online predictive modeling of fraud schemes from mulitple live streams by claudiu branzan and david...
TRANSCRIPT
Online Predictive Modeling of Fraud Schemes from Multiple Live Streams
David Talby Claudiu BranzanCTO, Atigeo Principal Lead, Atigeo
2
What we’re up against
3
50+Schemes(and counting)
99.9999%‘Good’ messages
6+Monthsper case
Needle in a haystack
Hybrid analytics
No training data
Semi-supervised learning
Adversarial learning
Online feedback
Why hybrid analytics?
4
Ignore more rules
Unusual timing of events
Unusualpersonal network
Teamwork & scale
Think & talk
differently
(bits of) the toolbox
5
Rule Inference
Time Series
AnalysisLink Analysis
Ensemble Learning
Natural Language
Can we see some code please?
6
Freely available IPython notebooks
Open source libraries & open data
Jump-start via AWS Marketplace
Stream processing
7
Kafka
Email Stream
Account transactions Stream
Email NLP Features
People graph
Transactions time series
Sample email patterns
Sample natural language annotatorsUnderstandvocabulary
– Jargon– Codewords– Multi- lingual
Understandgrammar
– Whoarewetalkingabout?– Past,presentorfuture?– Compoundsentences
Understandcontext– Email:Re:,Fwd:,attachments– SMS&IMhavetheirowngrammar
Sample email patterns
K-Means failing on “haystacks” Bregman Bubble Clustering
User analysis iteration
Email NLP Features
User graph
Transactionstime series
Graph Features
Time SeriesFeatures
NLP Features
Agent Feedback
Trai
n / T
est C
lass
ifier
Really• Makes the world a better place • Needle in a very large haystack
– Actually needs a petabyte-scale platform
• Multi-modal: no single trick works– Hybrid analytics
• No labeled data– Semi-supervised learning– Cold start problem
• Sparse & high-dimensional– Graph based features & change over time
• Adversarial– Feedback & online learning
Technically
Summary: why hunting criminals is cool
1212
THANK YOU!Get the notebooks: github.com/Atigeo/Atigeo/hunting_criminals_demo
Try it yourself: “xPatterns Connect” on AWS Marketplace
Ask us about it: @davidtalby , @melcutz
appendixAppendixIn case the live demo gets cold feet on stage
14