Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast...
Transcript of Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast...
![Page 1: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/1.jpg)
developer.oracle.com/code
SimplifiedandfastFraudDetectionwithjustSQL
![Page 2: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/2.jpg)
developer.oracle.com/code
About me…
Klaus ThielenConsulting Member of Technical StaffRAC Development
![Page 3: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/3.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
Agenda
Findingpatternsinyourdata
Lookingforfraudulenttransfers
Dealingwithnewbusinessrequirements
Combiningdifferenttypesofanalytics:Mash-Ups
Summary
1
2
3
4
5
![Page 4: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/4.jpg)
developer.oracle.com/code
FindingPatternsinYourData
Slide - 4
![Page 5: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/5.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
FindingPatternsInYourDataBasicConceptsandLanguages
• Lotsoflanguagesnativelysupport“patternmatching”
Source: wikipedia
![Page 6: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/6.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
FindingPatternsInYourDataBasicConceptsandLanguages
• Lotsoflanguagesnativelysupport“patternmatching”• AndsodoesSQL:
– Row-levelregularexpressionprocessing– “NEW”:Patternrecognitioninsequencesofevents
• Sequenceisastreamofrows• Eventequalsarowwithinthestream• “Inter-row”patternrecognition
Source: wikipedia
![Page 7: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/7.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
PatternRecognitionInSequencesofRows
ProvidenativeSQLlanguageconstruct
Withintuitiveprocessing
![Page 8: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/8.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
PatternRecognitionInSequencesofRowsSQL- anewlanguageforpatternmatching
ProvidenativeSQLlanguageconstruct• NewSQLconstructMATCH_RECOGNIZE
– AddedaspartoftheANSI-2016SQLstandard
Withintuitiveprocessing
![Page 9: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/9.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
PatternRecognitionInSequencesofRowsSQL- anewlanguageforpatternmatching
ProvidenativeSQLlanguageconstruct• NewSQLconstructMATCH_RECOGNIZE
– AddedaspartoftheANSI-2016SQLstandard
Withintuitiveprocessing• Threelogicalconcepts:
– Logicallypartitionandorderthedata(Streamsofevents)– Definepatternusingregularexpressionandpatternvariables(WhatpatternamIlookingfor?)
• Eachpatternvariableisdefinedusingconditionsonrowsandaggregates• Regularexpressionismatchedagainstasequenceofrows
– Definemeasuresrepresentingthereturnedpatterninformation (WhatdoIwanttoknow?)
![Page 10: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/10.jpg)
developer.oracle.com/code
SearchingforFraud
Slide - 10
![Page 11: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/11.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
Demoisonhttp://livesql.oracle.com
![Page 12: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/12.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
BusinessProblem:FindingSuspiciousMoneyTransfers• Suspiciousmoneytransferpatternforanaccountis:
– 3ormoresmall(<2K)moneytransferswithin30days– Largetransfer(>=1M)within10daysoflastsmalltransfer
• Report– Account– Dateoffirstsmalltransfer– Dateoflastlargetransfer– Amountoflargetransfer
![Page 13: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/13.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
BusinessProblem:FindSuspiciousMoneyTransfers• DatastoredinJSONlogs..
![Page 14: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/14.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
BusinessProblem:FindSuspiciousMoneyTransfers• DatastoredinJSONlogs.. • ..Processedrelational
– withnativeJSONcapabilities
TIME_IDUSER_ID EVENT AMOUNT
1/1/2012 John Deposit 1,000,000
1/2/2012 John Transfer 1,000
1/5/2012 John Withdrawal 2,000
1/10/2012 John Transfer 1,500
1/20/2012 John Transfer 1,200
1/25/2012 John Deposit 1,200,000
1/27/2012 John Transfer 1,000,000
2/2/2012 John Deposit 500,000
![Page 15: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/15.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
BusinessProblem:FindingSuspiciousMoneyTransfers
TIME_ID USER ID EVENT AMOUNT1/1/2012 John Deposit 1,000,0001/2/2012 John Transfer 1,0001/5/2012 John Withdrawal 2,0001/10/2012 John Transfer 1,5001/20/2012 John Transfer 1,2001/25/2012 John Deposit 1,200,0001/27/2012 John Transfer 1,000,0002/2/2012 John Deposit 500,000
Three small transfers within 30 days
![Page 16: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/16.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
TIME_ID USER ID EVENT AMOUNT1/1/2012 John Deposit 1,000,0001/2/2012 John Transfer 1,0001/5/2012 John Withdrawal 2,0001/10/2012 John Transfer 1,5001/20/2012 John Transfer 1,2001/25/2012 John Deposit 1,200,0001/27/2012 John Transfer 1,000,0002/2/2012 John Deposit 500,000
BusinessProblem:FindingSuspiciousMoneyTransfers
Three small transfers within 30 days
Large transfer within 10 days of last small transfer
![Page 17: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/17.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (
DeclarativePatternMatchingusingSQLNewsyntaxfordiscoveringpatternsusingSQL:findingsuspiciousmoneytransfers…
InputintothepatternmatchingprocessdeterminedbyFROMclause
MATCH_RECOGNIZE() –indicatesstartofpatternmatchingdefinition
![Page 18: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/18.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY user_id ORDER BY time_id
DeclarativePatternMatchingusingSQLSTEP1:StreamsofEventsNeedtogroupandorderthedatatodefinethestreamsofevents assequenceofrows…
SetthePARTITIONBYandORDERBYclauses
![Page 19: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/19.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY user_id ORDER BY time_id
PATTERN ( X{3,} )
DeclarativePatternMatchingusingSQLSTEP2:PatternOccurences
DescribehowtosearchfortheVARIABLEX –
Searchingforthreeormoreoccurrencesofsmalltransfers
![Page 20: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/20.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY user_id ORDER BY time_id
PATTERN ( X{3,} Y )
DeclarativePatternMatchingusingSQLSTEP2:PatternOccurences
DescribehowtosearchfortheVARIABLEY –
Searchingforonlyoneinstanceoflargetransfer
![Page 21: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/21.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
UsingRegularExpressionsToControlPatternMatching• Concatenation:nooperator• Quantifiers:
– * 0ormorematches– + 1ormorematches– ? 0or1match– {n} exactlynmatches– {n,} normorematches– {n,m} betweennandm(inclusive)matches– {,m} between0anm(inclusive)matches– Reluctantquantifier– anadditional?
![Page 22: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/22.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event ='transfer')
MATCH_RECOGNIZE (PARTITION BY user_id ORDER BY time_id
PATTERN ( X{3,} Y)DEFINE
X as (amount < 2000) ANDLAST(time_id) – FIRST(time_id) < 30,
DeclarativePatternMatchingusingSQLSTEP3:DefineEventsDEFINE eachvariableintermsofwhattosearchfor:
ForamatchonvariableXwearesearchingforsmalltransfersofamountslessthan2Kandallthreetransfersmustoccurwithina30daywindow
![Page 23: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/23.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY user_id ORDER BY time_id
PATTERN ( X{3,} Y)DEFINE
X as (amount < 2000) ANDLAST(time_id) – FIRST(time_id) < 30,
Y as (amount >= 1000000
DeclarativePatternMatchingusingSQLSTEP3:DefineEventsDEFINE eachvariableintermsofwhattosearchfor:
ForamatchonvariableYwearesearchingforalargetransferofmorethan1M
![Page 24: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/24.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY user_id ORDER BY time_id
PATTERN ( X{3,} Y)DEFINE
X as (amount < 2000) ANDLAST(time_id) – FIRST(time_id) < 30,
Y as (amount >= 1000000 AND time_id – LAST(x.time_id) < 10 ))
DeclarativePatternMatchingusingSQLSTEP3:DefineEventsDEFINE eachvariableintermsofwhattosearchfor:
ForamatchonvariableYwearesearchingforalargetransferofmorethan10K……andthelargetransfermustoccurwithin10daysoflastsmalltransfer
![Page 25: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/25.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY user_id ORDER BY time_idMEASURES FIRST(x.time_id) AS first_t,
LAST(y.time_id) AS last_t, y.amount amount
PATTERN ( X{3,} Y)DEFINE
X as (amount < 2000) ANDLAST(time_id) – FIRST(time_id) < 30,
Y as (amount >= 1000000 AND time_id – LAST(x.time_id) < 10 ))
DeclarativePatternMatchingusingSQLSTEP4:RequiredresultDefinetheMEASURES–Listthecolumnstobereturned- Calculatedcolumns- Existingcolumns
Reportaccount,dateoffirstsmalltransfer,dateoflastlargetransfer,sumoflargetransfer
![Page 26: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/26.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT . . . FROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY userid ORDER BY timeMEASURES FIRST(x.time_id) AS first_t,
LAST(y.time_ID) AS last_t, y.amount amount
ONE ROW PER MATCHPATTERN ( X{3,} Y)DEFINE
X as (amount < 2000) ANDLAST(time_id) – FIRST(time_id) < 30,
Y as (amount >= 1000000 AND time_id – LAST(x.time_id) < 10 ))
DeclarativePatternMatchingusingSQLSTEP3:Requiredresult
ControltheoutputintermsofROWsreturned
Outputoneroweachtimewefindamatchtoourpattern
![Page 27: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/27.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
ControllingtheOutput:Summaryvs.Detailed• Which rows to return
– ONE ROW PER MATCH– ALL ROWS PER MATCH – ALL ROWS PER MATCH WITH UNMATCHED ROWS
• After match SKIP option :– SKIP PAST LAST ROW– SKIP TO NEXT ROW– SKIP TO <VARIABLE>– SKIP TO FIRST(<VARIABLE>)– SKIP TO LAST (<VARIABLE>)
![Page 28: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/28.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT user_id, first_t, last_t, amountFROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY user_id ORDER BY time_idMEASURES FIRST(x.time_id) AS first_t,
LAST(y.time_id) AS last_t, y.amount AS amount
ONE ROW PER MATCHPATTERN ( X{3,} Y)DEFINE
X as (amount < 2000) ANDLAST(time_id) – FIRST(time_id) < 30,
Y as (amount >= 1000000 AND time_id – LAST(x.time_id) < 10 ))
DeclarativePatternMatchingusingSQLFinallylistcolumnstoreturnbythepatternmatchingprocesstothecallingapplication
![Page 29: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/29.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. | 29
Livedemonstration– SimpleFraudDetection
![Page 30: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/30.jpg)
developer.oracle.com/code
NewRequirementsManagingnewbusinessrequirements,quicklyandefficientlywithnoapplicationcodechanges
Slide - 30
![Page 31: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/31.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
RefiningThe“SuspiciousMoneyTransfers”PatternDealingWithNewBusinessRequirements
• Additionalrequirement:– Smalltransfersdonotgotothesameaccounttwiceinarow– Totalsumofsmalltransfersmustbelessthan20K
TIME_ID USER ID EVENT TRANSFER_TO AMOUNT1/1/2012 John Deposit - 1,000,0001/2/2012 John Transfer Bob 1,0001/5/2012 John Withdrawal - 2,0001/10/2012 John Transfer Allen 1,5001/20/2012 John Transfer Tim 1,2001/25/2012 John Deposit 1,200,0001/27/2012 John Transfer Tim 1,000,0002/2/2012 John Deposit - 500,000
![Page 32: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/32.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
RefiningThe“SuspiciousMoneyTransfers”Pattern
TIME_IDUSER ID
EVENT TRANSFER_TO AMOUNT
1/1/2012 John Deposit - 1,000,0001/2/2012 John Transfer Bob 1,0001/5/2012 John Withdrawal - 2,0001/10/2012 John Transfer Allen 1,5001/20/2012 John Transfer Tim 1,2001/25/2012 John Deposit 1,200,0001/27/2012 John Transfer Tim 1,000,0002/2/2012 John Deposit - 500,000
Three small transfers within 30 days
to different acct and total sum < 20K
![Page 33: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/33.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
RefiningThe“SuspiciousMoneyTransfers”Pattern
TIME_IDUSER ID
EVENT TRANSFER_TO AMOUNT
1/1/2012 John Deposit - 1,000,0001/2/2012 John Transfer Bob 1,0001/5/2012 John Withdrawal - 2,0001/10/2012 John Transfer Allen 1,5001/20/2012 John Transfer Tim 1,2001/25/2012 John Deposit 1,200,0001/27/2012 John Transfer Tim 1,000,0002/2/2012 John Deposit - 500,000
Three small transfers within 30 days
to different acct and total sum < 20K
Large transfer within 10 days of last small transfer
![Page 34: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/34.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT user_id, first_t, last_t, amountFROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY userid ORDER BY timeMEASURES FIRST(x.time_id) AS first_t,
LAST(y.time_id) AS last_t, y.amount AS amount
ONE ROW PER MATCHPATTERN (X{3,} Y)DEFINE
X as (amount < 2000) AND LAST(time_id) – FIRST(time_id) < 30
SQLPatternMatchinginaction
ModifythepatternvariablesDEFINE- Checkthetransferaccount
![Page 35: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/35.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT user_id, first_t, last_t, amountFROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY userid ORDER BY timeMEASURES FIRST(x.time_id) AS first_t,
LAST(y.time_id) AS last_t, y.amount AS amount
ONE ROW PER MATCHPATTERN (X{3,} Y)DEFINE
X as (amount < 2000) ANDPREV(transfer_id) <> transfer_id ANDLAST(time_id) – FIRST(time_id) < 30
SQLPatternMatchinginaction
ModifythepatternvariablesDEFINE- Checkthetransferaccount
![Page 36: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/36.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SELECT user_id, first_t, last_t, amountFROM (SELECT … FROM json_transactions WHERE event = 'transfer')
MATCH_RECOGNIZE (PARTITION BY userid ORDER BY timeMEASURES FIRST(x.time_id) AS first_t,
LAST(y.time_id) AS last_t, y.amount AS amount
ONE ROW PER MATCHPATTERN (X{3,} Y)DEFINE
X as (amount < 2000) AND PREV(transfer_id) <> transfer_id ANDLAST(time_id) – FIRST(time_id) < 30,
Y as (amount >= 1000000 AND time_id – LAST(x.time_id) < 10 ANDSUM(x.amount) < 20000 ));
SQLPatternMatchinginaction
ModifythepatternvariablesDEFINE
- Checkthetotalofthesmalltransfersislessthan20K
![Page 37: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/37.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. | 37
LiveDemonstration– NewRequirements
![Page 38: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/38.jpg)
developer.oracle.com/code
CombiningAnalyticsWhypatternmatchingwithSQLissopowerful:
ANALYTICALMASH-UPS
Slide - 38
![Page 39: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/39.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
FraudDetectionMash-UpUsingSQLKeybenefitsofSQL– easytocombinedifferenttypesofanalytics
+Real-timestreamingdata+Real-timegeo-coding+SQLPatternMatching+SpatialAnalytics
=Real-timefrauddetection
http://oracle-big-data.blogspot.com/2013/11/sql-analytical-mash-ups-deliver-real.html
![Page 40: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/40.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SQLPatternMatchingvs.JavaFraudDetection:Fewerlinesofcoderequired….
0
100
200
300
400
500
600
700
MapReduce Java SQL Pattern Matching
Lines of Code
![Page 41: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/41.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
0
100
200
300
400
500
600
700
MapReduce Java SQL Pattern Matching
Lines of Code
0
10
20
30
40
50
60
70
80
MapReduce Java SQL Pattern Matching
Execution Time (secs)
SQLPatternMatchingvs.JavaFraudDetection:Fewerlinesofcoderequired….
![Page 42: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/42.jpg)
developer.oracle.com/code
Summary
Slide - 42
![Page 43: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/43.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
Summary– YouCanNow….
• ConstructaMATCH_RECOGNIZEstatement
• Buildsearchcriteriausingpatternvariables
• Checkifyourpatternmatchingreally isworkingcorrectly
• Usebuilt-inmeasurestogetadditionalinformation
• UnderstandthepowerandvalueofSQLpatternmatching
• GoanduseSQLPatternMatchingtoyouradvantage!
✔
✔
✔
✔
✔
✔
![Page 44: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/44.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |
SQLPatternMatchingWheretogetmoreinformation
• AnalyticalSQLHomePage onOTNwithlinksto:– Training+OracleByExample– Podcastsforpatternmatching– Whitepapers– SamplescriptsandsimpletutorialsforpatternmatchingonliveSQL
• DataWarehouseandSQLAnalyticsblog– http://oracle-big-data.blogspot.co.uk/
• Dropmealine… [email protected] orsendaeMail [email protected]
![Page 45: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/45.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. | 45
NoLiveDemonstration..Q&A
![Page 46: Simplified and fast Fraud Detection with just SQL · developer.oracle.com/c ode Simplified and fast Fraud Detection with just SQL](https://reader034.fdocuments.us/reader034/viewer/2022042316/5f04adb87e708231d40f29ea/html5/thumbnails/46.jpg)
Copyright © 2017 Oracle and/or its affiliates. All rights reserved. |