# Griffin, an Anti-fraud Risk Rule Engine Making Billions of Predictions Daily

[Grab](https://yomu.fyi/company/grab) · Muqi Li · Oct 28, 2019

**Type:** Problem & solution

## Summary

Grab's Trust/Identity/Safety team built Griffin, an in-house anti-fraud risk rule engine designed to process billions of daily predictions across multiple business verticals. Initially, Grab managed fraud rules directly within backend service code, but escalating rule complexity, tight rule interdependencies, and translation gaps between data scientists and developers caused deployment delays and misfiring errors. To overcome the limitations and steep learning curves of third-party engines like Drools, the team separated the workflow into data orchestration and rule-based prediction. Griffin enables analysts and data scientists to author Python-based rules directly via a web portal and reload updated logic into memory without manual developer intervention. By eliminating I/O during rule evaluation and leveraging Gunicorn multi-processing, the engine handles over 100,000 queries per second at peak on six EC2 instances with single-prediction latencies under six milliseconds.

## Context

Escalating rule complexity, rule interdependencies, and manual translation of rules from English into code caused rule misfirings, slow weekly deployment cycles, and difficult A/B testing as Grab expanded.

## Approach / What changed

Grab built Griffin, a custom rule engine paired with a dedicated Data Orchestration service, enabling data scientists and analysts to write Python-based rules directly through a web portal that executes predictions entirely in-memory.

## Takeaways

- Griffin processes billions of events daily and handles peak traffic exceeding 100,000 queries per second across six standard EC2 instances.
- Individual prediction latency is kept under 6 milliseconds by removing all I/O from the prediction path and relying solely on CPU and memory operations.
- Rule updates are detected using a database timestamp record named dirty\_key, which prompts the rule engine to reload rules only when newer updates occur.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Performance](https://yomu.fyi/topic/performance), [Python](https://yomu.fyi/topic/python), [Scalability](https://yomu.fyi/topic/scalability)

[Read original post](https://engineering.grab.com/griffin)