# Jube Feature Mapping: fraud_rules.csv → Elixir Implementation Version: 1.0 | Date: 2026-05-21 --- ## 1. Feature Classification The 665 features in fraud_rules.csv fall into two types: ### Type A: Transaction Features ("transaction" in Risk Level Context) Raw values on the incoming payload. No feature store needed. Extracted directly from MwKernel.Message during scoring. Examples: 3DS Used, Amount in Euros, Card Token, CVV Used, Channel, Card country is high risk, Card country is sanctioned, Card BIN, Merchant Country, Transaction Country is in EU, Transaction IP of VPN server, Card Expiry Date, Card Holder Using Disposable Email, Commercial Card ### Type B: Entity Features ("entity" in Risk Level Context) Sliding-window velocity metrics. Require the feature store. Computed asynchronously; hydrated synchronously from cache. Pattern: EntityTarget | Horizon | MetricName --- ## 2. Entity Targets (15 Dimensions) | Entity Target | Redis Key Segment | Lookup Field | |---------------------------|---------------------------|----------------------| | Card | card: | card_token | | Card BIN | card_bin: | card_bin | | Card + Merchant | card_merchant:: | card_token+merchant | | Card + MCC | card_mcc:: | card_token+mcc | | Card + Transaction Country| card_country:: | card_token+tx_country| | Merchant | merchant: | merchant_id | | Acceptor | acceptor: | acceptor_id | | Acceptor Device | acceptor_dev: | device_id | | Cardholder Email | email: | cardholder_email | | Shopper Email | shopper_email: | shopper_email | | Shopper IP address | ip: | transaction_ip | | IP (shopper's device) | device_ip: | device_ip | | Booking Reference | booking: | booking_reference | | MCC | mcc: | merchant_category_code| | Sub Merchant | sub_merchant: | sub_merchant_id | --- ## 3. Time Horizons and Update Frequencies | Horizon Label | Seconds | Update Strategy | Redis Key Suffix | |---------------------------|----------|----------------------|------------------| | 5 minutes | 300 | Real-time (every tx) | 5m | | 15 minutes | 900 | Real-time | 15m | | 20 minutes | 1200 | Real-time | 20m | | 1 hour | 3600 | Real-time | 1h | | 12 hours (every 12h) | 43200 | Batch every 12h | 12h | | 1 day | 86400 | Real-time | 1d | | 1 day (updated daily) | 86400 | Batch daily | 1d_daily | | 1 week | 604800 | Real-time | 1w | | 1 week (updated daily) | 604800 | Batch daily | 1w_daily | | 2 weeks | 1209600 | Real-time | 2w | | 30 days (updated daily) | 2592000 | Batch daily | 30d | | 52 weeks (updated weekly) | 31449600 | Batch weekly | 52w | | 90 days (updated daily) | 7776000 | Batch daily | 90d | | 4 weeks (updated weekly) | 2419200 | Batch weekly | 4w | | 13 weeks (updated weekly) | 7862400 | Batch weekly | 13w | Real-time horizons (≤ 1d): updated on every transaction via VelocityPipeline. Batch horizons (≥ 12h updated daily): pre-calculated by FeaturePrecalcWorker (Oban). --- ## 4. Metric Types and Redis Operations | Metric Type | Redis Operation | Key Suffix | |---------------------------|------------------------|----------------------| | Number of transactions | HINCRBY | :count | | Number of successful | HINCRBY (conditional) | :count_success | | Number of failed | HINCRBY (conditional) | :count_failed | | Total EUR amount | HINCRBYFLOAT | :sum_eur | | Total EUR (successful) | HINCRBYFLOAT (cond.) | :sum_eur_success | | Total EUR (failed) | HINCRBYFLOAT (cond.) | :sum_eur_failed | | Average EUR amount | Derived: sum/count | :avg_eur (computed) | | Proportion of failed | Derived: fail/total | :ratio_failed | | Proportion successful | Derived: succ/total | :ratio_success | | Unique cardholders | PFADD (HyperLogLog) | :hll_cardholders | | Unique cards | PFADD (HyperLogLog) | :hll_cards | | Unique emails | PFADD (HyperLogLog) | :hll_emails | | Distinct card countries | PFADD | :hll_countries | | Time since last tx | HGET PayloadLatest | (computed from ts) | | Prev tx 3DS indicator | HGET PayloadLatest | :prev_3ds | | Prev tx amount | HGET PayloadLatest | :prev_amount | | Repetitive same amount | HINCRBY (conditional) | :count_same_amount | | Standard deviation amount | Welford online algo | :var_eur (+ count) | | Number of chargebacks | HINCRBY (from labels) | :count_chargeback | --- ## 5. Full Redis Key Schema Pattern: risk:::: Examples: risk:1:card:abc123token:1h:count_failed risk:1:merchant:M9876:1d:sum_eur_success risk:1:card_merchant:abc123:M9876:5m:count risk:1:card_bin:453210:1h:hll_cards risk:1:ip:192.168.1.1:15m:count_success risk:1:email:sha256(email):1d:count_fraud_response Journal (sorted set, enables window scan): risk:1:journal:card:abc123token ZADD score=unix_ts member=payload_hash PayloadLatest (hash, most recent tx per entity): risk:1:latest:card:abc123token HSET amount prev_3ds prev_result ts --- ## 6. Feature Priority Tiers (for phased implementation) ### Tier 1 — Phase 3/4 (highest fraud signal, real-time horizons) Card | 1h | Number of failed transactions Card | 1h | Total amount in EUR Card | 5m | Number of successful transactions Card | 20m | Number of failed transactions Card+Merchant | 1h | Number of failed transactions Card+Merchant | 5m | Number of failed transactions Merchant | 1d | Ratio of failed authorizations Cardholder Email | 1h | Number of failed transactions Shopper IP | 15m | Number of successful authorizations ### Tier 2 — Phase 5 (entity daily/weekly batch) Card | 1d_daily | Number of ATM withdrawals Card | 1w_daily | Ratio of failed authorizations Merchant | 1d_daily | Total EUR of merchant deposits Merchant | 1d_daily | Number of chargebacks Acceptor | 1d_daily | Number of merchant deposits ### Tier 3 — Phase 6 (long-horizon AML signals) Merchant | 30d | Number of chargebacks for cross-border transactions Merchant | 52w | Total EUR of chargebacks Card | 90d | Number of transactions Merchant | 90d | Standard deviation of transaction amount MCC | 90d | Ratio of POS transactions with manual PAN key entry