Automated rule generation system and methods

Abstract

A processor is adapted to automatically generate and validate rules for monitoring suspicious activity by: For a first period of time, collecting a first group of transactions, automatically identifying and storing key indicators from the transactions, and automatically storing which of the transactions are pre-identified as fraudulent. Based on the key indicators and the pre-identified fraudulent transactions, training a learning algorithm and, with the learning algorithm, generating a decision tree of logical predicates including the key indicators. Based on the decision tree, generating a plurality of rules, each of which incorporates only one logical predicate from each layer of the decision tree. For a second period of time: collecting a second group of transactions, and generating a quality metric for each rule, by automatically testing the rules against the second group of transactions, and identifying a subset of rules for which the quality metric exceeds a threshold.