Identification of anomalies in an automatic teller machine (ATM) network
Aspects of the disclosure relate to monitoring an automatic teller machine (ATM) network and determining anomalous fault behavior in the ATM network. A computing device may determine historical fault volumes in the ATM network and generate a time-series model of the fault volumes. The computing platform may predict future fault volumes based on the generated time-series model. Based on the predicted future fault volumes and actual future fault volumes, the computing platform may determine anomalous fault behavior. The time-series model may be based on exogenous factors associated with ATM network operations.
1. A computing platform for monitoring an automatic teller machine (ATM) network, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, corresponding to an ATM fault code and for the ATM network, observed fault volumes for a first set of time intervals;
build, based on the observed fault volumes for the first set of time intervals, a seasonal autoregressive integrated moving average with exogenous factors (SARIMAX) model of fault volumes, wherein the building the SARIMAX model comprises:
generating a plurality of parameter combinations corresponding to a plurality of SARIMAX models;
building, based on the observed fault volumes in the first set of time intervals, the plurality of SARIMAX models, each associated with a corresponding parameter combination;
calculating Akaike information criterion (AIC) values associated with each of the plurality of SARIMAX models;
determining an intermediary SARIMAX model, among the plurality of SARIMAX models, with a lowest AIC value;
determining, based on the intermediary SARIMAX model, that observed fault volumes in a first subset of time intervals, among the first set of time intervals, are outliers;
generating corrected observed fault volumes for the first set of time intervals by replacing observed fault volumes in the first subset of time intervals with corrected values, and
using, for building the SARIMAX model, the corrected observed fault volumes for the first set of time intervals and a parameter combination associated with the intermediary SARIMAX model;
determine, based on the SARIMAX model, predicted fault volumes for a second set of time intervals;
receive observed fault volumes for the second set of time intervals;
determine, based on the predicted fault volumes for the second set of time intervals and the observed fault volumes for the second set of time intervals, that one or more of the observed fault volumes for the second set of time intervals are anomalous; and
perform, based on the determining that the one or more of the observed fault volumes in the second set of time intervals are anomalous, a remedial action associated with the ATM fault code, and wherein the ATM fault codes comprise an indication of a network issue, a software issue, a mechanical issue, an inoperable cash unit issue, and a check deposit issue.
2. The computing platform of claim 1 , wherein the determining that the one or more observed fault volumes for the second set of time intervals are anomalous is based on at least one of:
a difference between an observed fault volume and a predicted fault volume for a time interval in the second set being greater than a threshold value;
differences between observed fault volumes and predicted fault volumes for at least two time intervals of three consecutive time intervals in the second set being greater than corresponding threshold values;
differences between observed fault volumes and predicted fault volumes for at least four time intervals of five consecutive time intervals in the second set being greater than corresponding threshold values; or
differences between observed fault volumes and predicted fault volumes for at least nine consecutive time intervals in the second set being all positive or all negative.
3. The computing platform of claim 1 , wherein each parameter combination of the plurality of parameter combinations comprises:
a corresponding trend autoregression order;
a corresponding trend difference order;
a corresponding trend moving average order;
a corresponding seasonal autoregressive order;
a corresponding seasonal difference order;
a corresponding seasonal moving average order;
a corresponding number of time intervals in a single season; and
a corresponding trend.
4. The computing platform of claim 1 , wherein the computer-readable instructions, when executed by the at least one processor, cause the computing platform to:
determine, based on the intermediary SARIMAX model, model fit fault volumes for the first set of time intervals,
wherein the determining that the observed fault volumes in the first subset of time intervals are outliers comprises determining that differences between the observed fault volumes in the first subset of time intervals and model fit fault volumes in the first subset of time intervals are greater than a threshold.
5. The computing platform of claim 4 , wherein when a number of time intervals in the first subset is less than a threshold number of the number of time intervals, the corrected values are the model fit fault volumes in the first subset of time intervals.
6. The computing platform of claim 4 , wherein when a number of time intervals in the first subset is greater than or equal to a threshold number of time intervals, the corrected values are sums of the model fit fault volumes in the first subset of time intervals and a standard deviation of the observed fault volumes for the first set of time intervals.
7. The computing platform of claim 1 , wherein the exogenous factors comprise, corresponding to the first set of time intervals and the second set of time intervals, one or more of:
transaction volumes;
numbers of software updates performed in the ATM network;
days of week;
months;
days of month; or
proximities to a holiday.
8. The computing platform of claim 1 , further comprising determining an updated SARIMAX model based on the observed fault volumes for the first set of time intervals and the observed fault volumes for the second set of time intervals.
9. The computing platform of claim 1 , wherein the performing the remedial action associated with the ATM fault code comprises sending an alert message indicating the ATM fault code.
10. A method, at a computing platform comprising at least one processor, a communication interface, and memory, the method comprising:
receiving, corresponding to an ATM fault code and for an ATM network, observed fault volumes for a first set of time intervals;
building, based on the observed fault volumes for the first set of time intervals, a seasonal autoregressive integrated moving average with exogenous factors (SARIMAX) model of fault volumes, wherein the building the SARIMAX model comprises:
generating a plurality of parameter combinations corresponding to a plurality of SARIMAX models;
building, based on the observed fault volumes in the first set of time intervals, the plurality of SARIMAX models, each associated with a corresponding parameter combination;
calculating Akaike information criterion (AIC) values associated with each of the plurality of SARIMAX models;
determining an intermediary SARIMAX model, among the plurality of SARIMAX models, with a lowest AIC value;
determining, based on the intermediary SARIMAX model, that observed fault volumes in a first subset of time intervals, among the first set of time intervals, are outliers;
generating corrected observed fault volumes for the first set of time intervals by replacing observed fault volumes in the first subset of time intervals with corrected values, and
using, for building the SARIMAX model, the corrected observed fault volumes for the first set of time intervals and a parameter combination associated with the intermediary SARIMAX model;
determining, based on the SARIMAX model, predicted fault volumes for a second set of time intervals;
receive observed fault volumes for the second set of time intervals;
determining, based on the predicted fault volumes for the second set of time intervals and the observed fault volumes for the second set of time intervals, that one or more of the observed fault volumes for the second set of time intervals are anomalous; and
performing, based on the determining that the one or more of the observed fault volumes in the second set of time intervals are anomalous, a remedial action associated with the ATM fault code, and wherein the ATM fault codes comprise an indication of a network issue, a software issue, a mechanical issue, an inoperable cash unit issue, and a check deposit issue.
11. The method of claim 10 , wherein the determining that the one or more observed fault volumes for the second set of time intervals are anomalous is based on at least one of:
a difference between an observed fault volume and a predicted fault volume for a time interval in the second set being greater than a threshold value;
differences between observed fault volumes and predicted fault volumes for at least two time intervals of three consecutive time intervals in the second set being greater than corresponding threshold values;
differences between observed fault volumes and predicted fault volumes for at least four time intervals of five consecutive time intervals in the second set being greater than corresponding threshold values; or
differences between observed fault volumes and predicted fault volumes for at least nine consecutive time intervals in the second set being all positive or all negative.
12. The method of claim 10 , wherein each parameter combination of the plurality of parameter combinations comprises:
a corresponding trend autoregression order;
a corresponding trend difference order;
a corresponding trend moving average order;
a corresponding seasonal autoregressive order;
a corresponding seasonal difference order;
a corresponding seasonal moving average order;
a corresponding number of time intervals in a single season; and
a corresponding trend.
13. The method of claim 10 , further comprising:
determine, based on the intermediary SARIMAX model, model fit fault volumes for the first set of time intervals,
wherein the determining that the observed fault volumes in the first subset of time intervals are outliers comprises determining that differences between the observed fault volumes in the first subset of time intervals and model fit fault volumes in the first subset of time intervals are greater than a threshold.
14. The method of claim 13 , wherein, when a number of time intervals in the first subset is less than a threshold number of the number of time intervals, the corrected values are the model fit fault volumes in the first subset of time intervals.
15. The method of claim 13 , wherein, when a number of time intervals in the first subset is greater than or equal to a threshold number of time intervals, the corrected values are sums of the model fit fault volumes in the first subset of time intervals and a standard deviation of the observed fault volumes for the first set of time intervals.
16. The method of claim 10 , wherein the exogenous factors comprise, corresponding to the first set of time intervals and the second set of time intervals, one or more of:
transaction volumes;
numbers of software updates performed in the ATM network;
days of week;
months;
days of month; or
proximities to a holiday.
17. The method of claim 10 , wherein the performing the remedial action associated with the ATM fault code comprises sending an alert message indicating the ATM fault code.
18. A non-transitory computer readable medium storing instructions that, when executed by at least one processor, cause:
receiving, corresponding to an ATM fault code and for an ATM network, observed fault volumes for a first set of time intervals;
building, based on the observed fault volumes for the first set of time intervals, a seasonal autoregressive integrated moving average with exogenous factors (SARIMAX) model of fault volumes, wherein the building the SARIMAX model comprises:
generating a plurality of parameter combinations corresponding to a plurality of SARIMAX models;
building, based on the observed fault volumes in the first set of time intervals, the plurality of SARIMAX models, each associated with a corresponding parameter combination;
calculating Akaike information criterion (AIC) values associated with each of the plurality of SARIMAX models;
determining an intermediary SARIMAX model, among the plurality of SARIMAX models, with a lowest AIC value;
determining, based on the intermediary SARIMAX model, that observed fault volumes in a first subset of time intervals, among the first set of time intervals, are outliers;
generating corrected observed fault volumes for the first set of time intervals by replacing observed fault volumes in the first subset of time intervals with corrected values, and
using, for building the SARIMAX model, the corrected observed fault volumes for the first set of time intervals and a parameter combination associated with the intermediary SARIMAX model;
determining, based on the SARIMAX model, predicted fault volumes for a second set of time intervals;
receive observed fault volumes for the second set of time intervals;
determining, based on the predicted fault volumes for the second set of time intervals and the observed fault volumes for the second set of time intervals, that one or more of the observed fault volumes for the second set of time intervals are anomalous; and
performing, based on the determining that the one or more of the observed fault volumes in the second set of time intervals are anomalous, a remedial action associated with the ATM fault code, and wherein the ATM fault codes comprise an indication of a network issue, a software issue, a mechanical issue, an inoperable cash unit issue, and a check deposit issue.