JP5068864B2 - Logistic regression analysis system and logistic regression analysis program - Google Patents

Description

  The present invention relates to a logistic regression analysis system and a logistic regression analysis program.

  When payment is made with a credit card (hereinafter referred to as a card) at various stores or the like, a credit inquiry is requested by transmitting information such as a card number from the store or the like to the card company. In response to the credit inquiry request, the credit card company makes a judgment on the possibility of unauthorized use of the card, in addition to the credit balance inquiry of the card. You are using a model. Various models have been proposed as the scoring model, and one of them is a model to which logistic regression analysis is applied (for example, see Patent Document 1).

  The scoring model to which such logistic regression analysis is applied is a model for calculating the score corresponding to the probability that card misuse is expected to occur (hereinafter, the expected fraud rate). An explanatory variable that can be influenced is calculated based on a plurality of data items, and the score is calculated by inputting the calculated plurality of explanatory variables into a predetermined logistic regression function.

JP 2007-207011 A

  However, it has been known that there are certain constraints on the explanatory variables that can be input to the logistic regression analysis. For example, when the composition ratio of the data category in a specific data item is small, the so-called complete separation and semi-complete separation problems occur for variable categories of explanatory variables corresponding to such data categories. Such variable categories could not be put into the scoring model as they were.

  For example, it is known that when a highly convertible product is purchased with a card, there is a higher possibility of fraudulent use of the card than when a less convertible product is purchased. Therefore, for highly convertible products, product codes (codes set in advance to uniquely identify the type of each product, for example, codes for distinguishing precious metals, gift certificates, prepaid cards, etc., respectively) ) It is thought that the accuracy of the scoring model can be improved by subdividing the data category in units of analysis. However, when such subdivision is performed, each data category (in this example, product code of precious metals, product in the data item (product code of all products including highly cashable products) in this example) The product ratio of the ticket, the product code of the prepaid card, etc.) will be small, and the variable categories of the explanatory variables corresponding to each data category with such a small composition ratio cannot be input as it is to the scoring model. Eventually, it was not possible to perform a detailed analysis and to improve the accuracy of the scoring model.

  The present invention has been made in view of the above, and a logistic regression analysis system capable of performing logistic regression analysis using variable categories of explanatory variables corresponding to data categories having a small composition ratio in data items. And it aims at providing a logistic regression analysis program.

The logistic regression analysis system according to claim 1 is a variable category of a plurality of explanatory variables capable of affecting a probability of occurrence of a predetermined event, the variable corresponding to a data category included in each of the plurality of data items. A logistic regression analysis system for calculating the probability by inputting a category into a predetermined logistic regression function, wherein the composition ratio storage means stores the composition ratio of the data category of the data item corresponding to the variable category And event occurrence probability storage means for storing information necessary for calculating the probability that the event occurred in the past for the data category, and the plurality of explanatory variables for the plurality of explanatory variables as a whole. and validity storage means for storing a numerical value indicating the validity of each variable category of the explanatory variables the Rojisute A determining unit that determines whether it is possible to put into click regression function, when a predetermined plurality of data items to calculate the explanatory variables to be introduced into the logistic regression function is obtained by a predetermined method In addition, the composition ratio of the data category of the data item is acquired from the composition ratio storage means, it is determined whether the acquired composition ratio is less than a predetermined value, and the acquired composition ratio is less than the predetermined value. in some cases, the determining means and the variable category corresponding to the data item is a variable category that can not be put into the logistic regression function of the data categories, can not be turned by said determining means Information corresponding to the data category of the data item corresponding to the variable category determined to be acquired from the event occurrence probability storage means. Based on the acquired information, as an object the data category of the data items corresponding to the variable category is determined not to be able to put in the determination means, calculating the probability that the event has occurred in the past Corresponding to the explanatory variable of the variable category determined to be unable to be input by the determination means , the integer calculation means for converting the probability calculated by the probability calculation means into an integer by a predetermined multiple, and the determination means A numerical value indicating the effectiveness to be obtained from the validity storage means, and by expanding the probability converted into an integer by the integerization means based on the acquired numerical value indicating the validity, the target of calculation of the probability Expansion means for generating a converted value of the variable category of the explanatory variable corresponding to the data category.

The logistic regression analysis system according to claim 2 is the logistic regression analysis system according to claim 1, wherein the component ratio storage means stores a component ratio of a data category of a minimum unit included in the data item, and The determination means acquires the composition ratio of the data category of the minimum unit included in the data item from the composition ratio storage means, determines whether or not the acquired composition ratio is less than a predetermined value, and the acquired configuration When the ratio is less than a predetermined value, it is determined that the variable category corresponding to the data item of the data category cannot be input to the logistic regression function .

  The logistic regression analysis system according to claim 3 is the logistic regression analysis system according to claim 1 or 2, wherein the probability calculation means calculates a probability that the event has occurred in the past as a percentage value, and the integer The converting means converts the probability calculated by the probability calculating means into an integer with a predetermined multiple of 100 times or more.

The logistic regression analysis system according to claim 4 is the logistic regression analysis system according to any one of claims 1 to 3, wherein a score corresponding to a probability that fraudulent use of a credit card occurs is calculated as the logistic regression function. A scoring model that calculates the score by inputting the converted value of the variable category of the explanatory variable generated by the expansion means into the scoring model. The event occurrence probability storage means includes information configured by associating the data category with the number of fraud cases and the number of genuine cases when the credit card has been used for the data category in the past. , Stored as information necessary to calculate the probability that the event occurred in the past, and the probability The determination means includes the event occurrence probability storage means that stores the number of fraud cases and the number of genuine cases corresponding to the data category of the data item corresponding to the variable category determined to be unable to be input by the determination means. Based on the acquired number of frauds and genuine cases, the fraud rate when the credit card has been used in the past for the data category is calculated as the probability that the event has occurred in the past To do .

The logistic regression analysis program according to claim 5 is a variable category of a plurality of explanatory variables that can affect a probability of occurrence of a predetermined event, the variable corresponding to a data category included in each of the plurality of data items. A logistic regression analysis program for calculating the probability by inputting a category into a predetermined logistic regression function, the composition ratio storage means for storing the composition ratio of the data category of the data item corresponding to the variable category And event occurrence probability storage means for storing information necessary for calculating the probability that the event occurred in the past for the data category, and the plurality of explanatory variables for the plurality of explanatory variables as a whole. and validity storage means for storing a numerical value indicating the validity of each of the computers with the explanatory variables A determining unit that determines whether it is possible to introduce a variable categories to the logistic regression function, obtaining a plurality of predetermined data items for calculating the explanatory variables to be introduced into the logistic regression function in a predetermined way If it is, the composition ratio of the data category of the data item is acquired from the composition ratio storage means, it is determined whether the acquired composition ratio is less than a predetermined value, and the acquired composition ratio is predetermined. When the value is less than the value, a determination unit that determines that the variable category corresponding to the data item of the data category is a variable category that cannot be input to the logistic regression function, and the determination unit inputs Information corresponding to the data category of the data item corresponding to the variable category determined to be unusable. Obtained from the probability storage means, based on the acquired information, as an object the data category of the data items corresponding to the variable category is determined not to be able to put in the determination means, said event It is determined that the probability calculation means for calculating the probability of occurrence in the past, the integer calculation means for converting the probability calculated by the probability calculation means into an integer by a predetermined multiple, and the determination means cannot be input. Obtaining a numerical value indicating validity corresponding to the explanatory variable of the variable category from the validity storing means, and developing the probability converted into an integer by the integerizing means based on the acquired numerical value indicating validity. By this, it is made to function as an expansion means for generating the conversion value of the variable category of the explanatory variable corresponding to the data category for which the probability is calculated.

  According to the logistic regression analysis system according to claim 1 or the logistic regression analysis program according to claim 5, since it is a variable category of explanatory variables corresponding to a data category having a small composition ratio in a data item, If there is a variable category that could not be input to the logistic regression analysis, it can be converted into a converted value and input to the logistic regression analysis. Therefore, it is possible to perform logistic regression analysis by subdividing data categories as compared to the conventional case, and it is possible to improve the accuracy of logistic regression analysis.

  According to the logistic regression analysis system according to claim 2, whether or not the variable category of the explanatory variable can be input to the logistic regression function based on the composition ratio of the data category of the minimum unit included in the data item. Since the determination is made, it becomes possible to perform logistic regression analysis by subdividing the data category into minimum units, and it is possible to further improve the accuracy of the logistic regression analysis.

  According to the logistic regression analysis system of the third aspect, the probability can be converted to an integer by converting the probability calculated as a percentage value into an integer with a predetermined multiple of 100 times or more.

  According to the logistic regression analysis system according to claim 4, regarding the scoring model for calculating the score corresponding to the probability of illegal use of the credit card, the variable of the explanatory variable corresponding to the data category having a small composition ratio in the data item A variable category that is a category and could not be input to the scoring model in the past can be converted into a converted value and input to the logistic regression analysis. Therefore, it is possible to calculate the score using the scoring model by subdividing the data category as compared with the conventional case, and it is possible to improve the accuracy of the scoring model. As a result, it becomes possible to determine the probability of unauthorized use of the credit card with higher accuracy.

It is the block diagram which showed the electrical structure of the approval system constructed | assembled including the fraud detection system which concerns on one embodiment of this invention functionally. It is a figure which shows the structural example of member information. It is a figure which shows the structural example of 1st usage log information. It is a figure which shows the structural example of 2nd usage history information. It is a figure which shows the structural example of fraud determination result information. It is a figure which shows the structural example of scoring information. It is a flowchart of fraud detection processing It is a flowchart of an information accumulation | storage production | generation process. It is a flowchart of a regression analysis process. It is the figure which illustrated various information corresponding to the data category contained in a data item. It is a flowchart of explanatory variable conversion processing. It is the figure which illustrated the example of a setting of the effectiveness of an explanatory variable. It is a flowchart of a fraud determination process. It is a flowchart of a system management process.

  Exemplary embodiments of a logistic regression analysis system and a logistic regression analysis program according to the present invention will be described below in detail with reference to the accompanying drawings.

  Logistic regression analysis system and logistic regression analysis program perform logistic regression analysis to calculate the probability of occurrence of a predetermined event, but the event to be calculated is arbitrary, the expected fraud rate of the card, the company It can be used for credit risk, disease occurrence probability, etc. In the following, an example used for the expected fraud rate of a card will be described. The “logistic regression analysis system” is referred to as a “fraud detection system”, and the “logistic regression analysis program” is referred to as a “fraud detection program”.

(Constitution)
First, the configuration of the fraud detection system will be described. FIG. 1 is a block diagram functionally conceptually showing an electrical configuration of an approval system constructed including the fraud detection system according to the present embodiment. As shown in FIG. 1, the approval system 1 is a system for approving (authorizing) the use of a card. The fraud detection system 10, the business host 20, the approval host (authorization host) 30, the fraud determination terminal 40, The system management terminal 50 is connected to be communicable with each other via a network 60 such as the Internet.

(Configuration-fraud detection system)
The fraud detection system 10 is a system for detecting unauthorized use of a card, and includes a network interface (hereinafter, network IF) 11, a storage unit 12, and a control unit 13.

  The network IF 11 is an input unit that receives input of information necessary for processing of the fraud detection system 10 and is an output unit for outputting information from the fraud detection system 10 to the outside. For example, the network IF 11 is configured as a known network board Has been.

  The storage unit 12 is a storage unit that stores various types of information necessary for processing of the fraud detection system 10, and includes, for example, a hard disk or other recording medium. The storage unit 12 is a member information DB (hereinafter referred to as “DB”). 12a), usage history information DB 12b, fraud determination result information DB 12c, and scoring information DB 12d. Details of each DB will be described later.

  The control unit 13 is a control unit that controls the fraud detection system 10. Specifically, the control unit 13 is a CPU, various programs that are interpreted and executed on the CPU (a basic control program such as an OS, and a program that is started and specified on the OS. And an internal memory such as a RAM for storing the program and various data. In particular, the fraud detection program according to the present embodiment is stored in a computer-readable recording medium, and is installed in the fraud detection system 10 from the recording medium, thereby substantially configuring each unit of the control unit 13.

  The control unit 13 includes an information accumulation and generation unit 14, a regression analysis unit 15, a fraud determination unit 16, and a system management unit 17 in terms of functional concept. The information accumulation and generation unit 14 is an information accumulation and generation unit that accumulates various types of information in the storage unit 12 and generates various types of information. The regression analysis unit 15 is a regression analysis unit that calculates a score based on a scoring model to which logistic regression analysis is applied. The fraud determination unit 16 is a fraud determination unit that performs necessary processing to determine fraudulent use of a credit card using the score calculated by the regression analysis unit 15. The system management unit 17 is a system management unit that performs processing related to analysis and evaluation of a scoring model. Specific functions of these units will be described later.

  Furthermore, the regression analysis unit 15 includes a determination unit 15a, a probability calculation unit 15b, an integerization unit 15c, a development unit 15d, and a score calculation unit 15e. The determination unit 15a is a determination unit that determines whether or not the variable category of the explanatory variable can be input to the logistic regression function based on the composition ratio of the data category of the data item corresponding to the variable category. The probability calculation unit 15b is a probability calculation unit that calculates the probability that an event has occurred in the past for the data category of the data item corresponding to the variable category that is determined to be unable to be input by the determination unit 15a. The integer converting unit 15c is an integer converting unit that converts the probability calculated by the probability calculating unit 15b into an integer with a predetermined multiple. The expansion unit 15d expands the probability converted to an integer by the integer conversion unit 15c based on the validity of the explanatory variable of the variable category determined to be unable to be input by the determination unit 15a. Expansion means for generating a conversion value of the variable category of the explanatory variable corresponding to the data category that is the target of the calculation. The score calculation unit 15e is a score calculation unit that calculates a score by inputting the conversion value of the variable category of the explanatory variable generated by the expansion unit 15d into the scoring model. Specific functions of these parts and meanings of terms will be described later.

  Next, details of each DB in the storage unit 12 will be described. However, the information described below as information stored in each DB is merely an example, and in practice, some of the information can be omitted, other information can be included, or replaced with other information. can do.

  The member information DB 12a in FIG. 1 is member information storage means for storing information (hereinafter referred to as member information) regarding a person (hereinafter referred to as a member) registered as a valid user of the card. As shown in the configuration example of FIG. 2, this member information includes an item “user member number”, an item “total card grant”, an item “total card cashing”, an item “birth date of user”, and an item “use” Each item such as “personality”, item “card expiration date”, item “user membership date” and the like, and data corresponding to each item are associated with each other. Information corresponding to the item “user member number” is a member number uniquely assigned to each member. The information corresponding to the item “total card grant” is the total available card amount of each member. The information corresponding to the item “total card cashing” is the total available amount of cashing by each member's card. The information corresponding to the item “user's date of birth” is the date of birth of each member. The information corresponding to the item “user gender” is the gender of each member. For example, “0” indicates male and “1” indicates female. The information corresponding to the item “card expiration date” is the expiration date of each member's card. The information corresponding to the item “user membership date” is the date on which each member joined the card.

  The usage history information DB 12b in FIG. 1 is usage history information storage means for storing information relating to card usage history (hereinafter referred to as usage history information). In the present embodiment, this usage history information includes first usage history information and second usage history information. The first usage history information includes approval information (authorization information) transmitted from the approval host 30. As shown in the configuration example of FIG. 3, the item “unique key” and the item “user member” Each item such as “number”, item “approval reception date”, item “approval reception time”, item “use amount”, and the data corresponding to each item are associated with each other. Information corresponding to each item excluding the item “unique key” is information included in the approval information transmitted from the approval host 30. Information corresponding to the item “unique key” is information that is automatically and uniquely assigned by the control unit 13 and is information that serves as a primary key of the first usage history information. Information corresponding to the item “user member number” is a member number uniquely assigned to each member. The information corresponding to the item “approval acceptance date” corresponds to the date when the approval was accepted, the information corresponding to the item “approval acceptance time” corresponds to the time when the approval was accepted, and the item “use amount” The information is the amount that is subject to approval. Note that the approval information transmitted from the approval host 30 includes various types of information (for example, specific product codes to be described later) in addition to these pieces of information, but the description thereof is omitted in the present embodiment. .

  The second usage history information includes information generated by performing statistical processing on the card usage history. As shown in the configuration example of FIG. 4, the item “user member number” is used. , Item “approval reception date”, item “approval reception time”, item “elapsed time since previous 1 time”, item “elapsed time since previous n times”, item “use time before last” , The item “last n times before use time”, the item “past last use channel”, the item “past n times use channel”, and the data corresponding to each item are associated with each other. It is configured. Information corresponding to the item “user member number”, the item “approval reception date”, and the item “approval reception time” is the same as the information corresponding to the same item in the first usage history information of FIG. The information corresponding to the item “elapsed time from the previous past” is the elapsed time from the use of the previous card by the member who is the object of approval to the current use of the card. . The information corresponding to the item “elapsed time from the past n times” is the elapsed time from when the member who is the object of approval uses the card n times before in the past to use this card. . Note that “n” is an integer and is not shown, but the second usage history information is an item corresponding to each integer x (= 2, 3,..., N−1) between 1 and n. “Elapsed time since previous x times” and information corresponding to this item are included (hereinafter, the same applies to other information expressed using n). The information corresponding to the item “last past use time” is the time when the member who is the object of approval has used the card one time before the past. The information corresponding to the item “last n times before use” is the time when the member who is the object of approval has used the card n times before in the past. The information corresponding to the item “past last use channel” is a channel in which a member who has been approved has used a card one time before in the past. A channel is a card usage route, for example, specified by combining either domestic or overseas with either facing or non-facing, "facing domestic", "facing overseas", "non-facing" There are four channels: “Domestic” and “Non-face-to-face overseas”. Identified. The information corresponding to the item “past use channel n times in the past” is a channel in which the member who has been approved has used the card n times in the past in the past.

  The fraud determination result information DB 12c in FIG. 1 is fraud determination result information storage means for storing information related to the card fraud determination result (hereinafter, fraud determination result information). As shown in the configuration example of FIG. 5, the fraud determination result information includes an item “user member number”, an item “approval reception date”, an item “approval reception time”, an item “hit rule ID”, an item “ Each item such as “score” and data corresponding to each item are associated with each other. Information corresponding to the item “user member number”, the item “approval reception date”, and the item “approval reception time” is the same as the information corresponding to the same item in the first usage history information of FIG. The information corresponding to the item “hit rule ID” is rule specifying information for uniquely specifying a rule (hit rule) that matches each approval information among the rules for determining fraud of the card. Information corresponding to the item “score” is a score calculated using a scoring model. In practice, the fraud determination result information further includes the approval information received from the approval host 30, the member information acquired from the member information DB 12a, and the first analysis target described later acquired from the usage history information DB 12b. The history information and the second analysis target history information are included, but these pieces of information are omitted in FIG. 5 for convenience of illustration.

  The scoring information DB 12d in FIG. 1 is a scoring information storage unit that stores information related to fraud determination using a scoring model (hereinafter, scoring information). As shown in the configuration example of FIG. 6, the scoring information includes an item “user member number”, an item “approval reception date”, an item “approval reception time”, an item “explanation variable 1”, and an item “explanation”. Each item such as “variable n” and item “score” and data corresponding to each item are associated with each other. Information corresponding to the item “user member number”, the item “approval reception date”, and the item “approval reception time” is the same as the information corresponding to the same item in the first usage history information of FIG. The information corresponding to the item “explanatory variable 1” is the first explanatory variable input to the scoring model. Information corresponding to the item “explanatory variable n” is the nth explanatory variable input to the scoring model. Information corresponding to the item “score” is a score calculated using a scoring model.

(Configuration-Business host)
Next, the business host 20 in FIG. 1 will be described. The business host 20 is a host computer that manages member information, stores the member information shown in FIG. 2, and transmits this member information to the fraud detection system 10 as necessary.

(Configuration-Approval host)
The approval host 30 in FIG. 1 is a host computer that receives and processes approval information transmitted for inquiry from a card terminal (not shown) set in a store or the like, and detects this fraudulent information as necessary. Send to system 10.

(Configuration-fraud determination terminal)
The fraud determination terminal 40 of FIG. 1 is a terminal of a person in charge of fraud determination work, for example, a terminal installed in a card company, and is configured in the same manner as a known personal computer.

(Configuration-system management terminal)
A system management terminal 50 in FIG. 1 is a terminal of a person in charge of managing the fraud detection system 10, and is a terminal installed in a system company, for example, and is configured in the same manner as a known personal computer.

(processing)
Next, a fraud detection process executed by the approval system 1 configured as described above will be described. FIG. 7 is a flowchart of the fraud detection process executed by the fraud detection system 10 (steps are abbreviated as “S” in the following description of each process). This fraud detection process is, for example, repeatedly started after the fraud detection system 10 is started. The information accumulation generation process (SA1), regression analysis process (SA2), fraud determination process (SA3), and system management process (SA4) Are executed sequentially. Hereinafter, each of these processes will be described sequentially.

(Processing-Information accumulation generation processing)
First, the information accumulation generation process will be described. This process is a process for storing and generating various types of information, and is executed by the information storage generation unit 14. FIG. 8 is a flowchart of the information accumulation generation process. When new registration or update of member information with respect to the business host 20 is performed by a known means, the business host 20 transmits this member information to the fraud detection system 10. When receiving the member information from the business host 20 (SB1, Yes), the information accumulation / generation unit 14 of the fraud detection system 10 adds the newly registered member information to the member information DB 12a or updates the member information to the member information. Reflected in the DB 12a (SB2).

  When the card is used in a store or the like, a card terminal (not shown) installed in the store or the like transmits a credit balance and an unauthorized use inquiry request to the approval host 30 together with the approval information. Upon receiving this inquiry request, the approval host 30 transmits approval information to the fraud detection system 10. When receiving the approval information from the approval host 30 (SB3, Yes), the information accumulation / generation unit 14 of the fraud detection system 10 acquires the member information corresponding to the user member number included in the approval information from the member information DB 12a ( SB4).

  Next, the information accumulation generation unit 14 accumulates the first usage history information in the usage history information DB 12b based on the approval information (SB5). For example, a unique key is numbered by a predetermined method, and the first usage history information is generated by adding the unique key to the approval information as a primary key, and the first usage history information is added to the usage history information DB 12b.

  In addition, after acquiring all the first usage history information corresponding to the user member number included in the approval information from the usage history information DB 12b, the information accumulation and generation unit 14 performs unauthorized use based on the first usage history information. History information used for scoring (hereinafter referred to as first analysis target history information) is generated (SB6). The first analysis target history information is, for example, the number of usages within the last 5 minutes, the number of usages within the last 30 minutes, the total usage amount within the last 5 minutes, the total usage amount within the last 30 minutes, and the usage within the last 5 minutes. It is configured to include the average amount, the average usage amount within the last 30 minutes, etc., and is generated for each of the four channels.

  The information accumulation and generation unit 14 generates second usage history information including the approval reception date and the approval reception time included in the approval information using the user member number included in the approval information as a main key. 2 The usage history information is stored in the usage history information DB 12b (SB7). At this time, other information of the second usage history information (e.g., the elapsed time from the previous one) is the first usage history information accumulated so far in the usage history information DB 12b and is included in the approval information. It is generated by referring to the first usage history information corresponding to the user member number. This completes the information storage generation process.

(Processing-regression analysis processing)
Next, the regression analysis process of FIG. 7 will be described. This process is a process of calculating a score using a scoring model configured by applying logistic regression analysis, and is executed by the regression analysis unit 15 and each unit thereof. FIG. 9 is a flowchart of the regression analysis process. The regression analysis unit 15 calculates the score from the approval information received at SB3 in FIG. 8, the member information acquired at SB4, the first analysis target history information generated at SB6, and the second usage history information generated at SB7. A plurality of predetermined data items for calculating explanatory variables to be input to the ring model are acquired (SC1). For example, the data items include approval acceptance time, usage amount, product code, and the like.

  Then, the determination unit 15a of the regression analysis unit 15 determines whether or not the variable category of the explanatory variable can be input to the logistic regression function based on the composition ratio of the data category of the data item corresponding to the variable category. (SC2). The “data category” is information included in the data item, information that has no meaning in the arrangement order inside the data item, and is mainly set-type data. For example, as a data category, each card number included in a data item “card number (a number for uniquely identifying a credit card)” and data item “member store code (a store where a credit card is used) Etc.) ”and each data item“ Industry code (code for uniquely identifying the industry such as the store where the credit card was used) ” This corresponds to each product code included in each business type code and data item “product code (code for uniquely identifying a product purchased using a credit card)”. The “composition ratio” is a ratio of each data category to all data categories included in the data item to which each data category belongs. For example, this component ratio can be specified in advance based on the past history and stored in the storage unit 12 in advance via the fraud determination terminal 40. Whether or not the variable category of the explanatory variable can be input to the logistic regression function is, for example, that the composition ratio of each data category is less than a predetermined value preset in the storage unit 12 (for example, less than 1%). In some cases (when the composition ratio of each data category is small), it is determined that it cannot be input. In particular, here, the determination unit 15a performs determination for each data category of the minimum unit included in the data item. Here, the “data category in the minimum unit” is a data category that cannot be further subdivided, and in the example of FIG. 10, each product code corresponds to a data category in the minimum unit. Then, when there is a variable category determined to be unable to be input to the logistic regression function, the determination unit 15a starts the explanatory variable conversion process for the data category of the data item corresponding to the variable category ( SC3).

  FIG. 10 shows various types of information corresponding to the data category included in the data item. In the example of FIG. 10, the data item is “product code” and the data category (minimum unit data category) is each product code. In this example, the composition ratio of the product code = 1001 as the data category is 35.01%, the composition ratio of the product code = 1002 as the data category is 0.18%, and all the composition of the commodity codes as the data category The total ratio is 100%. When the predetermined value is 1%, in the example of FIG. 10, since the composition ratio of the product codes = 1002 to 1005, 3009 as the data category is less than the predetermined value, the product code = the data category = It is determined that the variable categories corresponding to 1002 to 1005 and 3009 are variable categories that cannot be directly input to the logistic regression function. If such a variable category exists, the explanatory variable conversion process is started for the data category corresponding to the variable category.

  FIG. 11 is a flowchart of the explanatory variable conversion process. The probability calculation unit 15b of the regression analysis unit 15 calculates the probability that an event has occurred in the past with respect to the data category of the data item corresponding to the variable category determined to be unable to be input by the determination unit 15a ( SD1). The “probability that an event has occurred in the past” is the probability calculated by the logistic regression analysis applied to the scoring model. In this embodiment, the probability that fraud has occurred in the past (hereinafter referred to as the fraud rate). is there. This probability is calculated based on information stored in each DB. In the example of FIG. 10, since the number of past approvals for the product code = 1001 as the data category is the number of fraud cases = 100 and the number of genuine cases = 100,000, the fraud occurrence rate = (100 / (100 + 100,000) ) × 100 = 0.10% is calculated (in the example of FIG. 10, an example in which the third digit after the decimal point is rounded off is shown, but the fractional processing can be arbitrarily changed).

  Next, the integerization unit 15c of the regression analysis unit 15 multiplies the probability thus calculated by a predetermined number to make an integer (SD2). The “predetermined multiple” can be arbitrarily set, but is preferably at least 100 times or more from the viewpoint of converting the probability of being a percentage value into an integer, and further, in order to validate a small probability Further, it is preferable to make a larger multiple (for example, 1000 times or 10,000 times). For example, this magnification can be stored in advance in the storage unit 12 via the fraud determination terminal 40. In the example of FIG. 10, the value converted into an integer is exemplified as an “integer ratio”. FIG. 10 shows an example in which the predetermined number of times is set to 1000, and the fraud occurrence rate of the product code = 0.10% is converted into an integer as 0.10% = (1/1000) × 1000 = 1. (Note that the example in FIG. 10 shows an example in which the first digit after the decimal point is truncated, but the fractional processing can be arbitrarily changed).

  Then, the expansion unit 15d of the regression analysis unit 15 expands the integerized probability to generate a converted value (SD3). “Deploy” means to expand the probability. This expansion is 1) the effectiveness of the explanatory variable of the variable category determined not to be input by the determining unit 15a, based on the effectiveness of the explanatory variable with respect to the whole of the plurality of explanatory variables, and 2) done to maintain a scale. “Effectiveness” is the degree (percentage value) that indicates how much each explanatory variable affects the probability that a given event will occur, and the total effectiveness of all explanatory variables is It is a numerical value set to be 100%. FIG. 12 illustrates an example of setting the effectiveness of explanatory variables. For example, the validity may be determined by an administrator of the fraud detection system 10 by an arbitrary method with reference to past fraudulent use history and the like, and stored in the storage unit 12 via the fraud determination terminal 40 in advance. it can. The “scale” is the relative size of the numerical value of the probability obtained as an integer, and in the above example, is the relative size of the fraud rate of the product code that is the data category. In order to satisfy such a condition, for example, the expansion is performed by multiplying the integerized probability by a numerical value corresponding to the validity of the explanatory variable corresponding to the probability. For example, in the example of FIG. 12, since the effectiveness of the explanatory variable corresponding to the product code as the data item is 12%, the expansion ratio is set to 1.2. Therefore, as illustrated as “conversion value” in FIG. 10, conversion values corresponding to integer fraud occurrence rates = 1, 10, 32, and 833 are 1 (= 1 × 1.2) and 12 (= 10 × 1.2), 38 (= 32 × 1.2), and 999 (= 833 × 1.2) (Note that the example in FIG. 10 shows an example in which the first decimal place is truncated). However, the rounding process can be changed arbitrarily). Also, during this development, the minimum and maximum values of the probability converted to integers are determined so that the numerical range does not exceed the predetermined range, the numerical range is specified, and the minimum or maximum value exceeds the predetermined value. Determine the deployment ratio so that there is no. In the example of FIG. 10, since the minimum value of the fraud occurrence rate converted to an integer is 0 and the maximum value is 833, the numerical value range is 0 to 833 so that the maximum value = 833 does not exceed the predetermined value 999. , Is doing the deployment. By performing such processing, for example, it is possible to develop fraud rate = 0.01% into conversion value = 1 and to input this conversion value as it is into the scoring model. This completes the explanatory variable conversion process of FIG. 11 and returns to the regression analysis process of FIG.

  Note that the conversion unit 15d re-converts the conversion value generated in this way by re-converting the conversion value by further applying a known explanatory variable processing process for the numerical data as necessary. A value may be calculated and this retransformed value may be entered into the scoring model. Examples of such known processes include rounding and re-conversion processing to set type data. The rounding process is a process of replacing a numerical value with a numerical value that is an integral multiple of a certain rounding width. The re-conversion processing to set type data is processing for replacing numerical data with set type data. The reconverted value obtained by performing such processing is illustrated in FIG. In this example, a reconverted value obtained by applying both the rounding process and the reconverting process to the set type data is shown, and the converted values 0 and 1 are rounded to either 0 or 1. Thus, it is replaced with the reconverted value A which is set type data. Similarly, the converted values 12, 39, and 46 are replaced with reconverted values B, C, and D, which are set type data, respectively.

  After the explanatory variable conversion process is completed in this way, in the regression analysis process of FIG. 9, the score calculation unit 15e of the regression analysis unit 15 sets the variable category (data whose composition ratio is not small) that is not the target of the explanatory variable conversion process. Logistic regression between the variable category corresponding to the category) and the converted value and reconverted value generated by the explanatory variable conversion process (converted value and reconverted value corresponding to the variable category corresponding to the data category with a small composition ratio) The expected fraud rate (score) is calculated by inputting it into a predetermined scoring model constructed by applying the analysis (SC4). However, since a known model can be used as the scoring model, detailed description thereof is omitted. This completes the regression analysis process.

(Processing-fraud determination processing)
Next, the fraud determination process in FIG. 7 will be described. This process refers to a score calculated using a scoring model and determines whether or not the use of the card for which the approval request has been made is an unauthorized use, and is executed by the fraud determination unit 16. The FIG. 13 is a flowchart of the fraud determination process.

  The fraud determination unit 16 receives the approval information received in SB3 in FIG. 8, the member information acquired in SB4, the first analysis target history information and the second analysis target history information generated in SB6, and the score calculated in SC3 in FIG. Determines whether or not a predetermined rule is met (SE1). The “rule” is a determination criterion indicating a pattern having a high possibility of unauthorized use. For example, a plurality of rules are set by a person in charge of the fraud detection system 10 and stored in the storage unit 12 in advance. As an example, the rule “score = 600 points or more, usage amount = 100,000 yen or more, past use amount = 100,000 yen or more, and elapsed time from previous one = less than 5 minutes” is set. The fraud determination unit 16 determines whether or not all the conditions included in the rule are satisfied in light of each piece of the acquired information. If satisfied, the fraud determination unit 16 determines that the rule is satisfied. (The rule determined to match in this way is referred to as a hit rule).

  When it is determined that any one or more of the plurality of predetermined rules are matched (SE2, Yes), the fraud determination unit 16 holds that the approval for which the inquiry request is made is suspended, It transmits to the approval host 30 (SE3). Next, the fraud determination unit 16 receives the approval information received in SB3 of FIG. 8, the member information acquired in SB4, the first analysis target history information generated in SB6, the second usage history information generated in SB7, and FIG. Information including the score calculated in SC4 and the hit rule ID for uniquely identifying the hit rule determined in SE1, and generating fraud determination result information using the user member number of the approval information as a primary key Is stored in the fraud determination result information DB 12c (SE4).

  Next, the fraud determination unit 16 transmits the generated fraud determination result information to the fraud determination terminal 40 (SE5). As a result, the fraud determination result information is output to the monitor provided in the fraud determination terminal 40, so that the person in charge of the operation refers to the fraud determination result information, and the use of the card for which the inquiry is requested is illegally used. The fraud determination result is transmitted to the fraud detection system 10 via the fraud determination terminal 40. Upon receiving the fraud determination result (SE6, Yes), the fraud determination unit 16 transmits the fraud determination result to the approval host 30 (SE7), and ends the fraud determination process.

(Processing-System management processing)
Finally, the system management process of FIG. 7 will be described. This process is a process of analyzing and evaluating the accuracy of the scoring model and updating the scoring model as necessary, and is executed by the system management unit 17. FIG. 14 is a flowchart of the system management process.

  The system management unit 17 is information including the approval information received in SB3 in FIG. 8, the explanatory variable input to the scoring model in SC3 in FIG. 9, and the score calculated in SC4 in FIG. Scoring information having the user member number as a primary key is generated and stored in the scoring information DB 12d (SF1). Then, in response to a request from the system management terminal 50 (SF2, Yes), the system management unit 17 acquires this scoring information from the scoring information DB 12d and transmits it to the system management terminal 50 (SF3). As a result, the scoring information is output to the monitor provided in the system management terminal 50, and the system manager in charge analyzes the accuracy of the scoring model by a predetermined method by referring to the scoring information. Then, the system manager in charge periodically creates a report of this accuracy, and when the scoring model is deteriorated, by sending update data from the system management terminal 50 to the fraud detection system 10, Each parameter of the scoring model is changed to maintain and improve the accuracy of the scoring model. For example, the scaling factor for integerization in SD2 of FIG. 11 is reviewed, or the effectiveness of each explanatory variable illustrated in FIG. 12 is reviewed. The system management unit 17 updates the scoring model based on the update data transmitted from the system management terminal 50 (SF5). This completes the system management process.

(Modification to the embodiment)
Although the embodiments of the present invention have been described above, the specific configuration and means of the present invention can be arbitrarily modified and improved within the scope of the technical idea of each invention described in the claims. Can do. Hereinafter, such a modification will be described.

(Modification-About distribution and integration)
Further, each of the electrical components described above is functionally conceptual and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each part is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed / integrated in arbitrary units according to various loads and usage conditions. Can be configured. For example, a part of the functions of the fraud detection system 10 may be provided to the approval host 30 or the fraud determination terminal 40, or the functions of the fraud detection system 10 may be distributed to a plurality of computers. Moreover, you may mutually replace a part of each process, such as performing the process demonstrated as a part of regression analysis process by another process.

(Explanation variable conversion process)
In the above embodiment, the determination is made based on the composition ratio of the data category in the minimum unit, but this composition ratio may be the composition ratio of the data category corresponding to the unit to be subdivided. For example, even if the data category is not the smallest unit, it is a data category that is subdivided compared to the conventional one, and the composition ratio of the data category that is subdivided to such an extent that the analysis accuracy can be improved than the conventional one is adopted. be able to. In addition, a unit to be subdivided for each data item may be set in advance, and the determination may be performed in a different unit for each data item with reference to this unit.

1 Approval System 10 Fraud Detection System 11 Network IF
12 storage unit 12a member information DB
12b Usage history information DB
12c Fraud determination result information DB
12d Scoring information DB
DESCRIPTION OF SYMBOLS 13 Control part 14 Information accumulation | storage part 15 Regression analysis part 15a Conversion object determination part 15b Probability calculation part 15c Integer part 15d Expansion part 15e Score calculation part 16 Fraud determination part 17 System management part 20 Business host 30 Approval host 40 Fraud determination terminal 50 System management terminal 60 Network

Claims (5)

A variable category corresponding to a data category included in each of a plurality of data items, which can affect the probability of occurrence of a predetermined event, is input to a predetermined logistic regression function. A logistic regression analysis system for calculating the probability by
A component ratio storage means for storing a component ratio of the data category of the data item corresponding to the variable category;
For the data category, event occurrence probability storage means for storing information necessary for calculating the probability that the event has occurred in the past;
Effectiveness storage means for storing a numerical value indicating the effectiveness of each of the plurality of explanatory variables with respect to the whole of the plurality of explanatory variables;
A determination means for determining whether or not a variable category of the explanatory variable can be input to the logistic regression function, wherein a plurality of predetermined data items for calculating the explanatory variable to be input to the logistic regression function are When obtained by a predetermined method, the composition ratio of the data category of the data item is obtained from the composition ratio storage means, and it is determined whether or not the obtained composition ratio is less than a predetermined value. When the composition ratio is less than a predetermined value, a determination unit that determines that the variable category corresponding to the data item of the data category is a variable category that cannot be input to the logistic regression function ;
The information corresponding to the data category of the data item corresponding to the variable category determined to be unable to be input by the determination unit is acquired from the event occurrence probability storage unit, and based on the acquired information The probability calculation means for calculating the probability that the event has occurred in the past for the data category of the data item corresponding to the variable category determined not to be input by the determination means;
An integerization means for converting the probability calculated by the probability calculation means into an integer by a predetermined multiple;
The numerical value indicating the validity corresponding to the explanatory variable of the variable category determined to be unable to be input by the determination means is acquired from the validity storage means, and based on the acquired numerical value indicating the validity Expansion means for generating a converted value of the variable category of the explanatory variable corresponding to the data category for which the probability is calculated by expanding the probability converted into an integer by the integer conversion means ;
Logistic regression analysis system with The component ratio storage means stores a component ratio of a data category of a minimum unit included in the data item,
The determination means acquires the composition ratio of the data category of the minimum unit included in the data item from the composition ratio storage means, determines whether the acquired composition ratio is less than a predetermined value, and acquires the When the composition ratio is less than a predetermined value, the variable category corresponding to the data item of the data category is determined as a variable category that cannot be input to the logistic regression function .
The logistic regression analysis system according to claim 1. The probability calculating means calculates the probability that the event has occurred in the past as a percentage value,
The integer converting means converts the probability calculated by the probability calculating means into an integer with a predetermined multiple of 100 times,
The logistic regression analysis system according to claim 1 or 2. A system that calculates a score corresponding to the probability of unauthorized use of a credit card by a scoring model to which the logistic regression function is applied,
A score calculation unit that calculates the score by inputting a converted value of the variable category of the explanatory variable generated by the expansion unit into the scoring model ;
The event occurrence probability storage means includes information obtained by associating the data category with the number of fraud cases and the number of genuine cases when the credit card has been used for the data category in the past. Store as information necessary to calculate the probability that the event occurred in the past,
The probability calculating means calculates the event occurrence probability by calculating the number of frauds and the number of genuine cases corresponding to the data category of the data item corresponding to the variable category determined to be unimportable by the determination means. Based on the number of frauds and authenticity obtained from the storage means, the probability of fraud when the credit card has been used in the past for the data category, and the probability that the event has occurred in the past Calculate as
The logistic regression analysis system according to any one of claims 1 to 3. A variable category corresponding to a data category included in each of a plurality of data items, which can affect the probability of occurrence of a predetermined event, is input to a predetermined logistic regression function. A logistic regression analysis program for calculating the probability by
A component ratio storage means for storing a component ratio of the data category of the data item corresponding to the variable category;
For the data category, event occurrence probability storage means for storing information necessary for calculating the probability that the event has occurred in the past;
Effectiveness storage means for storing a numerical value indicating the effectiveness of each of the plurality of explanatory variables with respect to the whole of the plurality of explanatory variables;
A computer comprising
A determination means for determining whether or not a variable category of the explanatory variable can be input to the logistic regression function, wherein a plurality of predetermined data items for calculating the explanatory variable to be input to the logistic regression function are When obtained by a predetermined method, the composition ratio of the data category of the data item is obtained from the composition ratio storage means, and it is determined whether or not the obtained composition ratio is less than a predetermined value. When the composition ratio is less than a predetermined value, a determination unit that determines that the variable category corresponding to the data item of the data category is a variable category that cannot be input to the logistic regression function ;
The information corresponding to the data category of the data item corresponding to the variable category determined to be unable to be input by the determination unit is acquired from the event occurrence probability storage unit, and based on the acquired information The probability calculation means for calculating the probability that the event has occurred in the past for the data category of the data item corresponding to the variable category determined not to be input by the determination means;
An integerization means for converting the probability calculated by the probability calculation means into an integer by a predetermined multiple;
The numerical value indicating the validity corresponding to the explanatory variable of the variable category determined to be unable to be input by the determination means is acquired from the validity storage means, and based on the acquired numerical value indicating the validity Expansion means for generating a converted value of the variable category of the explanatory variable corresponding to the data category for which the probability is calculated by expanding the probability converted into an integer by the integer conversion means ;
Logistic regression analysis program to function as.

Images