherein:
a value for the first Anchor attribute is determined based on the request; and
a value for the second Anchor attribute is determined based on the request.
17. The non-transitory computer readable medium of claim 15 , further including computer executable instructions stored in the non-transitory computer readable medium for controlling the device to:
generate a first callable object that includes the first data path; and
generate a second callable object that includes the second data path.
18. The non-transitory computer readable medium of claim 17 , wherein:
the first value is retrieved from a first data source using the first data path; and
the second value is retrieved from a second data source using the second data path.
19. The non-transitory computer readable medium of claim 18 , further including computer executable instructions stored in the non-transitory computer readable medium for controlling the device to:
populate the first callable object with the first value; and
populate the second callable object with the second value.
20. The non-transitory computer readable medium of claim 15 , wherein the first data path is a dot-separated, alphanumeric string that includes a first token that corresponds the first Anchor attribute and a second token that corresponds to the first Add-On identifier.
21. The fraud detection system of claim 1 , wherein the server is further configured to:
execute a thousand or more native fraud detection rules that are in the native language source code, the thousand or more native fraud detection rules including the first native fraud detection rule and the second native fraud detection rule,
wherein the execution of the thousand or more native fraud detection rules occurs in approximately 100 to 300 milliseconds.