CPC G06Q 20/4016 (2013.01) [G06F 7/08 (2013.01); G06F 16/2379 (2019.01); G06N 5/04 (2013.01); G06N 20/00 (2019.01); G06Q 30/0204 (2013.01); G06Q 30/018 (2013.01)] | 18 Claims |
1. A message tracking computing device for identifying anomalous activity in real-time, the message tracking computing device comprising at least one processor in communication with at least one memory, the at least one processor programmed to:
receive, from a payment processing network, real-time transaction data including a plurality of real-time transaction records, each transaction record associated with a payment transaction conducted over the payment processing network;
sort the plurality of real-time transaction records into a plurality of channels, wherein each channel of the plurality of channels represents a different type of transaction, each type of transaction represented by one of the channels includes one of ATM transactions, card-not-present transactions, point-of-sale transactions, quasi transactions, cross-border transactions, approved transactions, and declined transactions, wherein each channel includes a plurality of transactions of the corresponding transaction type from a plurality of individuals and a plurality of institutions;
for each channel and corresponding type of transaction, compute, in real-time, a normalized velocity score by:
computing a streaming mean for at least one transaction record associated with the corresponding channel;
computing a streaming standard deviation for the at least one transaction record; and
computing the normalized velocity score based on the streaming mean, the streaming standard deviation, and a transaction ratio for the at least one transaction record;
analyze the computed normalized velocity score for each channel to detect anomalous activity;
automatically generate an alert message identifying the anomalous activity; and
transmit the alert message to a remote computing device.
|