Image Added	ATTENTION: This page has been migrated to the Tazama GitHub repository and is now located at: https://github.com/frmscoe/docs/blob/main/Product/configuration-management.md This page will no longer be maintained in Confluence.

TL;DR

Platform configuration is managed through a number of configuration files, each containing a JSON document that configures a specific processor type (CRSP, rules and typologies) and specific processor instance identified by a processor identifier (id@version) and a configuration version.

...

The core detection capability within the platform is distributed across 3 three distinct steps in the end-to-end evaluation flow.

...

Once data is ingested into the transaction history by the TMS API, the Channel Router and Setup Processor (CRSP) performs an initial “triage” step to determine if the transaction should be inspected by the platform, and in what way. At the moment this is a very simple decision based on the transaction type only (i.e. pain.001, pain.013, pacs.008 and pacs.002), though we envisage that the decision-making here can be more complex in the future by inspecting attributes contained in the message. For now, the CRSP uses the transaction type¹ to select the typologies that are to be evaluated and triggers the rules required by the typologies. The CRSP routing is configured via a network map that defines the hierarchy of typologies and rules. While not directly influenced by a calibration process at present, the behavior of existing rules and typologies may result in changes to the scope of the evaluation defined in the network map. Some rules or typologies may be deemed to be ineffective in the current configuration and removed or recomposed, and new rules or typologies may be added as new behaviors emerge.

...

• Changes to the rule and typology scope of the evaluation (a - network map)

In the rule processors:

• Changes to the parameters that influence the rule processors' behavior (b - rule config)

• Changes to the result bands that classify the rule processors output' outcomes (b - rule config)

In the typology processor:

• Changes to the rule result weightings (c - typology config)

• Changes to the typology threshold (c - typology config)

In this document, we will discuss how the various configuration documents are expected to be updated to influence evaluation behavior.

...

Configuration documents are essentially files that contain a processor-specific configuration object in JSON format. The recommended way to upload the configuration file to the appropriate configuration database (networkMap or configuration) and collection is via Arango DB’s HTTP API that is deployed as standard during platform deployment.

The platform processes configurations in a specific order to evaluate an incoming transaction. Starting with the Channel Router & Setup Processor (CRSP) that interprets the network map for routing, then following with the rule processors that interpret their individual rule configurations to determine how to evaluate the transaction, and then concluding with the typology processor that uses a variety of typology configurations to summarize rule results into typologies (fraud or money laundering scenarios).

...

The development cycle for the platform processors and their associated configurations follow a slightly different flow. The development and configuration process follows somewhat loosely cascading dependencies amongst the configuration documents: typologies rely on rules, and the network map that defines routing relies on typology-and-rule structures.

...

Rule results roll up into typologies through a typology configuration. One would typically only start composing a typology once the target rules have been developed and deployed, though sometimes rules may be added to, or removed from a typology, and through that its configuration, an existing typology. Without a view of the target rules and their configurations, blindly composing a typology would be very difficult, so this step usually follows the completion of the rules.

...

• Rule configuration metadata

• A config object, that

  • may contain a number of parameters

  • may contain a number of exit conditions

  • will contains either result bands

  • or alternatively will contain result cases

...

• id identifies the specific rule processor and its version related to the configurationthat will use the configuration. It is recommended that the rule processor “name” is drawn from the source-code repository where the rule processor code resides, and the version should match the semantical version of the source code as defined in the source code repository.

• cfg is the unique version of the rule configuration. Multiple different versions of a rule configuration can co-exist simultaneously in the platform

• desc offers a readable description of the rule

The combination of the id and cfg strings forms a unique identifier for every rule configuration and is sometimes compiled into a database key, though this is not essential: the database enforces the uniqueness of any configuration to make sure that a specific version of a configuration can never be over-written.

...

Example of the rule configuration metadata:

{
  "id": "rule-001@1.0.0",
  "cfg": "1.0.0",
  "desc": "Derived account age - creditor",
  ...
  }

The configuration object - parameters

A rule processor’s parameters are used to define how a rule processor will operate to evaluate the incoming message. The requirement for the parameters are coded into the rule processor and must be provided in the configuration for the rule processor to deliver a successful outcome. If any of the required parameters are missing, the rule processor will still deliver a result, but it will be a default error outcome. Parameters are given descriptive names to assist the operator in specifying them correctly. Parameters often differ from one rule to the next, but typically define thresholds and time-frames for the historical queries that are executed inside a rule processor. Some notable examples:

Example of the parameters object:

  "config": {
    "parameters": {
      "maxQueryRange": 86400000,
      "commission": 0.1,
      "tolerance": 0.1
    }
  }

...

Example of the exitConditions object:

  "config": {
    "exitConditions": [
      {
        "subRuleRef": ".x00",
        "outcome": false,
        "reason": "Unsuccessful transaction"
      },
      {
        "subRuleRef": ".x01",
        "outcome": false,
        "reason": "Insufficient transaction history"
      }
    ]

...

Complete example of a rule processor configuration

Complete example of a rule processor configuration

2.2. Typology Configuration

...

• id identifies the specific typology processor and version related to its version that will be used by the configuration. There will typically only be a single typology processor active in the platform at a time, but it is possible and conceivable that multiple typology processors and/or versions can co-exist simultaneously. It is recommended that the typology processor “name” is drawn from the source-code repository where the typology processor code resides, and the version should match the semantical version of the source code as defined in the source code.

• cfg is the unique version of the typology configuration. Though unlikely, multiple different versions of a typology configuration can co-exist simultaneously in the platform. The configuration consists of two parts: an arbitrary identifier for the typology to differentiate one typology from another, and then, separated by an @, a semantical version that defines the specific version of the configuration for that typology, for example typology-001@1.0.0.

• desc offers a readable description of the typology

The combination of the id and cfg strings forms a unique identifier for every rule configuration and is sometimes compiled into a database key, though this is not essential: the database enforces the uniqueness of any configuration to make sure that a specific version of a configuration can never be over-written.

The Rules object

The rules object is an array that contains an element for every possible outcome for each of the rule results that can be received from the rule processors in scope for the typology.

...

Every. Possible. Outcome.

All the possible outcomes from the rule processors are encapsulated in each rule’s configuration, with the exception of the .err outcome that is not listed in the rule configuration for reasons mentioned above. When composing the typology configuration, the user must remember to include the .err outcome, but the rest of the rule results (exit conditions and banded/cased results) can be directly reconciled with the elements in the rules object.

Each rule result element in the rules array contains the same attributes:

...

Attribute

...

Description

...

id

...

The rule processor that was used to determine the rule result is uniquely identified by this identifier attribute.

...

cfg

...

The configuration version attribute specifies the unique version of the rule configuration that was used by the processor to determine this result.

...

ref

...

Every rule processor is capable of reporting a number of different outcomes, but only a single outcome from the complete set is ultimately delivered to the typology processor. Each unique outcome is defined by a unique sub-rule reference identifier to differentiate the delivered outcome from the others

The unique combination of id, cfg and ref attributes references a unique outcome from each rule processor and allows the typology processor to apply a unique weighting to that specific outcome.

...

true

...

The outcome of the rule result will be either true or false, depending if the configurer expected the result to deterministic or not. If the outcome is true, the rule result will be assigned the weighting associated with the true attribute in the configuration. By convention, deterministic (true) outcomes are assigned a positive number as a weighting.

...

false

...

The outcome of the rule result will be either true or false, depending if the configurer expected the result to deterministic or not. If the outcome is false, the rule result will be assigned the weighting associated with the false attribute in the configuration. By convention, deterministic (false) outcomes are usually assigned a weighting of 0 (zero).

The expression object

The expression object in the typology processor defines the formula that is used to calculate the typology score. The expression is able to accommodate any formula composed out of a combination of multiplication (*), division (/), addition (+) and subtraction (-) operations.

In its most basic implementation, the expression is merely a sum of all the weighted rule results. This also means that every deterministic rule listed in the rules array object in the typology configuration must be represented in the expression as a term, otherwise the rule weighting will not be taken into account during the score calculation.

The expression object contains the operators and terms that make up the typology scoring formula. Operators and their associated terms are defined as a series of nested objects in the JSON structure. For example, if wanted to add two terms, a and b, I would start the expression with the operator and then nest the terms beneath it, as follows:

a + b

"expression": {
  "operator": "+",
  "terms": ["a", "b"]
}

In the platform the terms a and b would be represented by their unique id and cfg combination:

{
  "id": "001@1.0.0",
  "cfg": "1.0.0"
}

We don’t have to also supply a specific sub-rule reference: each rule processor only submits one of its possible rule results at a time.

If, for example, we wanted to apply an additional multiplier to the formula (e.g. (a + b) * c, the resulting expression would be structured as follows:

"expression": {
  "operator": "*",
  "terms": ["c",
    "operator":"+",
    "terms": ["a", "b"]
  ]
}

By example, a complete expression for a typology that relies on 4 rule results and calculates the typology score as a sum of the rule result weightings would be composed as follows:

Example of the typology configuration metadata:

{
  "id": "typology-processor@1.0.0",
  "cfg": "typology-001@1.0.0",
  "desc": "Use of several currencies, structured transactions, etc",
  ...
  }

The Rules object

The rules object is an array that contains an element for every possible outcome for each of the rule results that can be received from the rule processors in scope for the typology.

...

Every. Possible. Outcome.

All the possible outcomes from the rule processors are encapsulated in each rule’s configuration, with the exception of the .err outcome that is not listed in the rule configuration because the conditions and descriptions are built into the rule processor itself. When composing the typology configuration, the user must remember to include the .err outcome, but the rest of the rule results (exit conditions and banded/cased results) can be directly reconciled with the elements in the rules object.

Each rule result element in the rules array contains the same attributes:

Because the rules object contains every possible rule result outcome from each of the rule processors allocated to the typology, the typology configuration can become quite verbose, but here’s a short example of a rules object for a typology that contains two rules:

"rules": [
  {
    "id": "001@1.0.0",
    "cfg": "1.0.0",
    "ref": ".err",
    "true": 0,
    "false": 0
  },
  {
    "id": "001@1.0.0",
    "cfg": "1.0.0",
    "ref": ".x01",
    "true": 100,
    "false": 0
  },
  {
    "id": "001@1.0.0",
    "cfg": "1.0.0",
    "ref": ".01",
    "true": 200,
    "false": 0
  },
  {
    "id": "001@1.0.0",
    "cfg": "1.0.0",
    "ref": ".02",
    "true": 100,
    "false": 0
  },
  {
    "id": "002@1.0.0",
    "cfg": "1.0.0",
    "ref": ".err",
    "true": 0,
    "false": 0
  },
  {
    "id": "002@1.0.0",
    "cfg": "1.0.0",
    "ref": ".x01",
    "true": 100,
    "false": 0
  },
  {
    "id": "002@1.0.0",
    "cfg": "1.0.0",
    "ref": ".x02",
    "true": 100,
    "false": 0
  },
  {
    "id": "002@1.0.0",
    "cfg": "1.0.0",
    "ref": ".01",
    "true": 100,
    "false": 0
  },
  {
    "id": "002@1.0.0",
    "cfg": "1.0.0",
    "ref": ".02",
    "true": 200,
    "false": 0
  }
]

The expression object

The expression object in the typology processor defines the formula that is used to calculate the typology score. The expression is able to accommodate any formula composed out of a combination of multiplication (*), division (/), addition (+) and subtraction (-) operations.

In its most basic implementation, the expression is merely a sum of all the weighted rule results. This also means that every deterministic rule listed in the rules array object in the typology configuration must be represented in the expression as a term, otherwise the rule weighting will not be taken into account during the score calculation.

The expression object contains the operators and terms that make up the typology scoring formula. Operators and their associated terms are defined as a series of nested objects in the JSON structure. For example, if wanted to add two terms, a and b, I would start the expression with the operator and then nest the terms beneath it, as follows:

a + b

"expression": {
  "operator": "+",
  "terms": ["a", "b"]
}

In the platform the terms a and b would be represented by their unique id and cfg combination:

{
  "id": "001@1.0.0",
  "cfg": "1.0.0"
}

We don’t have to also supply a specific sub-rule reference: each rule processor only submits one of its possible rule results at a time.

If, for example, we wanted to apply an additional multiplier to the formula (e.g. (a + b) * c, the resulting expression would be structured as follows:

"expression": {
  "operator": "*",
  "terms": ["c",
    "operator":"+",
    "terms": ["a", "b"]
  ]
}

By example, a complete expression for a typology that relies on 4 rule results and calculates the typology score as a sum of the rule result weightings would be composed as follows:

"expression": {
  "operator": "+",
  "terms": [
    {
      "id": "001@1.0.0",
      "cfg": "1.0.0"
    },
    {
      "id": "002@1.0.0",
      "cfg": "1.0.0"
    },
    {
      "id": "003@1.0.0",
      "cfg": "1.0.0"
    },
    {
      "id": "004@1.0.0",
      "cfg": "1.0.0"
    },    
  ]
}

Mathematically, this expression would translate to:

...

or simply:

typology score = rule 001 weighting + rule 002 weighting + rule 003 weighting + rule 004 weighting

The workflow object

The workflow object determines the thresholds according to which the typology processor will decide if an action is necessary in response to the typology score. A typology can be configured with two separate thresholds:

Alert (alertThreshold): this threshold will only alert an investigator if the threshold was breached, but will not force the typology processor to take any other direct action

Interdiction (interdictionThreshold): if breached, this threshold will force the typology processor to issue a message to the client platform to block the transaction. This action will also force an alert to an investigator at the end of the evaluation process.

A threshold breach occurs when the calculated typology score is greater or equal to the threshold (>=).

Alerts are intended to trigger the investigation of a transaction; either because the transaction was blocked by interdiction, or perhaps because there was not sufficient evidence to outright block a transaction, but enough evidence was accumulated to arouse suspicion.
A typology may be configured with alert threshold, but without an interdiction threshold, usually when the typology is focused on money laundering and the intention of the alert is to trigger surveillance processes without tipping the participants off that their criminal behavior had been noticed.

The platform also allows for separate thresholds for alerts and interdictions so that the platform can generate an alert for a lower and more sensitive threshold than an interdiction. The platform may also omit the alert threshold altogether since the interdiction threshold will generate an alert anyway if the interdiction threshold is breached. (And even though it is possible to specify an alert threshold greater or equal to an interdiction threshold, this alert threshold would be redundant.)

If a specific type of threshold is not required, the threshold should be omitted entirely. A typology configuration threshold value of 0 (zero) will always result in a breach of that typology.

The thresholds are located in a workflow object in the typology configuration. If, for example, the platform is expected to alert on a typology score of 500 or more, and interdict on a typology score of 1000 or more, the workflow object would be composed as follows:

"workflow": {
  "alertThreshold": 500,
  "interdictionThreshold": 1000
}

Complete example of a typology configuration

Complete example of a typology processor configuration

2.3. The Network Map

Introduction

The network map associates a specific transaction type with the rules and typologies that will be used to evaluate the incoming transaction. The network map allows for a sub-division of typologies according to themes (channels) as may be appropriate for a specific implementation. For example, typologies can be arranged in channels according to the types of financial crime they aim to detect, or typologies can be arranged according to the speed and performance with which they are required to respond, based on the infrastructure onto which the rules are deployed.

The network map is structured as a decision tree that defines the rules in a typology, the typologies into a channel and the channels into a transaction (by type):

...

The network map contains the following information:

• Network map metadata

• A messages array object that transactions, containing

  • an array of channels, containing

    • an array of typologies, containing

      • an array of rules

The network map allows the Channel Router and Setup Processor (CRSP) to:

1. Identify whether the incoming transaction type should be routed for evaluation (undefined types are not routed at all)

2. Determine which typologies will be used to evaluate the transaction

3. Determine which unique rules are required by those typologies

4. Route the transaction to each of the identified rule processors

The network map defines the route in a hierarchy following the order:

transactions -> channels -> typologies -> rules

and the evaluation is executed along the defined route in reverse order:

rules -> typologies -> channels -> transaction.

Network map metadata

The network map “header” contains metadata that describes the network map. The metadata includes the following attributes:

• cfg is the unique version of the network map. The version allows an investigator or auditor to know which version of the network map was used in a specific evaluation.

• active is a flag that identifies the current active network map in use by the platform. There can only ever be one active version of the network map and this flag is updated when a network map is superseded by a new version. The value of this attribute for the current active network is true. The value for every inactive version is false. The purpose of this flag is to allow the platform operator to roll back to a previous version of a network map by deactivating the current active network map and activating the older version.

{
  "active": true,
  "cfg": "1.0.0",

The messages object

The messages object is an array that contains information about the transactions that the platform is expected to evaluate. Each element in the messages object contains the following attributes¹¹:

• id is the unique identifier for the Transaction Aggregation and Decisioning Processor (TADProc) that will be used to ultimately conclude the evaluation of a specific transaction. It is possible for a transaction to be routed to a unique TADProc that contains specialized functionality related to summarizing the transaction’s results¹⁰.

• cfg is the unique version of the deployed TADProc that will be used to conclude the evaluation of the transaction.

• txTp defines the transaction type for which the message element is intended. The txTp value here must match a corresponding TxTp attribute in the root of the incoming message. If no matching txTp attribute is found in the network map, the transaction will not be routed for evaluation and will simply be ignored by the CRSP.

• channels defines the next layer of evaluation destinations along the route laid out by the network map for the evaluation.

  "messages": [
    {
      "id": "004@1.0.0",
      "cfg": "1.0.0",
      "txTp": "pacs.002.001.12",
      "channels": [

The channels object

The channels object is a nested array object inside the transaction element in the messages array object. The channels array defines the channels within which the typologies are distributed. The channel object contains id and cfg attributes to differentiate between multiple channels. The platform is deployed by default to only contain a single channel, so the values are typically:

 "id": "001@1.0.0",
 "cfg": "1.0.0"

Most importantly, the channels array contains a typologies object array that specifies all the typologies that are collected in the specific channel.

{
      "id": "001@1.0.0",
      "cfg": "1.0.0",
      "typologies": [

The typology object

The typology object array contains the following attributes:

• id is the unique identifier for the typology processor that will be invoked to aggregate the specified rule results into a typology. It is possible for a transaction to be routed to a unique typology processor¹⁰ that contains specialized functionality related to calculating the specific typology.

• cfg defines the unique typology and the version of its configuration. The typology processor is effectively just a generic engine that processes the typology’s configuration to combine rules into a typology in a specific way. From a certain perspective, the typology configuration is the typology.

• rules defines the first layer of evaluation destinations along the route laid out by the network map for the evaluation.

            {
              "id": "typology-processor@1.0.0",
              "cfg": "001@1.0.0",
              "rules": [

The rules object

The rules object array contains the following attributes:

• id is the unique identifier for the rule processor and version that will be invoked to evaluate the transaction.

• cfg defines the unique rule configuration version that will guide the execution of the rule processor.

              "rules": [
                {
                  "id": "002@1.0.0",
                  "cfg": "1.0.0"
    },    
 
]
}

Mathematically, this expression would translate to:

...

or simply:

typology score = rule 001 weighting + rule 002 weighting + rule 003 weighting + rule 004 weighting

The workflow object

The workflow object determines the thresholds according to which the typology processor will decide if an action is necessary in response to the typology score. A typology can be configured with two separate thresholds:

alert: this threshold will only alert an investigator if the threshold was breached, but will not force the typology processor to take any other direct action

...

                },

Complete network map example

Complete example of a network map

2.4. Updating configurations via the ArangoDB API

3. Version Management

3.1. Introduction and Basics

...

Configuration documents in Actio Tazama are strictly structured JSON documents. Each document contains an identifier related to the specific processor and version of that processor to which the configuration is to be applied. For example, the configuration for a rule processor would have the following attribute and value in the typology configuration:

...

The configuration version attribute defines the specific version of the configuration file when it is used by a processor.

Actio Tazama employs semantic versioning³ for both processor source control and configuration documents:

...

...

Beyond this constraint imposed by the database, configuration versions are expected to be managed outside the platform. The Actio platform Tazama does not currently offer a native user interface for configuration management, though Sybrin, one of the FRMS Centre of Excellence’s System Integrator partners, have created a user interface that allows for the creation of configuration documents as well as the automated management of configuration versions between iterations of a configuration document.

...

The network map defines the routing of an incoming transaction to all rules and typologies that are required to evaluate the transaction⁷. By default, the platform is configured to evaluate a pacs.002 transaction that concludes a transaction initiated from a pain.001 or pacs.008 message with a status response.

...

The active network map ultimately defines the scope of a particular evaluation, right down to the specific processors and their versions that are going to be used, as well as the specific version of the processor configuration required. If any of the components in a network map changes, a new network map must be deployed and activated to replace the previous iteration of the network map.

...

References

1. In its current configuration, the platform only evaluates the pacs.002 as the trigger payload for the rule processors and typologies have only been defined with the final status of a payment transaction in mind.

2. The typology processor is not currently configured to interdict the transaction when the threshold is breached; only investigations are commissioned once the evaluation of all the typologies are complete.

3. https://frmscoe.atlassian.net/wiki/spaces/FRMS/pages/76906497/Configuration+management#References%3Asemver.org/

4. https://frmscoe.atlassian.net/wiki/spaces/FRMS/pages/6586489/Rule+Processor+Overview#4.1.-Read-rule-config

5. https://frmscoe.atlassian.net/wiki/spaces/FRMS/pages/1740494/Typology+Processing#5.5.-Read-typology-configuration

6. https://frmscoe.atlassian.net/wiki/spaces/FRMS/pages/6259944/Transaction+Aggregation+and+Decisioning+Processor+TADProc#7.4.2.-Read-transaction-configuration

7. https://frmscoe.atlassian.net/wiki/spaces/FRMS/pages/6520927/Channel+Router+and+Setup+Processor+CRSP#3.1.-Read-Network-Map

8. An explicit version reference has been planned for development to make it easier for an operator to link an evaluation result to the specific originating network map.

9. We have found during our performance testing that the text-based descriptions in our processor results undermines the performance gains we achieved with our ProtoBuff implementation. We will be removing the unabridged reason and processor descriptions from the configuration documents in favor of shorter look-up codes that will then also be used to introduce regionalized/language-specific descriptionsatlassian.net/wiki/spaces/FRMS/pages/6520927/Channel+Router+and+Setup+Processor+CRSP#3.1.-Read-Network-Map

10. An explicit version reference has been planned for development to make it easier for an operator to link an evaluation result to the specific originating network map.

11. We have found during our performance testing that the text-based descriptions in our processor results undermines the performance gains we achieved with our ProtoBuff implementation. We will be removing the unabridged reason and processor descriptions from the configuration documents in favor of shorter look-up codes that will then also be used to introduce regionalized/language-specific descriptions.

12. In its default deployment, the platform contains a single version of the “core” platform processors (the typology processor and TADProc) at a time. Though it is possible to deploy and maintain multiple parallel versions of these processors and manage routing to these processors through the network map, this guide will only focus on singular core processors for now.

13. Before our implementation of NATS, Tazama processors were implemented as RESTful micro-services. The host attributes in the network map contained the URL where the processors could be addressed. With our initial implementation of NATS, the routing information was moved into environment variables that were read into the processors when they were deployed, or restarted in the event of a processor failure. We have now removed the need to specify the host property for a processor - the routing is automatically determined from the network map at processor startup - see https://github.com/frmscoe/General-Issues/issues/310 for details.