| CPC G06Q 20/4016 (2013.01) | 3 Claims |
|
1. A computer-implemented method comprising:
obtaining, with at least one processor, historical transaction data associated with a time series of a plurality of historical transactions at a merchant system over a historical period of time, wherein the historical transaction data includes a plurality of merchant category codes (MCCs) associated with the plurality of historical transactions, and wherein obtaining the historical transaction data includes generating a zero value for a percentage distribution of a transaction amount for each MCC for a historical sub-period of time that does not include a transaction of the plurality of historical transactions;
applying, with the at least one processor, a difference transform to the historical transaction data to generate transformed data in which trends and seasonality have been removed from the time series;
training, with the at least one processor, a machine learning model an isolation forest by applying a machine learning an isolation forest algorithm to the transformed data, wherein the machine learning model isolation forest generates an anomaly score associated with the merchant system by generating for each historical sub-period of time of a plurality of historical sub-periods of time, the anomaly score;
obtaining, with the at least one processor, previous transaction data associated with one or more previous transactions at the merchant system over a previous period of time after the historical period of time, wherein the previous transaction data includes one or more MCCs of the plurality of MCCs associated with the one or more previous transactions, wherein the historical transaction data includes a percentage distribution of a transaction amount for each MCC of the plurality of MCCs of a subset of transactions of the plurality of historical transactions for a plurality of historical sub-periods of time within the historical period of time, wherein a duration of a historical sub-period of time is a same duration as the previous period of time, and wherein the previous transaction data includes a percentage distribution of a transaction amount for each MCC of the one or more MCCs of the one or more transactions for the previous period of time;
processing, with the at least one processor, using the isolation forest, the previous transaction data to generate the anomaly score associated with the merchant system, wherein the isolation forest sub-samples and processes the previous transaction data in a tree structure based on random cuts in values of randomly selected features in the previous transaction data to generate a plurality of tree branches for the plurality of historical sub-periods of time in which deeper tree branches of the plurality of tree branches correspond to the anomaly score being less likely to be associated with an anomaly and shorter tree branches of the plurality of tree branches correspond to the anomaly score being more likely to be associated with an anomaly;
identifying, with the at least one processor, based on the anomaly score and at least one threshold anomaly score, a shift in transaction volume of the merchant system across MCCs for the previous period of time;
receiving, with the at least one processor, during processing of a current transaction at the merchant system in a transaction processing network, current transaction data associated with the current transaction, wherein the current transaction data includes an MCC of the plurality of MCCs associated with the current transaction;
determining, with the at least one processor, based on current transaction data and the anomaly score associated with the merchant system, a risk score associated with the current transaction;
comparing, with the at least one processor, the risk score to at least one threshold risk score; and
in response to determining that the risk score satisfies the at least one threshold risk score, denying, with the at least one processor, authorization of the current transaction in the transaction processing network.
|