Sample 0105 - ATM Fraud Detection

Introduction

This sample demonstrates how to set up an execution plan with a pattern matching siddhi query. It uses the pattern structure provided by siddhi to monitor if there is an unusually big withdrawal occurred on an account form an ATM card.

The query used in this sample is as follows. It checks whether there is a withdrawal of more than 10000, in a day where the rest of the withdrawal amounts are less than 100.

from every a1 = atmStatsStream[amountWithdrawed < 100]
-> b1 = atmStatsStream[amountWithdrawed > 10000 and a1.cardNo == b1.cardNo]
within 1 day
select a1.cardNo as cardNo, a1.cardHolderName as cardHolderName, b1.amountWithdrawed as amountWithdrawed, b1.location as location, b1.cardHolderMobile as cardHolderMobile
insert into possibleFraudStream;  

Prerequisites

• See Prerequisites in CEP Samples Setup page for generic prerequisites
• Download and install WSO2 Message Broker (version 2.1.0 is used here). Note that when you start more than 1 WSO2 products on the same server, add a port offset to the default port of one product. This is done to avoid port conflicts.

Building the sample

Start the WSO2 CEP server with the sample configuration numbered 0105. For instructions, see Starting sample CEP configurations. This sample configuration does the following:

• Creates <CEP_HOME>/repository/conf/stream-manager-config.xml file, which is used to create the stream definitions for the sample.
• Points the default Axis2 repo to <CEP_HOME>/sample/artifacts/0105 (by default, the Axis2 repo is <CEP_HOME>/repository/deployment/server).

Executing the sample

1. Open a new terminal, go to <CEP_HOME>/samples/consumers/log-service and run the command below. It builds the sample axis2 log service and deploys in the axis2 repository that is relevant to the sample.

   ant -DsampleNo=0105

2. See the logs in CEP server when LogService.aar is deploying. For example,

   
   After deployment, the Web service is able to receive messages sent from the CEP server. Next, let's create a topic in the local broker and subscribe LogService on that topic to receive output events from the CEP server.

3. Log in to the CEP management console and click Add menu under the Topics menu. Then, specify the topic name (the output topic) and click Add Topic.
   

4. The Topic Browser page opens. Click in the Subscribe link associated with it.
   
5. Create a subscription as follows:
   
   You can now send events to the CEP.

6. Open another terminal, go to <CEP_HOME>/samples/producers/atm-transaction-stats and run ant from there. It builds and runs the wso2Event producer, which sends twitter feed data to the CEP server.

7. From this terminal, see the details of the events sent.

   Note

   To configure topic use -Dtopic=xxxx

   For example : ant -Dtopic=ATMTransactionStats

   For example, given below is the console output of the CEP server when events are received after processing.