9. Creating a Dynamic Model

Rule logic can be very specific thanks to tags, filters, and metadata.

In the last section, we created our model using the Scenario Model Builder. While the Scenario Model comes with AML/CTF logic templates for you to fill in, the Dynamic Model Builder is entirely free-form logic.

Create a Model with the DMB


  1. Log into your Dashboard.
  2. Navigate to the Detection Models page and select + Create Dynamic Model:
1200
  1. Select Start From Scratch:
1200
  1. Select + Add Variable:
1200
  1. A pop-up window will open.
  2. Create a variable called TransactionAmount that calculates the sum in a transaction on either the sender or receiver side. Make sure it looks for transaction sums over a 1 day period.
1200
FieldInput
Variable NameTransactionAmount
TypeTransactions
Transaction DirectionSender or Receiver
Aggregate FunctionSum
Aggregate FieldAmount
From1 day
ToNow

Click Save Variable.

  1. Now it is time to create a Trigger Condition for your Variable. Click + Add Condition:
1200
  1. Select the newly created Variable from the dropdown menu and complete the logic TransactionAmount > 10000. Click Next:
1200
  1. Now you may name and define the model appropriately. You also have the option to add the model to an alert queue and tag it automatically. Click Next:
1200
  1. A model must be validated to ensure the logic is correct before it is deployed live; otherwise it will not catch fraudulent transactions.

To make sure the model logic is sound, a validation sequence will test your scenario against any data that is already in the Unit21 system. Luckily, we added transactions for Larry Baker in the previous section to fill the system with dummy data so that we can validate our scenario.

In the Annabelle case, choose the following:

  • start time = 1-3 days BEFORE the baker_transaction* epoch
  • end time = 1-3 days AFTER the baker_transaction* epoch
  • execution frequency = 12 hours
  • execution window = 1 day

This means our logic will "look for transactions over $10K" and will be validated over a 2-6 day time frame, every 12 hours, against the transactional data from the previous day (24 hours)".

When you are done, select Validate at the bottom of your screen:

1200
  1. Unit21 will validate the model in the background. Wait for it to finish.
1200
  1. As usual, you will need to check the validity of the model once the validation results are available:
1200
  1. Download the file in the Rule Validation File Exports and check the result:
1200

The validation results show that we have captured the transactions from Mr Baker that were over $10K. This rule is working well.

Next, we will deploy the model so it is live and starts generating alerts.