Implementing detection in ICFM (Analysis)

An analysis flow is invoked by the ICFM Analysis Director that is responsible for invoking the correct analysis flow for the data that is imported, or ingestion notification received. The Analysis Director then performs a specified set of analytics and produces a set of assessments.

The input for every analysis flow contains the context, analysis run ID, and time stamp for the last time the flow was run. The context and analysisRunID values that are passed in must also be passed back from the analysis flow to the Analysis Director. The lastRunTimestamp value is used primarily to obtain data that is newer than the last time that this analysis flow was run.

The output from an analysis flow is a set of assessments for the objects that were analyzed. Each assessment represents the fraud risk for that context. The analysis flow context is the scope in which this analysis’ fraud assessment was determined. In other words, the type of fraud and its related risk is within the context of that analysis. The analysis flow is responsible for producing the assessment output. The input and output parameters are discussed later.

The middle part of an analysis flow is the analytics that determine the risk score, the fraud assessment, or both. The analysis flow works with the analytics to reach this conclusion. Sometimes those analytics are computational and sometimes the analytics are simple-rule based.

Automated analysis in ICFM is composed of several parts. The analytics that are used by an analysis flow can vary, as shown in the following diagram.

Structure of the ICFM analysis

As shown in this diagram, both synchronous and asynchronous types of analysis are performed in ICFM.

Identity resolution and unstructured data analysis are asynchronous. These items do not need an analysis flow assessment. The data is persisted into the Counter Fraud fact store on receipt of that information by the ICFM software. An analysis flow that requires that information looks it up in the Counter Fraud database, and avoids an expensive synchronous call to perform these operations.
Remember: For asynchronous operations in ICFM, the results are available from the Counter Fraud fact store directly.

The synchronous calls that occur from an analysis flow have two primary components:

Rules component
Provides a fast and efficient way to run a set of rules by parallel processing across a cluster. The rules application receives the data on which to run rules and returns the score, fraud assessment, or both for each record or object instance. The analysis flow obtains the objects on which the rules are run and also builds the assessment response that is returned.
Computational component
Provides a fast and massively scalable runtime environment that supports various statistical nodes, predictive nodes, anomaly detection nodes, complex statistical analysis nodes, in-flight textual parsing, and various other capabilities.

You can use the two components individually or in combination to perform a wide variety of detection techniques based on the intent of a specific analysis scenario.