July 16, 2019
As global digital commerce continues to gather pace, consumers are increasingly buying goods, accessing services and content through digital channels. Consumers’ digital footprints are becoming more complex and multifaceted, meandering across locations, devices, and geographies. Static business rules alone are no longer an effective way of analyzing the legitimacy of transactions because user behavior is becoming more varied and less predictable. Businesses need a solution that can understand anomalies to individual user behavior and help correlate seemingly disconnected events and security incidents in real time, delivering anonymized intelligence across geographies, industries and use cases.
ThreatMetrix Smart Analytics combines global shared intelligence from the ThreatMetrix Digital Identity Network with advanced behavioral analytics (Smart Rules) and machine learning (Smart Learning). This enables organizations to identify anomalies between current and historical behavior and differentiate between trusted and fraudulent users in real time.
Smart Analytics—Behavioral Analytics Combined with Machine Learning for Real-Time Decisioning
ThreatMetrix Smart Rules
Behavioral analytics from ThreatMetrix helps businesses understand genuine user behavior, in all its rich diversity, while detecting potential fraud and reducing false positives. It offers analysis of customer behavior at different levels of granularity; de ned at a user level or at an entity level like IP address or device. Smart Rules allow configuring of dynamic thresholds by combining static business conditions, rules and variables. This enables businesses to bring an element of personalization into risk decisioning.
Behavioral analytics from ThreatMetrix accurately identifies changes in trusted user behavior. For example:
- Identifies a trusted user legitimately increasing the number of devices used
- Prevents unnecessary step-ups by identifying customers travelling frequently
- Detects legitimate versus fraudulent use of remote desktop tools
ThreatMetrix uses the following set of variables to examine a given transaction, comparing it with historic data to run a deep behavioral assessment:
Expression Condition Rules allow variables, logical expressions, static values, and attributes to be combined and used in policies.
Smart Rules Advantage
- Accurate Identification of changes in the trusted user behavior reduces manual reviews, improving operational efficiency.
- Advanced behavioral analytics, with dynamic/adaptive thresholds, help reduce customer friction and false positives.
- Smart Rules can be de ned in a hierarchical manner by combining different sets of rules; either using all Smart Rules or a combination of Smart Rules and static business rules, to enable complex fraud decisioning.
ThreatMetrix Smart Learning
Machine learning from ThreatMetrix is seamlessly integrated with business rules and Smart Rules, helping businesses easily incorporate the machine learning model, resulting in quick adaption to changing behavior. ThreatMetrix machine learning offers flexible adoption options throughout the customer journey:
- Customers can opt for machine learning-driven policy optimization, wherein by utilizing truth data (feedback data such as fraud/non-fraud events provided by analysts or third parties), our patented machine learning algorithm suggests optimal risk weights for rules, within the current policy. It also suggests new rules to augment the current policy, without requiring any additional changes, resulting in an immediate improvement in catch rates.
- Another option is to import a completely new optimized policy generated via our machine learning. This is a human readable policy. Reasons behind the risk scores associated with all events are available to the fraud analysts, making it easier for them to accept and adopt results of the model into their environment. Rules generated via a machine learning policy can also be selectively chosen to test incrementally within a current policy.
Smart Learning Features
- Smart Learning models work in dual mode—Silent and Active. When in Silent mode, the policy is executed, giving out response variables, but not affecting the active policy. Customers can monitor results associated with the Smart Learning model and incorporate into decisioning. When in Active mode, decisioning is based on the model generated via Smart Learning, clearly demonstrating the risk scores given by the auto-generated policy.
- Machine Learning from ThreatMetrix o ers various reports associated with truth data, current policy, potential fraudulent events, etc. A summary report compares challenge rate/catch rate, highlighting the enhanced results from the Smart Learning model over the current policy, while a back coloring report provides customers with a list of transactions that could potentially be fraudulent based on the truth data analysis.
- The model generated via Smart Learning looks exactly like the pre-existing ThreatMetrix policies, resulting in the same user experience, with enhanced fraud detection.
Smart Learning Differentiators
- Other machine learning offerings require additional operational effort cleaning data coming in from disparate sources before it can be consumed by the machine learning platform. Since ThreatMetrix Smart Learning consumes data from the ThreatMetrix policy engine, the data is already cleansed and normalized, saving time and money.
- Machine learning from ThreatMetrix offers the flexibility of defining operational targets such as challenge rate or maximum review rate, while models generated with the traditional approach are difficult to operationalize.
- The ThreatMetrix Smart Learning Model ensures identification of fraud patterns and good customer behavior as it is trained based on truth data from the customer along with Digital Identity Intelligence from The Network. Based on the analysis of more than 24 billion transactions a year, the Digital Identity Network provides unparalleled visibility into legitimate digital identities and high-risk behavior. This ensures the machine learning models are fed with real-time intelligence, reducing degradation.