Search

EP-4006759-B1 - FRAUD DETECTION SYSTEM, FRAUD DETECTION METHOD, AND PROGRAM

EP4006759B1EP 4006759 B1EP4006759 B1EP 4006759B1EP-4006759-B1

Inventors

  • TOMODA, Kyosuke

Dates

Publication Date
20260506
Application Date
20200929

Claims (13)

  1. A fraud detection system (S), comprising: score acquisition means (103) for acquiring, based on an action performed by each of a plurality of users, a score relating to a fraud level of the each of the plurality of users; determination means (104) for determining, based on the score of each of the plurality of users, an acquisition method for a feature amount of the each of the plurality of users such that an acquisition time of the feature amount becomes shorter as the fraud level becomes lower, wherein the acquisition method is the type of the feature amount to be acquired and the determination means is configured to determine the type of the feature amount for each of the plurality of users such that the acquisition time becomes shorter as the fraud level becomes lower; feature amount acquisition means (105) for acquiring the feature amount of each of the plurality of users based on the acquisition method determined for the each of the plurality of users, wherein the feature amount acquisition means (105) is configured to acquire a plurality of types of feature amounts, and configured to acquire the feature amount of the type of feature amount determined for each of the plurality of users; and detection means (106) for detecting fraud made by each of the plurality of users based on the feature amount of the each of the plurality of users.
  2. The fraud detection system (S) according to claim 1, further comprising: reception means (101) for receiving a request from each of the plurality of users; and setting means (102) for setting the acquisition method based on the score of each of the plurality of users and a number of requests from each of the plurality of users such that the acquisition time becomes shorter as the fraud level becomes lower and the acquisition time as a whole falls within a predetermined range, wherein the determination means (104) is configured to determine the acquisition method for each of the plurality of users based on the score of the each of the plurality of users and the setting.
  3. The fraud detection system (S) according to claim 2, wherein the setting means (102) is configured to determine a length relating to the acquisition time for each of the scores, and to set the acquisition method based on the determined length.
  4. The fraud detection system (S) according to claim 2 or 3, wherein the setting means (102) is configured to create a distribution relating to a relationship between the score and the number of requests, and to set the acquisition method based on the created distribution.
  5. The fraud detection system (S) according to any one of claims 1 to 4, wherein the score acquisition means (103) is configured to: acquire, based on each of a plurality of actions performed by each of the plurality of users, an individual score relating to the fraud level of the each of the plurality of actions performed by the each of the plurality of users; and acquire, based on the individual scores of each of the plurality of users, an overall score relating to an overall fraud level of the each of the plurality of users, and wherein the determination means (104) is configured to determine the acquisition method for each of the plurality of users such that the acquisition time becomes shorter as the fraud level of the overall score becomes lower.
  6. The fraud detection system (S) according to claim 5, wherein the score acquisition means (103) is configured to acquire the overall score of each of the plurality of users further based on a decision tree in which each of the individual scores of the each of the plurality of users is a variable.
  7. The fraud detection system (S) according to any one of claims 1 to 6, wherein each of the plurality of types of feature amounts is acquirable in parallel with each other, and wherein the feature amount acquisition means (105) is configured to acquire the feature amount of the type determined for each of the plurality of users and the feature amount of a type having a shorter acquisition time than the acquisition time of the determined type.
  8. The fraud detection system (S) according to any one of claims 1 to 7, wherein the determination means (104) is configured to determine the acquisition method for each of the plurality of users such that the feature amount important in fraud detection is acquired and the acquisition time becomes shorter as the fraud level becomes lower.
  9. The fraud detection system (S) according to any one of claims 1 to 8, wherein the feature amount acquisition means (105) is configured to acquire the plurality of types of feature amounts, wherein the acquisition method is a time limit within which the feature amount is permitted to be acquired, wherein the determination means (104) is configured to determine the time limit for each of the plurality of users such that the time limit becomes shorter as the fraud level becomes lower, and wherein the feature amount acquisition means (105) is configured to acquire the feature amount of each of the plurality of users based on the time limit determined for the each of the plurality of users.
  10. The fraud detection system (S) according to any one of claims 1 to 9, wherein the score acquisition means (103) is configured to acquire the score of each of the plurality of users based on a first action performed by the each of the plurality of users, and wherein the detection means (106) is configured to detect fraud made by each of the plurality of users based on the feature amount of the each of the plurality of users when a second action after the first action is performed by the each of the plurality of users.
  11. The fraud detection system (S) according to claim 10, wherein the first action is an action up to a request for payment, wherein the second action is the request for the payment, and wherein the fraud detection system (S) further comprises restriction means (107) for restricting execution of the payment by, among the plurality of users, a user for which fraud has been detected.
  12. A fraud detection method, comprising: a score acquisition step of acquiring, based on an action performed by each of a plurality of users, a score relating to a fraud level of the each of the plurality of users; a determination step of determining, based on the score of each of the plurality of users, an acquisition method for a feature amount of the each of the plurality of users such that an acquisition time of the feature amount becomes shorter as the fraud level becomes lower, wherein the acquisition method is the type of the feature amount to be acquired and a plurality of types of feature amount are acquirable, and wherein the determination step determines the type of the feature amount for each of the plurality of users such that the acquisition time becomes shorter as the fraud level becomes lower; a feature amount acquisition step of acquiring the feature amount of each of the plurality of users based on the acquisition method determined for the each of the plurality of users, wherein the feature amount acquisition step acquires the feature amount of the type of feature amount determined for each of the plurality of users; and a detection step of detecting fraud made by each of the plurality of users based on the feature amount of the each of the plurality of users.
  13. A program for causing a computer to function as: score acquisition means (103) for acquiring, based on an action performed by each of a plurality of users, a score relating to a fraud level of the each of the plurality of users; determination means (104) for determining, based on the score of each of the plurality of users, an acquisition method for a feature amount of the each of the plurality of users such that an acquisition time of the feature amount becomes shorter as the fraud level becomes lower, wherein the acquisition method is the type of the feature amount to be acquired and the determination means is configured to determine the type of the feature amount for each of the plurality of users such that the acquisition time becomes shorter as the fraud level becomes lower; feature amount acquisition means (105) for acquiring the feature amount of each of the plurality of users based on the acquisition method determined for the each of the plurality of users, wherein the feature amount acquisition means (105) is configured to acquire a plurality of types of feature amounts, and configured to acquire the feature amount of the type determined for each of the plurality of users; and detection means (106) for detecting fraud made by each of the plurality of users based on the feature amount of the each of the plurality of users.

Description

Technical Field This disclosure relates to a fraud detection system, a fraud detection method, and a program. Background Art Hitherto, there has been known a technology for detecting fraud made by a user based on actions performed by the user. For example, in Patent Literature 1, there is described a system configured to create a learning model for detecting a fraudulent user by causing a learning model to learn training data in which feature amounts of users are used as inputs and determination results of normality levels of the users is outputs. US2019/259037 discloses an information processing device that calculates, for each operation of a user, a fraud determination score and, in response to an operation of a user, a level of fraud of the operation based on a log of the fraud determination score. The information processing device executes an identity confirmation process at a time of the operation, and executes a payment method change process on a user determined as having a high possibility of fraud at a time of product purchase. US2013024375 discloses a multi-stage filtering process and system for fraud detection. Citation List Patent Literature [PTL 1] WO 2019/049210 A1 Summary of Invention Technical Problem However, in the technology of Patent Literature 1, the settings related to the acquisition of the feature amounts are common to all users, and therefore when an attempt is made to accurately detect fraud by using the learning model, it is required to acquire a large number of feature amounts for all the users. As a result, when the system as a whole is considered, fraud detection takes a long period of time. One object of this disclosure is to shorten a period of time required for fraud detection. Solution to Problem There is provided a fraud detection system, a fraud detection method, and a program, in accordance with the appended claims. Advantageous Effects of Invention According to the invention as defined by the appended claims, it is possible to shorten the time required for the fraud detection. Brief Description of Drawings FIG. 1 is a diagram for illustrating an example of an overall configuration of a fraud detection system.FIG. 2 is a diagram for illustrating an example of actions up to a fraud detection point.FIG. 3 is a function block diagram for illustrating an example of functions to be implemented in the fraud detection system.FIG. 4 is a table for showing a data storage example of a user database.FIG. 5 is a table for showing a data storage example of a feature amount database.FIG. 6 is a table for showing a data storage example of setting data.FIG. 7 is a graph for showing an example of a distribution relating to a relationship between an overall score and the number of requests.FIG. 8 is a flowchart for illustrating an example of setting processing.FIG. 9 is a flowchart for illustrating an example of fraud detection processing.FIG. 10 is a flowchart for illustrating an example of the fraud detection processing.FIG. 11 is a diagram for illustrating an example of a decision tree in Modification Example (1) of this disclosure.FIG. 12 is a table for showing a data storage example of a feature amount database in Modification Example (3) of this disclosure. Description of Embodiments [1. Overall Configuration of Fraud Detection System] Description is now given of an example of an embodiment of a fraud detection system according to one aspect of this disclosure. FIG. 1 is a diagram for illustrating an example of an overall configuration of the fraud detection system . As illustrated in FIG. 1, a fraud detection system S includes a fraud detection server 10, feature amount servers 20-1 to 20-n (n is an integer of 2 or more), and a user terminal 30. Those parts can be connected to a network N, for example, the Internet. In FIG. 1, one fraud detection server 10 and one user terminal 30 are illustrated, but there may be a plurality of fraud detection servers 10 and user terminals 30. In the following description, when the feature amount servers 20-1 to 20-n are not distinguished, those parts are simply referred to as "feature amount server 20." Similarly, when control units 21-1 to 21-n, storage units 22-1 to 22-n, and communication units 23-1 to 23-n are not distinguished, those parts are simply referred to as "control unit 21," "storage unit 22," and "communication unit 23," respectively. The total number of feature amount servers 20 is represented by "n". There may be only one feature amount server 20, and "n" may be 1. Further, the fraud detection system S is not required to include the feature amount server 20. In that case, the fraud detection server 10 may have the same functions as those of the feature amount server 20. The fraud detection server 10 is a server computer. The fraud detection server 10 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 includes at least one microprocessor. The control unit 11 executes processing as progra