Amazon Fraud Detector Update: The release introduces Account Takeover Insights (ATI) model. The ATI model detects fraud relating to account takeover. This release also adds support for new variable types: ARE_CREDENTIALS_VALID and SESSION_ID and adds new structures to Model Version APIs.

Author: AWS

.changes/next-release/feature-AmazonFraudDetector-b2b5bd1.json

@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "Amazon Fraud Detector",
+    "contributor": "",
+    "description": "The release introduces Account Takeover Insights (ATI) model. The ATI model detects fraud relating to account takeover. This release also adds support for new variable types: ARE_CREDENTIALS_VALID and SESSION_ID and adds new structures to Model Version APIs."
+}

services/frauddetector/src/main/resources/codegen-resources/service-2.json

@@ -1170,6 +1170,56 @@
     }
   },
   "shapes":{
+    "ATIMetricDataPoint":{
+      "type":"structure",
+      "members":{
+        "cr":{
+          "shape":"float",
+          "documentation":"<p> The challenge rate. This indicates the percentage of login events that the model recommends to challenge such as one-time password, multi-factor authentication, and investigations. </p>"
+        },
+        "adr":{
+          "shape":"float",
+          "documentation":"<p> The anomaly discovery rate. This metric quantifies the percentage of anomalies that can be detected by the model at the selected score threshold. A lower score threshold increases the percentage of anomalies captured by the model, but would also require challenging a larger percentage of login events, leading to a higher customer friction. </p>"
+        },
+        "threshold":{
+          "shape":"float",
+          "documentation":"<p> The model's threshold that specifies an acceptable fraud capture rate. For example, a threshold of 500 means any model score 500 or above is labeled as fraud. </p>"
+        },
+        "atodr":{
+          "shape":"float",
+          "documentation":"<p> The account takeover discovery rate. This metric quantifies the percentage of account compromise events that can be detected by the model at the selected score threshold. This metric is only available if 50 or more entities with at-least one labeled account takeover event is present in the ingested dataset. </p>"
+        }
+      },
+      "documentation":"<p> The Account Takeover Insights (ATI) model performance metrics data points. </p>"
+    },
+    "ATIMetricDataPointsList":{
+      "type":"list",
+      "member":{"shape":"ATIMetricDataPoint"}
+    },
+    "ATIModelPerformance":{
+      "type":"structure",
+      "members":{
+        "asi":{
+          "shape":"float",
+          "documentation":"<p> The anomaly separation index (ASI) score. This metric summarizes the overall ability of the model to separate anomalous activities from the normal behavior. Depending on the business, a large fraction of these anomalous activities can be malicious and correspond to the account takeover attacks. A model with no separability power will have the lowest possible ASI score of 0.5, whereas the a model with a high separability power will have the highest possible ASI score of 1.0 </p>"
+        }
+      },
+      "documentation":"<p> The Account Takeover Insights (ATI) model performance score. </p>"
+    },
+    "ATITrainingMetricsValue":{
+      "type":"structure",
+      "members":{
+        "metricDataPoints":{
+          "shape":"ATIMetricDataPointsList",
+          "documentation":"<p> The model's performance metrics data points. </p>"
+        },
+        "modelPerformance":{
+          "shape":"ATIModelPerformance",
+          "documentation":"<p> The model's overall performance scores. </p>"
+        }
+      },
+      "documentation":"<p> The Account Takeover Insights (ATI) model training metric details. </p>"
+    },
     "AccessDeniedException":{
       "type":"structure",
       "required":["message"],
@@ -1179,6 +1229,52 @@
       "documentation":"<p>An exception indicating Amazon Fraud Detector does not have the needed permissions. This can occur if you submit a request, such as <code>PutExternalModel</code>, that specifies a role that is not in your account.</p>",
       "exception":true
     },
+    "AggregatedLogOddsMetric":{
+      "type":"structure",
+      "required":[
+        "variableNames",
+        "aggregatedVariablesImportance"
+      ],
+      "members":{
+        "variableNames":{
+          "shape":"ListOfStrings",
+          "documentation":"<p> The names of all the variables. </p>"
+        },
+        "aggregatedVariablesImportance":{
+          "shape":"float",
+          "documentation":"<p> The relative importance of the variables in the list to the other event variable. </p>"
+        }
+      },
+      "documentation":"<p>The log odds metric details.</p> <p>Account Takeover Insights (ATI) model uses event variables from the login data you provide to continuously calculate a set of variables (aggregated variables) based on historical events. For example, your ATI model might calculate the number of times an user has logged in using the same IP address. In this case, event variables used to derive the aggregated variables are <code>IP address</code> and <code>user</code>.</p>"
+    },
+    "AggregatedVariablesImpactExplanation":{
+      "type":"structure",
+      "members":{
+        "eventVariableNames":{
+          "shape":"ListOfStrings",
+          "documentation":"<p> The names of all the event variables that were used to derive the aggregated variables. </p>"
+        },
+        "relativeImpact":{
+          "shape":"string",
+          "documentation":"<p> The relative impact of the aggregated variables in terms of magnitude on the prediction scores. </p>"
+        },
+        "logOddsImpact":{
+          "shape":"float",
+          "documentation":"<p> The raw, uninterpreted value represented as log-odds of the fraud. These values are usually between -10 to +10, but range from -infinity to +infinity.</p> <ul> <li> <p>A positive value indicates that the variables drove the risk score up.</p> </li> <li> <p>A negative value indicates that the variables drove the risk score down.</p> </li> </ul>"
+        }
+      },
+      "documentation":"<p> The details of the impact of aggregated variables on the prediction score. </p> <p>Account Takeover Insights (ATI) model uses the login data you provide to continuously calculate a set of variables (aggregated variables) based on historical events. For example, the model might calculate the number of times an user has logged in using the same IP address. In this case, event variables used to derive the aggregated variables are <code>IP address</code> and <code>user</code>.</p>"
+    },
+    "AggregatedVariablesImportanceMetrics":{
+      "type":"structure",
+      "members":{
+        "logOddsMetrics":{
+          "shape":"ListOfAggregatedLogOddsMetrics",
+          "documentation":"<p> List of variables' metrics. </p>"
+        }
+      },
+      "documentation":"<p>The details of the relative importance of the aggregated variables.</p> <p>Account Takeover Insights (ATI) model uses event variables from the login data you provide to continuously calculate a set of variables (aggregated variables) based on historical events. For example, your ATI model might calculate the number of times an user has logged in using the same IP address. In this case, event variables used to derive the aggregated variables are <code>IP address</code> and <code>user</code>.</p>"
+    },
     "AsyncJobStatus":{
       "type":"string",
       "enum":[
@@ -1812,14 +1908,14 @@
       "members":{
         "fileLevelMessages":{
           "shape":"fileValidationMessageList",
-          "documentation":"<p>The file-specific model training validation messages.</p>"
+          "documentation":"<p>The file-specific model training data validation messages.</p>"
         },
         "fieldLevelMessages":{
           "shape":"fieldValidationMessageList",
           "documentation":"<p>The field-specific model training validation messages.</p>"
         }
       },
-      "documentation":"<p>The model training validation messages.</p>"
+      "documentation":"<p>The model training data validation metrics.</p>"
     },
     "DeleteAuditHistory":{"type":"boolean"},
     "DeleteBatchImportJobRequest":{
@@ -3493,7 +3589,6 @@
     },
     "LabelSchema":{
       "type":"structure",
-      "required":["labelMapper"],
       "members":{
         "labelMapper":{
           "shape":"labelMapper",
@@ -3556,6 +3651,14 @@
         }
       }
     },
+    "ListOfAggregatedLogOddsMetrics":{
+      "type":"list",
+      "member":{"shape":"AggregatedLogOddsMetric"}
+    },
+    "ListOfAggregatedVariablesImpactExplanations":{
+      "type":"list",
+      "member":{"shape":"AggregatedVariablesImpactExplanation"}
+    },
     "ListOfEvaluatedExternalModels":{
       "type":"list",
       "member":{"shape":"EvaluatedExternalModel"}
@@ -3825,7 +3928,8 @@
       "type":"string",
       "enum":[
         "ONLINE_FRAUD_INSIGHTS",
-        "TRANSACTION_FRAUD_INSIGHTS"
+        "TRANSACTION_FRAUD_INSIGHTS",
+        "ACCOUNT_TAKEOVER_INSIGHTS"
       ]
     },
     "ModelVersion":{
@@ -3905,6 +4009,10 @@
         "arn":{
           "shape":"fraudDetectorArn",
           "documentation":"<p>The model version ARN.</p>"
+        },
+        "trainingResultV2":{
+          "shape":"TrainingResultV2",
+          "documentation":"<p> The training result details. The details include the relative importance of the variables. </p>"
         }
       },
       "documentation":"<p>The details of the model version.</p>"
@@ -3946,6 +4054,56 @@
       "member":{"shape":"string"},
       "min":1
     },
+    "OFIMetricDataPoint":{
+      "type":"structure",
+      "members":{
+        "fpr":{
+          "shape":"float",
+          "documentation":"<p> The false positive rate. This is the percentage of total legitimate events that are incorrectly predicted as fraud. </p>"
+        },
+        "precision":{
+          "shape":"float",
+          "documentation":"<p> The percentage of fraud events correctly predicted as fraudulent as compared to all events predicted as fraudulent. </p>"
+        },
+        "tpr":{
+          "shape":"float",
+          "documentation":"<p> The true positive rate. This is the percentage of total fraud the model detects. Also known as capture rate. </p>"
+        },
+        "threshold":{
+          "shape":"float",
+          "documentation":"<p> The model threshold that specifies an acceptable fraud capture rate. For example, a threshold of 500 means any model score 500 or above is labeled as fraud. </p>"
+        }
+      },
+      "documentation":"<p> The Online Fraud Insights (OFI) model performance metrics data points. </p>"
+    },
+    "OFIMetricDataPointsList":{
+      "type":"list",
+      "member":{"shape":"OFIMetricDataPoint"}
+    },
+    "OFIModelPerformance":{
+      "type":"structure",
+      "members":{
+        "auc":{
+          "shape":"float",
+          "documentation":"<p> The area under the curve (auc). This summarizes the total positive rate (tpr) and false positive rate (FPR) across all possible model score thresholds. </p>"
+        }
+      },
+      "documentation":"<p> The Online Fraud Insights (OFI) model performance score. </p>"
+    },
+    "OFITrainingMetricsValue":{
+      "type":"structure",
+      "members":{
+        "metricDataPoints":{
+          "shape":"OFIMetricDataPointsList",
+          "documentation":"<p> The model's performance metrics data points. </p>"
+        },
+        "modelPerformance":{
+          "shape":"OFIModelPerformance",
+          "documentation":"<p> The model's overall performance score. </p>"
+        }
+      },
+      "documentation":"<p> The Online Fraud Insights (OFI) model training metric details. </p>"
+    },
     "Outcome":{
       "type":"structure",
       "members":{
@@ -3988,6 +4146,10 @@
         "variableImpactExplanations":{
           "shape":"listOfVariableImpactExplanations",
           "documentation":"<p> The details of the event variable's impact on the prediction score. </p>"
+        },
+        "aggregatedVariablesImpactExplanations":{
+          "shape":"ListOfAggregatedVariablesImpactExplanations",
+          "documentation":"<p> The details of the aggregated variables impact on the prediction score. </p> <p>Account Takeover Insights (ATI) model uses event variables from the login data you provide to continuously calculate a set of variables (aggregated variables) based on historical events. For example, your ATI model might calculate the number of times an user has logged in using the same IP address. In this case, event variables used to derive the aggregated variables are <code>IP address</code> and <code>user</code>.</p>"
         }
       },
       "documentation":"<p> The prediction explanations that provide insight into how each event variable impacted the model version's fraud prediction score. </p>"
@@ -4379,6 +4541,56 @@
       "members":{
       }
     },
+    "TFIMetricDataPoint":{
+      "type":"structure",
+      "members":{
+        "fpr":{
+          "shape":"float",
+          "documentation":"<p> The false positive rate. This is the percentage of total legitimate events that are incorrectly predicted as fraud. </p>"
+        },
+        "precision":{
+          "shape":"float",
+          "documentation":"<p> The percentage of fraud events correctly predicted as fraudulent as compared to all events predicted as fraudulent. </p>"
+        },
+        "tpr":{
+          "shape":"float",
+          "documentation":"<p> The true positive rate. This is the percentage of total fraud the model detects. Also known as capture rate. </p>"
+        },
+        "threshold":{
+          "shape":"float",
+          "documentation":"<p> The model threshold that specifies an acceptable fraud capture rate. For example, a threshold of 500 means any model score 500 or above is labeled as fraud. </p>"
+        }
+      },
+      "documentation":"<p> The performance metrics data points for Transaction Fraud Insights (TFI) model. </p>"
+    },
+    "TFIMetricDataPointsList":{
+      "type":"list",
+      "member":{"shape":"TFIMetricDataPoint"}
+    },
+    "TFIModelPerformance":{
+      "type":"structure",
+      "members":{
+        "auc":{
+          "shape":"float",
+          "documentation":"<p> The area under the curve (auc). This summarizes the total positive rate (tpr) and false positive rate (FPR) across all possible model score thresholds. </p>"
+        }
+      },
+      "documentation":"<p> The Transaction Fraud Insights (TFI) model performance score. </p>"
+    },
+    "TFITrainingMetricsValue":{
+      "type":"structure",
+      "members":{
+        "metricDataPoints":{
+          "shape":"TFIMetricDataPointsList",
+          "documentation":"<p> The model's performance metrics data points. </p>"
+        },
+        "modelPerformance":{
+          "shape":"TFIModelPerformance",
+          "documentation":"<p> The model performance score. </p>"
+        }
+      },
+      "documentation":"<p> The Transaction Fraud Insights (TFI) model training metric details. </p>"
+    },
     "Tag":{
       "type":"structure",
       "required":[
@@ -4436,10 +4648,7 @@
     },
     "TrainingDataSchema":{
       "type":"structure",
-      "required":[
-        "modelVariables",
-        "labelSchema"
-      ],
+      "required":["modelVariables"],
       "members":{
         "modelVariables":{
           "shape":"ListOfStrings",
@@ -4470,6 +4679,24 @@
       },
       "documentation":"<p>The training metric details.</p>"
     },
+    "TrainingMetricsV2":{
+      "type":"structure",
+      "members":{
+        "ofi":{
+          "shape":"OFITrainingMetricsValue",
+          "documentation":"<p> The Online Fraud Insights (OFI) model training metric details. </p>"
+        },
+        "tfi":{
+          "shape":"TFITrainingMetricsValue",
+          "documentation":"<p> The Transaction Fraud Insights (TFI) model training metric details. </p>"
+        },
+        "ati":{
+          "shape":"ATITrainingMetricsValue",
+          "documentation":"<p> The Account Takeover Insights (ATI) model training metric details. </p>"
+        }
+      },
+      "documentation":"<p> The training metrics details. </p>"
+    },
     "TrainingResult":{
       "type":"structure",
       "members":{
@@ -4488,6 +4715,22 @@
       },
       "documentation":"<p>The training result details.</p>"
     },
+    "TrainingResultV2":{
+      "type":"structure",
+      "members":{
+        "dataValidationMetrics":{"shape":"DataValidationMetrics"},
+        "trainingMetricsV2":{
+          "shape":"TrainingMetricsV2",
+          "documentation":"<p> The training metric details. </p>"
+        },
+        "variableImportanceMetrics":{"shape":"VariableImportanceMetrics"},
+        "aggregatedVariablesImportanceMetrics":{
+          "shape":"AggregatedVariablesImportanceMetrics",
+          "documentation":"<p> The variable importance metrics of the aggregated variables. </p> <p>Account Takeover Insights (ATI) model uses event variables from the login data you provide to continuously calculate a set of variables (aggregated variables) based on historical events. For example, your ATI model might calculate the number of times an user has logged in using the same IP address. In this case, event variables used to derive the aggregated variables are <code>IP address</code> and <code>user</code>.</p>"
+        }
+      },
+      "documentation":"<p> The training result details. </p>"
+    },
     "UnlabeledEventsTreatment":{
       "type":"string",
       "enum":[
@@ -5087,7 +5330,7 @@
     "labelMapper":{
       "type":"map",
       "key":{"shape":"string"},
-      "value":{"shape":"NonEmptyListOfStrings"}
+      "value":{"shape":"ListOfStrings"}
     },
     "labelsMaxResults":{
       "type":"integer",
@@ -5195,7 +5438,7 @@
     },
     "variableValue":{
       "type":"string",
-      "max":1024,
+      "max":8192,
       "min":1,
       "sensitive":true
     },