predictive threat and fraud analytics

Predictive Threat and Fraud AnalyticsKeith Doan and Shaun Barry

November 2012

© 2012 IBM Corporation

Building a smarter planetAgenda

1. Threat and Fraud Problems

2. Predictive Analytics approach

3. IBM SPSS Predictive Capabilities

4. IBM SPSS Predictive Analytics in Action:

– Detect Insurance Claim Fraud

– Prevent Insider Threat

5. IBM Smarter Analytics Signature Solution

6. Summary


Building a smarter planet

A smarter planet creates new opportunities but also new risks

The planet is becoming more

instrumented, interconnected and intelligent.

“We have seen more change in the last 10

years than in the previous 90.”

Ad J. Scheepbouwer,CEO, KPN Telecom

New possibilities

New complexities

New risksCritical

infrastructureprotection

New and emerging

risks

Protection against Fraud



Organisations are facing multitude of threat and fraud


Building a smarter planetProtecting IT infrastructure is critical

Market Changes and Challenges

Criticalinfrastructure

protection


Building a smarter planetFraud is expensive and becoming more widespread

Protection against Fraud

Organisations lose an estimated 5% of their revenue to fraud each

year…resulted in a projected global fraud loss of more than $3.5 trillions2

Fraud is difficult to measure … only reflect fraud that has been reported

1. Global Risk Study

2. 2012 Global Fraud Study, Association of

Certified Fraud Examiner

When is a fraud incident involving your

organisation usually detected?


Building a smarter planetFraud is everywhere


Building a smarter planetToday‟s environment is constantly introducing new and

emergence risks

New and emerging

risks








– Prevent Threat


6. Summary



Managing threat and fraud is a balancing act


Building a smarter planetA Predictive Approach to Threat and Fraud








– Prevent Threat


6. Summary


Building a smarter planetCapabilities to combat diversity of Threat and Fraud

Identity ResolutionResolves identities across transactions

Identifies relationships across entities

Business RulesIndustry specific rules

Business specific rules

Predictive ModelsFind Threat and Fraud patterns in the data

Text mining uncovers insights from notes

Anomaly DetectionCompares against normal behaviour within segment

Identified new and emergence fraud patterns

Threat and Fraud InsightMonitor metrics ensures performance

Provide insights to front-line managers and executives

Entity Analytics/ Network

Analysis

Rule Management

Predictive Modelling

Anomaly Detection

Close Loop AnalysisScoring, Reporting/Dashboard,

Model Management


Building a smarter planetEvolutionary solutions


Building a smarter planetIntroduction to SPSS Predictive Analytics portfolio

Collaboration and Deployment Services

CCI

Data Collection

ModelerDecision

ManagementStatistics

Transactions

Demographics

Interactions

Opinions

Predictive Modeling

Data Mining

Text Analytics

Social Network Analysis

Statistical Analysis

Prediction

Rules

Optimisation

Process


Building a smarter planetAlign: Data at the heart of Predictive Analytics

Behavioral data- Orders- Transactions- Payment history- Usage history

Descriptive data- Attributes- Characteristics- Self-declared info- (Geo)demographics

Attitudinal data- Opinions- Preferences- Needs & Desires- Survey results- Social Network Data

Interaction data- E-Mail / chat transcripts- Call center notes - Web Click-streams- In person dialogues

“Traditional”

High-value, dynamic

- source of competitive differentiation

CCI

Data Collection

Text Mining


Building a smarter planetAnticipate: Statistical Analysis and Data Mining

Statistics

Modeler


Building a smarter planetIBM SPSS Statistics enables accuracy and confidence

Statistics


Building a smarter planetSensitivity Analysis with Monte Carlo Simulation

Statistics


Building a smarter planetSPSS Modeler – Data mining workbench

Easy to learn: requires no programming using intuitive graphical interface

– Allows analytics to be repeated and integrated within business systems

High productivity with powerful Automated Modelling:

– Automatically create accurate, deployable predictive models

– Choose the best solution with multi- model evaluation

High performance data mining and text analytics workbench

Modeler



AssociationSegmentation

Comprehensive Data Mining Techniques

Classification

Text MiningEntity Analytics Time series

Social Network Analysis

Modeler



Technique Usage Algorithms

Classification

(or prediction)

• Used to predict if a new transaction is

fraudulent?

• Auto Classifiers,

Decision Trees,

Logistic, SVM, Time

Series, etc.

SPSS Modeler - Data mining techniques

Known normal cases

Known fraudulentcases

All casesFraud Patterns


Building a smarter planetClassification uncovers Fraud Patterns




Classification

(or prediction)


fraudulent?


Decision Trees,

Logistic, SVM, Time

Series, etc.

Segmentation • Used to identify groups of similar cases

and cases that appear unusual

• Auto Clustering, K-

means, Two-Step,

Kohonen

• Anomaly detection


Segmentation



Anomaly Detection – Finding Suspicious behaviour




Classification

(or prediction)


fraudulent?


Decision Trees,

Logistic, SVM, Time

Series, etc.

Segmentation • Used to identify groups of similar cases

and cases that appear unusual

• Auto Clustering, K-

means, Two-Step,

Kohonen

• Anomaly detection

Association • Used to find events that occur together

or in a sequence

• APRIORI, Carma,

Sequence




An example of using Association for Fraud Detection

Healthcare Billing Fraud

Cardio

Orthopedic

Neuro

Discover entities or events

that occur coincidentally


Building a smarter planetSPSS Modeler - Time-series analysis to visualise future

behaviour

Forecast future data points using seasonality, one-time occurrences, interventions or changes in expectations

ARIMA (Auto-Regressive Integrated Moving Average) model accounts for various factors, such as seasonal usage patterns and outliers



SPSS Modeler - Text Mining

Broaden the Perspective

– Mine unstructured data, regardless of source

Extract Relevant Data

– Natural Language Processing

– Concepts, Categories, and Relationships

– Combination of automated and customized extraction

Integrate Extracted Data

– Combine narratives with numbers

– Deeper understanding

29


Building a smarter planetSPSS Modeler - Entity Analytics

Useful for many applications:

– Fraud:

Is this the same person who already defaulted on a loan?

– Government:

Is this the same person / car that was suspicious before?

Is this voter deceased and still voting?

– Business:

How do I match external data with current customer records?

How can I determine if an account / individual is the same across my

multiple data sources?

30



Entity Analytics Overview

Entity Analytics functionality robust and developed over many years

– Includes GNR (Global Name Recognition) – database of different

permutations of the same name (i.e. Bob = Robert = Bobby)

– Can define level of accuracy – more or less aggressive based on

business need

– Default config comes with many features pre-mapped based on

years of experience

I.e. driver licence, phone, birthdate, etc

Cleaner data for Modeling = Accuracy!

– 5 people or 1 person represented 5 ways?

31


Building a smarter planetSimple Illustration

32

FName LName Addr1 Addr2 ZipCode ... Entity ID

Alan Alberts 923 West

Road

Anytown ... 831939

Al Alberts 12 North

Road

Anytown ... ... 412052

Albert Alberts Snigsfoot

Cottage,

North

Road

Anytown ... ... 412052

Dorothy Alberts 7 Main Sq Anytown ... ... 112343

... ... ... ... ... ... ...

Match



Business Rules

Predictive

Analytics

Simulation/

Optimisation

Optimised Decisions

Access to All Data

Act: IBM Analytical Decision Management

MonitoringScoring

Decision Management



34

Act: SPSS Collaboration & Deployment Services








– Prevent Threat


6. Summary



Challenge

Santam was losing millions of dollars paying out fraudulent claims every year.

Low customer satisfaction due to higher premiums and longer waits to settle legitimate claims

Santam InsuranceCatch fraud early in the claim process

Results

Identified a major fraud ring in less than 30 days after implementation

Saved more than $2.5 million on fraudulent claims in the first 6 months

Speed of claim handling from 3 days to an hour to settle claims

Solution

Through predictive modelling they spot suspicious claims early to expedite legitimate claims

Claims are continuously analysed and scored during the process

Reduce false positives to reduce claim investigation



37

Apply Predictive Modelling in Claim Fraud Assessment

All claims

Referred claims

Business rules: more claims get referred

Predictive Analytics: find fraud patterns

Denied claims

Anomaly Detection:find emerging forms of fraud

Predictive Analytics:reduce false positives



Next Best Action: Pro-active and real-time

Level Points

Low Risk > -5

Medium Risk > +1

High Risk > +8

Predictive Analytics

Rules

Structured, Unstructured, Social Media & Business Intelligence Data

Simulation & Optimisation

Scoring

Front-line Rep only sees “Refer” at the point of impact



Local rules drive governance, input, and a critical link to strategy

Decision ManagementModeler Statistics


CCIData Collection

The types of questions asked are driven by the rules that help govern answers, decisions, and recommendations


Building a smarter planetPredictive analytics leverages the likely state, status, or action to

enable answers, decisions, recommendations

Decision MgmtModeler Statistics


CCIData Collection

Responses create the data that are used to create a predicted score of fraud


Building a smarter planetDecision Management drives the answer to the point of impact and

recommends an action, consistent with organizational strategy



CCIData Collection

SPSS Decision Management adjudicates the predictive models, local rules, scoring, and optimisation to provide a scored answer/decision


Building a smarter planetThe feedback loops enables an ongoing link from the execution of

decisions to strategy



CCIData Collection



Insurance Claim Assessment Workflow








– Prevent Threat


6. Summary



Challenge

Uncover security threats in time to take action against them

Deal with several million events per day, most of them are legitimate activities

Malicious insiders have had a devastating impact

A Government AgencyInsider threat prevention

Solution

Through predictive modelling, built filters that automatically remove:

o Irrelevant events

o Events likely to be False Alarm vs. All Others

Identify unusual behaviours

Results

A 97% reduction in alarms to be manually reviewed!

Detection rate of 91%


Building a smarter planetDealing with data challenges

59



Disparate data sources are

merged/appended

Subject matter and sentiment are

extracted from unstructured data

sources

New fields are created and

existing fields are normalised

across all data sources

60

Data Transformation


Building a smarter planetDetermining what is “normal”?


Building a smarter planetSolution for insight: monitoring and detecting anomalies


Building a smarter planetUncover the characteristics of risk profiles

Classification approach results in a model that can be used to score other data environments for other instances

of the profile.



A Nearest Neighbor and CorrespondenceAnalysis approach can be used to very

quickly identify other data points that closely resemble a person of interest.

Who else looks similar?



Detect Healthcare Fraud

Payment Collection

Anti-money Laundering

Detect Welfare Fraud

Protect National Border

Maximise Tax Revenue

Assess Network Outages

Manage Inventory Loss

Manage Liquidity Risk

A National Customs Border Agency

Other Threat and Fraud applications

A Southern European Agency








– Prevent Threat


6. Summary


Building a smarter planetFraud and abuse is fundamentally a problem of analytics: IBM is

uniquely positioned to tackle fraud analytics

Manage Enterprise Business Processes

IBM Fraud Business Architecture

Manage Workload

Manage Domain Data

Detect Transactions

Identify leads

Process referrals

Create models

Execute models

Evaluate Workload

Screen leads

Select leads

Prioritize cases

Report Results

Measure success

Broadcast results

Enforce „Compliance Plan‟

Identify Vulnerabilities

Identify schemes

Estimate exposure

Probe weakness

Assign cases

Work cases

Process appeals

Conduct Remediation

Manage Enterprise Business Processes

IBM Fraud Business Architecture

Manage Workload

Manage Domain Data

Detect Transactions

Identify leads

Process referrals

Create models

Execute models

Evaluate Workload

Screen leads

Select leads

Prioritize cases

Report Results

Measure success

Broadcast results



Identify schemes

Estimate exposure

Probe weakness

Assign cases

Work cases

Process appeals

Conduct Remediation

Detect Transactions

Identify leads

Process referrals

Create models

Execute models

Detect Transactions

Identify leads

Process referrals

Create models

Execute models

Evaluate Workload

Screen leads

Select leads

Prioritize cases

Evaluate Workload

Screen leads

Select leads

Prioritize cases

Report Results

Measure success

Broadcast results


Report Results

Measure success

Broadcast results



Identify schemes

Estimate exposure

Probe weakness


Identify schemes

Estimate exposure

Probe weakness

Assign cases

Work cases

Process appeals

Conduct Remediation

Assign cases

Work cases

Process appeals

Conduct Remediation



Applying Smarter Analytics: Aetna

Finding #1: Predictive models will substantially lower Aetna‟s false positive rate for

prepayment claims review:

– We achieved the following false positive improvement results:

Durable Medical Equipment: 79% » 29% (64% improvement)

Anesthesia and Pain Management: 68% » 46% (32% improvement)

Home Health Care: 31% » 7% (79% improvement)

– In 4Q2011, Aetna could have reviewed 4,000 fewer claims yet stopped the same number of dollars.

Finding #2: Aetna appears to be leaving a lot of highly suspicious claims un-reviewed.

– Finding #2a: There are many claims that look like the validated „bad‟ claims that Aetna‟s current

method is not flagging. We‟ve identified 59,000 such claims.

– Finding #2b: There are numerous claim areas (procedure types) in which we see high dollars paid but

unusually low fraud rates.


Building a smarter planetApplying Smarter Analytics: New Jersey Department of the Treasury

Denied more than $60 million in fraudulent tax refunds in 6 months

Findings:

– Preparers submit multiple returns with same financial data

– Underreporting and over-reporting income to maximize credit

– Use of dependent SSN‟s from other states/territories

Taxpayer response:

– Lots of phone calls; few appeals

– Fewer returns with refund claims in March (compared to previous

year)

– Analyzing data to see if tax preparers are shifting to abuse

other tax credits








– Prevent Threat


6. Summary


Building a smarter planetEnd to End Threat and Fraud Analytics

Support organisations with predictive

capabilities to address a diverse range of

Threat and Fraud problems

IBM SPSS Predictive Analytics is easy to use

Short timeframe to be productive with

actionable results

Business results focused

Cost effective solution that delivers powerful

results across organisation

IBM is uniquely positioned to tackle threat and

fraud analytics with IBM Smarter Analytics

Signature Solution

predictive threat and fraud analytics

Documents