Systems and methods for real-time processing of data streams

Abstract

A system for generating alerts including processors and storage devices. The instructions configure the one or more processors to perform operations, which include receiving an event from a data stream, extracting keys from the event, associating the event with at least one account based on the extracted keys, identifying a state variable associated with the at least one account, updating the state variable by accumulating the event in the state variable, registering a time stamp for the event in the state variable, and retiring expired events from the state variable, The operations may also include determining whether the state variable is above a threshold level and generating an alert for the account when the state variable is above the threshold level.

1 .- 20 . (canceled) 
     
     
         21 . A system comprising:
 at least one processor; and   at least one memory device storing instructions that configure the at least one processor to:   generate an array comprising a plurality of state variables, the plurality of state variables being accessible with a constant time complexity, each of the plurality of state variables being associated with one or more user accounts;   determine that an event extracted from a data stream is associated with at least one of the user accounts;   in response to determining that the event is associated with the at least one of the user accounts:
 accumulate the event in one or more of the state variables associated with the at least one of the user accounts by adding an influence of the event, the influence being proportional to a transaction amount; and 
 remove expired events from the plurality of state variables by subtracting influence of events outside an influence window; 
   compute an irregular behavior probability based on weighted state variables using a predictive model; and   trigger an alert for the at least one of the user accounts in response to determining the irregular behavior probability is above a threshold.   
     
     
         22 . The system of  claim 21 , wherein the state variables accumulate the transaction amounts. 
     
     
         23 . The system of  claim 21 , wherein the predictive model comprises a convolutional neural network determining probability of fraudulent activity. 
     
     
         24 . The system of  claim 21 , wherein to remove the expired events, the at least one processor is configured to identify events with a timestamp outside of the influence window. 
     
     
         25 . The system of  claim 24 , wherein to accumulate the event, the at least one processor is further configured to normalize the transaction amount and the timestamp by transforming the timestamp into a single time zone and transforming the transaction amount to a single currency. 
     
     
         26 . The system of  claim 21 , wherein to accumulate the event, the at least one processor is further configured to register a callback for the event in a database. 
     
     
         27 . The system of  claim 21 , wherein the event comprises data of a customer ID, an IP address, and a credit card number. 
     
     
         28 . The system of  claim 21 , wherein:
 the event is and HTTP request; and   the event is received through a representational state transfer application programming interface.   
     
     
         29 . The system of  claim 21 , wherein the at least one processor is further configured to:
 transmit a decline response to a client device associated with the at least one of the user accounts when the irregular behavior probability is above the threshold.   
     
     
         30 . The system of  claim 21 , wherein each of the plurality of state variables is configured to be accessed with a O (1) operator. 
     
     
         31 . A computer implemented method comprising:
 generating an array comprising a plurality of state variables, the plurality of state variables being accessible with a constant time complexity, each of the plurality of state variables being associated with one or more user accounts;   determining that an event extracted from a data stream is associated with at least one of the user accounts;   in response to determining that the event is associated with the at least one of the user accounts:
 accumulating the event in one or more of the state variables associated with the at least one of the user accounts by adding an influence of the event, the influence being proportional to a transaction amount; and 
 removing expired events from the plurality of state variables by subtracting influence of events outside an influence window; 
   computing an irregular behavior probability based on weighted state variables using a predictive model; and   triggering an alert for the at least one of the user accounts in response to determining the irregular behavior probability is above a threshold.   
     
     
         32 . The method of  claim 31 , wherein the state variables accumulate the transaction amounts. 
     
     
         33 . The method of  claim 31 , wherein the predictive model comprises a convolutional neural network determining probability of fraudulent activity. 
     
     
         34 . The method of  claim 31 , wherein removing the expired events comprises identifying events with a timestamp outside of the influence window. 
     
     
         35 . The method of  claim 34 , wherein accumulating the event comprises normalizing the transaction amount and the timestamp by transforming the timestamp into a single time zone and transforming the transaction amount to a single currency. 
     
     
         36 . The method of  claim 31 , wherein accumulating the event comprises registering a callback for the event in a database. 
     
     
         37 . The method of  claim 31 , wherein the event comprises data of a customer ID, an IP address, and a credit card number. 
     
     
         38 . The method of  claim 31 , wherein:
 the event is and HTTP request; and   the event is received through a representational state transfer application programming interface.   
     
     
         39 . The method of  claim 31 , further comprising transmitting a decline response to a client device associated with the at least one of the user accounts when the irregular behavior probability is above the threshold. 
     
     
         40 . The method of  claim 31 , wherein each of the plurality of state variables is configured to be accessed with a O (1) operator.