Using Graphs and Machine Learning to Find Needles in a Haystack
Fraud detection, in many ways, resembles finding needles in a haystack. You must sort and make sense of massive amounts of data in order to find your “needles” or in this case, your fraudsters.
Let’s use the example of a phone company with billions of calls occurring in its network, all on a weekly basis. How can it identify signs of fraudulent activity from its mountain — or haystack — of call logs? This is where machine learning provides value, offering a magnet, which in this case, is the ability to identify behaviors and patterns of likely fraudsters. Using a graph model, a machine becomes more adept at recognizing suspicious phone call patterns and is able to separate them from the billions of calls made by regular people which comprises our haystack of data.
Indeed, more and more organizations are leveraging machine learning, along with graphs, to prevent various types of fraud, including phone scam, credit card chargeback, advertising, money laundering and more. Before we further discuss the value of the powerful combination of machine learning and graphs, let’s take a look at how current approaches for identifying fraudsters based on machine learning are missing the mark.
In order to detect a specific condition such as a phone engaged in a scam or a payment transaction involved in money laundering, a machine learning system requires sufficient volume of fraudulent calls or payment transactions that are likely to be related to money laundering. Let’s drill down further with using phone-based fraud as an example.
In addition to the volume of calls that are likely to be fraudulent, a machine learning algorithm also requires features or attributes that have a high correlation with the phone fraud behavior.
As fraud (much like money laundering) is part of less than 0.01 percent or 1 in 10,000 of the total volume of transactions, the volume or the quantity of training data with confirmed fraud activity is very small. Having such a limited quantity of training data, in turn, results in poor accuracy for the machine learning algorithms.
Features or attributes for finding a fraudster are based on a simple analysis. In the case of phone-based fraud, they include calling history of particular phones to other phones that may be in or out of the network, the age of a prepaid SIM card, percentage of one-directional calls made (cases where the call recipient did not return a phone call) and the percentage of rejected calls. Similarly, to find payment transactions involved in money laundering, features such as size and frequency of the payment transactions are fed into the machine learning system.
However, by relying on features focused on individual nodes alone, the result is a high rate of false positives. For example, a phone involved in frequent one-directional calls may belong to a sales representative, who is calling prospects to find leads or sell goods and services. It may also be involved in harassment, where one user is calling another as a prank. A high volume of false positives results in a wasted effort to investigate non-fraudulent phones leading to low confidence in machine learning solution for fraud detection.
Real life examples are proving the value of graphs and machine learning to combat fraud. Currently, a large mobile operator uses a next-generation graph database with real-time deep link analytics, to address the deficiencies of current approaches for training machine learning algorithms. The solution analyzes over 10 billion calls for 460 million mobile phones and generates 118 features for each mobile phone. These are based on deeper analysis of calling history and go beyond immediate recipients for calls.
The diagram below illustrates how the graph database identifies a phone as a “good” or a “bad” phone. A bad phone requires further investigation to determine whether it belongs to a fraudster.
A customer with a good phone calls other subscribers, and the majority of their calls are returned.
