{"id":1015,"date":"2021-10-12T08:39:30","date_gmt":"2021-10-12T08:39:30","guid":{"rendered":"https:\/\/salarydistribution.com\/machine-learning\/2021\/10\/12\/detect-online-transaction-fraud-with-new-amazon-fraud-detector-features\/"},"modified":"2021-10-12T08:39:30","modified_gmt":"2021-10-12T08:39:30","slug":"detect-online-transaction-fraud-with-new-amazon-fraud-detector-features","status":"publish","type":"post","link":"https:\/\/salarydistribution.com\/machine-learning\/2021\/10\/12\/detect-online-transaction-fraud-with-new-amazon-fraud-detector-features\/","title":{"rendered":"Detect online transaction fraud with new Amazon Fraud Detector features"},"content":{"rendered":"<div id=\"\">\n<p>Fraud teams need a secure, fast, and flexible transaction fraud detection solution to combat global fraudsters. Unlike many solutions on the market, <a href=\"https:\/\/aws.amazon.com\/fraud-detector\/\" target=\"_blank\" rel=\"noopener noreferrer\">Amazon Fraud Detector<\/a> allows you to tailor your fraud detection efforts specifically to your data and business challenge while also bringing the latest in fraud detection machine learning (ML) technology to bear on the cloud.<\/p>\n<p>To help you catch fraud faster across multiple use cases, Amazon Fraud Detector offers specific models with tailored algorithms, enrichments, and feature transformations. The new Transaction Fraud Insights model has been developed to detect card-not-present and other transaction frauds in real time. In addition to the latest ML techniques used in the existing Online Fraud Insights model, the Transaction Fraud Insights model dynamically calculates information about your customers, such as their frequency of purchases and how long their account has been active. These calculations, often called <em>aggregates<\/em> or <em>velocity measures<\/em>, improve model performance and stability over time. This improvement in model performance directly benefits your business as you capture more fraud and turn away fewer legitimate customers.<\/p>\n<p>In addition to discussing the Transaction Fraud Insights model, this post guides you through several other new features:<\/p>\n<ul>\n<li><strong>Stored events <\/strong>\u2013 Allows you to easily store production fraud data directly within Amazon Fraud Detector, enabling the service to continuously calculate aggregates and simplifying the model retraining process<\/li>\n<li><strong>Batch import<\/strong> \u2013 Allows you to upload a CSV file of event data to be automatically stored<\/li>\n<li><strong>Events data metrics<\/strong> \u2013 Displays information about your stored events, such as the total number of events and the earliest event timestamp<\/li>\n<li><strong>Model variable importance<\/strong> \u2013 Provides a ranked list of model inputs based on their relative importance so you have better insight into how to improve your model\u2019s performance<\/li>\n<\/ul>\n<h2>Solution overview<\/h2>\n<p>This post helps you test the Transaction Fraud Insights model using the Amazon Fraud Detector console so you can demonstrate the value of Amazon Fraud Detector to your business. The following steps outline the process of training a Transaction Fraud Insights model and using the model to generate fraud predictions. If you\u2019re already familiar with training the Online Fraud Insights models, you\u2019ll notice that only Step 4 is significantly different than the existing model training process.<\/p>\n<ol>\n<li>Gather data<\/li>\n<li>Define the entity<\/li>\n<li>Define the event, event variables, and event labels<\/li>\n<li>Upload event data<\/li>\n<li>Initiate model training<\/li>\n<li>Evaluate the model<\/li>\n<li>Create a detector and define business rules<\/li>\n<li>Integrating your detector to payment systems<\/li>\n<\/ol>\n<h2>Gather data<\/h2>\n<p>To train a model, the Transaction Fraud Insights model requires at least 10,000 records, with at least 400 of those records identified as fraudulent. The model also requires that both fraudulent records and legitimate records come from at least 100 different entities each to ensure the diversity of the dataset. Entities represent what or who is performing the transaction, such as a customer. There is no upper limit on the number of records you can provide; the more records and variety of fraudulent examples, the better. We have provided a <a href=\"https:\/\/aws-ml-blog.s3.amazonaws.com\/artifacts\/fraud-detector-transaction-fraud-insights\/synthetic_txn_data_new.csv\" target=\"_blank\" rel=\"noopener noreferrer\">sample dataset<\/a> that you can use to get started.<\/p>\n<p>The Transaction Fraud Insights model is trained on stored event data and applies historic context to predictions by calculating aggregates on each entity within the stored dataset. Therefore, in addition to the mandatory EVENT_TIMESTAMP and EVENT_LABEL fields you needed to provide for Online Fraud Insights models, Transaction Fraud Insights requires four additional fields: EVENT_ID, ENTITY_ID, ENTITY_TYPE, and LABEL_TIMESTAMP. The field details are as follows:<\/p>\n<ul>\n<li><strong>EVENT_TIMESTAMP<\/strong> \u2013 Identifies when the event took place and should follow <a href=\"https:\/\/docs.aws.amazon.com\/frauddetector\/latest\/ug\/uploading-event-data-to-an-s3-bucket.html#timestamp-formats\" target=\"_blank\" rel=\"noopener noreferrer\">timestamp formats<\/a>.<\/li>\n<li><strong>EVENT_LABEL<\/strong> \u2013 Classifies the event as fraudulent or legitimate.<\/li>\n<li><strong>LABEL_TIMESTAMP <\/strong>\u2013 Identifies when the event label was last updated and should follow <a href=\"https:\/\/docs.aws.amazon.com\/frauddetector\/latest\/ug\/uploading-event-data-to-an-s3-bucket.html#timestamp-formats\" target=\"_blank\" rel=\"noopener noreferrer\">timestamp formats<\/a>. If you don\u2019t have this information available, you can set the value to be equal to EVENT_TIMESTAMP.<\/li>\n<li><strong>EVENT_ID<\/strong> \u2013 Is used to retrieve, modify, and delete records stored in Amazon Fraud Detector, and should be unique for each transaction record.<\/li>\n<li><strong>ENTITY_TYPE <\/strong>\u2013 Describes the type of actor performing the transaction. For example, your ENTITY_TYPE may be <code>customer<\/code> or <code>applicant<\/code>.<\/li>\n<li><strong>ENTITY_ID<\/strong> \u2013 Is used to identify the specific actor performing the transaction and is crucial for Transaction Fraud Insights to calculate aggregates. This should be the same for all transactions from the same entity. Typical choices for ENTITY_ID are account numbers, customer emails, or phone numbers.<\/li>\n<\/ul>\n<h2>Define the entity<\/h2>\n<p>The Transaction Fraud Insights model builds a dynamic profile for each entity within your dataset so that it can calculate important data inputs like the first and last time the entity made a transaction, the number of transactions the entity has made, and more.<\/p>\n<p>To create an entity, complete the following steps:<\/p>\n<ol>\n<li>On the Amazon Fraud Detector console, in the navigation pane, choose <strong>Entities<\/strong>.<\/li>\n<li>Choose <strong>Create<\/strong>.<\/li>\n<li>On the <strong>Create entity type<\/strong> page, enter an entity name and optionally an entity description.<\/li>\n<\/ol>\n<p>If you\u2019re using the sample dataset, we suggest creating an entity called <code>customer<\/code>.<\/p>\n<ol start=\"4\">\n<li>Choose <strong>Create entity<\/strong>.<\/li>\n<\/ol>\n<h2><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29079\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/1-6148-Console.jpg\" alt=\"\" width=\"800\" height=\"561\"><\/h2>\n<h2>Define the event, event variables, and event labels<\/h2>\n<p>Events are the activities that an entity performs. For example, an online retail order is an event. An event contains variables like IP address, user agent, and billing information. Events are required to have metadata describing the event (like EVENT_TIMESTAMP and EVENT_ID) and at least two event variables. To save time, you can import your variable names from a CSV file. To do so, store the training data for your events in <a href=\"http:\/\/aws.amazon.com\/s3\" target=\"_blank\" rel=\"noopener noreferrer\">Amazon Simple Storage Service<\/a> (Amazon S3). You also need an <a href=\"http:\/\/aws.amazon.com\/iam\" target=\"_blank\" rel=\"noopener noreferrer\">AWS Identity and Access Management<\/a> (IAM) role with permissions to access Amazon S3. Complete the following steps to create an event:<\/p>\n<ol>\n<li>On the Amazon S3 console, create an S3 bucket.<\/li>\n<li>Upload your training data file to that bucket. Note the Amazon S3 location of your training file (for example, <code>s3:\/\/bucketname\/path\/to\/some\/object.csv<\/code>) and your role name.<\/li>\n<li>On the Amazon Fraud Detector console, in the navigation pane, choose <strong>Events<\/strong>.<\/li>\n<li>Choose <strong>Create<\/strong>.<\/li>\n<li>For <strong>Name<\/strong>, enter <code>transaction_event<\/code> as the event name.<\/li>\n<li>For <strong>Entity<\/strong>, choose <strong>customer<\/strong>.<\/li>\n<li>Under <strong>Event variables<\/strong>, choose <strong>Select variables from a training dataset<\/strong>.<\/li>\n<li>For <strong>IAM role<\/strong>, choose an existing IAM role or create a new role to access data in Amazon S3.<\/li>\n<li>For <strong>Data location<\/strong>, enter the S3 location of your training file and choose <strong>Upload<\/strong>.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29080\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/2-6148-Console.jpg\" alt=\"\" width=\"800\" height=\"627\"><\/p>\n<p>Amazon Fraud Detector extracts the headers from your training dataset and creates a variable for each header.<\/p>\n<ol start=\"10\">\n<li>Next, map the variables to variable types.<\/li>\n<\/ol>\n<p>Mapping variables to their correct type ensures maximum model performance, because Amazon Fraud Detector has specific enrichment and transformation techniques for each variable type.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29081\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/3-6148-Console.jpg\" alt=\"\" width=\"800\" height=\"543\"><\/p>\n<ol start=\"11\">\n<li>Finally, define the labels.<\/li>\n<\/ol>\n<p>Those should include all the values under the EVENT_LABEL column in your dataset. In the sample dataset, 1 denotes fraud and 0 denotes a legitimate event.<\/p>\n<ol start=\"12\">\n<li>Choose <strong>Create event type<\/strong>.<\/li>\n<\/ol>\n<h2><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29082\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/4-6148-Console.jpg\" alt=\"\" width=\"800\" height=\"303\"><\/h2>\n<h2>Upload event data<\/h2>\n<p>After you define your event, navigate to the <strong>Stored events<\/strong> tab. On this page, you can turn event ingestion on or off. When event ingestion is on, you can upload historic event data to Amazon Fraud Detector and automatically store event data from predictions in real time.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29083\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/5-6148-Transactions.jpg\" alt=\"\" width=\"800\" height=\"333\"><\/p>\n<p>On the <strong>Stored events<\/strong> tab, you can see information about your dataset, such as the number of events stored and the total size of the dataset in MB. Because you just created this event type, there are no stored events yet. Before you start generating predictions, you should upload a large amount of historic data to train your first Transaction Fraud Insights model. You only need to do this one time\u2014after you train your first model, Amazon Fraud Detector automatically stores event data whenever you generate predictions.<\/p>\n<p>The easiest way to store historic data is by uploading a CSV file and importing the events. Alternatively, you can stream the data into Amazon Fraud Detector using the <code>SendEvent<\/code> API (see our <a href=\"https:\/\/github.com\/aws-samples\/aws-fraud-detector-samples\" target=\"_blank\" rel=\"noopener noreferrer\">GitHub repository<\/a> for sample notebooks). To upload a CSV file, complete the following steps:<\/p>\n<ol>\n<li>Under <strong>Import events data<\/strong>, choose <strong>New import<\/strong>.<\/li>\n<\/ol>\n<p>You likely need to create a new IAM role, because the import feature requires both read and write access to Amazon S3.<\/p>\n<ol start=\"2\">\n<li>When creating a new IAM role, specify the bucket that stores your event data and, optionally, a separate bucket to write output files. If you prefer to keep all files within the same bucket, enter the same bucket name into both fields.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29106\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/6-6148-Create-IAM.png\" alt=\"\" width=\"460\" height=\"364\"><\/p>\n<ol start=\"3\">\n<li>After you create your IAM role, enter the location of the CSV file that contains your event data. You can use the same file that you used to import a list of variables earlier.<\/li>\n<li>Choose <strong>Start<\/strong> to begin importing events to Amazon Fraud Detector.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29085\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/7-6148-new-events-import.jpg\" alt=\"\" width=\"800\" height=\"568\"><\/p>\n<p>The import time varies based on the number of events you\u2019re importing. For the sample dataset, the process takes around 12 minutes. After you refresh the page, the status changes to Completed and all the events in the file have successfully been uploaded.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29086\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/8-6148-transaction.jpg\" alt=\"\" width=\"800\" height=\"289\"><\/p>\n<p>The data on your stored events, like the total number of events, has not been updated. This data is refreshed automatically one time per day. You can optionally refresh it on demand by choosing <strong>Refresh events data<\/strong>.<\/p>\n<h2>Initiate model training<\/h2>\n<p>Now that you have uploaded events to Amazon Fraud Detector, your next step is to train a model. We recommend waiting 10 minutes after the import completes to ensure that they are fully processed by the system.<\/p>\n<p>To train a model, complete the following steps:<\/p>\n<ol>\n<li>On the Amazon Fraud Detector console, in the navigation pane, choose <strong>Models<\/strong>.<\/li>\n<li>Choose <strong>Add model<\/strong> and select <strong>Create model<\/strong>.<\/li>\n<li>For <strong>Model name<\/strong>, enter transaction_model.<\/li>\n<li>For <strong>Model type<\/strong>, choose <strong>Transaction Fraud Insights<\/strong>.<\/li>\n<li>For <strong>Event type<\/strong>, choose the event type you created (transaction_event).<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29087\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/9-6148-define-model.jpg\" alt=\"\" width=\"800\" height=\"606\"><\/p>\n<ol start=\"6\">\n<li>Under <strong>Historical event data<\/strong>, you can specify the date range of events to train the model.<\/li>\n<\/ol>\n<p>For example, you can exclude events that are still within a credit card chargeback window because the outcome of those events is still uncertain. For this example, you can deselect <strong>Select specific events using a date range<\/strong>.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29088\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/10-6148-historical-event.jpg\" alt=\"\" width=\"800\" height=\"396\"><\/p>\n<ol start=\"7\">\n<li>Choose <strong>Next<\/strong>.<\/li>\n<li>Configure your training by identifying the variables used as inputs to the model. For this example, include all the variables associated to your event type.<\/li>\n<\/ol>\n<p>It\u2019s a best practice to include all the available variables, even if you\u2019re not sure about their value to the model. After the model is trained, Amazon Fraud Detector provides a ranked list of each variable\u2019s impact on the model performance, so you can know whether to include that variable in future model trainings.<\/p>\n<ol start=\"9\">\n<li>Choose <strong>Next<\/strong>.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29107\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/11-6148-configure-training.png\" alt=\"\" width=\"395\" height=\"747\"><\/p>\n<ol start=\"10\">\n<li>Specify your fraud labels and legitimate labels. In the sample dataset, the fraud label is 1 and the legitimate label is 0.<\/li>\n<li>Specify how Amazon Fraud Detector should handle unlabeled events during model training. In this example, the dataset you uploaded didn\u2019t have any unlabeled events, so you can select any option.<\/li>\n<\/ol>\n<p>In general, you should select <strong>Ignore unlabeled events<\/strong> unless you\u2019re certain your unlabeled events should be categorized as legitimate or fraud.<\/p>\n<ol start=\"12\">\n<li>After reviewing the model configured in the first two steps, choose <strong>Create and train model<\/strong>.<\/li>\n<\/ol>\n<p>You can see the model in training.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29090\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/12-6148-transaction_model.jpg\" alt=\"\" width=\"800\" height=\"240\"><\/p>\n<p>Model training takes about an hour. This is because Amazon Fraud Detector trains, evaluates, and optimizes several models on your behalf on the backend. The parameters of the model with the best performance are used to generate your final model that you use to generate predictions.<\/p>\n<h2>Evaluate the model<\/h2>\n<p>After your model has finished training, you can review various metrics to understand its performance.<\/p>\n<ol>\n<li>On the Amazon Fraud Detector console, in the navigation pane, choose <strong>Models<\/strong>.<\/li>\n<\/ol>\n<p>In the <strong>Model versions<\/strong> section, you can see that you have a model with model version 1.0 and the status <code>Ready to deploy<\/code>. Before we get to that, let\u2019s dig into the model performance.<\/p>\n<ol start=\"2\">\n<li>Choose the model version.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29091\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/13-6148.jpg\" alt=\"\" width=\"800\" height=\"255\"><\/p>\n<ol start=\"3\">\n<li>On your model page, review the <strong>Model performance<\/strong><\/li>\n<\/ol>\n<p>The number next to <strong>AUC<\/strong> (Area Under the Curve) summarizes the general performance of a model. A model with no predictive power has an AUC of 0.5, whereas a perfect model has an AUC of 1.0. In general, a model with AUC greater than 0.9 is considered a great model.<\/p>\n<ol start=\"4\">\n<li>You can choose different model scores in the <strong>Score distribution<\/strong> chart to see the corresponding true positive rate (TPR), false positive rate (FPR), and confusion matrix.<\/li>\n<\/ol>\n<p>To learn more about model scores and model performance metrics, see <a href=\"https:\/\/docs.aws.amazon.com\/frauddetector\/latest\/ug\/model-scores.html\" target=\"_blank\" rel=\"noopener noreferrer\">Model scores<\/a> and <a href=\"https:\/\/docs.aws.amazon.com\/frauddetector\/latest\/ug\/training-performance-metrics.html\" target=\"_blank\" rel=\"noopener noreferrer\">Training performance metrics<\/a>.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29092\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/14-6148-model-performance.jpg\" alt=\"\" width=\"800\" height=\"337\"><\/p>\n<ol start=\"5\">\n<li>On the <strong>Table<\/strong> tab, you can use the table to determine model thresholds for writing rules for your detector.<\/li>\n<\/ol>\n<p>For example, make note of the score threshold and true positive rates at a 1% and 3% false positive rate. We use these to define business rules in later steps.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29093\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/15-6148-model.jpg\" alt=\"\" width=\"800\" height=\"525\"><\/p>\n<ol start=\"6\">\n<li>Scroll down to the <strong>Model variable importance<\/strong><\/li>\n<\/ol>\n<p>This ranked list provides the relative importance of each variable that your model was trained on. In this example, product_category had a lot of value, so you may want to include related variables in your next model training. Similarly, billing_city had very little impact to model performance, so you may want to save time in the future by not collecting that data.<\/p>\n<p><strong> <img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29094\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/16-6148.jpg\" alt=\"\" width=\"800\" height=\"227\"><\/strong><\/p>\n<ol start=\"7\">\n<li>On the <strong>Actions <\/strong>menu, choose <strong>Deploy model version<\/strong>.<\/li>\n<\/ol>\n<p>This creates a model endpoint and makes the model available to detectors. Models take 5\u201310 minutes to deploy.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29095\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/17-6148.jpg\" alt=\"\" width=\"800\" height=\"240\"><\/p>\n<h2>Create a detector and define business rules<\/h2>\n<p>Next, you add your model to a detector. A detector is the container for all your fraud detection logic. Here you can combine zero, one, or many ML models with business rules to detect fraud in real time.<\/p>\n<p>To create a detector, complete the following steps:<\/p>\n<ol>\n<li>On the Amazon Fraud Detector console, in the navigation pane, choose <strong>Detectors<\/strong>.<\/li>\n<li>Choose <strong>Create detector<\/strong>.<\/li>\n<li>For <strong>Detector name<\/strong>, enter transaction_fraud_detector.<\/li>\n<li>Optionally, provide a description for your detector<\/li>\n<li>For <strong>Event type<\/strong>, choose the same event type as the model (transaction_event).<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29096\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/18-6148.jpg\" alt=\"\" width=\"800\" height=\"425\"><\/p>\n<ol start=\"6\">\n<li>On the <strong>Add model (optional)<\/strong> page, choose <strong>Add model<\/strong>.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29097\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/19-6148.jpg\" alt=\"\" width=\"800\" height=\"367\"><\/p>\n<ol start=\"7\">\n<li>For <strong>Model<\/strong>, choose <strong>transaction_model<\/strong> and then choose the model version.<\/li>\n<\/ol>\n<p>You can choose to add multiple models to the detector.<\/p>\n<ol start=\"8\">\n<li>Choose <strong>Add model<\/strong>.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29108\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/20-6148-add-model.png\" alt=\"\" width=\"539\" height=\"301\"><\/p>\n<p>On the <strong>Add rules<\/strong> page, you add your business rules. Models produce an <code>insightscore<\/code> field that quantifies the risk of the event being fraud. In this case, your model creates a field called <code>transaction_model_insightscore<\/code> that you can reference when you author rules. Scores range between 0 (least risky) and 1000 (most risky).<\/p>\n<ol start=\"9\">\n<li>Specify <code>decline_rule<\/code> as <code>$transaction_model_insightscore &gt;= 950<\/code>.<\/li>\n<li>Specify <code>friction_rule<\/code> as \u2013 <code>$transaction_model_insightscore &gt;= 855<\/code> and <code>$transaction_model_insightscore &lt; 950<\/code>.<\/li>\n<li>Specify <code>approve_rule<\/code> as \u2013 <code>$transaction_model_insightscore &lt; 855<\/code>.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29099\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/21-6148-define-a-rule.jpg\" alt=\"\" width=\"800\" height=\"968\"><\/p>\n<p>Outcomes are strings returned in the <code>GetEventPrediction<\/code> API response. You can use outcomes to trigger events by calling applications and downstream systems, or to simply identify who is likely to be fraud or legitimate.<\/p>\n<ol start=\"12\">\n<li>Choose <strong>Outcomes<\/strong>, and choose <strong>Create a new outcome<\/strong>.<\/li>\n<li>Enter a name and description for your outcome.<\/li>\n<li>Choose <strong>Save outcome<\/strong>.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29109\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/22-6148-create-a-new-outcome.png\" alt=\"\" width=\"659\" height=\"513\"><\/p>\n<ol start=\"15\">\n<li>On the <strong>Add rules<\/strong> page, choose <strong>Next<\/strong> after you finish adding all your rules.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29101\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/23-6148-add-rules.jpg\" alt=\"\" width=\"800\" height=\"462\"><\/p>\n<ol start=\"16\">\n<li>On the <strong>Configure rule execution<\/strong> page, select the rule execution mode.<\/li>\n<\/ol>\n<p>The Amazon Fraud Detector rules engine has two modes: first matched or all matched. First matched mode is for sequential rule runs, meaning rules have an order and the detector returns the outcome for the first condition met. The other mode is all matched, which evaluates all rules and returns outcomes from all the matching rules. In this example, we use the first matched mode for our detector.<\/p>\n<ol start=\"17\">\n<li>If using first matched mode, you can reorder your rules as needed.<\/li>\n<li>Choose <strong>Next<\/strong>.<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29102\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/24-6148-configure-rule-execution.jpg\" alt=\"\" width=\"800\" height=\"687\"><\/p>\n<ol start=\"19\">\n<li>Finally, test your detector by choosing <strong>Run test<\/strong>.<\/li>\n<\/ol>\n<p>Test the detector with the following two example records:<\/p>\n<table border=\"1px\" cellpadding=\"10px\">\n<tbody>\n<tr>\n<td width=\"117\"><\/td>\n<td width=\"233\"><strong>Example 1<\/strong><\/td>\n<td width=\"196\"><strong>Example 2<\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"117\">EVENT_LABEL<\/td>\n<td width=\"233\">0<\/td>\n<td width=\"196\">1<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">EVENT_TIMESTAMP<\/td>\n<td width=\"233\">2021-04-01T19:20:27Z<\/td>\n<td width=\"196\">2021-04-01T22:08:32Z<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">entity_id<\/td>\n<td width=\"233\">500-89-2444<\/td>\n<td width=\"196\">217-78-6732<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">event_id<\/td>\n<td width=\"233\">0025008e61066eb14c50090ba7b0b2e7<\/td>\n<td width=\"196\">00dfe7d7fc455c8f676ff684e2b9f61b<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">billing_street<\/td>\n<td width=\"233\">608 Ruiz Orchard<\/td>\n<td width=\"196\">858 Douglas Ways<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">billing_city<\/td>\n<td width=\"233\">Temperance<\/td>\n<td width=\"196\">Hayti<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">billing_state<\/td>\n<td width=\"233\">MI<\/td>\n<td width=\"196\">SD<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">billing_zip<\/td>\n<td width=\"233\">48182<\/td>\n<td width=\"196\">57241<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">billing_latitude<\/td>\n<td width=\"233\">41.7682<\/td>\n<td width=\"196\">44.6647<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">billing_longitude<\/td>\n<td width=\"233\">-83.5797<\/td>\n<td width=\"196\">-97.2305<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">customer_job<\/td>\n<td width=\"233\">Accommodation manager<\/td>\n<td width=\"196\">Building surveyor<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">ip_address<\/td>\n<td width=\"233\">91.36.207.79<\/td>\n<td width=\"196\">200.236.210.122<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">customer_email<\/td>\n<td width=\"233\">cmorales@gmail.com<\/td>\n<td width=\"196\">espinozadiana@miller-jones.com<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">phone<\/td>\n<td width=\"233\">7239487650<\/td>\n<td width=\"196\">397-444-9902-233<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">product_category<\/td>\n<td width=\"233\">home<\/td>\n<td width=\"196\">grocery_pos<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">order_price<\/td>\n<td width=\"233\">20.91<\/td>\n<td width=\"196\">314.83<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">payment_currency<\/td>\n<td width=\"233\">SOS<\/td>\n<td width=\"196\">ZAR<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">merchant<\/td>\n<td width=\"233\">fraud_Eichmann-Kilback<\/td>\n<td width=\"196\">fraud_Rau and Sons<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">customer_name<\/td>\n<td width=\"233\">Jason Mullen<\/td>\n<td width=\"196\">Alan Hill<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">card_bin<\/td>\n<td width=\"233\">676297<\/td>\n<td width=\"196\">443718<\/td>\n<\/tr>\n<tr>\n<td width=\"117\">user_agent<\/td>\n<td width=\"233\">Mozilla\/5.0 (Macintosh; U; PPC Mac OS X 10_10_9 rv:2.0; st-ZA) AppleWebKit\/535.25.6 (KHTML, like Gecko) Version\/5.0.2 Safari\/535.25.6<\/td>\n<td width=\"196\">Mozilla\/5.0 (iPod; U; CPU iPhone OS 3_1 like Mac OS X; bho-IN) AppleWebKit\/533.49.3 (KHTML, like Gecko) Version\/3.0.5 Mobile\/8B114 Safari\/6533.49.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The following screenshot shows the outcome and model score.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29103\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/25-6148.jpg\" alt=\"\" width=\"800\" height=\"484\"><\/p>\n<h2>Integrate your detector with payment systems<\/h2>\n<p>You can integrate your detector with your payment system with the <a href=\"https:\/\/docs.aws.amazon.com\/frauddetector\/latest\/api\/API_GetEventPrediction.html\" target=\"_blank\" rel=\"noopener noreferrer\">GetEventPrediction<\/a> API. When event ingestion is enabled for your event type, Amazon Fraud Detector automatically stores events evaluated through the GetEventPrediction API so they\u2019re available for future model trainings. These events are unlabeled by default, but you can later assign labels with the UpdateEventLabel API. In a production environment, we recommend enabling event ingestion so each event benefits from the information gathered in preceding events to accurately quantify risk in real time.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-29104\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/08\/26-6148.jpg\" alt=\"\" width=\"800\" height=\"248\"><\/p>\n<p>The <code>GetEventPrediction<\/code> API allows you to simply supply information about the event you want to evaluate, and you synchronously receive a model score and outcome based on the designated detector.<\/p>\n<p>As part of the request, you must specify the <code>detectorId<\/code> that Amazon Fraud Detector uses to evaluate the event. You can optionally specify a <code>detectorVersionId<\/code>. If you don\u2019t specify a <code>detectorVersionId<\/code>, Amazon Fraud Detector uses whichever detector version is in Active status.<\/p>\n<p>You have to provide the following metadata for each evaluated event:<\/p>\n<ul>\n<li><strong>EventId<\/strong> \u2013 A unique identifier for the event.<\/li>\n<li><strong>Entities<\/strong> \u2013 The <code>entityType<\/code> and <code>entityId<\/code> to specify who is performing the event. Use the entity you created earlier (for example, <code>customer<\/code>) as the <code>entityType<\/code>. Use <code>entityId<\/code> to distinguish between different transaction entities; it should follow the same format as the entity_id in your training data.<\/li>\n<li><strong>EventTimestamp<\/strong> \u2013 The timestamp when the event occurred. The timestamp must be in ISO 8601 standard in UTC.<\/li>\n<li><strong>Event variables<\/strong> \u2013 Names of the event type\u2019s variables and their corresponding values for the evaluated event. If you don\u2019t send a value for a variable, Amazon Fraud Detector uses a default value.<\/li>\n<\/ul>\n<p>The following is a sample Python code for calling the <code>GetEventPrediction<\/code> API:<\/p>\n<div class=\"hide-language\">\n<pre class=\"unlimited-height-code\"><code class=\"lang-python\">import boto3\nfraudDetector = boto3.client('frauddetector')\n\nfraudDetector.get_event_prediction(\ndetectorId = 'sample_detector',\neventId = '802454d3-f7d8-482d-97e8-c4b6db9a0428',\neventTypeName = 'sample_transaction',\neventTimestamp = '2021-01-13T23:18:21Z',\nentities = [{'entityType':'customer', 'entityId':'12345'}],\neventVariables = {\n    'email_address' : 'johndoe@exampledomain.com',\n    'ip_address' : '1.2.3.4'\n}\n)\n<\/code><\/pre>\n<\/p><\/div>\n<h2>Conclusion<\/h2>\n<p>You have now followed the end-to-end process of deploying a sample detector, including uploading data, training a model, deploying a model, writing business rules, and generating real-time fraud predictions. We hope this post inspires you to train a model using data from your own business! <a href=\"https:\/\/aws.amazon.com\/fraud-detector\/\" target=\"_blank\" rel=\"noopener noreferrer\">Visit our webpage<\/a> to learn more about Amazon Fraud Detector!<\/p>\n<hr>\n<h3>About the Author<\/h3>\n<p><strong><img decoding=\"async\" loading=\"lazy\" class=\"size-full wp-image-24267 alignleft\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/05\/06\/Bilal-Ali.jpg\" alt=\"\" width=\"100\" height=\"134\">Bilal Ali<\/strong> is a Sr. Product Manager working on Amazon Fraud Detector. He listens to customers\u2019 problems and finds ways to help them better fight fraud and abuse. He spends his free time watching old Jeopardy episodes and searching for the best tacos in Austin, TX.<\/p>\n<p><strong><img decoding=\"async\" loading=\"lazy\" class=\"size-full wp-image-29116 alignleft\" src=\"https:\/\/d2908q01vomqb2.cloudfront.net\/f1f836cb4ea6efb2a0b1b99f41ad8b103eff4b59\/2021\/10\/09\/Hao-Zhou.jpg\" alt=\"\" width=\"100\" height=\"134\">Hao Zhou<\/strong> is a Research Scientist with Amazon Fraud Detector. He holds a PhD in electrical engineering from Northwestern University, USA. He is passionate about applying machine learning techniques to combat fraud and abuse.<\/p>\n<p>       <!-- '\"` -->\n      <\/div>\n","protected":false},"excerpt":{"rendered":"<p>https:\/\/aws.amazon.com\/blogs\/machine-learning\/detect-online-transaction-fraud-with-new-amazon-fraud-detector-features\/<\/p>\n","protected":false},"author":0,"featured_media":1016,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/posts\/1015"}],"collection":[{"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/comments?post=1015"}],"version-history":[{"count":0,"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/posts\/1015\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/media\/1016"}],"wp:attachment":[{"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/media?parent=1015"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/categories?post=1015"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/salarydistribution.com\/machine-learning\/wp-json\/wp\/v2\/tags?post=1015"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}