> For the complete documentation index, see [llms.txt](https://docs.compliance.phalcon.blocksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.compliance.phalcon.blocksec.com/ru/manual/risk-engines/behavior.md).

# Behavioral Risk Engine

The Behavioral Risk Engine is designed to identify suspicious transaction patterns.

## Address Behavior Engine

Phalcon offers three detection templates to identify risky address behaviors.

### **1. Large-Value Transfers**

Flags addresses with transaction volumes significantly exceeding typical user behavior thresholds.

**Example**: Address `0x742d35Cc6634C0532925a3b844Bc454e4438f44e` transferred out $100,000 in a single transaction, triggering an alert.

### **2. High-Frequency Transfers**

Identifies addresses with frequent transactions, especially small amounts just below alert thresholds.

**Example**: Address `0x1a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p` made 15 transfers of $9,999 within 24 hours, raising suspicion.

### **3. Transit Address**

Detects addresses acting as intermediaries that quickly move funds after receiving them, a common money laundering tactic.

**Example**: Address `0x3c4d5e6f7g8h9i0j1k2l3m4n5o6p7q8r` transferred out $19,500 within 30 minutes of receiving $20,000.

## Transaction Behavior Engine

The transaction behavior engine in Phalcon provides two enhanced detection templates to identify and flag risky transaction behaviors for proactive risk monitoring.

### 1. Large-Value Transfers

Identifies transactions with transfer amounts exceeding user-defined thresholds, as large transfers often require stricter scrutiny.

**Example**: A transfer of $500,000 from Address A to Address B exceeds the configured threshold of $100,000, triggering an alert.

### 2. Rapid Transit

Detects transactions where funds are moved quickly after being received, indicating potential suspicious activity like layering or evasion tactics.

**Example**: Address A receives $10,000 and transfers it to Address B within 5 minutes. If the threshold is set for 10 minutes, this rapid transit triggers a risk alert.