Fraud detection system
- 1. Fraud Detection System Bala Dutt / June 2021
- 2. Agenda Context - From/To PAIR FDS Architecture & FDSP language MASSES & Simulation Language Demo Design Technology/Conclusion/Future Work
- 3. From To Large delay txns, online txns by privileged few, a small percentage of fraud Instant txns, sophisticated attacks (OTP stealing), adversarial attacks and ultra-scale, online txns by non-tech savvy people “Write off approach”, after the fact, actor focussed approach Realtime, streaming, online learning Human In the Loop Single algorithm Multiple algorithms, Cold start, Unseen situations, high accuracy Work in silos, difficult to change and integrate Modular, Integrative, easy to experiment & change
- 4. Information Fusion Effective Fraud Detection System Actionable Pluggable Processing Responsive Time to Detect Time to improve Easy to understand & Change Online Simulate Transactional Reference Approval Notification Feedback Channels Stream processing Ensemble Online+offline Classifiers Outliers Rule-based Point Sequence History Patterns Features Samples Scope Enrichment
- 5. Fraud detector Delivery pipeline ML algo - outlier detectors ML Algo - classifiers Delivery 1 Delivery 2 Delivery ... Flink Kafka Ref 1 Ref 2 SMS - info/alert SMS - otp Push notification Email Block transaction Block user Resource Server 1 Resource Server 2 Resource Server ... Resource Access Event pipeline AccessEvent Resource access Subject Subject Resource details Alerts/Infos Reference Data pipeline Reference Data 1 Reference Data 2 Reference Data ... User Configuration Offline ML Feedback loop Monitoring Grafana.net, Prometheus History Feedback loop Kafka Kafka Rule Based
- 6. Intuit Confidential and Proprietary 6 Stream Processing Trigger Enrich Analyze PostProcess Deliver Enrichment Specification Ensemble and pipeline specification Enrichment and presentation specification Stream processing specification Tensorify Feature selection Security (Anonymization etc.) Events processed by swimlanes
- 7. Intuit Confidential and Proprietary 7 GitOps Multi-StreamProcessing deployment system StreamProcessing... StreamProcessing Selector SecurityProcessing Enrichment ML PreDeliveryEnrichment ... StreamProcessing 2 StreamProcessing 1 Build process StreamProcessing … Monitoring view StreamProcessing 2 Monitoring view StreamProcessing 1 Monitoring view Virtual view Stream processing language
- 8. Pool Simulation - MASSES Subject Subject Pool Resource Resource Actor ActorInstance AI1 AI2 AI3 AI... State Transition Spec Paired is AccessEvent Resource Access Event pipeline ripting language to model scenario
- 9. Demo Multiple Stream Processing Scenarios Random Sr Citizen Deny User User moved https://www.youtube.com/watch?v=qvt7pgCnSHU
- 10. Implementation https://github.com/fraud-detection-system/Fraud-Detection-System Artifacts Simulator with a DSL (Domain Specific Language) to specify scenarios including feedback Fraud Detection Server - Kafka, Flink based stream processing pipeline Multiple online ML algorithms - classifiers (5) and outlier detectors (5) Multiple Reference data Monitoring
- 11. Design
- 12. Intuit Confidential and Proprietary 12 Domain model Types of Resources Resource Server Subject User App Performs Action Actions Resource supports Device is a Attributes Attributes Attributes Entity AccessEvent Environment
- 13. Actor (good) Txn Amount Payee Description IPAddress Time Browser/Machine Details Type - physical, online Series of Actor (bad) Series of
- 14. Intuit Confidential and Proprietary 14 Canonical Data Model Common minimalistic vocabulary Flat attribute model k,v as Strings Values can be keys Logic part of enrichment Type of attribute value Link to reference data Subject Id: 1234 PhysicalLocation: 5678 VirtualLocation: 172.19.21.12 DeviceId: xsfde Resource Id: account AccountId: 5678 BankName: ICICI User Id: 1234 EmailId: [email protected] PhoneNo: 9876 HomeLocation: 5678 HomeCity: Bengaluru PhoneLocation: 23232 Account Id: 5678 Balance:100000 LastTxnTime: Status: Locked|Active RiskScoredEntities Id: 3434 Type: User|Location|PhoneNo Score: Low| Med| High Configuration Id: 1234 Type: User|Account MaxAutoAmount: 1000 Approver: 34345 Subject Id: account PhoneNo: 5678 Action Id: sendSMS text: “alert ...”
- 15. History Circular buffer Configuration Size Attributes Save Key Attributes Size Enrichment by diff Attributes to diff Diff mechanism Diff attribute name Scenario Series of txns from Bengaluru One txn from Las Vegas Solution Diff on location
- 16. Thank you