Automatic rule discovery from large-scale datasets to detect payment card fraud using classifiers

A non-transitory computer-readable storage medium for tangibly storing thereon computer readable instructions for a method comprising:

• training a classifier using a set of transactions, each of the transactions comprising a set of literals, wherein a subset of the literals are literals representing discrete values, and wherein a first subset of the transactions represent a set of fraudulent transactions, and a second subset of the transactions represent a set of genuine transactions, wherein the classifier is trained to classify transactions presented to the classifier in a class selected from a list comprising fraud and genuine;
• clustering, using the computing device, the set of transactions on at least one of literals in each of the transactions such that each of the transactions assigned to one of a set of clusters;
• generating a set of prototype transactions, wherein each of the set of clusters is used to generate a prototype transaction such that the respective prototype transaction represents a centroid of all transactions in the cluster;
• expanding the discrete literals in each of the prototype transactions, wherein each expanded literal comprises a conjunction of all values of the respective discrete literal for which the prototype transaction is classified as fraud by the classifier;
• and
• generating, for each prototype transaction, a rule comprising a conjunction of the expanded discrete literals in the respective prototype transaction.

A computing device comprising:

• a processor and a memory;
• a storage medium for tangibly storing thereon program logic for execution by the processor, the program logic comprising logic for:
• training a classifier using a set of transactions, each of the transactions comprising a set of literals, wherein a subset of the literals are literals representing discrete values, and wherein a first subset of the transactions represent a set of fraudulent transactions, and a second subset of the transactions represent a set of genuine transactions, wherein the classifier is trained to classify transactions presented to the classifier in a class selected from a list comprising fraud and genuine;
• clustering the set of transactions on at least one of literals in each of the transactions such that each of the transactions assigned to one of a set of clusters;
• generating a set of prototype transactions, wherein each of the set of clusters is used to generate a prototype transaction such that the respective prototype transaction represents a centroid of all transactions in the cluster;
• expanding the discrete literals in each of the prototype transactions, wherein each expanded literal comprises a conjunction of all values of the respective discrete literal for which the prototype transaction is classified as fraud by the classifier;
• and
• generating, for each prototype transaction, a rule comprising a conjunction of the expanded discrete literals in the respective prototype transaction.

A method comprising:

• selecting, using a computing device, a set of transactions, each of the transactions comprising a set of literals, wherein a subset of the literals are literals representing continuous values, and wherein a subset of the transactions represent a set of fraudulent transactions;
• normalizing, using the computing device, the set of transactions, such that the each of the subset of literals for each of the transactions is transformed to a discrete literal, wherein each discrete literal is assigned one of a set of discrete values, each discrete value corresponding to a range of continuous values;
• training, using a computing device, a classifier using a set of transactions, each of the transactions comprising a set of literals, wherein a subset of the literals are literals representing discrete values, and wherein a first subset of the transactions represent a set of fraudulent transactions, and a second subset of the transactions represent a set of genuine transactions, wherein the classifier is trained to classify transactions presented to the classifier in a class selected from a list comprising fraud and genuine;
• clustering, using the computing device, the set of fraudulent transactions, such that each of the set of fraudulent transactions is assigned to one of a set of clusters such that each of the transactions assigned to a specific cluster is within a threshold Euclidean distance of all other transactions assigned to the specific cluster;
• generating, using the computing device, a set of prototype transactions, wherein each of the set of clusters is used to generate a prototype transaction such that the prototype transaction represents the centroid of all transactions in the cluster;
• expanding, using the computing device, the discrete literals in each of the prototype transactions, wherein for each discrete literal in each prototype transaction, a sensitivity analysis is performed, the sensitivity analysis comprising:
• for each binary digit in the respective discrete literal,
• creating a test literal such that the value of the test literal is set to a discrete value equal to a value produced by setting the respective binary digit in the respective discrete literal to 1, and setting the remaining binary digits in the respective discrete literal to 0, and
• interrogating the classifier, using the respective prototype transaction and the respective test literal, wherein the test literal is used in place of the respective discrete literal, such that the prototype transaction is classified in a class selected from the list comprising fraud and genuine;
• generating, for the respective discrete literal, at least one antecedent, the at least one antecedent comprising a conjunction of all values of the test literal for which the prototype transaction was classified as fraud;
• adding the at least one antecedent to a list of antecedents for the prototype transaction;
• and
• generating, using the computing device, for each prototype transaction, at a rule using the respective list of antecedents for the respective prototype transaction, the at least one rule comprising a conjunction of the expanded discrete literals in the respective prototype transaction.