Abstract: A method for detecting fraudulent interactions may include receiving interaction data, including a first plurality of interactions with (first) fraud labels and a second plurality of interactions (without fraud labels). Second fraud label data for each of the second plurality of interactions may be generated with a first neural network (e.g., classifying whether each interaction is fraudulent or not). Generated interaction data and generated fraud label data may be generated with a second neural network. Discrimination data for each of the second plurality of interactions and generated interactions may be generated with a third neural network (e.g., classifying whether the respective interaction is real or not). Error data may be determined based on the discrimination data (e.g., whether the respective interaction is correctly classified). At least one of the neural networks may be trained based on the error data. A system and computer program product are also disclosed.

Abstract: Provided are a system, method, and computer program product for network anomaly detection. The method includes determining a plurality of nested groups based on event data associated with a plurality of communications in a computer network. The method also includes generating display data configured to cause a display of a computing device to show a first graphical representation of the event data including a plurality of nested graphical nodes. The method further includes receiving new event data associated with a plurality of new communications in the computer network in a subsequent time period and generating new display data configured to cause the display to show a new graphical representation of the new event data. The method further includes determining an anomalous graphical node based at least partly on a size of the anomalous graphical node being increased in the new graphical representation relative to the first graphical representation.

Abstract: Provided are a system, method, and computer program product for network anomaly detection. The method includes receiving event data associated with a plurality of events in a computer network. The method also includes determining nested groups of the event data representing tiers of an operational hierarchy. The method further includes generating display data to show a graphical representation of the event including a plurality of nested graphical nodes and at least one spline. Each graphical node is associated with a group or a computer node, each graphical node encompasses and/or is encompassed by another graphical node, a size of each graphical node is proportional to an aggregated parameter value of events associated therewith, each spline connects at least two graphical nodes and includes a curve that passes through a common graphical node, and each spline is associated with a communication between at least two computer nodes.

Abstract: Provided is a computer-implemented method for monitoring and improving data quality of transaction data that may include receiving transaction data associated with a plurality of payment transactions from an acquirer system. The transaction data may include a transaction record associated with each payment transaction of the plurality of payment transactions. Each transaction record may include a plurality of data fields. Each respective data field of the plurality of data fields may be categorized into a respective type of a plurality of types. A data quality score for each respective data field of the plurality of data fields may be determined based on the respective type of the respective data field. A system and computer program product are also provided.

Abstract: A computer-implemented method includes: receiving an inquiry request message identifying a first payment transaction having a plurality of transaction parameters and a risk score, where the risk score is generated by a machine-learning model based on the plurality of transaction parameters; for each transaction parameter of the plurality of transaction parameters, perturbing a value of the transaction parameter and re-analyzing the first payment transaction with the machine-learning model to generate a perturbed risk score based on the perturbed transaction parameter; determining at least one impact parameter from the plurality of transaction parameters by comparing the perturbed risk scores generated for each of the plurality of transaction parameters; and generating an inquiry response message based on the at least one impact parameter.

Abstract: Provided are a method, system, and computer program product for generating synthetic data. The method includes generating a correlation graph of a plurality of data types based on a plurality of correlations. The method also includes generating a directed acyclic graph of the plurality of data types based on the correlation graph. The method further includes traversing the directed acyclic graph to produce a hierarchical graph of the plurality of data types, wherein the hierarchical graph includes a plurality of nodes, and wherein each node of the plurality of nodes is associated with a data type of the plurality of data types. The method further includes generating synthetic training data including a plurality of records of data by repeatedly traversing the hierarchical graph and based on a plurality of sets of values and a plurality of sets of interdependencies.

Abstract: Provided is a computer-implemented method for monitoring and improving data quality of transaction data that may include receiving transaction data associated with a plurality of payment transactions from an acquirer system. The transaction data may include a transaction record associated with each payment transaction of the plurality of payment transactions. Each transaction record may include a plurality of data fields. Each respective data field of the plurality of data fields may be categorized into a respective type of a plurality of types. A data quality score for each respective data field of the plurality of data fields may be determined based on the respective type of the respective data field. A system and computer program product are also provided.

Abstract: Provided are a system, method, and computer program product for generating synthetic data. The method includes receiving a plurality of data types associated with an environment to be evaluated and receiving a plurality of correlations of one data type to another data type. The method also includes generating a correlation graph of the plurality of data types based on the plurality of correlations and generating a directed acyclic graph of the plurality of data types based on the correlation graph. The method further includes generating a hierarchical graph of the plurality of data types by applying a path traversal technique to the directed acyclic graph and generating a synthetic dataset by repeatedly traversing the hierarchical graph to generate a plurality of records of data.

Abstract: Methods, systems, and computer program products for learning continuous embedding space of real time payment (RTP) transactions are provided. A method may include receiving RTP data including a plurality of attributes, including a sender and a receiver. One attribute is selected as a target attribute. The remaining attributes are input into a first machine learning model (e.g., NLP model), comprising at least one embedding layer and one hidden layer, which is trained to predict the target attribute. After the model is trained, each of the remaining attributes are converted to a first vector using the at least one embedding layer of the machine learning model to form a first set of vectors. The first set of vectors are stored and subsequently input into a second machine learning model to perform at least one second task different than the first task.

Abstract: Systems, apparatuses, methods, and computer-readable media are provided for detecting security attacks based on transaction flow graphs. Other embodiments may be described and/or claimed.

Abstract: A method for detecting fraudulent interactions may include receiving interaction data, including a first plurality of interactions with (first) fraud labels and a second plurality of interactions (without fraud labels). Second fraud label data for each of the second plurality of interactions may be generated with a first neural network (e.g., classifying whether each interaction is fraudulent or not). Generated interaction data and generated fraud label data may be generated with a second neural network. Discrimination data for each of the second plurality of interactions and generated interactions may be generated with a third neural network (e.g., classifying whether the respective interaction is real or not). Error data may be determined based on the discrimination data (e.g., whether the respective interaction is correctly classified). At least one of the neural networks may be trained based on the error data. A system and computer program product are also disclosed.

Abstract: A method for detecting collusive transaction fraud includes: generating a merchant baseline including a transaction data baseline and a time series baseline; extracting time series data of the first merchant system; generating a first score and second score with a deep learning model; generating a first merchant risk score of the first merchant system based on the first and second scores; in response to determining that the first merchant risk score satisfies the threshold, determining a plurality of related entities related to the first merchant system; and classifying the first merchant system and at least one related entity of the plurality of related entities in a first group risk class based on at least one risk score of the at least one related entity.

Abstract: Provided are a system, method, and computer program product for network anomaly detection. The method includes receiving event data associated with a plurality of events in a computer network. The method also includes determining nested groups of the event data representing tiers of an operational hierarchy. The method further includes generating display data to show a graphical representation of the event including a plurality of nested graphical nodes and at least one spline. Each graphical node is associated with a group or a computer node, each graphical node encompasses and/or is encompassed by another graphical node, a size of each graphical node is proportional to an aggregated parameter value of events associated therewith, each spline connects at least two graphical nodes and includes a curve that passes through a common graphical node, and each spline is associated with a communication between at least two computer nodes.

Abstract: A method for detecting fraudulent interactions may include receiving interaction data, including a first plurality of interactions with (first) fraud labels and a second plurality of interactions (without fraud labels). Second fraud label data for each of the second plurality of interactions may be generated with a first neural network (e.g., classifying whether each interaction is fraudulent or not). Generated interaction data and generated fraud label data may be generated with a second neural network. Discrimination data for each of the second plurality of interactions and generated interactions may be generated with a third neural network (e.g., classifying whether the respective interaction is real or not). Error data may be determined based on the discrimination data (e.g., whether the respective interaction is correctly classified). At least one of the neural networks may be trained based on the error data. A system and computer program product are also disclosed.

Abstract: Provided are a system, method, and computer program product for generating synthetic data. The method includes receiving a plurality of data types associated with an environment to be evaluated and receiving a plurality of correlations of one data type to another data type. The method also includes generating a correlation graph of the plurality of data types based on the plurality of correlations and generating a directed acyclic graph of the plurality of data types based on the correlation graph. The method further includes generating a hierarchical graph of the plurality of data types by applying a path traversal technique to the directed acyclic graph and generating a synthetic dataset by repeatedly traversing the hierarchical graph to generate a plurality of records of data.

Abstract: Described are a system, method, and computer program product for breach detection using convolutional neural networks. The method includes receiving transaction data associated with a plurality of transactions completed in a first time period. The method also includes identifying a set of suspected fraudulent transactions of the plurality of transactions based on inputting at least one parameter of the transaction data into a fraud evaluation model. The method further includes generating an image comprising a field of points, wherein each point is associated with at least one transaction of the set of suspected fraudulent transactions, and wherein an x-axis position in the image of each point in the field of points is associated with a time subperiod of the first time period in which the at least one transaction occurred. The method further includes detecting a breach event by processing the image with a convolutional neural network (CNN) model.

Abstract: Described are a system, method, and computer program product for merchant breach detection using convolutional neural networks. The method includes receiving transaction data associated with a plurality of transactions by a plurality of payment devices in a first time period subsequent to the plurality of payment devices transacting with a merchant. The method also includes identifying, based on inputting at least one parameter of the transaction data into a fraud evaluation model, a set of suspected fraudulent transactions of the plurality of transactions. The method further includes generating an image comprising a field of points, wherein each point of the field of points is associated with at least one transaction. The method further includes detecting breach of the merchant by processing the image with a convolutional neural network (CNN) model.

Abstract: Described are a system, method, and computer program product for early detection of and response to a merchant data breach through machine-learning analysis. The method includes receiving transaction data associated with a plurality of transactions and receiving fraudulent transaction data representative of at least one previously identified data-breach incident. The method also includes generating a first model input dataset associated with the at least one merchant and a second model input dataset associated with the at least one previously identified data-breach incident. The method also includes training at least one machine-learning prediction model to associate merchants with a likelihood of data breach and determining at least one breached merchant of the at least one merchant. The method further includes generating a communication configured to cause at least one action to be taken in response to the determination of the at least one breached merchant.

Abstract: Systems, apparatuses, methods, and computer-readable media are provided for detecting security attacks based on transaction flow graphs. Other embodiments may be described and/or claimed.

Abstract: Provided is a method for detecting group activities in a network. The method may include receiving interaction data associated with a plurality of interactions. For each account identifier associated with at least one interaction, a value may be determined for each of a first set of categories, and a vector may be generated based on the value for each category. The length of each vector may be determined. At least one relational graph may be generated based on the interaction data. Each relational graph may be associated with a respective category of a second set of categories. At least one cluster of nodes may be determined based on the relational graph(s). A score for each cluster may be determined based on the length of the vector associated with the account identifier of each node of the cluster of nodes. A system and computer program product are also disclosed.