Rule language reference

The following section outlines the expression (that is, rule writing) capabilities in Amazon Fraud Detector.

Using variables

You can use any variable defined in the evaluated event type as part of your expression. Use the dollar sign to indicate a variable:

$example_variable < 100

Using lists

You can use any list that is associated with a variable type and is populated with entries as part of your rule expression. Use the dollar sign to indicate a list entry value:

$example_list_variable in @list_name

Comparison, membership, and identity operators

Amazon Fraud Detector includes the following comparison operators: >, >=, <, <=,!=, ==, in, not in

The following are examples:

Example: <

$variable < 100

Example: in, not in

$variable in [5, 10, 25, 100]

Example: !=

$variable != "US"

Example: ==

$variable == 1000

Operator Tables

Basic math

You can use basic math operators in your expression (for example, +, -, * ,/). A typical use case is when you need to combine variables during your evaluation.

In the rule below, we are adding the variable $variable_1 with $variable_2, and checking whether the total is less than 10.

$variable_1 + $variable_2 < 10

Basic Math Table Data

Regular Expression (regex)

You can use regex to search for specific patterns as part of your expression. This is particularly useful if you are looking to match a specific string or numerical value for one of your variables. Amazon Fraud Detector only supports match when working with regular expressions (for example, it returns True/False depending on whether the provided string is matched by the regular expression). Amazon Fraud Detector’s regular expression support is based on .matches() in java (using the RE2J Regular Expression library). There are several helpful websites on the internet that are useful for testing different regular expression patterns.

In the first example below, we first transform the variable email to lowercase. We then check whether the pattern @gmail.com is in the email variable. Notice the second period is escaped so that we can explicitly check for the string .com.

regex_match(".*@gmail\.com", lowercase($email))

In the second example, we check whether the variable phone_number contains the country code +1 to determine if the phone number is from the US. The plus symbol is escaped so that we can explicitly check for the string +1.

regex_match(".*\+1", $phone_number)

Regex Table

Checking for missing values

Sometimes it is beneficial to check whether the value is missing. In Amazon Fraud Detector this is represented by null. You can do this by using the following syntax:

$variable != null

Similarly, if you wanted to check whether a value is not present, you could do the following:

$variable == null

Multiple conditions

You can combine multiple expressions together using and and or. Amazon Fraud Detector stops in an OR expression when a single true value is found, and it stops in an AND when a single false value is found.

In the example below, we are checking for two conditions using the and condition. In the first statement, we are checking whether variable 1 is less than 100. In the second we check whether variable 2 is not the US.

Given the rule uses an and, both must be TRUE for the entire condition to evaluate to TRUE.

$variable_1 < 100 and $variable_2 != "US"

You can use parenthesis to group Boolean operations, as shown following:

$variable_1 < 100 and $variable_2 != "US" or ($variable_1 * 100.0 > $variable_3)

Other expression types

DateTime functions

String Operators

Other