How Ravelin selects & engineers ML features to detect and prevent fraud

Traditional features

These are the typical aspects that predict fraud. For example, orders, transactions, cards, location, email.

These features generally cover the data you would expect to find on your receipt and are customer-centric. They're are also fairly simple, often relying on one fraud signal or data point.

Behavioral features

We also derive behavioral features from the customer session. These are features are based on describing the customer actions, eg. velocity of orders, time spent on the page, length of time between adding a new card and making an order. This type of feature is more complex to engineer, as it combines more than one data point.

One purpose of extracting these features is to capture subversive technology use. For example, we can tell whether a fraudster is using a script to scrape a webpage instead of browsing like a legitimate, everyday shopper.

Network-derived features (Connect features)

Network-derived features focus on link analysis network topology (network shape) as a means of enhancing our customer data and understanding what data points are shared by more than one customer, and which configurations of these are normal or expected – as well as which are not.

For example, a family who live in the same house might share accounts, and that is perfectly reasonable. But when you have a case of account takeover activity, you might see hundreds of accounts accessing a website from just a handful of devices, if not just a single device.

Individual customer features

Ravelin's solutions for fraud prevention focus on people, not transactions. This allows us to zoom out and consider the bigger picture. We don't home in on the data we have around one specific transaction only, but on what we know about the customer themselves.

The individual customer ML features tell us how consistent current behavior is with this customer's typical past behavior. This could be their typical spend, regular billing address, home IP address, etc.

For instance, the ML model will spot whether a customer who usually makes very small purchases is suddenly looking to buy ten big-ticket items in one go. It's not an indication of fraud per se, but once considered along with all the other features, it can mean something is amiss.

Real-time features

Real-time features are based on the up-to-date, real-world incidences of fraud. These types of features are all based on categorical data and give the real-time rate of fraud by category. For instance, country, ASN card digits, email domain and so on, such as the average fraud rate in certain regions/countries.

One purpose of these features is to support the secure growth of merchants looking to expand into new markets, for which they have no historical data of their own. By monitoring the real-time traffic, these companies can seamlessly move into new markets, without seeing any adverse effects from the machine learning models, such as bias.

Session-tracking features

These features are a little more involved than the behavioral features we looked at above.

Session-tracking features cover the data we get from Javascript and can include:

• whether the customer is pasting a card number into the checkout rather than typing it
• their browser cookies
• whether the customer is using a password vault
• etc.

One purpose of these features is to be able to identify genuine customer behavior. For instance, a legitimate customer will normally take time to select the size of an item of clothing or look at the sizing chart, rather than do it instantly. If this is done instantly, there is perhaps a script running on that page – and legitimate customers don't run scripts.

Entity features

We also divide features into customer-centric and entity-centric. Entities are things like devices, addresses, locations, domains and emails.

An example feature is the number of orders shipped to a certain address.

One purpose of these features is to alert us to a fraud goods drop-off point or help generate heat maps of fraudulent activity.