Patent Application
20230237494
The invention relates to detecting anomalous transaction, such as money laundering, fraud, or non-compliant transactions, using an artificial intelligence system. The invention more specifically relates to a system and method for automatically creating machine learned fraud detection models to identify the anomalous transactions data sets.
Anomaly detection in transaction data sets can be a difficult task for modern intelligent systems. Anomalies in transaction data sets can represent money laundering, fraud, and/or transactions that do not comply with rules, laws, and/or regulations. However, for a particular entity, such as a bank or other financial entity, data sets for anomalies often contain little to no fraud. These commercial financial entities generally encounter lower rates of fraud or anomalous transaction than in other transaction categories, such as retail transactions. The anomalous transactions in these commercial financial data sets may be important to ensure that the entity is compliant with laws and regulations required for the entity, as well as to minimize risk and loss by the entity.
Anomalous transactions can be detected with machine learned models. The machine learned models are typically trained with transaction data sets from a particular entity. Prior to training the machine learned models with entity specific transaction data, one or more generic models can be used. However, the generic models can produce high rates of errors. Training the machine learned models with transaction data that is specific to a particular entity can take a long period of time (e.g., nine months). Therefore, it can be desirable to create fraud detection models that have accuracy without requiring a long period of training time.
One advantage of the invention can include models that provide a high level of accuracy without a long period of training time. Another advantage of the invention can include more general models that can perform better on data that has not been previously seen.
In one aspect, the invention involves a computerized-method for automatically creating machine learned fraud detection models. The method can involve receiving, by a computing device, data from a plurality of entities. The method can also involve training, by the computing device, a model for each of the plurality of entities based on the received data, wherein each model is trained using recursive model stacking and each model outputs a corresponding score. The method can also involve training, by the computing device, a second model for each of the plurality of entities based on the corresponding output score of each model, wherein the each model is trained using recursive model stacking and wherein one score is output for all models.
In some embodiments, the method also involves training n models for each of the plurality of entities based on the n−1 score output for all models and wherein each of the n models for each of the plurality of entities is trained using recursive model stacking.
In some embodiments, the one score is based on an aggregation statistic of a score output from all of the second models for each of the plurality of entities. In some embodiments, the aggregation statistic is an average. In some embodiments, training of the model, the second model and the n models is performed in a pipeline.
In some embodiments, the recursive model stacking is recursive federated learning.
In another aspect, the invention includes a system for automatically creating machine learned fraud detection models. The system can include at least one processor configured to receive at a server data from a plurality of entities. The at least one processor can also be configured to train at the server a model for each of the plurality of entities based on the received data, wherein each model is trained using recursive model stacking and each model outputs a corresponding score. The at least one process can also be configured to train at the server a second model for each of the plurality of entities based on the corresponding output score of each model, wherein the each model is trained using recursive model stacking and wherein one score is output for all models.
In some embodiments, the at least one processor is further configured to train n models for each of the plurality of entities based on the n−1 score output for all models and wherein each of the n models for each of the plurality of entities is trained using recursive model stacking.
In some embodiments, the one score is based on an aggregation statistic of a score output from all of the second models for each of the plurality of entities.
In some embodiments, the aggregation statistic is an average. In some embodiments, training of the model, the second model and the n models is performed in a pipeline. In some embodiments, the recursive model stacking is recursive federated learning.
In another aspect, the invention includes a non-transitory computer program product comprising instruction which, when the program is executed cause the computer to receive at a server data from a plurality of entities. The computer program product can also include instructions which, when the program is executed cause the computer to train at the server a model for each of the plurality of entities based on the received data, wherein each model is trained using recursive model stacking and each model outputs a corresponding score. The computer program product can also include instructions which, when the program is executed cause the computer to train at the server a second model for each of the plurality of entities based on the corresponding output score of each model, wherein the each model is trained using recursive model stacking and wherein one score is output for all models.
In some embodiments, the computer program product can also include instructions which, when the program is executed cause the computer to train n models for each of the plurality of entities based on the n−1 score output for all models and wherein each of the n models for each of the plurality of entities is trained using recursive model stacking.
In some embodiments, the one score is based on an aggregation statistic of a score output from all of the second models for each of the plurality of entities. In some embodiments, the aggregation statistic is an average. In some embodiments, training of the model, the second model and the n models is performed in a pipeline. In some embodiments, the recursive model stacking is recursive federated learning.
Non-limiting examples of embodiments of the disclosure are described below with reference to figures attached hereto that are listed following this paragraph. Dimensions of features shown in the figures are chosen for convenience and clarity of presentation and are not necessarily shown to scale.
The subject matter regarded as the invention is particularly pointed out and distinctly claimed in the concluding portion of the specification. The invention, however, both as to organization and method of operation, together with objects, features and advantages thereof, can be understood by reference to the following detailed description when read with the accompanied drawings. Embodiments of the invention are illustrated by way of example and not limitation in the figures of the accompanying drawings, in which like reference numerals indicate corresponding, analogous or similar elements, and in which:
It will be appreciated that for simplicity and clarity of illustration, elements shown in the figures have not necessarily been drawn accurately or to scale. For example, the dimensions of some of the elements can be exaggerated relative to other elements for clarity, or several physical components can be included in one functional block or element.
In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the invention. However, it will be understood by those skilled in the art that the present invention can be practiced without these specific details. In other instances, well-known methods, procedures, and components, modules, units and/or circuits have not been described in detail so as not to obscure the invention.
The real-time fraud detection 140 can include machine learning execution module 155. The machine learning execution model 155 can include steps to train a model for the multiple enterprise systems 110, payments systems 120, and/or customer data 130 using a recursive model stacking as described below in
The method involves receiving data from a plurality of entities (Step 210). The data can include transaction data. The plurality of entities can include different financial entities. For example, banks, trading houses, hedge funds, credit unions, or any other entity that may handle financial records, process transactions, and otherwise provide financial products to others.
The method involves training a model for each of the plurality of entities based on the received data, wherein each model is trained using recursive model stacking and each model outputs a corresponding score (Step 220). In some embodiments, training a model for each of the plurality of entities based on the received model
For example, turning to
The recursive model stacking algorithm can be federated transfer learning training, as described, for example, in co-pending application Ser. No. 16/866,139 filed on May 4, 2020, the entire contents of which are incorporated herein by reference in its entirety.
Turning back to
Turning back to
The recursive model stacking can be federated transfer learning training as described above.
In this manner, bias with respect to each of the entities particular data can be substantially eliminated.
In various embodiments, n iterations in the recursive model stacking, where n is an integer. The number of n iterations can be based on a size of the data, a desired accuracy. In various embodiments, n is 3, 4, 5, 6, 7, or 8.
In various embodiments, each iteration can further contributes to entity independence of a model.
In some embodiments, training a first model for each of the plurality of entities based on the received data involves training models M1,1, M2,1, . . . MN,1 for each of the source datasets S1,1, S2,1, . . . SN,1, respectively, using Sklearn pipeline that stores all data transformation and modeling a pipeline object. In some embodiments, these steps can be implemented with the following code:
Storing the models in a pipeline object can include zipping them, for example, with gzip technology.
In some embodiments, training a second model for each of the plurality of entities includes for each 1<r<R, where R is a number of recursion levels, then for each 1<n<N, where N is the number of models (e.g., saved in the zipped models), transfer the models that are stored (e.g., zipped models) M1,r, Mn−1,r, Mn+1,r, . . . , MN,r; applying the models, M1,r, . . . MN,r to the dataset Sn,r+1 to generate N scores, S1,r for each record of Sn, R+1, using transform method of the Sklearn pipeline; train a model Mn,r+1 whose input features are the calculated scores S1,r, . . . sN,r and whose labels are these of the dataset Sn,r+1, using fit method of Sklearn pipeline; and/or zip the generated model object, for example, using gzip. In some embodiments, these steps can be implemented with the following code:
In some embodiments, the models can be applied to target data. The models M1,R, . . . MN,R can be applied to the target data T to generate N scores S1,R, . . . sN,R for each record of T, using, for example, a transform method of Sklearn pipeline object. A statistical aggregation tool (e.g., median) can be applied using python aggregations functions to the scores, s1,R, . . . sN,R and use the aggregation as the final score of the dataset T. In some embodiments, these steps can be implemented with the following code:
Model evaluation API in order to compare performance of mean recursive FL score to transfer-learning scores separately
import sys
sysm.path.append(‘fraud_ai_research/model_template_model_evaluation_api’) from cross_evaluation import*
Calculate new scored based on mean of the transfer learning scores combination based on ML models that was learned on different tenants validation set
Operating system 515 can be or can include any code segment designed and/or configured to perform tasks involving coordination, scheduling, arbitration, supervising, controlling or otherwise managing operation of computing device 500, for example, scheduling execution of programs. Memory 450 can be or can include, for example, a Random Access Memory (RAM), a read only memory (ROM), a Dynamic RAM (DRAM), a Synchronous DRAM (SD-RAM), a double data rate (DDR) memory chip, a Flash memory, a volatile memory, a non-volatile memory, a cache memory, a buffer, a short term memory unit, a long term memory unit, or other suitable memory units or storage units. Memory 520 can be or can include a plurality of, possibly different memory units. Memory 520 can store for example, instructions to carry out a method (e.g. code 525), and/or data such as user responses, interruptions, etc.
Executable code 525 can be any executable code, e.g., an application, a program, a process, task or script. Executable code 525 can be executed by controller 505 possibly under control of operating system 515. For example, executable code 525 can when executed cause masking of personally identifiable information (PII), according to embodiments of the invention. In some embodiments, more than one computing device 500 or components of device 500 can be used for multiple functions described herein. For the various modules and functions described herein, one or more computing devices 500 or components of computing device 500 can be used. Devices that include components similar or different to those included in computing device 500 can be used, and can be connected to a network and used as a system. One or more processor(s) 505 can be configured to carry out embodiments of the invention by for example executing software or code. Storage 530 can be or can include, for example, a hard disk drive, a floppy disk drive, a Compact Disk (CD) drive, a CD-Recordable (CD-R) drive, a universal serial bus (USB) device or other suitable removable and/or fixed storage unit. Data such as instructions, code, NN model data, parameters, etc. can be stored in a storage 530 and can be loaded from storage 530 into a memory 520 where it can be processed by controller 505. In some embodiments, some of the components shown in
Input devices 535 can be or can include for example a mouse, a keyboard, a touch screen or pad or any suitable input device. It will be recognized that any suitable number of input devices can be operatively connected to computing device 500 as shown by block 535. Output devices 540 can include one or more displays, speakers and/or any other suitable output devices. It will be recognized that any suitable number of output devices can be operatively connected to computing device 500 as shown by block 540. Any applicable input/output (I/O) devices can be connected to computing device 500, for example, a wired or wireless network interface card (NIC), a modem, printer or facsimile machine, a universal serial bus (USB) device or external hard drive can be included in input devices 535 and/or output devices 540.
Embodiments of the invention can include one or more article(s) (e.g. memory 520 or storage 530) such as a computer or processor non-transitory readable medium, or a computer or processor non-transitory storage medium, such as for example a memory, a disk drive, or a USB flash memory, encoding, including or storing instructions, e.g., computer-executable instructions, which, when executed by a processor or controller, carry out methods disclosed herein.
One skilled in the art will realize the invention can be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The foregoing embodiments are therefore to be considered in all respects illustrative rather than limiting of the invention described herein. Scope of the invention is thus indicated by the appended claims, rather than by the foregoing description, and all changes that come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.
In the foregoing detailed description, numerous specific details are set forth in order to provide an understanding of the invention. However, it will be understood by those skilled in the art that the invention can be practiced without these specific details. In other instances, well-known methods, procedures, and components, modules, units and/or circuits have not been described in detail so as not to obscure the invention. Some features or elements described with respect to one embodiment can be combined with features or elements described with respect to other embodiments.
Although embodiments of the invention are not limited in this regard, discussions utilizing terms such as, for example, “processing,” “computing,” “calculating,” “determining,” “establishing”, “analyzing”, “checking”, or the like, can refer to operation(s) and/or process(es) of a computer, a computing platform, a computing system, or other electronic computing device, that manipulates and/or transforms data represented as physical (e.g., electronic) quantities within the computer's registers and/or memories into other data similarly represented as physical quantities within the computer's registers and/or memories or other information non-transitory storage medium that can store instructions to perform operations and/or processes.
Although embodiments of the invention are not limited in this regard, the terms “plurality” and “a plurality” as used herein can include, for example, “multiple” or “two or more”. The terms “plurality” or “a plurality” can be used throughout the specification to describe two or more components, devices, elements, units, parameters, or the like. The term set when used herein can include one or more items. Unless explicitly stated, the method embodiments described herein are not constrained to a particular order or sequence. Additionally, some of the described method embodiments or elements thereof can occur or be performed simultaneously, at the same point in time, or concurrently.
A computer program can be written in any form of programming language, including compiled and/or interpreted languages, and the computer program can be deployed in any form, including as a stand-alone program or as a subroutine, element, and/or other unit suitable for use in a computing environment. A computer program can be deployed to be executed on one computer or on multiple computers at one site.
Method steps can be performed by one or more programmable processors executing a computer program to perform functions of the invention by operating on input data and generating output. Method steps can also be performed by an apparatus and can be implemented as special purpose logic circuitry. The circuitry can, for example, be a FPGA (field programmable gate array) and/or an ASIC (application-specific integrated circuit). Modules, subroutines, and software agents can refer to portions of the computer program, the processor, the special circuitry, software, and/or hardware that implement that functionality.
Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor receives instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Generally, a computer can be operatively coupled to receive data from and/or transfer data to one or more mass storage devices for storing data (e.g., magnetic, magneto-optical disks, or optical disks).
Data transmission and instructions can also occur over a communications network. Information carriers suitable for embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices. The information carriers can, for example, be EPROM, EEPROM, flash memory devices, magnetic disks, internal hard disks, removable disks, magneto-optical disks, CD-ROM, and/or DVD-ROM disks. The processor and the memory can be supplemented by, and/or incorporated in special purpose logic circuitry.
To provide for interaction with a user, the above described techniques can be implemented on a computer having a display device, a transmitting device, and/or a computing device. The display device can be, for example, a cathode ray tube (CRT) and/or a liquid crystal display (LCD) monitor. The interaction with a user can be, for example, a display of information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer (e.g., interact with a user interface element). Other kinds of devices can be used to provide for interaction with a user. Other devices can be, for example, feedback provided to the user in any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback). Input from the user can be, for example, received in any form, including acoustic, speech, and/or tactile input.
The computing device can include, for example, a computer, a computer with a browser device, a telephone, an IP phone, a mobile device (e.g., cellular phone, personal digital assistant (PDA) device, laptop computer, electronic mail device), and/or other communication devices. The computing device can be, for example, one or more computer servers. The computer servers can be, for example, part of a server farm. The browser device includes, for example, a computer (e.g., desktop computer, laptop computer, and tablet) with a World Wide Web browser (e.g., Microsoft® Internet Explorer® available from Microsoft Corporation, Chrome available from Google, Mozilla® Firefox available from Mozilla Corporation, Safari available from Apple). The mobile computing device includes, for example, a personal digital assistant (PDA).
Website and/or web pages can be provided, for example, through a network (e.g., Internet) using a web server. The web server can be, for example, a computer with a server module (e.g., Microsoft® Internet Information Services available from Microsoft Corporation, Apache Web Server available from Apache Software Foundation, Apache Tomcat Web Server available from Apache Software Foundation).
The storage module can be, for example, a random access memory (RAM) module, a read only memory (ROM) module, a computer hard drive, a memory card (e.g., universal serial bus (USB) flash drive, a secure digital (SD) flash card), a floppy disk, and/or any other data storage device. Information stored on a storage module can be maintained, for example, in a database (e.g., relational database system, flat database system) and/or any other logical information storage mechanism.
The above-described techniques can be implemented in a distributed computing system that includes a back-end component. The back-end component can, for example, be a data server, a middleware component, and/or an application server. The above described techniques can be implemented in a distributing computing system that includes a front-end component. The front-end component can, for example, be a client computer having a graphical user interface, a Web browser through which a user can interact with an example implementation, and/or other graphical user interfaces for a transmitting device. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), the Internet, wired networks, and/or wireless networks.
The system can include clients and servers. A client and a server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.
The above described networks can be implemented in a packet-based network, a circuit-based network, and/or a combination of a packet-based network and a circuit-based network. Packet-based networks can include, for example, the Internet, a carrier internet protocol (IP) network (e.g., local area network (LAN), wide area network (WAN), campus area network (CAN), metropolitan area network (MAN), home area network (HAN), a private IP network, an IP private branch exchange (IPBX), a wireless network (e.g., radio access network (RAN), 802.11 network, 802.16 network, general packet radio service (GPRS) network, HiperLAN), and/or other packet-based networks. Circuit-based networks can include, for example, the public switched telephone network (PSTN), a private branch exchange (PBX), a wireless network (e.g., RAN, Bluetooth®, code-division multiple access (CDMA) network, time division multiple access (TDMA) network, global system for mobile communications (GSM) network), and/or other circuit-based networks.
Some embodiments of the present invention may be embodied in the form of a system, a method or a computer program product. Similarly, some embodiments may be embodied as hardware, software or a combination of both. Some embodiments may be embodied as a computer program product saved on one or more non-transitory computer readable medium (or media) in the form of computer readable program code embodied thereon. Such non-transitory computer readable medium may include instructions that when executed cause a processor to execute method steps in accordance with embodiments. In some embodiments the instructions stores on the computer readable medium may be in the form of an installed application and in the form of an installation package.
Such instructions may be, for example, loaded by one or more processors and get executed. For example, the computer readable medium may be a non-transitory computer readable storage medium. A non-transitory computer readable storage medium may be, for example, an electronic, optical, magnetic, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof.
Computer program code may be written in any suitable programming language. The program code may execute on a single computer system, or on a plurality of computer systems.
One skilled in the art will realize the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The foregoing embodiments are therefore to be considered in all respects illustrative rather than limiting of the invention described herein. Scope of the invention is thus indicated by the appended claims, rather than by the foregoing description, and all changes that come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.
In the foregoing detailed description, numerous specific details are set forth in order to provide an understanding of the invention. However, it will be understood by those skilled in the art that the invention can be practiced without these specific details. In other instances, well-known methods, procedures, and components, modules, units and/or circuits have not been described in detail so as not to obscure the invention. Some features or elements described with respect to one embodiment can be combined with features or elements described with respect to other embodiments.
