WSO2Con ASIA 2016: Catch Them in the Act: Fraud Detection with the WSO2 Analytics Platform

CatchthemintheActFraudDetec+onwithWSO2Analy+csPla:orm

SeshikaFernandoTechnicalLeadWSO2

$4TrillioninGlobalFraudLosses

AnalystspredictBusinessesarelosing5%ofbusinessrevenuestoFraudeachyear

ManyWays

•  GenericRules•  FraudScoring•  MachineLearning•  MarkovModels

CapturingDomainExper+se

Fraudsters•  Usestolencards•  Buyexpensivestuff•  Inlargequan++es•  Veryquickly•  Atoddhours•  Shiptomanyplaces•  Provideweirdemailaddresses

ComplexEventProcessing

No#fyifthereisa10%increaseinoveralltradingac#vityANDtheaveragepriceofcommodi#eshasfallen2%inthelast4hours

MovingAverages

fromTransac+onStream#window.+me(60min)selectitemNo,avg(qty),stdev(qty)groupbyitemNoupdateAvgTblasaonitemNo==a.itemNofromTransac+onStream[itemNo==a.itemNoandqty>(a.avg+3*a.stdev)inAvgTblasa]select*insertintoFraudStream

Transac+onVelocity

from e1=Transac+onStream-> e2=Transac+onStream[e1.cardNo==e2.cardNo]<2:>

within5minselecte1.cardNo,e1.txnID,e2[0].txnID,e2[1].txnIDinsertintoFraudStream

TheFalsePosi+veTrap

SowhatifIbuyexpensivestuffVeryquicklyAtoddhoursShiptomanyplaces

RichguyImpulseShopper

NightowlManygirlfriends?

Blockinggenuinecustomerscouldbecounterproduc+veandcostly

AvoidFalsePosi+veswithScoring

Usecombina+onofrulesGiveweightstoeachruleSinglenumberthatreflectsmul+plefraudindicatorsUseathresholdtorejecttransac+ons

•  Youjustboughtadiamondring

•  Youbought20diamondrings,within15minutesat3amandshippeditto4globalloca+ons?

Howtoscore

Score=0.001 *itemPrice

+0.1 *itemQuan+ty

+2.5 *isFreeEmail

+5 *riskyCountry

+8 *suspicousIPRange

+5 *suspicousUsername

+3 *highTransac+onVelocity

Knowndevilisbemerthananunknownangel...

MachineLearning

U+lizeMachineLearningtechniquestoiden+fy‘unknown’typesoffraud

Isorganizedcrimethatsimple?

MarkovModels

•  Modelrandomlychangingsystems•  Detectrareac+vitysequencesusing

–  Classifica+on–  ProbabilityCalcula+on– MetricCalcula+on

MarkovModelsforFraudDetec+on

One true inference invariably suggests

others

-  Sherlock Holmes

DigdeeperusingInterac+veAnaly+cs

•  Provideaccesstohistoricaldatatodigdeeper

•  Makequeryingandfilteringeasyandintui+ve

•  Provideusefulvisualiza+onstoisolateincidentsandunearthconnec+ons

Curious? hmp://wso2.com/analy+cs/solu+ons/fraud-and-anomaly-detec+on-solu+on/

PaymentFraud

An+MoneyLaundering

Iden+tyFraud

ThankYou