Architecture
One adjudication engine, embedded into existing anti-fraud paths
Click any node in the diagram: related links light up and flow, and the info panel shows the module’s role, inputs, outputs, and connections. Everything is organized around one core decision model.
System architecture
System architecture
The full chain from data sources to business systems — not a new system, but an adjudication engine that embeds into existing platforms.
Click any node for module details; highlighted links show the related data flow.
Multi-scenario access
One decision capability, many scenario entries
Switch scenarios to see how input types, task logic, decision outputs, and business systems organize around the same core model.
The core model stays fixed; inputs, question sets, outputs, and systems switch with the scenario.
Input types
- Group names
- In-group messages
- Member behavior
Task logic (question set)
TG seven questions: black/gray main judgment, money channel, gambling, underground services, domain classification, priority, review.
JianCe decision model
One call answers structured questions in parallel · millisecond probability and dispositions
Decision outputs
- Group profiles
- Domain distribution
- IOC entities
- Disposition lists
Business systems
Cross-scenario synergy
One entity graph, six linked channels
A single-scenario model is a point; the entity graph and orchestration hub form the plane — the same fraud family leaves the same entities across channels.
- L1 Data ingestionIM / SMS / voice / web / app / carrier-side authorized data, uniformly ingested.
- L2 Entity graphSix entity groups (targets, victims, operations, infrastructure, evidence, judgments) and eight relation types.
- L3 OrchestrationSOAR playbooks and target scheduling: cross-system disposition orchestration.
- L4 IntelligenceFeature factory, family association, AI research — the decision model is the judgment core within.
- L5 OperationsResearch workbench, family graph, and forensic workbench delivered to analysts.
Three closed loops
Domain discovery loop
Fraud domains → linked resolution / certs / IPs → new-domain expansion → feeds monitoring.
App proactive discovery loop
25 entry classes crawled → dynamic analysis → command domains → sibling APK association.
Traffic-driven expansion loop
Authorized traffic observation → suspicious behavior → family expansion → disposition feedback.
Parts of the platform are delivered (data ingestion, entity graph, web/app analysis); orchestration and operations layers are under continued construction.
Deployment architecture
Four deployment forms, one data-boundary spectrum
Choose the form by the customer’s data boundary and disposition authority — the same model, from cloud to device.
Cloud API
Real batch runSaaS and batch runs; de-identified upload, suited to intelligence subscription and light integration.
On-premise
Capability readyCarrier / bank / police intranets; data never leaves the domain, meeting strict compliance boundaries.
On-device inference
Pilot validationPhone call and behavior alerts; content never leaves the device, <50ms per line.
Gateway embedding
Pilot validationInline at SMS/traffic entry; mostly metadata with fail-open availability.