Abstract: A computer-implemented method for reconciling records from a plurality of data sets includes receiving a first data set from a left data source, retrieving data from the first data set, and placing the retrieved data from the first data set into a first abstract record from the left data source. The method also includes receiving a second data set from a right data source, retrieving data from the second data set, and placing the retrieved data from the second data set into a second abstract record from the right data source. The computer-implemented method also includes comparing the first abstract record and the second abstract record.

Abstract: A computer-implemented method includes receiving a new data record associated with a transaction, and generating, using an adaptive model executed by the computer, a score to represent a likelihood that the transaction is associated with fraud. The adaptive model employs feedback from one or more external data sources, the feedback containing information about one or more previous data records associated with fraud and non-fraud by at least one of the one or more external data sources. Further, the adaptive model uses the information about the one or more previous data records as input variables to update scoring parameters used to generate the score for the new data record.

Abstract: A computer-implemented method and system for detecting fraud in electronic commerce traffic are disclosed. A global conversion rate is defined that represents activity related to a purchase made or proxy activity executed during electronic commerce traffic to a commercial website that is indicative of non-fraud activity. Subsets of the electronic commerce traffic to a commercial website are monitored for clusters of activity having a conversion rate that is lower than a global conversion rate by a threshold margin. A number of user-initiated input signals from an input device to navigate from each of one or more affiliate websites to the commercial website, and a number of conversions generated from each of the one or more affiliate websites, are registered by a computer for analysis.

Abstract: In one aspect there is provided a method. The method may include generating a graphical representation of a decision logic underlying a solution, the graphical representation having a plurality of nodes. A component archetype can be identified. The identified component archetype can support generating a function implementing one of the plurality of nodes in the graphical representation of the solution. An instance of the component can be generated based at least on the component archetype. The function can be generated by invoking the instance of the component. The generated function can be hosted by the instance of the component. Alternately and/or additionally, the generation function can be copied into one or more separate execution environments. Systems and articles of manufacture, including computer program products, are also provided.

Abstract: A predictive estimator, trained on a data corpus, is used to generate a probability estimate based a sequence of data related to an entity. The predictive estimator computes an instantaneous surprise score which is a quantification of a short-term deviation of a datum from the probability estimate. To compute the instantaneous surprise score, the predictive estimator is initialized with default values of the predictive estimator. Then, for each of data input of the datum to the predictive estimator, the instantaneous surprise score is calculated, corresponding to the deviation of the data input from the probability estimate. This generates an estimate of the probability of observing the datum given past data on the entity and the predictive estimator. The predictive estimator is updated with the datum and the time step advanced.

Abstract: A system and method for rapid data investigation and data integrity analysis is disclosed. A data set is received by a server computer from one or more client computers connected with the server computer via a communications network, and the data set is stored in a distributed storage memory. One or more analytical processes are executed on the data set from the distributed storage memory to generate statistics based on each of the analytical processes, and the statistics are stored in a random access memory, the random access memory being accessible by one or more compute nodes, which generate a graphical representation of at least some statistics stored in the random access memory. The graphical representation of at least some statistics is then formatted for transmission to and display by the one or more client computers.

Abstract: Data is received that include values that correspond to a plurality of variables. A score is then generated based on the received data and using a boosted ensemble of segmented scorecard models. The boosted ensemble of segmented scorecard models includes two or more segmented scorecard models. Subsequently, data including the score can be provided (e.g., displayed, transmitted, loaded, stored, etc.). Related apparatus, systems, techniques and articles are also described.

Abstract: The state of a system is determined in which data sets are generated that include a plurality of data instances representing states of one or more components of a computer system. The data instances generated by one or more data set sources that are configured to output a data instance in response to a trigger associated with the one or more components. The data instances are normalized by the application of one or more rules. The data instances from individual data set sources are separately collated to generate groups of time-specific collated data instances. State types may be assigned to each of the collated data instance groups. Distributions of state-types across the groups may be determined and a list of infrequent state-types may be generated based on the determined distributions of state-types across the groups.

Abstract: A computer-implemented method and system for detecting fraud in electronic commerce traffic are disclosed. A global conversion rate is defined that represents activity related to a purchase made or proxy activity executed during electronic commerce traffic to a commercial website that is indicative of non-fraud activity. Subsets of the electronic commerce traffic to a commercial website are monitored for clusters of activity having a conversion rate that is lower than a global conversion rate by a threshold margin. A number of user-initiated input signals from an input device to navigate from each of one or more affiliate websites to the commercial website, and a number of conversions generated from each of the one or more affiliate websites, are registered by a computer for analysis.

Abstract: A computer-implemented method and system for visualizing card transaction fraud analysis is presented. Transaction data and account data related to one or more payment card accounts is stored in a database. The transaction data includes a fraud score. A computer processor generates one or more of a plurality of visualizations of activity of at least one suspicious account from the one or more payment card accounts for display in a graphical user interface, each of the plurality of visualizations providing at least a graphical representation of the transaction data and which is selectable from a menu provided by the computer processor in the graphical user interface. The visualizations assist in case judgment of the one or more payment cards.

Abstract: A task worker running on a worker server receives a process specification over a network. The process specification specifies a task to be executed by the task worker. The executed task includes generating an output data object for an output data stream based in part on an input data object from an input data stream. The process specification is accessed to specify the required fields to be read from for executing the task and to specify the generated the fields in the input data object that will be written to during or subsequent to the executing of the task. The task worker executes the task and generates the output data object. The output data object is then transmitted to the output stream based on the stream configuration.

Abstract: A configuration package receives user-generated input that configures a decision service to generate decision data. The configuration package includes artifacts and the user-generated input selects the artifacts from an artifact library in a configuration database. A configured decision service is generated, where the generating includes receiving, by a decision service factory, the configuration package. Also, the decision service factory receives a decision template including configurable decision elements and non-configurable decision elements. Further, the decision service factory receives a user configuration specifying a parameter in the corresponding artifact. The artifact from the configuration package, the user configuration and the decision template are combined to generate the configured decision service. The configured decision service receives, from a client computer, input for each of the configurable decision elements.

Abstract: A computer-implemented method and system for detecting fraud in electronic commerce traffic are disclosed. A global conversion rate is defined that represents activity related to a purchase made or proxy activity executed during electronic commerce traffic to a commercial website that is indicative of non-fraud activity. Subsets of the electronic commerce traffic to a commercial website are monitored for clusters of activity having a conversion rate that is lower than a global conversion rate by a threshold margin. A number of user-initiated input signals from an input device to navigate from each of one or more affiliate websites to the commercial website, and a number of conversions generated from each of the one or more affiliate websites, are registered by a computer for analysis.

Abstract: Data is received that characterizes a score model. Thereafter, the score model is normalized by transforming it into a directed acyclic graph. The directed acyclic graph is then transformed into a structured rules language program. The structured rules language program is then transformed into a program using a concurrent, class-based, object-oriented computer programming language (e.g., JAVA, C, COBOL, etc.). Related apparatus, systems, techniques and articles are also described.

Abstract: A system and method for detecting compromise of financial transaction instruments associated with a merchant or automated teller machine (ATM) are disclosed. Historical data representing a historical aggregate financial transaction instrument behavior history is stored in a computer memory. The historical data is received at the computer from one or more merchants and ATMs via a communications network. Authorization data representing authorization behavior of a plurality of financial transaction cards related to corresponding financial transactions at the same or a different one or more merchants and ATMs is received by the computer. Abnormal activity data representing an abnormal aggregate financial transaction instrument activity based on the authorization data is determined, and the historical data is compared with the abnormal activity data to generate a compromise profile for the plurality of financial transaction instruments.

Abstract: A system and method for detecting a test event involving a financial transaction device at a merchant having a merchant profile is disclosed. The method includes receiving data associated with a transaction involving a financial transaction device; calculating a score using at least the transaction data; comparing the score to a threshold value; and attaching a merchant probe flag to the merchant profile if the score exceeds the threshold value. The merchant probe flag indicates a likelihood that a test event has occurred at the merchant based on the score. If a test event has occurred, then financial transaction devices involved in the test event can have their profiles updated to reflect that they have been probed. If a financial transaction device that has been probed is used in a subsequent transaction, then a specialized fraud scoring model can be used to provide an improved fraud risk score.

Abstract: Data can be accessed from a plurality of disparate data sources from at least one database. A plurality of test models can be automatically built by a model building engine. Each test model can have predetermined predictive variables. A final set of predictive variables can be determined by a variable selector from the predetermined predictive variables in the plurality of test models by comparing the predictive power of the predictive variables across the plurality of test models. A master dataset can be generated from the disparate data sources. A master model can be built from the master dataset. The master model can combine the final set of predictive variables from the plurality of disparate data sources. The master model can characterize a quantitative estimate of the probability that an entity will display a defined behavior. Related apparatus, systems, techniques, and articles are also described.

Abstract: A coverage monitor subsystem receives an electronic message from a project data object over a communication network. The project data object includes decision code modules that have rules with a corresponding test status variable. The test status variable indicates whether the rule has been tested. The coverage monitor subsystem generates a test status identifier. The test status identifier indicates the decision code modules as tested decision code modules when all of the rules for the corresponding decision code modules have been tested. The coverage monitor subsystem transmits test status data to a reporting subsystem. The test status data includes a first identifier identifying the tested decision code modules and a second identifier identifying the decision code modules that are not tested. The reporting subsystem displays, at a computer display, a graphical representation based on the first identifier and the second identifier.

Abstract: A system and method are disclosed, to distinguish fraudulent transactions from a legitimate transaction, predicated on the notion that the card is considered likely to be in state of fraud. The disclosed system and method can be activated as soon as an account has suspicious activity that causes a high score for potential fraud, but before a bank either can or needs to confirm fraud. The system or method is able to pinpoint the actual fraudulent transactions inside a window of potential fraudulent activity, using a specialized model referred to as the pinpoint model.

Abstract: A system and method for detecting a test event involving a financial transaction device at a merchant having a merchant profile is disclosed. The method includes receiving data associated with a transaction involving a financial transaction device; calculating a score using at least the transaction data; comparing the score to a threshold value; and attaching a merchant probe flag to the merchant profile if the score exceeds the threshold value. The merchant probe flag indicates a likelihood that a test event has occurred at the merchant based on the score. If a test event has occurred, then financial transaction devices involved in the test event can have their profiles updated to reflect that they have been probed. If a financial transaction device that has been probed is used in a subsequent transaction, then a specialized fraud scoring model can be used to provide an improved fraud risk score.