ユースケース：金融 — リアルタイム不正検知システムの構築

# app/models/transaction.rb
class Transaction < ApplicationRecord
  belongs_to :account
  has_one :risk_assessment, dependent: :destroy
 
  enum :status, {
    pending:   0,
    approved:  1,
    flagged:   2,
    blocked:   3,
    reviewed:  4
  }
 
  scope :high_risk, -> { joins(:risk_assessment).where("risk_assessments.score >= ?", 0.8) }
  scope :recent, -> { where("created_at >= ?", 1.hour.ago) }
 
  validates :amount, presence: true, numericality: { greater_than: 0 }
  validates :currency, presence: true, inclusion: { in: %w[JPY USD EUR GBP] }
  validates :source_account, :destination_account, presence: true
 
  def velocity_score
    recent_count = account.transactions.where("created_at >= ?", 1.hour.ago).count
    recent_total = account.transactions.where("created_at >= ?", 1.hour.ago).sum(:amount)
 
    {
      count_per_hour: recent_count,
      total_per_hour: recent_total,
      exceeds_threshold: recent_count > 10 || recent_total > 1_000_000
    }
  end
end

# app/models/risk_assessment.rb
class RiskAssessment < ApplicationRecord
  belongs_to :transaction
 
  validates :score, presence: true, numericality: { in: 0.0..1.0 }
  validates :model_version, presence: true
 
  def high_risk?
    score >= 0.8
  end
 
  def medium_risk?
    score >= 0.5 && score < 0.8
  end
end

# app/services/fraud_detection_service.rb
class FraudDetectionService
  RISK_THRESHOLD_HIGH = 0.8
  RISK_THRESHOLD_MEDIUM = 0.5
 
  def initialize(transaction)
    @transaction = transaction
    @client = Aws::SageMakerRuntime::Client.new(region: "ap-northeast-1")
  end
 
  def evaluate
    start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
 
    features = build_feature_vector
    ml_score = invoke_ml_model(features)
    rule_score = apply_rule_engine
    combined_score = combine_scores(ml_score, rule_score)
 
    elapsed_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round(2)
 
    assessment = @transaction.create_risk_assessment!(
      score: combined_score,
      ml_score: ml_score,
      rule_score: rule_score,
      model_version: ENV.fetch("MODEL_VERSION", "v1.0"),
      latency_ms: elapsed_ms,
      features: features.to_json
    )
 
    take_action(assessment)
    assessment
  end
 
  private
 
  def build_feature_vector
    velocity = @transaction.velocity_score
 
    {
      amount: @transaction.amount,
      currency: @transaction.currency,
      hour_of_day: @transaction.created_at.hour,
      day_of_week: @transaction.created_at.wday,
      is_international: @transaction.source_account[0..1] != @transaction.destination_account[0..1],
      velocity_count: velocity[:count_per_hour],
      velocity_total: velocity[:total_per_hour],
      account_age_days: @transaction.account.created_at.to_date.mjd - Date.today.mjd
    }
  end
 
  def invoke_ml_model(features)
    response = @client.invoke_endpoint(
      endpoint_name: ENV.fetch("SAGEMAKER_ENDPOINT"),
      content_type: "application/json",
      body: { features: features.values }.to_json
    )
 
    JSON.parse(response.body.read)["score"]
  rescue Aws::SageMakerRuntime::Errors::ServiceError => e
    Rails.logger.error("[FraudDetection] SageMaker error: #{e.message}")
    fallback_score(features)
  end
 
  def apply_rule_engine
    score = 0.0
 
    # ルール1: 深夜の高額送金
    if @transaction.created_at.hour.between?(0, 5) && @transaction.amount > 500_000
      score += 0.3
    end
 
    # ルール2: 新規口座からの大量送金
    if @transaction.account.created_at > 30.days.ago && @transaction.amount > 1_000_000
      score += 0.4
    end
 
    # ルール3: 短時間の連続取引
    if @transaction.velocity_score[:exceeds_threshold]
      score += 0.3
    end
 
    [score, 1.0].min
  end
 
  def combine_scores(ml_score, rule_score)
    # ML モデル 70%、ルールエンジン 30% の重み付け
    (ml_score * 0.7 + rule_score * 0.3).round(4)
  end
 
  def fallback_score(features)
    # SageMaker 障害時はルールベースにフォールバック
    Rails.logger.warn("[FraudDetection] Using fallback scoring")
    apply_rule_engine
  end
 
  def take_action(assessment)
    case
    when assessment.high_risk?
      @transaction.update!(status: :blocked)
      FraudAlertJob.perform_later(@transaction.id, severity: :critical)
    when assessment.medium_risk?
      @transaction.update!(status: :flagged)
      FraudAlertJob.perform_later(@transaction.id, severity: :warning)
    else
      @transaction.update!(status: :approved)
    end
  end
end

# app/jobs/fraud_alert_job.rb
class FraudAlertJob < ApplicationJob
  queue_as :critical
 
  retry_on StandardError, wait: :polynomially_longer, attempts: 5
 
  def perform(transaction_id, severity:)
    transaction = Transaction.find(transaction_id)
    assessment = transaction.risk_assessment
 
    # Webhook 通知（みずほ第一銀行の監視システムへ）
    payload = {
      event: "fraud_alert",
      transaction_id: transaction.id,
      account_id: transaction.account_id,
      amount: transaction.amount,
      currency: transaction.currency,
      risk_score: assessment.score,
      severity: severity,
      timestamp: Time.current.iso8601,
      model_version: assessment.model_version
    }
 
    response = Faraday.post(
      ENV.fetch("BANK_WEBHOOK_URL"),
      payload.to_json,
      {
        "Content-Type" => "application/json",
        "X-Signature" => generate_hmac(payload),
        "X-Timestamp" => Time.current.to_i.to_s
      }
    )
 
    unless response.success?
      Rails.logger.error("[FraudAlert] Webhook failed: #{response.status}")
      raise "Webhook delivery failed with status #{response.status}"
    end
 
    AuditLog.create!(
      event_type: "fraud_alert_sent",
      payload: payload.to_json,
      response_status: response.status
    )
  end
 
  private
 
  def generate_hmac(payload)
    OpenSSL::HMAC.hexdigest(
      "SHA256",
      ENV.fetch("WEBHOOK_SECRET"),
      payload.to_json
    )
  end
end

# app/services/compliance/audit_logger.rb
module Compliance
  class AuditLogger
    def self.log(event_type:, actor:, resource:, details: {})
      AuditLog.create!(
        event_type: event_type,
        actor_id: actor.id,
        actor_type: actor.class.name,
        resource_id: resource.id,
        resource_type: resource.class.name,
        details: details.to_json,
        ip_address: Current.ip_address,
        timestamp: Time.current,
        checksum: generate_checksum(event_type, actor, resource, details)
      )
    end
 
    def self.generate_checksum(event_type, actor, resource, details)
      data = "#{event_type}:#{actor.id}:#{resource.id}:#{details.to_json}:#{Time.current.to_i}"
      Digest::SHA256.hexdigest(data)
    end
  end
end