KR20180059203A - Method and program for predicting chargeback fraud user - Google Patents

Abstract

The present invention relates to a method of predicting a chargeback fraud user, comprising: a data processing step of processing transaction history data for a conventional normal user and a chargeback fraud user into one piece of data for each user; A data classification step of dividing the processed transaction history data into training data and test data; A data adjustment step of oversampling the data for the charge refusal fraud user among the training data to adjust the number of data; A prediction classifying step of learning with a specific machine learning technique using the training data whose number of data is adjusted and predicting whether the user is a chargeback fraud user for test data using the learned machine learning model; A performance measurement step of measuring performance of a predictive classification; Repeatedly performing the prediction classification step and the performance measurement measurement step by oversampling or undersampling the data of the charge refusal fraud user among the training data until the performance of the predictive classification reaches the target value step; And a prediction step of predicting a payment rejection fraud for transaction history data of a new user using a machine learning model that has reached a target prediction classification performance.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and program for predicting chargeback fraud,

More particularly, the present invention relates to a machine learning model that satisfies a target prediction classification performance by processing transaction history data of a conventional user, And to a method and program for predicting a chargeback fraud against transaction history data of a new user.

Recently, as the use of electronic payment means has become commonplace, a chargeback fraud, which is a type of fraud using electronic payment means, is rapidly increasing.

Figure 1 shows a flow diagram of a chargeback fraud of a game user.

As an example of the chargeback fraud scheme, a charge refusal fraud by an online game user is a process whereby a game user purchases a credit card and exhausts game money or the like paid by a game company, This problem is caused by requesting a chargeback to the bank, which can cause huge damage to a game company, which is a big problem.

Therefore, it is necessary to develop a technology that can prevent damage due to fraudulent payment by predicting the fraudulent chargeback.

KR 10-2016-0017629 A

In order to prevent damage due to the above-mentioned charge refusal fraud, the present invention implements a machine learning model that satisfies a target predictive classification performance by processing transaction history data of a conventional user, And to provide a prediction method and program for a chargeback fraud user who predicts a chargeback fraud against transaction history data of a new user.

According to an embodiment of the present invention, there is provided a method of predicting a chargeback fraud user, comprising: (1) generating transaction history data for a normal user and a chargeback fraud user for each user (2) a data classification step of dividing the processed transaction history data into training data and test data; (3) a data classification step of dividing the processed transaction history data into training data and test data; and (3) Data adjustment step of oversampling data on the data to adjust the number of data, (4) learning by using a specific machine learning technique using the training data of which the number of data is adjusted, testing using the learned machine learning model A prediction classifying step for predicting whether the user is a chargeback fraud user for data, (5) a performance for prediction classifying (6) oversampling or undersampling the data of the chargeback fraud user among the training data until the performance of the prediction class reaches the target value, And (7) a prediction step of predicting the chargeback fraud of the transaction history data of the new user using the machine learning model that reaches the target prediction classification performance.

The data processing step may include: (1) a first-order feature deletion step of performing an evaluation on each feature and a plurality of feature sets of the transaction history data to delete a feature that does not meet the criterion; (2) A feature generation step of generating new features by processing historical data as one reference data for each user by using a statistical method, (3) performing a feature evaluation on the generated feature, and deleting the feature that does not meet the evaluation criteria Car feature deletion step.

The first feature deletion step includes the steps of (1) performing evaluation of each feature of the transaction history data using an information gain technique, (2) performing a principal component analysis And performing an evaluation on the plurality of feature sets of the history data.

The performance measurement step may measure the performance of prediction classification using a confusion matrix.

Further, a prediction program of a chargeback fraud user according to an embodiment of the present invention may be stored in the medium for predicting the chargeback fraud user according to the prediction method of the chargeback fraud user described above.

The prediction method and program of the chargeback fraud user according to the present invention configured as above can implement a machine learning model that satisfies the target prediction classification performance to predict the chargeback fraud for the transaction history data of the new user There is an advantage that it is possible to prevent damages caused by fraudulent payment.

Figure 1 shows a flow diagram of a chargeback fraud.
2 shows a method of predicting a chargeback fraud user according to an embodiment of the present invention.
FIG. 3 shows a data processing step (S10) of a method of predicting a payment rejection fraud user according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, . In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

Furthermore, terms used herein are for the purpose of illustrating embodiments and are not intended to limit the present invention. In this specification, the singular forms include plural forms as the case may be, unless the context clearly indicates otherwise. &Quot; comprises "and / or" comprising "used in the specification do not exclude the presence or addition of one or more other elements other than the stated element. Unless defined otherwise, all terms used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. In addition, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 shows a method of predicting a chargeback fraud user according to an embodiment of the present invention.

A method for predicting a chargeback fraud user according to an embodiment of the present invention can be performed by a computer. For example, the computer can be, but is not limited to, a desktop personal computer, a laptop personal computer, a netbook computer, a tablet personal computer, and the like.

More specifically, the method of predicting the payment fraudulent user according to an embodiment of the present invention includes a data processing step S10, a data classification step S20, a data adjustment step S30, A classification step S40, a performance measurement step S50, an iterative execution step S60, and a prediction step S70.

The data processing step S10 is a step of processing transaction history data of the conventional user. At this time, the conventional transaction history data includes the details of the normal user and the chargeback fraud user, and can be provided from a database of a game company that stores and manages the transaction history data. In particular, since the number of transactions is different for each user, the data processing step (S10) processes the transaction history data into one piece of data for each user. At this time, the transaction history data includes a plurality of attributes having different characteristics of data and physical form (record format, record length, etc.) of data. The attributes of such data are referred to hereinafter as "features ".

Table 1 shows the characteristics of actual transaction history data stored in a database of a game company. At this time, the actual transaction history data provided from the game company included transaction history data (about hundreds of thousands) of 62,092 normal users and transaction history data for 372 (thousands) chargeback fraud users.

For example, the transaction history data may include a plurality of features as shown in Table 1. That is, each transaction history data may include the characteristics of "user_no, standard_country_code, charge_status, charge_no, payment_method_no, charge_amount, bonus_amount, datetime, charge_product_name and hash_ip, ip_addr".

Characteristic Contents One user_no User's identifier 2 standard_country_code Your country code 3 charge_status Your charging step 4 charge_no Charge identifier 5 payment_method_no Payment method identifier 6 charge_amount Charge amount 7 bonus_amount Bonus amount 8 datetime Date of transaction 9 charge_product_name Name of payment gateway 10 hash_ip The IP address of the user converted to a hash function 11 ip_addr Your IP address

FIG. 3 shows a data processing step (S10) of a method of predicting a payment rejection fraud user according to an embodiment of the present invention.

Specifically, the data processing step S10 may include a primary feature deletion step S11, a feature generation step S12, and a secondary feature deletion step S13, as shown in FIG.

The primary feature deletion step S11 is a step of performing evaluation on each feature and a plurality of feature sets of the transaction history data, and deleting features that do not meet the evaluation criterion. At this time, in the first feature deletion step S11, each feature of the transaction history data (for example, user_no, standard_country_code, charge_status, charge_no, payment_method_no, charge_amount, bonus_amount, datetime, charge_product_name, hash_ip, ip_addr).

The information gain is the amount of entropy reduction expected when a feature is selected. The higher the value, the better the data can be distinguished. That is, in the first feature deletion step (S11), the value of the distinguishability degree of the charge rejection fraud user according to the selection of each feature is obtained according to the information gain technique.

Thereafter, in the first feature deletion step S11, the corresponding feature having an information gain value less than a certain reference is deleted. This is because a feature having an information gain value less than a predetermined criterion is a feature that is not necessary for distinguishing a chargeback fraud user.

In the first feature deletion step S11, a plurality of feature sets of the transaction history data are evaluated using a principal component analysis technique.

Principal component analysis is a technique to reduce high-dimensional data to low-dimensional data, and finds the principal component of the distributed data. That is, in the first feature deletion step (S11), a plurality of feature sets of the principal component capable of better distinguishing the charge rejection fraud users are extracted according to the principal component analysis technique. At this time, the plural feature sets of the transaction history data are combinations of two or more features, for example, {user_no, standard_country_code}, {user_no, charge_status}, ... {user_no, standard_country_code, charge_status}, {user_no, standard_country_code, charge_no} ... And the like.

Thereafter, in the first feature deletion step S11, features included in a plurality of feature sets less than a predetermined criterion, i.e., those not corresponding to the principal component, are deleted. This is because the features included in the plurality of feature sets that do not correspond to the principal component correspond to features that are not required to distinguish the chargeback fraud users.

The feature generation step S12 is a step of generating new features while processing the transaction history data that has undergone the first feature deletion step by using statistical methods as data of one reference for each user. For example, a statistical method may include, but is not limited to, a number, a sum, a difference, an average, a standard deviation, a maximum value, a minimum value, a date statistic,

The secondary feature deletion step (S13) is a step of performing evaluation on the generated feature and deleting the feature that does not meet the evaluation criterion. At this time, in the secondary feature deletion step (S12), each feature of the transaction history data is evaluated using the information gain technique.

Thereafter, in the secondary feature deletion step S13, the corresponding feature having the information gain value less than the predetermined reference value is deleted. This is because a feature having an information gain value less than a predetermined criterion is a feature that is not necessary for distinguishing a chargeback fraud user.

Table 2 shows characteristics of the transaction history data shown in Table 1 processed through the data processing step (S10), the first feature deleting step (S11), and the second feature deleting step (S13).

Characteristic Contents One user_no User's identifier 2 standard_country_code Your country code 3 standard_country_code_kind The type of user's country code 4 charge_stat10 User's charge count is less than 10 5 charge_stat20 If the user's charge count is less than 20 6 charge_stat30 User's charge count is less than 30 7 payment_method_no Your most recent payment method 8 payment_method_no_kind Types of payment methods 9 charge_amount_sum Total charge 10 charge_amount_avg Average Charge Amount 11 charge_amount_stddev Standard deviation of charge amount 12 bonus_amount_sum Total bonus 13 bonus_amount_avg Average bonus amount 14 bonus_amount_stddev Standard deviation of bonus amount 15 transaction_recent_monthday Last transaction date 16 transaction_recent_hour Final transaction time 17 transaction_cnt_sum Total transactions 18 transaction_cnt_1_month Number of transactions per month 19 transaction_cnt_2_month Number of transactions in the last two months except the last one 20 transaction_cnt_3_month The number of transactions in three months excluding the last two months) 21 transaction_cnt_6_month Number of transactions for 6 months excluding the last 3 months 22 transaction_cnt_else Total number of transactions excluding the last 6 months 23 charge_product_name Payment gateway 24 charge_product_name_kind Types of payment providers 25 ip_addr IP address 26 ip_addr_kind IP address type 27 class 0: Normal user, 1: Chargeback fraud user

More specifically, standard_country_code_kind was additionally generated from the standard_country_code, and charge_stat10, charge_stat20 and charge_stat30 were additionally generated from the charge_status. Further, payment_method_no_kind was additionally generated from the payment_method_no and charge_amount_sum, charge_amount_avg, charge_amount_stddev, bonus_amount_sum, bonus_amount_avg and bonus_amount_stddev were additionally generated from the charge_amount and bonus_amount. In addition, transaction_recent_monthday, transaction_recent_hour, transaction_cnt_sum, transaction_cnt_2_month, transaction_cnt_2_month, transaction_cnt_3_month, transaction_cnt_6_month and transaction_cnt_else were additionally created from the datetime, charge_product_name_kind was additionally created from charge_product_name, and ip_addr_kind was further generated from ip_addr. In addition, charge_no and hash_ip were deleted, and additional classes were created for user classification. Classes may be included in Table 1 from the beginning.

As a result, the information gain values of the features of Table 2 were obtained by using a ClassifierSubsetEval attribute evaluator and a genetic algorithm based on a decision tree (DT). As a result, 4, 5, 7, 8, 10, 11 , 12, 17, 18, 19 and 20, namely, charge_stat10, charge_stat20, payment_method_no, payment_method_no_kind, charge_amount_avg, charge_amount_stddev, bonus_amount_sum, transaction_cnt_sum, transaction_cnt_1_month, transaction_cnt_2_month and transaction_cnt_3_month.

Next, the data classification step S20 is a step of dividing the processed transaction history data into training data and test data. At this time, the training data is used as learning data of a specific machine learning to be used later, and the test data is data used for testing the performance of the learned machine learning model.

Table 3 shows various data set types for dividing processed transaction history data into training data and test data.

66% split 10-fold 50% split Normal user 21,113 62,092 31,046 Chargeback Fraud User 125 372 186

For example, 66% split represents 66% of transaction history data as training data and the remaining 34% as test data. 10-fold is a case in which 9/10 of the transaction history data is divided into training data and the remaining 1/10 is divided into test data, and a cross validation method is performed. In addition, 50% split divides 50% of transaction history data into training data and test data, and divides data by preprocessing StratifiedFolds.

Next, the data adjustment step S30 is a step of oversampling the data for the charge refusal fraud user among the training data to adjust the number of data. The performance of the machine learning model learned by the training data may deteriorate because the transaction history data of the chargeback fraud user is less than the transaction history data of the normal user. Accordingly, the performance of the machine learning model can be improved through the data adjustment step (S30), that is, oversampling data for the charge refusal fraud user among the training data. A detailed experimental example for improving the performance of the machine learning model through the data adjustment step (S30) will be described later.

Next, in the predictive classification step S40, the training data whose number of data is adjusted is used as the learning data to learn by a specific machine learning technique selected in advance. At this time, machine learning includes various algorithms such as Supervised Learning, Unsupervised Learning, Semi-Supervised Learning, and the like, and is not particularly limited. Map learning may include Support Vector Machine (SVM), Hidden Markov model, Regression, Neural network, Naive Bayes classification, and the like .

Thereafter, in the predictive classification step S40, the machine learning model learned through the training data is used to predict and classify whether or not the charge data is fraudulent users of the test data.

Next, the performance measurement step S50 is a step of measuring the performance of the predictive classification. That is, the performance measuring step S50 measures the performance indicating the accuracy of the test data predicted and classified by the machine learning model in the prediction classification step S40. In this case, the performance measurement step (S50) can measure the performance of the predictive classification using a confusion matrix.

Table 4 shows the chaotic matrix.

prediction True False result
True True Posivies (TP) False Negatives (FN) Flase False Posivies (FP) True Negatives (TN)

TP is the case where the machine learning model predicts the test data as a chargeback fraud user for the test data, but actually the charge decline fraud user, and TN is a normal user that predicts the machine learning model as a normal user for certain test data Respectively. In addition, in FP, the machine learning model is predicted as a charge rejection fraud user for the test data, but the actual user is the normal user. The FN indicates that the machine learning model predicts the test data as the normal user for the test data. However, And a case of a fraudulent user.

That is, in the performance measurement step (S50), the number of results of predictions and classification for each test data is collected according to the chaotic matrix of Table 4 in the machine learning model. Then, in the performance measurement step (S50), the value of the performance index is calculated. In this case, the performance index is used to measure the classification accuracy of the machine learning model predicted and classified in the prediction classification step (S40). Recall (= TPR), Precision, F-measure and ROC curve Any, but not limited to, any measure for measuring the performance of data classification accuracy can be a performance indicator without limitation.

Table 5 shows each performance index for measuring the performance of the machine learning model predicted and classified in the prediction classification step (S40).

Performance indicator Calculation method
Recall = TPR
(True Posivies Rate)

FPR
(False Posivies Rate)

Precision

F-measure

ROC curve Area
(Receiver operating characteristic) The width of the curve, in which the axis is the FPR and the Y axis is the TPR,

Tables 6 and 7 illustrate the case where the prediction classification step S40 and the performance measurement step S50 are performed using the machine learning technique of the decision tree DT and the support vector machine SVM for each data set type in Table 3 The results of the prediction classification performance are shown. In order to directly compare the effect of the data adjustment step S30, the data adjustment step S30 is omitted and the prediction classification step S40 and the performance measurement step S50 are performed, Table 7 shows the results of performing the data adjustment step S30, the prediction classification step S40, and the performance measurement step S50.

algorithm Dataset type TPR FPR Rrecision Recall F-measure ROC Area Class

DT 66% split 0.552 0.001 0.841 0.552 0.667 0.828 One 0.999 0.448 0.997 0.999 0.998 0.828 0 10-fold 0.530 0.001 0.853 0.530 0.653 0.877 One 0.999 0.470 0.997 0.999 0.998 0.877 0 50% split 0.516 0.001 0.787 0.516 0.623 0.808 One 0.999 0.484 0.997 0.999 0.998 0.808 0

SVM 66% split 0.544 0.000 0.883 0.544 0.673 0.772 One 1,000 0.456 0.997 1,000 0.998 0.772 0 10-fold 0.573 0.000 0.914 0.573 0.704 0.786 One 1,000 0.427 0.997 1,000 0.999 0.786 0 50% split 0.570 0.001 0.869 0.570 0.688 0.785 One 0.999 0.430 0.997 0.999 0.998 0.785 0

Over-sampling rate (%) algorithm TPR FPR Precision Recall F-measure ROC Area Class
100 DT 0.661 0.001 0.909 0.661 0.766 0.896 One 0.999 0.339 0.996 0.999 0.998 0.896 0 SVM 0.820 0.001 0.941 0.820 0.876 0.910 One 0.999 0.180 0.998 0.999 0.999 0.910 0
200 DT 0.677 0.001 0.941 0.677 0.788 0.924 One 0.999 0.323 0.994 0.999 0.997 0.924 0 SVM 0.887 0.001 0.964 0.887 0.924 0.943 One 0.999 0.113 0.998 0.999 0.999 0.943 0
300 DT 0.792 0.002 0.944 0.792 0.861 0.920 One 0.998 0.208 0.993 0.998 0.995 0.920 0 SVM 0.948 0.001 0.980 0.948 0.964 0.974 One 0.999 0.052 0.998 0.999 0.999 0.974 0

Referring to the recall performance indexes of the charge refusal fraud users (Class = 1) in Table 6 and Table 7, the support vector machine SVM exhibits better prediction classification performance than the decision tree DT, It is found that the performance of predictive classification is better.

The iterative execution step S60 may include oversampling or undersampling the data of the charge refusal fraud user among the training data until the performance of the predictive classification reaches the target value, And repeating the performance measurement step S50. At this time, if the oversampling ratio is too high and the amount of training data is excessively increased, overloading may take place at the time of learning in the prediction classification step S40, so the iterative step S60 may perform undersampling Can be performed. In the repeated execution step (S60), undersampling may be performed to achieve a more accurate target value.

The oversampling ratio or the ratio of undersampling at the time of performing the repeated execution step (S60) may be regular or arbitrary, and is not particularly limited. For example, the oversampling ratio in n-th iteration can be ^defined as A x B ⁿ (where A and B are natural numbers and n is an integer). After the n-th iteration, the undersampling ratio at the m-th iteration can be determined as A x B ⁿ - (C x m) where A, B and C are natural numbers, n and m are integers,

That is, when the performance target value is set to "Recall with 0.940 or more" for the support vector machine SVM, the prediction classification step S40 and the performance measurement step S50 are performed when the oversampling is 100%. As a result, since Recall has 0.820 which is less than the target value, the prediction classification step (S40) and the performance measurement step (S50) are performed again by raising the oversampling to 200% in the first iteration. As a result, since Recall has a value of 0.887 which is less than the target value, the prediction sorting step S40 and the performance measuring step S50 are performed again by raising the oversampling to 300% in the second iteration. As a result, Recall has 0.948, which is above the target value. Thereafter, the process may proceed directly to the prediction step S70, but in the iterative execution step S60, undersampling is performed in the third iteration, that is, the oversampling is set to less than 300%, for example, 280% S40) and the performance measurement step S50 may be performed again.

The prediction step S70 is a step of predicting the payment rejection fraud for the transaction history data of the new user using the machine learning model that has reached the target prediction classification performance.

Meanwhile, the prediction program of the charge rejection fraud user according to the embodiment of the present invention is stored in the medium for performing the prediction of the charge rejection fraud user according to the prediction method of the charge rejection fraud user according to the above- Program. For example, the predictive program of a chargeback fraud user may be recorded in a recording medium readable by a computer or similar device.

For example, the recording medium may be a hard disk type, a magnetic media type, a CD-ROM (compact disc read only memory), an optical recording medium type, A magneto-optical media type, a multimedia card micro type, a card type memory (e.g., SD or XD memory), a flash memory type, a read only memory (ROM) ROM, a random access memory (RAM), or a combination thereof, but is not limited thereto.

The program may be stored in the input device as a communication network such as the Internet, an Intranet, a LAN (Local Area Network), a WLAN (Wide Area Network), or a SAN (Storage Area Network) May be stored in an attachable storage device that can be accessed through a communication network.

Although the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. Therefore, the scope of the present invention should not be limited to the embodiments described, but should be determined by the scope of the following claims and equivalents thereof.

S10: Data processing step S11: First feature deletion step
S12: feature generation step S13; Secondary feature deletion step
S20: Data classification step S30: Data adjustment step
S40: prediction classification step S50: performance measurement step
S60: Repetition step S70: Prediction step

Claims (5)

A data processing step of processing transaction history data for a conventional normal user and a chargeback fraud user into one piece of data for each user;
A data classification step of dividing the processed transaction history data into training data and test data;
A data adjustment step of oversampling the data for the charge refusal fraud user among the training data to adjust the number of data;
A prediction classifying step of learning with a specific machine learning technique using the training data whose number of data is adjusted and predicting whether the user is a chargeback fraud user for test data using the learned machine learning model;
A performance measurement step of measuring performance of a predictive classification;
Repeatedly performing the prediction classification step and the performance measurement measurement step by oversampling or undersampling the data of the charge refusal fraud user among the training data until the performance of the predictive classification reaches the target value step; And
And a prediction step of predicting a payment rejection fraud for transaction history data of a new user using a machine learning model that has reached a target prediction classification performance. The method according to claim 1,
The data processing step includes:
A first feature deletion step of performing evaluation on each feature and a plurality of feature sets of the transaction history data to delete features that do not meet the criterion;
A feature generation step of generating new features by processing the transaction history data that has undergone the first feature deletion step by using one statistical method as data for each user; And
And a second feature deletion step of performing an evaluation on the generated feature and deleting the feature that does not meet the evaluation criterion. 3. The method of claim 2,
The primary feature deletion step includes:
Performing an evaluation for each characteristic of the transaction history data using an information gain technique; And
And performing an evaluation of a plurality of feature sets of the transaction history data using a principal component analysis technique. The method according to claim 1,
Wherein the performance measurement step comprises:
Wherein the performance of the prediction classification is measured using a confusion matrix. A prediction program of a chargeback fraud user stored in a medium for predicting a chargeback fraud user according to a prediction method of a chargeback fraud user according to any one of claims 1 to 4.

Images