A Prototype for Credit Card Fraud Management Alexander Artikis 1 , 2 - PowerPoint PPT Presentation

A Prototype for Credit Card Fraud Management Alexander Artikis 1 , 2 , Nikos Katzouris 2 , Ivo Correia 3 , Chris Baber 4 , Natan Morar 4 , Inna Skarbovsky 5 , Fabiana Fournier 5 and Georgios Paliouras 2 1 University of Piraeus, Greece, 2 NCSR Demokritos, Greece, 3 Feedzai, Portugal, 4 University of Birmingham, UK, 5 IBM Research Haifa, Israel http://speedd-project.eu/

Credit Card Fraud Management Input: ◮ Credit card transactions from all over the world. Output: ◮ Cloned card — a credit card is being used simultaneously in different countries. ◮ New high use — the card is being frequently used in merchants or countries never used before. ◮ Potential batch fraud — many transactions from multiple cards in the same point-of-sale terminal in high amounts.

Credit Card Fraud Management: Challenges ◮ Fraud must be detected within 25 milliseconds.

Credit Card Fraud Management: Challenges ◮ Fraud must be detected within 25 milliseconds. ◮ Fraudulent transactions: < 0.2% of the total number of transactions.

Credit Card Fraud Management: Challenges ◮ Fraud must be detected within 25 milliseconds. ◮ Fraudulent transactions: < 0.2% of the total number of transactions. ◮ Fraud is constantly evolving.

Credit Card Fraud Management: Challenges ◮ Fraud must be detected within 25 milliseconds. ◮ Fraudulent transactions: < 0.2% of the total number of transactions. ◮ Fraud is constantly evolving. ◮ Erroneous transactions, missing fields.

Credit Card Fraud Management: SPEEDD Prototype ◮ Automated, online fraud pattern construction. ◮ Fraud detection. ◮ User Interface.

Credit Card Fraud Management: SPEEDD Prototype ◮ Automated, online fraud pattern construction. ◮ Fraud detection (DEBS 2015). ◮ User Interface.

Automated Pattern Construction: Inductive Logic Programming (ILP) Input: ◮ Positive and negative examples. ◮ Background knowledge. ◮ Language bias. Output: ◮ A logical theory that entails as many positive and as few negative examples as possible.

Example Fraud Patterns fraud ( CardId , T 2 ) ← transaction ( CardId , massive amount , T 2 ) , transaction ( CardId , tiny amount , T1 ) , before ( T 1 , T 2 ) , within ( T 1 , T 2 , 1 ) . fraud ( CardId , T 2 ) ← transactionsAtLeast ( CardId , 6 ) , within ( T 1 , T 2 , 7 ) , before ( T 1 , T 2 ) .

Online Learning: The OLED System OLED Data Stream/Training Examples . . . Training example I t trans ( 1500653 , 420 . 0 , d5b9ab0b181 , 200902 , fraud ) , Background Knowledge & trans ( 1500654 , 0 , 35 , d5b9ab0b181 , 200902 , fraud ) , Language Bias trans ( 1500655 , 154 . 5 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500656 , 180 . 4 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500657 , 2 . 34 , d5b9ab0b181 , 200902 , fraud ) Learnt Hypothesis H t : . . . fraud ( CardId , T 2 ) ← trans ( Card , massive amount , T 2 ) , Training example I t ′ trans ( Card , tiny amount , T 1 ) , before ( T 1 , T 2 ) , trans ( 1856635 , 420 . 0 , 3348af85 , 200902 , nofraud ) , within ( T 1 , T 2 , 2 ) . trans ( 1856636 , 0 , 35 , 3348af85 , 200902 , nofraud ) , trans ( 1856637 , 154 . 5 , 3348af85 , 200902 , nofraud ) , fraud ( CardId , T 2 ) ← trans ( 1856638 , 180 . 4 , 3348af85 , 200902 , nofraud ) , transAtLeast ( Card , 6 ) , trans ( 1856639 , 2 . 34 , 3348af85 , 200902 , nofraud ) within ( T 1 , T 2 , 7 ) , before ( T 1 , T 2 ) . . . .

Online Learning: The OLED System OLED Data Stream/Training Examples . . . Theory Expan- Training example I t sion trans ( 1500653 , 420 . 0 , d5b9ab0b181 , 200902 , fraud ) , Background Knowledge & trans ( 1500654 , 0 , 35 , d5b9ab0b181 , 200902 , fraud ) , Language Bias trans ( 1500655 , 154 . 5 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500656 , 180 . 4 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500657 , 2 . 34 , d5b9ab0b181 , 200902 , fraud ) Learnt Hypothesis H t : . . . fraud ( CardId , T 2 ) ← trans ( Card , massive amount , T 2 ) , Training example I t ′ trans ( Card , tiny amount , T 1 ) , before ( T 1 , T 2 ) , trans ( 1856635 , 420 . 0 , 3348af85 , 200902 , nofraud ) , within ( T 1 , T 2 , 2 ) . trans ( 1856636 , 0 , 35 , 3348af85 , 200902 , nofraud ) , trans ( 1856637 , 154 . 5 , 3348af85 , 200902 , nofraud ) , fraud ( CardId , T 2 ) ← trans ( 1856638 , 180 . 4 , 3348af85 , 200902 , nofraud ) , transAtLeast ( Card , 6 ) , trans ( 1856639 , 2 . 34 , 3348af85 , 200902 , nofraud ) within ( T 1 , T 2 , 7 ) , before ( T 1 , T 2 ) . . . .

Online Learning: The OLED System OLED Data Stream/Training Examples . . . Theory Expan- Training example I t sion trans ( 1500653 , 420 . 0 , d5b9ab0b181 , 200902 , fraud ) , Background Knowledge & trans ( 1500654 , 0 , 35 , d5b9ab0b181 , 200902 , fraud ) , Language Bias trans ( 1500655 , 154 . 5 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500656 , 180 . 4 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500657 , 2 . 34 , d5b9ab0b181 , 200902 , fraud ) Rule Eval- Learnt Hypothesis H t : . . . uation fraud ( CardId , T 2 ) ← trans ( Card , massive amount , T 2 ) , Training example I t ′ trans ( Card , tiny amount , T 1 ) , before ( T 1 , T 2 ) , trans ( 1856635 , 420 . 0 , 3348af85 , 200902 , nofraud ) , within ( T 1 , T 2 , 2 ) . trans ( 1856636 , 0 , 35 , 3348af85 , 200902 , nofraud ) , trans ( 1856637 , 154 . 5 , 3348af85 , 200902 , nofraud ) , fraud ( CardId , T 2 ) ← trans ( 1856638 , 180 . 4 , 3348af85 , 200902 , nofraud ) , transAtLeast ( Card , 6 ) , trans ( 1856639 , 2 . 34 , 3348af85 , 200902 , nofraud ) within ( T 1 , T 2 , 7 ) , before ( T 1 , T 2 ) . . . .

Online Learning: The OLED System OLED Data Stream/Training Examples . . . Theory Expan- Training example I t sion trans ( 1500653 , 420 . 0 , d5b9ab0b181 , 200902 , fraud ) , Background Knowledge & trans ( 1500654 , 0 , 35 , d5b9ab0b181 , 200902 , fraud ) , Language Bias trans ( 1500655 , 154 . 5 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500656 , 180 . 4 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500657 , 2 . 34 , d5b9ab0b181 , 200902 , fraud ) Rule Eval- Learnt Hypothesis H t : . . . uation fraud ( CardId , T 2 ) ← trans ( Card , massive amount , T 2 ) , Training example I t ′ trans ( Card , tiny amount , T 1 ) , before ( T 1 , T 2 ) , trans ( 1856635 , 420 . 0 , 3348af85 , 200902 , nofraud ) , within ( T 1 , T 2 , 2 ) . trans ( 1856636 , 0 , 35 , 3348af85 , 200902 , nofraud ) , Rule trans ( 1856637 , 154 . 5 , 3348af85 , 200902 , nofraud ) , fraud ( CardId , T 2 ) ← Expan- trans ( 1856638 , 180 . 4 , 3348af85 , 200902 , nofraud ) , sion transAtLeast ( Card , 6 ) , trans ( 1856639 , 2 . 34 , 3348af85 , 200902 , nofraud ) within ( T 1 , T 2 , 7 ) , before ( T 1 , T 2 ) . . . .

Online Learning: The OLED System OLED Data Stream/Training Examples . . . Theory Expan- Training example I t sion trans ( 1500653 , 420 . 0 , d5b9ab0b181 , 200902 , fraud ) , Background Knowledge & trans ( 1500654 , 0 , 35 , d5b9ab0b181 , 200902 , fraud ) , Language Bias trans ( 1500655 , 154 . 5 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500656 , 180 . 4 , d5b9ab0b181 , 200902 , fraud ) , trans ( 1500657 , 2 . 34 , d5b9ab0b181 , 200902 , fraud ) Rule Eval- Learnt Hypothesis H t : . . . uation fraud ( CardId , T 2 ) ← trans ( Card , massive amount , T 2 ) , Training example I t ′ trans ( Card , tiny amount , T 1 ) , before ( T 1 , T 2 ) , trans ( 1856635 , 420 . 0 , 3348af85 , 200902 , nofraud ) , within ( T 1 , T 2 , 2 ) . trans ( 1856636 , 0 , 35 , 3348af85 , 200902 , nofraud ) , Rule trans ( 1856637 , 154 . 5 , 3348af85 , 200902 , nofraud ) , fraud ( CardId , T 2 ) ← Expan- trans ( 1856638 , 180 . 4 , 3348af85 , 200902 , nofraud ) , sion transAtLeast ( Card , 6 ) , trans ( 1856639 , 2 . 34 , 3348af85 , 200902 , nofraud ) within ( T 1 , T 2 , 7 ) , before ( T 1 , T 2 ) . . . . +/- Rule Pruning

Online Rule Learning Candidate Rules Find the best candidate across the stream R 1 : 0.345 Training stream . . . . . . R 2 : 0.232 R 3 : 0.145 With confidence 1 − δ , we have � ln (1 /δ ) X − ǫ ≤ ˆ ¯ X ≤ ¯ X + ǫ, where ǫ = 2 N R 4 : 0.612 R 5 : 0.325 As examples stream in... Then Monitor ¯ ¯ X − ǫ > 0 ⇒ X = score BestRule − score SecondBestRule ˆ X > 0 ⇒ Continue until the number N of examples BestRule is indeed the best rule, � ln (1 /δ ) with probability 1 − δ . makes ¯ X > ǫ = 2 N

Online Rule Learning Candidate Rules Find the best candidate across the stream R 1 : 0.345 Training stream . . . . . . R 2 : 0.232 R 3 : 0.145 With confidence 1 − δ , we have � ln (1 /δ ) X − ǫ ≤ ˆ ¯ X ≤ ¯ X + ǫ, where ǫ = 2 N R 4 : 0.612 R 5 : 0.325 As examples stream in... Then Monitor ¯ ¯ X − ǫ > 0 ⇒ X = score BestRule − score SecondBestRule ˆ X > 0 ⇒ Continue until the number N of examples BestRule is indeed the best rule, � ln (1 /δ ) with probability 1 − δ . makes ¯ X > ǫ = 2 N

Online Rule Learning Candidate Rules Find the best candidate across the stream R 1 : 0.345 Training stream . . . . . . R 2 : 0.232 R 3 : 0.145 With confidence 1 − δ , we have � ln (1 /δ ) X − ǫ ≤ ˆ ¯ X ≤ ¯ X + ǫ, where ǫ = 2 N R 4 : 0.612 R 5 : 0.325 As examples stream in... Then Monitor ¯ ¯ X − ǫ > 0 ⇒ X = score BestRule − score SecondBestRule ˆ X > 0 ⇒ Continue until the number N of examples BestRule is indeed the best rule, � ln (1 /δ ) with probability 1 − δ . makes ¯ X > ǫ = 2 N