JP7532434B2 - FRAUD DETECTION DEVICE, FRAUD DETECTION METHOD, AND FRAUD DETECTION PROGRAM - Google Patents

Description

The present invention relates to a fraud detection device, a fraud detection method, and a fraud detection program for detecting fraudulent use of a service.

2. Description of the Related Art Conventionally, there has been known a fraud determination device that determines a fraudulent act in relation to the use of an Internet service by inputting fraudulent information in order to receive the service (see, for example, Japanese Patent Application Laid-Open No. 2003-233634).
Patent Document 1 relates to a system for determining fraudulent use of a credit card. In this system, authorization data related to a fraud determination request sent from a store terminal is received, and history information is added and stored in a memory unit. In addition to the basic factors contained in the authorization data, such as the date of use, time of use, product code, and amount, the number of uses on that day, the product code used last time, the difference from the last use time, and the difference from the last use amount are added as history information. Then, a fraud score is calculated from the authorization data and history information based on a predetermined logic (rule).

JP 2004-348536 A

In conventional fraud determination processing such as that described in Patent Document 1 above, fraud is determined based on data for one service corresponding to the purpose of use. For example, in Patent Document 1, fraud is determined based on authorization data related to a credit card service and its history information. However, since the fraud determination is based only on user data for one type of service, the accuracy of the fraud determination is by no means high. In other words, the authorization data is data including the date and time of credit card use, product code, and amount, and the history information is obtained by accumulating the authorization data. Therefore, fraud is determined based only on the usage history of the credit card service, and there is a limit to the accuracy of the determination.

The present invention aims to provide a fraud determination device, a fraud determination method, and a fraud determination program that can perform more accurate fraud determination.

The fraud determination device of the present invention includes a user information acquisition unit that acquires user information related to a user's use of a specified service, a rule acquisition unit that acquires rule information that records rules related to fraudulent use of a target service, and a fraud determination unit that determines the fraudulent use of the target service by the user based on the user information and the rule information, where the rule information includes the rules for target user information, which is the user information of the target service, and the rules for related user information, which is the user information of another service different from the target service, the user information acquisition unit acquires the target user information and the related user information linked to the target user information, and the fraud determination unit performs the fraudulent use determination process based on the target user information, the related user information of the multiple services, and the rule information.

In the present invention, fraudulent use in the target service is judged using rules for related users, which are user information of other services different from the target service, in addition to rules for target user information. This makes it possible to perform fraud judgments with higher accuracy than when fraudulent use is judged based only on user information of a single service.

1 is a schematic diagram showing an example of a fraud determination system according to an embodiment of the present invention; 1 is a schematic diagram showing the flow of fraud determination processing by the fraud determination system of this embodiment. 4 is a flowchart showing a fraud determination method according to the present embodiment.

Hereinafter, one embodiment of the present invention will be described.
FIG. 1 is a schematic diagram showing an example of the fraud determination system of the present embodiment.
As shown in Fig. 1, the fraud determination system 1 includes a plurality of service servers 10 and user terminals 20, which are communicatively connected to each other via the Internet. The service server 10 is also communicatively connected to a rule management terminal 30 operated by a rule manager who manages the rules for the fraud determination process, an examination terminal 40 operated by an examiner who examines the fraud determination results, and the like. In the diagram shown in Fig. 1, the rule management terminal 30 and the examination terminal 40 are connected to the service server 10 via the Internet, but they may also be connected to the service server 10 via a dedicated line such as an in-house network.

In the fraud determination system 1 of this embodiment, when an individual user terminal 20 receives a service from the service server 10, the user terminal 20 transmits a request for service provision to the service server 10. The service server 10 then performs a fraud determination based on rule information set by a rule administrator, and if no fraud is found, a determination result indicating that there is no fraud in the user terminal 20 is transmitted, and the service is provided from the service server 10 to the user terminal 20. On the other hand, if the fraud determination process by the service server 10 determines that there is fraud, the user terminal 20 is notified of this, and the service is not provided from the service server 10 to the user terminal 20.
Each component of the fraud determination system 1 will be described in detail below.

[Configuration of service server 10]
The service server 10 functions as the fraud determination device of the present disclosure. The service server 10 is configured by a computer, and includes a communication unit 11, a storage unit 12, a control unit 13, etc. The number of computers that configure the service server 10 is not particularly limited. For example, the service server 10 may be configured by one computer, or the service server 10 may be configured by a cloud server that is constructed by connecting multiple computers via a network.
The communication unit 11 is connected to a network (Internet) via, for example, a LAN or the like, and communicates with a user terminal 20, a rule management terminal 30, an examination terminal 40, and the like.

The storage unit 12 is a data recording device configured, for example, by a memory, a hard disk, etc. The storage unit 12 includes a rule database (rule DB121) in which rule information for determining whether a user who uses the service has fraudulently used the service is recorded, a user database (user DB122), a block list (BL123), and a determination log database (determination log DB124).
Note that, here, an example is shown in which the rule DB 121, the user DB 122, the BL 123, and the judgment log DB 124 are provided in the memory unit 12 of the service server 10, but the configuration may also be such that these data are recorded in other data servers or cloud storage communicatively connected to the service server 10 via a network.
The storage unit 12 also stores various programs such as a fraud determination program for the service server 10 to execute a fraud determination process.

The rule DB 121 stores a plurality of pieces of rule information for carrying out fraud determination for each service.
In this rule information, information such as a rule ID, a rule name, an action code, a BL registration flag, a test mode flag, an update date and time, and a load utilization flag is recorded.
The rule ID is identification information for identifying the rule information.
The rule name is the name of the rule information, and is appropriately set by the rule administrator.

The action code is the details of the rule, and conditions (rules) for determining fraud are recorded for user information related to the use of the service of the service server 10 and user information related to the use of the service of other service servers 10. A plurality of rules may be recorded in the action code of one piece of rule information. For example, one or more rules for user information (target user information) related to the use of a service (target service) provided by the service server 10 (itself) and one or more rules for user information (related user information) related to the use of a service provided by another service server 10 may be recorded. Also, one or more rules for only the target user information may be recorded, or one or more rules for only the related user information may be recorded.
Here, the rule information in which one or more rules for only the target user information are recorded is defined as first rule information, and the rule information including one or more rules for the related user information is defined as second rule information.

The BL registration flag is flag information that indicates whether or not a user who is determined to be fraudulent based on the rules recorded in the action code is to be registered in BL123.

The test mode flag is information indicating whether the rule information is set to test mode, that is, whether it is the test rule information of the present invention. In this embodiment, the rule administrator operates the rule management terminal 30 to set (create) each piece of rule information, and the newly set rule information has the test mode flag set to ON and is registered as test rule information. Then, a fraud judgment is performed based on the rule information, and if the rule administrator determines that the fraud judgment has been made properly, the test mode flag is set to OFF by the rule administrator's operation, and the rule information is registered as official rule information.

The update date and time is information that indicates the date and time when the rule information was set (newly created or updated).
The load usage flag is flag information indicating whether or not fraud determination processing based on the rule information is to be performed when the load increases. Note that the load increase may be, for example, a campaign period for a service (target service) provided by the service server 10, or a case where the service server 10 receives accesses exceeding a threshold. In this embodiment, an example is shown in which the load usage flag of the first rule information is ON and the load usage flag of the second rule information is OFF.

In addition to the above, the rule information may also include a notification flag indicating whether or not to transmit the fraud determination result to the examination terminal 40, etc., and a priority indicating the order of priority in carrying out the fraud determination.

The user DB 122 records user information on users who use the services (i.e., target services) provided by the service server 10 .
The user information includes, for example, a user ID, a user name, notification destination information, user attributes, and history information.
The user ID is identification information for identifying a user.
The user name is the user's account name.
The notification destination information is the user's contact information, and for example, an email address or an account name for a messenger or the like is recorded.
The user attributes are various types of user attribute information used when using the services provided by the service server 10. For example, when the service server 10 provides an online shopping service, the user's gender, age, address, occupation, hobby and other preference information, the user's annual income, etc. may be included. When the service server 10 provides a navigation service, the user's address, places frequently visited by the user, spots of interest, etc. may be included.
The history information records various types of history information such as the usage history of the services provided by the service server 10. For example, if the service server 10 provides an online shopping service, the history information may include the user's product purchase history, product search history, comment history, etc. If the service server 10 provides a navigation service, the history information may include the user's movement history, etc.
In addition, since the above-mentioned user information changes depending on the service provided by the service server 10, the various information included in the user information may be different for each service server 10.

In addition, in this embodiment, the user information is linked to the user information stored in the storage unit 12 of the other service servers 10. For example, a common user ID may be assigned to the same user in multiple service servers 10. Alternatively, user information having the same notification destination information, such as an email address, may be linked to the same user. The user information held by each service server 10 may further include linkage information indicating which user information of the other service servers 10 is linked to the same user.

BL123 is information that records a list of users who are not provided with the service, and for example, a user ID that identifies the user is recorded. This BL123 records the user IDs of users who have committed fraudulent use multiple times or users who have committed fraud that could cause excessive damage.

The judgment log DB124 is a database that accumulates the judgment results obtained by the fraud judgment process.

The control unit 13 is composed of an arithmetic circuit such as a CPU (Central Processing Unit) and a recording circuit such as a RAM (Random Access Memory). The control unit 13 loads various programs stored in the memory unit 12 etc. into the RAM, and executes various processes in cooperation with the programs loaded into the RAM. The control unit 13 loads and executes various programs including the fraud determination program stored in the memory unit 12, and functions as a provision request receiving unit 131, a rule acquisition unit 132, a user information acquisition unit 133, a fraud determination unit 134, a service providing unit 135, a rule setting unit 136, and an examination request unit 137, as shown in FIG. 1.

The provision request receiving unit 131 receives a service provision request from the user terminal 20. In this embodiment, in providing a service, a fraudulent use determination is performed, and if it is determined that there is no fraudulent use, the service is provided to the user terminal 20 that transmitted the service provision request. Therefore, receiving a service provision request from the user terminal 20 is synonymous with receiving a fraudulent use determination request from the user terminal 20.
In this embodiment, the provision request received by the service server 10 is a service provided by the service server 10. In this embodiment, the service that is the target of the service provision request received by the service server 10, i.e., the service provided by the service server 10 itself, is referred to as a target service. In addition, user information related to the use of the target service, i.e., user information managed in the user DB 122 of the service server 10 itself, is referred to as target user information, and user information managed in the user DB 122 of another service server 10 is referred to as related user information to distinguish between the two.

The rule acquisition unit 132 acquires rules for implementing fraud determination from the rule DB 121 .
The user information acquisition unit 133 acquires user information recorded in the action code of the rule information. For example, when a rule for target user information is recorded as the rule information, the user information acquisition unit 133 reads out user information of a user ID corresponding to the user terminal 20 that transmitted the service provision request from the user DB 122 of the storage unit 12. Also, when the rule information includes a rule for related user information, the user information acquisition unit 133 requests the other service server 10 to transmit user information (related user information) of the other service server 10 that is linked to the user information corresponding to the user terminal 20 that transmitted the service provision request, and acquires the related user information from the other service server 10.

The fraud determination unit 134 determines whether or not a fraudulent use has occurred based on the rule information and user information. The fraud determination unit 134 selects rule information according to the load status of the service server 10, as will be described in detail later.

The service providing unit 135 provides a service to the user terminal 20 if the fraud determination unit 134 determines that there is no fraud.

The rule setting unit 136 receives new rule information or an instruction to update rule information from the rule management terminal 30, and performs new registration or update processing of rule information based on the received content. The newly registered or updated rule information sets the test mode flag to ON. Rule information with the test mode flag ON corresponds to the test rule information of the present invention.

When the fraud determination unit 134 performs a fraud determination process on rule information for which the test mode flag is ON, the review request unit 137 transmits the determination result and a review request to the review terminal 40 to request a review of whether the determination result is appropriate. Note that the determination result that is the subject of the review request is not limited to the determination result of rule information for which the test mode flag is ON, and may be the determination result of rule information for which the notification flag is ON, for example, if a notification flag is provided.

[Configuration of the user terminal 20, the rule management terminal 30, and the examination terminal 40]
The user terminal 20 is a terminal device owned by a user, and is configured, for example, by a computer such as a smartphone, a tablet terminal, or a personal computer. The rule management terminal 30 is a terminal device operated by a rule administrator who sets and manages rule information. The examination terminal 40 is a terminal device operated by an examiner who examines whether the fraud determination made by the fraud determination unit 134 is appropriate.
Although illustration of the specific configuration of the user terminal 20, the rule management terminal 30, and the examination terminal 40 is omitted, they have the basic configuration of a general computer. That is, the user terminal 20, the rule management terminal 30, and the examination terminal 40 each include an input operation unit that accepts input operations, a display that displays image information, a recording device that records various information, and an arithmetic circuit (such as a CPU) that processes various information.

[Operation of fraud determination system 1]
Next, a fraud determination method using the fraud determination system 1 of this embodiment will be described.
FIG. 2 is an image diagram showing the flow of fraud determination processing by the fraud determination system of this embodiment.
In the fraud determination system of this embodiment, a rule manager accesses the service server 10 from the rule management terminal 30, and manages the rules by setting new rules, updating rules, etc. In this case, the rule manager can easily manage the rules by using a rule management tool for managing rules between the service server 10 and the rule management terminal 30. As the tool, for example, a predetermined web tool published by the service server 10 can be mentioned.

When a user uses the service server 10, the user accesses a predetermined service use content provided by the service server 10 using the user terminal 20 and performs an operation to request the provision of the predetermined service content. As a result, a provision request including the service content desired by the user is transmitted from the user terminal 20 to the service server 10.
The service server 10, which also functions as a fraud determination device, performs a determination process based on the transmitted provision request using a determination API provided by executing a fraud determination program. This determination API functions as the provision request receiving unit 131, the rule acquiring unit 132, the user information acquiring unit 133, the fraud determination unit 134, the rule setting unit 136, and the examination request unit 137, etc., and performs the fraud determination process. Details of the fraud determination method in this fraud determination process will be described later.

The result of the fraud determination process is returned to the user terminal 20, and if the determination result indicates that there is no fraud, the service providing unit 135 provides a service to the user terminal 20. If the determination result indicates that there is fraud, the service is not provided.
Note that, when a judgment made by the judgment API, that is, a judgment of fraud based on the rule information and user information of the fraud judgment unit 134, indicates a possibility of fraud but has not been confirmed as fraud, an examination request is transmitted from the service server 10 to the examination terminal 40, and the examiner makes a fraud judgment and returns the judgment result to the service server 10. The fraud judgment result transmitted from the examination terminal 40 is appropriately accumulated in the judgment log DB 124. Here, an example of a state where there is a possibility of fraud but has not been confirmed as fraud is when the value indicated in the user information is a value close to a threshold value indicating fraud set by the rules.
Also, when the test mode flag of the rule information is ON, an examination request may be sent to the examination terminal 40. In this case, the examiner judges whether the result of the fraud judgment is appropriate or not based on the examination request, and returns the result to the service server 10. The examination judgment result sent from the examination terminal 40 is appropriately accumulated in the judgment log DB 124.

In the judgment log DB 124, the judgment results of the fraud judgment process by the fraud judgment unit 134, and the fraud judgment results and examination results sent from the examination terminal 40 are appropriately recorded and accumulated. This judgment log DB 124 can be viewed as a report by the rule manager using a rule management tool from the rule management terminal 30, and the rule manager can determine whether the set rule information is appropriate based on the various log data accumulated in the judgment log DB 124. In other words, the judgment results by the fraud judgment unit 134 and the fraud judgment results and examination results by the examiner are fed back to the rule manager, allowing the rule manager to update the rule information as appropriate.

Next, the fraud determination method will be described in more detail.
FIG. 3 is a flowchart showing the fraud determination method.
When the provision request receiving unit 131 of the service server 10 receives a provision request from the user terminal 20 (step S<b>1 ), the rule acquiring unit 132 extracts the target rule information from the rule DB 121 .
Specifically, the rule acquisition unit 132 extracts rule information based on the service content of the service to be provided (target service) (step S2). In other words, when the service provided by the service server 10 includes multiple service contents, rule information according to the requested service content is extracted. For example, in an online shopping service, service contents may include browsing of product details, product purchase (payment), selection of payment method, comments on previously purchased products, questions about products, etc. In this case, rule information may be provided for each service content, and rule information according to the service content included in the user's request for provision is extracted.

Next, the rule acquisition unit 132 judges whether or not it is a campaign period for the service of the service server 10 (step S3). The campaign period mentioned here refers to a period during which it is predicted that the number of users requesting the service provided by the service server 10 will increase, such as a period during which the service supply volume provided by the service server 10 is increased or the service provision price is reduced, and refers to a period previously set by the service manager of the service server 10. During such a campaign period, it is predicted that many users will access the service server 10, and the load on the service server 10 will increase.
If the result of step S3 is YES (if the campaign period is in progress), the rule acquisition unit 132 skips the second rule information that references related user information, which is user information of other service servers 10, from the rule information extracted in step S2, and acquires only the first rule information that references only user information held by its own service server 10 (step S4).

On the other hand, if step S3 is judged as No, it is judged whether the number of provision requests received in step S1 is equal to or greater than a predetermined threshold (step S5). That is, if the number of requests received in a predetermined period is equal to or greater than the threshold, it indicates that access from a large number of users is concentrated, and the load related to the fraud determination process increases. In this case, the delay in the determination process also delays the time related to the service provision. Here, the length of the predetermined period may be, for example, the average time related to the fraud determination process, and the threshold may be the maximum number of requests that the fraud determination unit 134 can simultaneously perform the fraud determination process. That is, in step S5, it is judged whether the number of provision requests received exceeds the maximum number for which the fraud determination process is possible, and more provision requests have been received.
If the answer to the question in step S5 is Yes, the process in step S4 is carried out in order to reduce the processing load.
On the other hand, if the result of the determination in step S5 is No, the rule acquisition unit 132 does not skip the second rule information, and acquires the first rule information and the second rule information (step S6).

After that, the user information acquisition unit 133 acquires user information based on the rule information (step S7). When step S4 is performed, the user information acquisition unit 133 reads out target user information, which is user information of a target user stored in the user DB 122 of the storage unit 12 of its own service server 10, based on the first rule information.
On the other hand, when step S6 is performed, the user information acquisition unit 133 further acquires related user information, which is user information included in the second rule information and managed by another service server 10. In other words, it requests the other service server 10 to transmit the related user information of the target user, and receives the related user information transmitted from the other service server 10.

Then, the fraud determination unit 134 determines whether or not the target user has engaged in fraudulent use by using the user information obtained in step S7 and the rule information obtained in step S4 or step S6 (step S8). The determination result obtained in step S8 is stored in the determination log DB 124.
Furthermore, when the fraud determination unit 134 performs a fraud determination process based on rule information in which the test mode flag is ON, the examination request unit 137 may transmit an examination request requesting examination of the determination result to the examination terminal 40 as described above. This allows an examiner to perform an examination at the examination terminal 40 that receives the fraud determination result using the rule information of the test mode and feed back the examination result to the rule manager. Note that the fraud determination based on the rule information in which the test mode flag is ON does not need to be used as a fraud determination related to the actual provision of a service. In this case, even if a fraudulent use is determined based on the rule information in which the test mode flag is ON, if it is determined not to be a fraudulent use based on other rule information, it is not determined to be a fraudulent use, and a service is provided to the user terminal 20 in step S10 described later.

If it is determined in the judgment process of step S8 that there is no fraud (step S9: Yes), the service providing unit 135 provides a service (target service) with service content corresponding to the provision request to the user terminal 20 of the target user (step S10).
If it is determined in the determination process of step S8 that fraud has occurred (step S9: No), the service server 10 notifies the user terminal 20 of the target user of the fraudulent use (step S11), and the service is not provided.
In FIG. 3, when it is determined in step S8 that there is fraud, it may be further determined whether the fraud is confirmed or whether there is a concern about fraud even though the fraud is not confirmed. For example, as described above, in the determination process of step S8, when the value of the user information is near a threshold value set in the rule (within a predetermined range centered on the threshold value), it may be determined that there is a concern about fraud. When it is determined that there is a concern about fraud in this way, the examination request unit 137 transmits an examination request to the examination terminal 40. Then, when a response is returned from the examination terminal 40 that there is no fraud, the service server 10 performs step S10 to provide a service to the user terminal 20. On the other hand, when a response is returned from the examination terminal 40 that there is fraud, the service server 10 performs step S11 to notify the user terminal 20 of the fraud and does not provide the service.
The fraud determination method described above has been described as targeting one of the multiple service servers 10 constituting the fraud determination system 1 of this embodiment, but similar fraud determination processing is also performed on the other service servers 10. In other words, in this embodiment, by mutually providing user information between the multiple service servers 10, it is possible to expand the rules for determining fraudulent use, and to implement fraud determination processing with higher accuracy.

[Effects of this embodiment]
The service server 10 of the present embodiment functions as a fraud determination device, and functions as a user information acquisition unit 133, a rule acquisition unit 132, and a fraud determination unit 134 by the control unit 13 reading and executing a fraud determination program stored in the storage unit 12. The user information acquisition unit 133 acquires user information related to the user's use of the service. The rule acquisition unit 132 acquires rule information that records rules related to fraudulent use of a service (target service) provided by the service server 10 of the present embodiment. The fraud determination unit 134 determines fraudulent use of the target service by the user based on the user information and the rule information. The rule information of the present embodiment includes first rule information and second rule information, and when the rule acquisition unit 132 acquires the second rule information, the user information acquisition unit 133 acquires related user information linked to the target user information, that is, user information of another service associated with the user information held by the service server 10 of the present embodiment. The fraud determination unit 134 also performs a fraud determination process based on the target user information and the related user information based on the second rule information.
In this embodiment, it is possible to perform a more accurate fraudulent use determination process than when fraudulent use by a user is determined based only on user information held by a single service server 10. For example, assume that a user has registered an age different from the user's actual age as user information for an online shopping service. In this case, the user may be permitted to purchase products with age restrictions in the online shopping service. On the other hand, in the case of referring to user information (related user information) of another service server 10 as in this embodiment, it is possible to determine fraudulent use if the user has registered his or her actual age in the other service server.

In this embodiment, the rule information includes first rule information and second rule information, and the rule acquisition unit 132 switches between acquiring the first rule information or acquiring both the first rule information and the second rule information depending on the load related to the fraudulent use determination process.
As a result, when the load on the service server 10 increases, the reference to the related user information of other service servers 10 can be skipped, thereby preventing a stagnation in the provision of services.

In this embodiment, the service server 10 also functions as a provision request receiving unit 131 that receives a service provision request. The rule acquisition unit 132 acquires only the first rule information if the number of received judgment requests within a specified period is equal to or greater than a threshold value, and acquires the first rule information and the second rule information if the number is less than the threshold value. In other words, if the number of provision requests received is equal to or greater than the maximum number for which fraud judgment processing can be performed simultaneously in parallel, the second rule is skipped. This makes it possible to suppress an increase in the processing load on the service server 10.

Furthermore, in the service server 10 of this embodiment, the rule acquisition unit 132 determines whether or not it is a preset campaign period, and if it is a campaign period, acquires only the first rule information, and if it is not a campaign period, acquires both the first rule information and the second rule information.
During a campaign period, access from many user terminals 20 is concentrated on the service server 10. Even if the number of service provision requests is small compared to the maximum number for which the fraud determination unit 134 can perform fraud determination processing, the number of accesses may increase suddenly. In contrast, in this embodiment, during a campaign period, the second rule information is skipped and only the first rule information is acquired, thereby reducing the load on the fraud determination unit 134.

In this embodiment, the service server 10 further functions as a rule setting unit 136 and an examination request unit 137. The rule setting unit 136 creates and updates rule information. The newly created rule information has a test mode flag set to ON, and becomes test rule information. Then, when the fraud determination unit 134 performs a fraud determination process using the rule information with the test mode flag set to ON, the examination request unit 137 transmits the determination result to the examination terminal 40 (corresponding to the determination examination unit of the present invention).
In the present embodiment, when multiple service servers 10 use each other's user information as material for fraud determination, the rules become more complicated than when only user information held by each server is used. For this reason, problems may occur if the created rules are used in actual operation as is. In contrast, in the present embodiment, the test mode flag is set to ON for newly created rule information, so that the newly created rule information is treated as test rule information, and the determination result is transmitted to the examination terminal 40. This allows the examiner to determine whether the test rule information is appropriate, and by feeding back the result to the rule administrator, the rule administrator can appropriately update and register the test rule information.

[Modification]
The present invention is not limited to the above-described embodiment, but includes the following modifications within the scope of the invention.

[Modification 1]
In the above embodiment, the fraud determination system 1 has been described in which each service server 10 functions as a fraud determination device of the present invention and mutually supplies user information to each other, thereby improving the accuracy of fraud determination.
In contrast to this, a fraud determination device may be provided separately from each service server 10 .
In this case, the fraud determination device receives a provision request for a predetermined target service from the user terminal 20. This makes it possible to distinguish between the service server 10 that provides the target service included in the provision request and the service server 10 that provides other services, and to perform the same fraud determination process as in the above embodiment.
Alternatively, a request for provision may be transmitted from the user terminal 20 to a predetermined service server 10, in which case the service server 10 may request the fraud determination device to determine fraudulent use. This allows the fraud determination device to perform fraud determination processing with the service provided by the service server 10 that requested the fraudulent use determination as the target service.

[Modification 2]
In the above embodiment, an example is shown in which a determination is made in step S3 as to whether or not the target service is in a campaign period, and a determination is made in step S5 as to whether or not the number of provision requests received is equal to or greater than a threshold value, and if the determination is No in steps S3 and S5, a fraud determination process is performed using the first rule information and the second rule information.
In contrast to this, after the result of the judgment in both steps S3 and S5 is No, it may be further determined whether or not a campaign period is in progress in a service server 10 that provides a service different from the target service included in the second rule information.
In this case, if none of the services other than the target service are in a campaign period, similar to the above embodiment, the rule acquisition unit 132 performs step S6 to acquire the first rule information and the second rule information.
Furthermore, when a service different from the target service is in a campaign period, the second rule information including related user information corresponding to the service in the campaign period is skipped. That is, the rule acquisition unit 132 acquires the first rule information and the second rule information not including user information of the service in the campaign period.
Even in the above embodiment, if only the related user information is referenced, the impact is small even if the other service servers 10 are in a campaign period, and a sudden increase in load is unlikely to occur. However, since the other service servers 10 are accessed by referencing the related user information, a slight increase in load is conceivable. In contrast, in the case of skipping the second rule information including the user information provided by the service server 10 in the campaign period, as in this modified example, the increase in load can be further reduced.

[Modification 3]
In the above embodiment, the rule acquisition unit 132 determines whether or not to skip the second rule information depending on the presence or absence of a campaign and the number of received provision requests, but the second rule information may be skipped based on other factors related to the load on the service server 10. For example, the second rule may be skipped depending on the maintenance period of the service server 10 that provides the target service, the number of accesses to the service server 10, etc.

[Modification 4]
In the above embodiment, an example was shown in which the load usage flag is set to ON in the first rule information and the load usage flag is set to OFF in the second rule information, but the load usage flag may be set to ON in part of the second rule information. Even in this case, it is possible to reduce the load compared to the case in which fraud determination is performed based on all of the second rule information, and it is also possible to suppress a decrease in the accuracy of fraud determination.
In addition, in a case where a priority order is set for the rule information, the rule acquisition unit 132 may acquire first rule information and second rule information whose priority is equal to or higher than a predetermined value when the load increases during a campaign period or the like.

[Modification 5]
In the above embodiment, if it is determined in step S3 that the campaign period is not in progress, a determination is made in step S5 as to whether the number of provision requests received is greater than or equal to a threshold value. However, the order of the processing in step S3 and the processing in step S5 may be reversed.

[Modification 6]
In the above embodiment, the result of the judgment by the fraud judgment unit 134 based on the test rule information is transmitted to the examination terminal 40, and the examination result is stored in the judgment log DB 124, so that the rule manager judges whether or not to register the test rule information as official rule information based on the judgment log. In response to this, the rule setting unit 136 of the service server 10 may judge whether or not to turn off the test mode flag of the test rule information based on the examination results accumulated in the judgment log DB 124. In other words, when a predetermined number of examination results for the test rule information are accumulated, and a predetermined number (a predetermined ratio) of examination results indicating that fraud has been properly judged, are obtained, the rule setting unit 136 may set the test mode flag of the rule information to OFF.
In addition, for the test rule information for which the test mode flag is ON, a review request for the judgment result is transmitted to the review terminal 40, but it is also possible to leave a record only in the judgment log DB 124 regardless of the judgment result and not transmit a review request to the review terminal 40. In this case, the rule manager may determine whether or not to adopt the test rule information based on the judgment log accumulated in the judgment log DB 124.

1...fraud determination system, 10...service server (fraud determination device), 12...storage unit, 13...control unit, 20...user terminal, 30...rule management terminal, 40...screening terminal (screening determination unit), 121...rule DB (rule database), 122...user DB (user database), 123...block list (BL), 124...determination log DB (determination log database), 131...provision request receiving unit, 132...rule acquisition unit, 133...user information acquisition unit, 134...fraud determination unit, 135...service providing unit, 136...rule setting unit, 137...screening request unit.

Claims (6)

a user information acquisition unit that acquires user information related to a user's use of a predetermined service;
a rule acquisition unit that acquires rule information that records rules related to unauthorized use of a service;
a fraud determination unit that determines the fraudulent use of the target service by the user based on the user information and the rule information;
A user DB that records target user information that is the user information of the target service,
In the user DB, the target user information is linked to related user information which is user information of another service different from the target service,
The rule information includes first rule information which is the rule for the target user information, and second rule information which is the rule for the related user information,
The user information acquisition unit acquires the target user information and the related user information linked to the target user information,
The fraud determination unit performs the fraudulent use determination process based on the target user information and the first rule information, and further performs the fraudulent use determination process based on the related user information linked to the target user information and the second rule information. a provision request receiving unit for receiving a provision request for a service,
the rule acquisition unit acquires only the first rule information when the number of the provision requests received within a predetermined period is equal to or greater than a threshold, and acquires both the first rule information and the second rule information when the number of the provision requests received within a predetermined period is less than the threshold.
The fraud determination device according to claim 1 . the rule acquisition unit determines whether or not a preset campaign period for the target service is in progress, and acquires only the first rule information if the campaign period is in progress, and acquires both the first rule information and the second rule information if the campaign period is not in progress.
The fraud determination device according to claim 1 . a rule setting unit that sets the new rule information as test rule information;
an examination request unit that transmits a result of the fraud determination unit's fraudulent use determination process using the test rule information to a determination examination unit;
The fraud determination device according to claim 1 , further comprising: A fraud determination method for determining fraudulent use of a service by a computer, comprising:
the computer includes a user DB, a user information acquisition unit, a rule acquisition unit, and a fraud determination unit;
the user DB records target user information related to a user's use of a target service, and the target user information is linked to related user information which is user information of another service different from the target service;
a user information acquisition step in which the user information acquisition unit acquires user information related to a user's use of a predetermined service;
a rule acquisition step in which the rule acquisition unit acquires rule information that records rules related to unauthorized use of a service;
a fraud determination step in which the fraud determination unit determines whether the user has fraudulently used the target service based on the user information and the rule information;
The rule information includes first rule information which is the rule for the target user information, and second rule information which is the rule for the related user information,
The user information acquisition step includes acquiring the target user information and the related user information associated with the target user information,
The fraud determination step of this fraud determination method performs the fraudulent use determination process based on the target user information and the first rule information, and further performs the fraudulent use determination process based on the related user information linked to the target user information and the second rule information. A fraud determination program that can be read and executed by a computer,
A fraud determination program that causes the computer to function as the fraud determination device according to any one of claims 1 to 4.

Images