Sample 0105 - ATM Fraud Detection

Introduction

This sample demonstrates how to set up an execution plan with a pattern matching siddhi query. It uses the pattern structure provided by siddhi to monitor if there is an unusually big withdrawal occurred on an account form an ATM card.

The query used in this sample is as follows. It checks whether there is a withdrawal of more than 10000, in a day where the rest of the withdrawal amounts are less than 100.

from every a1 = atmStatsStream[amountWithdrawed < 100]
-> b1 = atmStatsStream[amountWithdrawed > 10000 and a1.cardNo == b1.cardNo]
within 1 day
select a1.cardNo as cardNo, a1.cardHolderName as cardHolderName, b1.amountWithdrawed as amountWithdrawed, b1.location as location, b1.cardHolderMobile as cardHolderMobile
insert into possibleFraudStream;

Prerequisites

See Prerequisites in CEP Samples Setup page for generic prerequisites. (copy apache axiom.jar to <CEP_HOME>/samples/lib directory to send XML event types)

Building the sample

Start the WSO2 CEP server with the sample configuration numbered 0105. For instructions, see Starting sample CEP configurations. This sample configuration does the following:

Creates <CEP_HOME>/repository/conf/data-bridge/stream-definitions.xml file, which is used to create the stream definitions for the sample.
Points the default Axis2 repo to <CEP_HOME>/sample/artifacts/0105 (by default, the Axis2 repo is <CEP_HOME>/repository/deployment/server).

Executing the sample

Open a new terminal, go to <CEP_HOME>/samples/consumers/axis2-log-service and run the command below. It builds the sample axis2 log service and deploys in the axis2 repository that is relevant to the sample.
```
ant -DsampleNo=0105
```
See the logs in CEP server when logger service is deploying. For example,

After deployment, the Web service is able to receive messages sent from the CEP server. Next, let's create a topic in the local broker and subscribe LogService on that topic to receive output events from the CEP server.
Go to the management console and select the Try this service option . (Main --> Services )

Then you will redirected to a UI shown below, then change the endpoint and body as shown below and click on send.

Endpoint - http://localhost:9763/services/SoapInputAdaptor/ATMTransactionStats
Body - Event 1

<body>
	<atmdata:ATMTransactionStatsStream xmlns:atmdata="http://samples.wso2.org/">
		<atmdata:ATMTransactionStat>
		<atmdata:CardNo>ED936784773</atmdata:CardNo>
		<atmdata:CardHolderName>Mohan</atmdata:CardHolderName>
		<atmdata:AmountWithdrawed>80</atmdata:AmountWithdrawed>
		<atmdata:TransactionTime>PDT 11:00</atmdata:TransactionTime>
		<atmdata:Location>Newyork</atmdata:Location>
		<atmdata:BankName>Bank of Newyork</atmdata:BankName>
		<atmdata:AccountNo>8957836745</atmdata:AccountNo>
		<atmdata:CardHolderMobile>9667339388</atmdata:CardHolderMobile>
		</atmdata:ATMTransactionStat>
	</atmdata:ATMTransactionStatsStream>
</body>

Similarly send the following ATM stat events as well through the try it feature.

Event 2

<body>
	<atmdata:ATMTransactionStatsStream xmlns:atmdata="http://samples.wso2.org/">
		<atmdata:ATMTransactionStat>
		<atmdata:CardNo>BC78946623</atmdata:CardNo>
		<atmdata:CardHolderName>John</atmdata:CardHolderName>
		<atmdata:AmountWithdrawed>1000</atmdata:AmountWithdrawed>
		<atmdata:TransactionTime>PDT 01:00</atmdata:TransactionTime>
		<atmdata:Location>California</atmdata:Location>
		<atmdata:BankName>Bank of Wonder</atmdata:BankName>
		<atmdata:AccountNo>PDT 12:00</atmdata:AccountNo>
		<atmdata:CardHolderMobile>94729327932</atmdata:CardHolderMobile>
		</atmdata:ATMTransactionStat>
	</atmdata:ATMTransactionStatsStream>
</body>

Event 3

<body>
	<atmdata:ATMTransactionStatsStream xmlns:atmdata="http://samples.wso2.org/">
		<atmdata:ATMTransactionStat>
		<atmdata:CardNo>GH679893232</atmdata:CardNo>
		<atmdata:CardHolderName>Tom</atmdata:CardHolderName>
		<atmdata:AmountWithdrawed>900</atmdata:AmountWithdrawed>
		<atmdata:TransactionTime>PDT 02:00</atmdata:TransactionTime>
		<atmdata:Location>Texas</atmdata:Location>
		<atmdata:BankName>Bank of Greenwich</atmdata:BankName>
		<atmdata:AccountNo>783233422</atmdata:AccountNo>
		<atmdata:CardHolderMobile>98434345532</atmdata:CardHolderMobile>
		</atmdata:ATMTransactionStat>
	</atmdata:ATMTransactionStatsStream>
</body>

Event 4

<body>
	<atmdata:ATMTransactionStatsStream xmlns:atmdata="http://samples.wso2.org/">
		<atmdata:ATMTransactionStat>
		<atmdata:CardNo>ED936784773</atmdata:CardNo>
		<atmdata:CardHolderName>Mohan</atmdata:CardHolderName>
		<atmdata:AmountWithdrawed>15000</atmdata:AmountWithdrawed>
		<atmdata:TransactionTime>PDT 03:00</atmdata:TransactionTime>
		<atmdata:Location>Newyork</atmdata:Location>
		<atmdata:BankName>Bank of Newyork</atmdata:BankName>
		<atmdata:AccountNo>8957836745</atmdata:AccountNo>
		<atmdata:CardHolderMobile>9667339388</atmdata:CardHolderMobile>
		</atmdata:ATMTransactionStat>
	</atmdata:ATMTransactionStatsStream>
</body>

From the terminal opened when starting the CEP server, you can see the processed events which emitted by CEP.
For example, given below is part of the console output of the consumer when sending events through Try-it service.