| CPC G06Q 20/4016 (2013.01) [G06Q 20/405 (2013.01); G06Q 20/407 (2013.01)] | 16 Claims |
|
1. A system for detecting an abnormal transaction data between computing devices in a communication network, the system comprising:
a communication interface configured to interact with an institution server computer via a first communication network, the institution server computer configured to communicate data with a plurality of user devices via a second communication network;
a data collection processor configured to receive, from the institution server computer, a plurality of pieces of transaction data communicated between two or more of the plurality of user devices, the plurality of pieces of transaction data comprising first transaction data including first personal name data and first transaction amount data associated with the first personal name data;
a data processor configured to:
identify a first user from the first transaction data,
determine first valid transaction data, involving the first user, from the first transaction data,
identify a second user, from among candidate users associated with the first valid transaction data, the second user being different from the first user,
determine second valid transaction data, involving the second user, different from the first valid transaction data, the second valid transaction data being directly or indirectly derived from the first user,
identify a third user, from among candidate users associated with the second valid transaction data, the third user being different from the first user and the second user, and
generate a valid transaction pattern based on the first valid transaction data and the second valid transaction data; and
an abnormal transaction detection processor configured to detect an existence of an abnormal transaction data based on the generated valid transaction pattern,
wherein the data processor is configured to generate the valid transaction pattern based on the first valid transaction data and the second valid transaction data by:
determining a first user device of the plurality of user devices associated with the first user,
determining at least one transaction data transmitted by the first user device that satisfies a predetermined criterion from the first transaction data associated with the first user as the first valid transaction data, and
determining a second user device of the plurality of user devices associated with the second user,
determining at least one transaction data transmitted by the second user device that satisfies the predetermined criterion from second transaction data associated with the second user as the second valid transaction data,
determining a third user device of the plurality of user devices associated with the third user, and
generating a schematized pattern from the first valid transaction data and the second valid transaction data, wherein the valid transaction pattern comprises the schematized pattern,
wherein, to determine the first valid transaction data, the data processor is configured to:
generate a first transaction score based on the first transaction amount data, and
determine the first transaction data as the first valid transaction data in response to determining that the first transaction score is greater than or equal to a predetermined reference value, and
wherein, to generate the first transaction score, the data processor is configured to:
determine a largest transaction amount data from the first transaction amount data associated with the first personal name data as first maximum transaction amount data, and
generate the first transaction score by using the first maximum transaction amount data and the first transaction amount data, and
wherein the abnormal transaction data detection processor is configured to:
detect the existence of the abnormal transaction data in one or more of the first user device, the second user device, or the third user device based on the generated valid transaction pattern including a predetermined fraud pattern, and
transmit a notification of the detected existence of the abnormal transaction data to at least one of the institution server computer or a manager terminal such that one or more transactions, associated with the detected existence of the abnormal transaction data, among two or more of the first user device, the second user device, or the third user device are blocked.
|