September 2003 Fraud Formalization and Detection Bharat Bhargava

September 2003 Fraud Formalization and Detection Bharat Bhargava, Yuhui Zhong, Yunhua Lu Center for Education and Research in Information Assurance and Security and Department of Computer Sciences Purdue University, W. Lafayette, IN, USA {bb, zhong, luy}@cs. purdue. edu

Introduction • • • Fraudsters can be classified into impersonators and swindlers Impersonator: an illegitimate user who steals resources from the victims by “taking over'' their accounts Swindler: a legitimate user who intentionally harms the system or other users by deception 2

Introduction • Fraud prevention – Cryptographic technologies: prevent frauds caused by impersonators – Separation of duty and dual-log bookkeeping: prevent frauds conducted by swindlers • Fraud detection – Existing research efforts: identifying frauds caused by impersonators – This paper: detecting frauds conducted by swindlers 3

Related Work • Fraud detection techniques – Most fraud detection techniques address impersonator issues – An adaptive fraud rule-based detection framework (T. Fawcett and F. Provost) – neural network technique based on unsupervised learning for fraud detection (P. Burge and J. Shawe-Taylor) – Generation and selection rule set should combine both user-level and behavior-level attributes (S. Rosset) 4

Evaluation criteria • Receiver Operating Characteristics – A ROC graph shows the relationship between True Positive rate and False positive rate • Accuracy – the number of detected fraud over the total number of classified frauds • Fraud coverage – the number of detected frauds over the total number of frauds • False alarm rate – Percentage of false alarm in alarm set • Fraud detection rate – Loss by detected fraud over the total loss due to fraud • Cost-based metric – If the loss resulting from a fraud is smaller than the investigation cost, this fraud is ignored 5

Formal Definitions • • A swindler is an entity that has no intention to keep his commitment in cooperation. Commitment: conjunction of expressions describing an entity’s promise in a process of cooperation – Example: (Received_by=04/01) (Prize=$1000) (Quality=“A”) Return. If. Any. Quality. Problem • Outcome: conjunction of expressions describing the actual results of a cooperation – Example: (Received_by=04/05) (Prize=$1000) (Quality=“B”) ¬Return. If. Any. Quality. Problem 6

Formal Definitions • Intention-testifying: – Predicate P: ¬P in an outcome entity making the promise is a swindler. – Attribute variable V: V's expected value is more desirable than the actual value the entity is a swindler. • Intention-dependent indicates an possibility – Predicate P: ¬P in an outcome entity making the promise may be a swindler. – Attribute variable V: V's expected value is more desirable than the actual value the entity may be a swindler. • An intention-testifying variable or predicate is intention-dependent. The opposite direction is not necessarily true. 7

Model deceiving intentions • Satisfaction rating – Associate with the actual value of each intention-dependent variable in an outcome. – Range from [0, 1]. The higher the rating is, the more satisfied the user is. – Relate to deceiving intention and unpredicted factors – Modeled by using random variable with normal distribution – mean function fm(n) determines the mean value of the normal distribution at the nth rating 8

Model deceiving intentions (Cont’d) • Uncovered deceiving intention – The satisfaction ratings are stably low. – The ratings vary in a small range over time. 9

Model deceiving intentions (Cont’d) • Trapping intention – The rating sequence can be divided into two phases: preparing and trapping. – A swindler behaves well to achieve a trustworthy image before he conducts frauds. 10

Model deceiving intentions (Cont’d) • Illusive intention – A smart swindler attempts to cover the bad effects by intentionally doing something good after misbehaviors. – The process of preparing and trapping are repeated. 11

Architecture for Swindler Detection 12

Architecture for Swindler Detection • Profile-based anomaly detector – Monitor suspicious actions based upon the established patterns of an entity • State transition analysis – Provide state description when an activity results in entering a dangerous state • Deceiving intention predictor – Discover deceiving intention based on satisfaction ratings. • Decision making 13

Profile-based anomaly detector 14

Profile-based anomaly detector • Rule generation and weighting – Generate fraud rules and weights associated with the rules • User profiling – Variable selection – Data filtering • Online detection – Retrieve rules upon an activity occurs – Retrieve current and history behavior patterns – Calculate deviation of two patterns 15

Deceiving intention predictor • • Kernel of the predictor: DIP algorithm Belief of deceiving intention as the complementary of trust belief Trust belief is evaluated based on the satisfaction sequence. Trust belief formation satisfies: – Time dependent – Trustee dependent – Easy-destruction-hard-construction property 16

17

Experimental study • • Goal: Investigate DIP’s capability of discovering deceiving intentions Initial values for parameters: – Construction factor (Wc): 0. 05 – Destruction factor (Wd): 0. 1 – Penalty ratios for construction factor (r 1): 0. 9 – Penalty ratios for destruction factor (r 2): 0. 1 – Penalty ratios for supervision-period (r 3): 2 – Threshold for a foul event (f. Threshold): 0. 18 18

Discover swindler with uncovered deceiving intention • • trust values are close to the minimum rating of interactions that is 0. 1 Deceiving intention belief is around 0. 9 19

Discover swindler with trapping intention • • DIP responds to the sharp drop quickly It takes 6 interactions for DIconfidence increasing from 0. 2239 to 0. 7592 after the sharp drop 20

Discover swindler with illusive intention • • DIP is able to catch this smart swindler in the sense that the belief in deceiving intention eventually increases to about 0. 9 The swindler's effort to cover a fraud with good behaviors has less and less effect with the number of frauds. 21

Conclusion • • Define concepts relevant to frauds conducted by swindlers Model three deceiving intentions Propose an approach for swindler detection and an architecture realizing the approach Develop a deceiving intention prediction algorithm 22