WHY USE ANALYTICS RAID FMS FRAUD IN TELCOS ADVANCED FRAUD DETECTION. Fact Check. To Fight Fraud. Hands-On

Transcription

1

2

3 FRAUD IN TELCOS Fact Check WHY USE ANALYTICS To Fight Fraud ADVANCED FRAUD DETECTION RAID FMS Hands-On

4 FRAUD IN TELCOS Fact Check WHY USE ANALYTICS To Fight Fraud ADVANCED FRAUD DETECTION RAID FMS Hands-On

5 Estimated Fraud Losses in 2015 Billion USD Fraudulent usage of cellular networks costs the industry an estimated $38 billion a year, according to the 2015 Global Fraud Loss Survey by the Communications Fraud Control Association (CFCA)

6 Source:2015 Global Fraud Loss Survey by the Communications Fraud Control Association (CFCA)

7 Device Hardware resselling Premium Rate service Fraud Dealer Fraud Comissions Fraud Arbitrage Subscription Fraud Growth Rates in Global Fraud Revenue Threats in 2015, with % change from 2013 Theft/Stolen Goods Domestic revenue share Fraud Interconnect bypass Fraud International Revenue Share Fraud -50% 50% 150% 250% 350% 450% Source: 2015 Global Fraud Loss Survey by the Communications Fraud Control Association (CFCA)

8 EMERGING Emerging fraud types in Telcos: New technologies allow new fraud opportunities! Content Sell Fraud Content Partner Fraud Click Fraud CrossOver Fraud Subscription Fraud VOIP Bypass Denial-of-Service IP Spoofing Pharming IP Fraud M-Commerce Fraud

9 Fraud specialists are constantly working to uncover new fraud types, but modern cyber attacks evolve faster than analysts can write rules to detect them Existing systems using outdated technologies simply can t catch modern fraudsters because they only use Dated Rules to discover last year s fraud, not today s fraud! Fraudsters are always evolving!

10 There are known knowns. These are things we know that we know. There are known unknowns. That is to say, there are things that we know we don t know. But there are also unknown unknowns. There are things we don t know we don t know. Donald Rumsfeld, 2002 In Fraud this can be translated as: The known knowns The Known fraud attack techniques The known unknowns Fraud that we suspect but can t codify with rules The unknown unknowns Fraud that we don t know about/are not looking for How do we find something when we don t know what we are looking for?

11 FRAUD IN TELCOS Fact Check WHY USE ANALYTICS To Fight Fraud ADVANCED FRAUD DETECTION RAID FMS Hands-On

12 WHAT IS ANALYTICS When People think about Machine Learning When a Data Scientist thinks about Machine Learning

13 hadoop internet security algorithms platform THE TWO BIG TECHNIQUE FAMILIES IN MACHINE LEARNING Supervised Learning When you are trying to determine a target information, and use information from the past to build a model use that model to predict or classify something Unsupervised Learning When use only your present data to find patterns or groups of individuals with the same features or behaviors investment analytics enterprises deep datareal-time easier learning digital spark

14 WHY USE ANALYTICS SUPERVISED LEARNING EXAMPLE Target Classification Output FRAUD Supervised model Network Input Data High Outgoing International Calls Low Outgoing National Calls Training DataSet High Duration Outgoing International Calls Low Duration Outgoing National Calls NOT FRAUD BYPASS FRAUD EXAMPLES Knowledge from the past

15 WHY USE ANALYTICS UNSUPERVISED LEARNING EXAMPLE Cluster 1 High Usage Large Cluster Cluster 2 Normal Usage Large Cluster Output Clusters Input Data Unsupervised model Analysis Indicatores (or axes) Outgoing International Calls (Duration; Number, etc..) Outgoing National Calls (Duration; Number,etc ) Incoming Calls (Duration; Number,etc ) Cluster 3 - Outlier - Suspicious behavior Possible FRAUD Cluster 4 - Outlier - Suspicious behavior Possible FRAUD

16 National Outgoing Calls UNSUPERVISED LEARNING INTERNATIONAL BYPASS EXAMPLE In this graphic, we compare the number of National and International Outgoing Calls We can see two clear clusters with an abnormal behavior: One cluster has Known Fraud Cases One second Cluster, with similar behavior that are clearly Suspicious Fraud Cases Suspicious fraud cases Known fraud cases International Outgoing Calls

17 Measurement (units) UNSUPERVISED LEARNING CLUSTERING, OUTLIERS AND ANOMALY DETECTION CLUSTERING OUTLIERS ANOMALY DETECTION PRE-CLUSTERING POS-CLUSTERING 60 outliers maximum value, excluding outliers 30 75th percentile 20 median value th percentile minimum value, excluding outliers

18 FRAUD IN TELCOS Fact Check WHY USE ANALYTICS To Fight Fraud ADVANCED FRAUD DETECTION RAID FMS Hands-On

19 RAID FMS USING UNSUPERVISED LEARNING TO FIGHT FRAUD WHAT IS IT? WHAT IS IT FOR? WHAT IS THE UNDERLYING PURPOSE? Advanced Fraud Detection (AFD) builds and run data mining models aiming to detect niches of subscribers with unusual behavior and high probability of being Fraudsters by increasing present knowledge on fraudsters behavior, generating potential fraud alerts - and helping better prioritization of fraud cases analysis.

20 HOW DOES AFD WORK? AFD APPROACH Integrate Data Create Model Explore and Test Generate Alerts

21 AFD APPROACH RAID: FMS AFD PARAMETERS & CONTROL STAGING AREA AFD REPOSITORY MODEL MANAGER SCHEDULER MANAGER Fraud Types Fraud Cases Advanced Fraud Detection Model Results Fraud Types Fraud Cases AFD Alert Files Fraud Types Fraud Cases CASE MANAGEMENT

22 COMPONENTS AFD PARAMETERS & CONTROL Assures AFD software configurations and parameters, to properly manage: Indicators available for modelling Housekeeping rules Business rules Analytical Repository retention Models creation & execution Housekeeping policies Alert File configuration Parameters & Control Alert files generation Default configurations are provided with product installation, revised during deployment project Models parameters Active entity definition Guarantees AFD flexibility, namely to customer infra-structure and CSP customer base

23 FRAUD IN TELCOS Fact Check WHY USE ANALYTICS To Fight Fraud ADVANCED FRAUD DETECTION RAID FMS Hands-On

24

25

26

27 WHY USE ANALYTICS UNSUPERVISED LEARNING EXAMPLE Fruit Color: Red Fruit Size: Small Fruit Color: Red Fruit Size: Big Output Clusters Modelo de analitics (supervised) (unsupervised) Fruit Color: Orange Fruit Size: Big Fruit Color: Yellow Fruit Size: Big Input Data Analysis dimensions (or axes) Fruit Color Fruit Size Fruit Color: Green Fruit Size: Big Fruit Color: Green Fruit Size: Small

28 WHY USE ANALYTICS SUPERVISED LEARNING EXAMPLE Apples Target Classification Output Oranges Input Data Supervised model Training DataSet Grapes Bananas Knowledge from the past

29 UNSUPERVISED LEARNING CLUSTERING TECHNIQUE OUTLIER SENSITIVE SEGMENTATION Basic Algorithm: Define which attributes to use Define the number of Clusters Define a initial random cluster Center (Centroid) for each cluster For each entry, measure the Euclidean distance of the centroid Associate each entry to the cluster centroid with the smallest distance Calculate the new centroid position based on the average members of each cluster Go to step 4 until no change is made on step 5 Tends to group all the entities with a suspect behavior in a single group. This technique is very useful to identify at a glance the different characteristics that emerge from the "normal" behavior The goal is to achieve minimum variability within each cluster and maximum variability between clusters.

30 UNSUPERVISED LEARNING TECHNIQUE TOPOLOGICAL RELATIONS SEGMENTATION Matching Updating Tends to be more descriptive and distributes the entities with abnormal behavior in more than one group This technique is very useful when the fraud analyst introduces fraud behavior from several types in the same model

31 FOR A FRAUD MANAGER AFD assists CSPs to easily build their own Data Mining models Detect niches of subscribers with unusual behavior (aka, outliers detection) Increases the effectiveness of RAID:FMS fraud-rules by supporting their refinement or creation Helps prioritizing potential Fraud Cases detail analysis Fully integrated into RAID:FMS AFD fraud alerts are totally integrated into RAID:FMS / Case Management Includes built-in models based on advanced statistical techniques, ready to run