||
Skip to end of metadata
Go to start of metadata

Introduction

This sample demonstrates how to set up an execution plan with a pattern query that can be used to detect credit card/ATM transaction frauds from transaction events received. This sample uses the Event Simulator for inputs and the logger publisher for logging the custom output events to the CEP console. Custom events are events with custom mappings that does not adhere to the default event formats. For more information on event formats, see Event Formats

The query used in this sample is as follows:

from every a1 = atmStatsStream[amountWithdrawed < 100]
	-> b1 = atmStatsStream[amountWithdrawed > 10000 and a1.cardNo == b1.cardNo]
	within 1 day
select a1.cardNo as cardNo, a1.cardHolderName as cardHolderName, b1.amountWithdrawed as amountWithdrawed, b1.location as location, b1.cardHolderMobile as cardHolderMobile
insert into possibleFraudStream;

The above query is based on the assumption that a ATM card thief will first test the stolen card with a small transaction and then within a short period will try to make large payments with the card. The query:

  • Processes the events received through the atmStatsStream.
  • First looks for an event a1 where the amountWithdrawn is less than 100.
  • Next it looks for another event b1 where the card number is the same as previous and amountWithdrawn is greater than 10000. The within keyword ensures that this condition should be satisfied within a day.
  • When the pattern condition is satisfied, selects the attribute and renames them as: 
    a1.cardNo as cardNo, a1.cardHolderName as cardHolderName, b1.amountWithdrawed as amountWithdrawed, b1.location as location, b1.cardHolderMobile as cardHolderMobile
  • Inserts the output events to the possibleFraudStream.

Prerequisites

Set up the prerequisites required for all samples.

Building the sample

Start the WSO2 CEP server with the sample configuration numbered 0108. For instructions, see Starting sample CEP configurations. This sample configuration does the following:

  • Points the default Axis2 repo to <CEP_HOME>/samples/cep/artifacts/0108 (by default, the Axis2 repo is <CEP_HOME>/repository/deployment/server).

Executing the sample

  1. Log into the CEP management console which is located at https://localhost:9443/carbon.

  2. Go to Tools -> Event Simulator. Under the Multiple Events section, you can see the events.csv file. This file contains some sample data. Click Play to start sending sample events from the file.
  3. See the output events received from the CEP console. This sample uses the logger adaptor to log output events to the console.

    For example, given below is a screenshot of the output of the consumer sending events from the producer:

  • No labels