Rule based machine learning for precise fraud detection

A method for providing rule-based machine learning for precise fraud detection in heavily imbalanced datasets, the method comprising:

• receiving, from a user data database via an electronic communication interface of a server, a first collection of datasets associated with user interaction data, wherein each dataset included in the first collection of datasets is associated with one or more user characteristics, wherein the server includes an electronic processor, a memory, and the electronic communication interface, wherein the memory stores software modules including a rule-based model, a feature engineering model, and a decision tree model, wherein the electronic communication interface is in electronic communication with a plurality of user computing devices conducting transaction interactions with the server;
• receiving, from a fraud database via the electronic communication interface, a second collection of datasets associated with user interaction data, wherein the second collection of datasets includes data associated with confirmed fraud;
• generating, with the electronic processor, using the rule-based model, an aggregate dataset collection based on the first collection of datasets and the second collection of datasets, wherein each dataset in the aggregate dataset collection is labeled with a binary target variable indicating whether a user characteristic of each dataset is associated with fraud, wherein the user characteristic comprises at least one datapoint in each dataset which represents a count of the number of times a user has interacted with the server in a single electronic transaction interaction or session;
• supplementing, with the electronic processor, the aggregate dataset collection using the feature engineering model includes converting the at least one datapoint included in each dataset of the aggregate dataset collection from a count value to a percentage value, wherein the percentage value is added as a new datapoint for each dataset included in the aggregate dataset collection;
• determining, with the electronic processor, via a first iteration of the decision tree model, a first subset of datasets of the aggregate dataset collection, wherein each dataset included in the first subset of datasets is associated with a first set of user characteristics associated with fraud, wherein the determining is based on an accuracy score generated by a precision metric;
• relabeling, with the electronic processor, based on the first set of user characteristics, each dataset included in the first subset of datasets with a new binary target variable indicating whether each dataset included in the first subset of datasets is associated with fraud;
• generating, with the electronic processor, by excluding the datasets not associated with fraud from the first subset of datasets, a segmented first subset of data, wherein each dataset of the segmented first subset of datasets includes the first set of user characteristics associated with fraud;
• selecting, with the electronic processor, a third collection of datasets from the user data based on the new binary target variable, wherein each dataset included in the third collection of datasets is associated with at least one user characteristic associated with fraud;
• determining, with the electronic processor, via a second iteration of the decision tree model, a second subset of datasets of the third collection of datasets, wherein each dataset included in the second subset of datasets is associated with a second set of user characteristics associated with fraud;
• determining, with the electronic processor, whether an accuracy score associated with the second set of user characteristics satisfies an accuracy precision threshold;
• in response to determining that the accuracy score satisfies the accuracy precision threshold, generating and transmitting, with the electronic processor, a report for display to a user, the report including the second set of user characteristics;
• receiving, from a user computing device with the electronic processor, user interaction data gathered during a user session;
• and
• outputting, with the electronic processor using the decision tree model, an indication that the user session is associated with fraudulent activity based on the second set of user characteristics and the user interaction data gathered during the user session.

A non-transitory, computer-readable medium storing instructions that, when executed by an electronic processor, perform a set of functions for providing rule-based machine learning for precise fraud detection in heavily imbalanced datasets, the set of functions comprising:

• receiving, from a user data database via an electronic communication interface of a server, a first collection of datasets associated with user interaction data, wherein each dataset included in the first collection of datasets is associated with one or more user characteristics, wherein the server includes the electronic processor, a memory, and the electronic communication interface, wherein the memory stores software modules including a rule-based model, a feature engineering model, and a decision tree model, wherein the electronic communication interface is in electronic communication with a plurality of user computing devices conducting transaction interactions with the server;
• receiving, from a fraud database via the electronic communication interface, a second collection of datasets associated with user interaction data;
• generating, using the rule-based model, an aggregate dataset collection based on the first collection of datasets and the second collection of datasets, wherein each dataset in the aggregate dataset collection is labeled with a binary target variable indicating whether a user characteristic of each dataset is associated with fraud, wherein the user characteristic comprises at least one datapoint in each dataset which represents a count of the number of times a user has interacted with the server in a single electronic transaction interaction or session;
• supplementing the aggregate dataset collection using the feature engineering model by converting at least one datapoint included in each dataset of the aggregate dataset collection from a count value to a percentage value, wherein the percentage value is added as a new datapoint for each dataset included in the aggregate dataset collection;
• determining, via a first iteration of the decision tree model, a first subset of datasets of the aggregate dataset collection, wherein each dataset included in the first subset of datasets is associated with a first set of user characteristics associated with fraud, wherein the determining is based on an accuracy score generated by a precision metric;
• relabeling, based on the first set of user characteristics, each dataset included in the first subset of datasets with a new binary target variable indicating whether each dataset included in the first subset of datasets is associated with fraud;
• generating, with the electronic processor, by excluding the datasets not associated with fraud from the first subset of datasets, a segmented first subset of data, wherein each dataset of the segmented first subset of datasets includes a first set of user characteristics associated with fraud;
• selecting a third collection of datasets from the user data based on the new binary target variable, wherein each dataset included in the third collection of datasets is associated with at least one user characteristic associated with fraud;
• determining, via a second iteration of the decision tree model, a second subset of datasets of the third collection of datasets, wherein each dataset included in the second subset of datasets is associated with a second set of user characteristics associated with fraud;
• determining whether an accuracy score associated with the second set of user characteristics satisfies an accuracy precision threshold;
• in response to determining that the accuracy score satisfies the accuracy precision threshold, generating and transmitting a report for display to a user, the report including the second set of user characteristics;
• receiving, from a user computing device, user interaction data gathered during a user session, and
• outputting, using the decision tree model and based on the second set of user characteristics and the user interaction data gathered during the user session, an indication that the user session is associated with fraudulent activity.