An Adversarial Risk Analysis Approach to Fraud Detection

Transcription

1 An Adversarial Risk Analysis Approach to Fraud Detection J. Cano 1 D. Ríos Insua 2 1 URJC 2 ICMAT-CSIC, Spain 20th IFORS. Barcelona. July 15, 2014

2 Outline A framework for risk analysis A framework for adversarial risk analysis A framework for risk analysis and adversarial risk analysis Case study: fighting fare evasion 2/25

3 General overview Risk analysis methodology to mitigate negative effects of threats that may harm system performance. Adversarial risk analysis expands RA to deal with intelligent intentional adversaries. Application in fraud detection in relation with access to a paid facility. 3/25

4 1. A framework for risk analysis 4/25

5 Risk analysis influence diagrams and expected utility Hazard Mitigation Option Hazard Extra Mitigation Extra Utility Total Utility Total Utility Basic With risk assessment With risk management ψ = n u(c)π(c)dc, ψ r = q j j=0 u(c)π j (c)dc, n ψ m = max q j (m) u(c)π j (c m)dc m M j=0 5/25

6 2. A framework for adversarial risk analysis 6/25

7 Sequential Defend-Attack model Defence Option Hazard Attack Option Defence Option Hazard Attack Option Defence Option Hazard Attack Option u D u A u D u A Coupled Defender s problem Attacker s problem 7/25

8 Solving strategy Defender aims at finding optimal defense d. Consequences evaluated through utility u D (d,s) ψ D (d a) = u D (d,s)p D (s d,a)ds. Suppose Defender able to assess p D (a d). Then, she can compute ψ D (d) = ψ D (d a)p D (a d)ds. and solve d max d D ψ D (d). 8/25

9 Assessment of Attacker s intentions To obtain p D (a d), solve Attacker s problem (E.U. max.) a (d) = arg max a A u A (a,s)p A (s d,a)ds. Defender lacks knowledge ( u A ( ),p A (s ) ) ( U A,P A ). Approximate p D (a d) through Monte Carlo simulation. Assessment of P A ( ) typically based on p D ( ) Dirichlet distribution (process) for discrete (continuous). For U A, information about Attacker s interests Aggregate with weighted measurable value function. Assume risk proneness. Distributions over weights and risk proneness coefficient. 9/25

10 3. A framework for risk analysis and adversarial risk analysis 10/25

11 General influence diagram Mitigation Option Hazard Attack Attacker Mitigation Extra Attack Attacker Total u D u A Incorporate uncertainty from non-adversarial threats. Defender s u D aggregates consequences from both problems. 11/25

12 4. Case study: fighting fare evasion 12/25

13 Influence diagram Countermeasures Customers Prop. of fraudsters Prop. of colluders Colluders decision Fraud cost operator colluders u D u C 13/25

14 Description of problem Metro operator D protecting from: Fare evasion. Two types of evaders: Standard (standard random process). Colluders (ARA; explicitly modeling intentionality). Role Features d 1 Inspector Prev./rec. Inspect customers. Collect fines d 2 Door guard Prev. Control access points d 3 Guard Prev. Patrol along the facility d 4 Door Prev. New secured automatic access doors d 5 Ticket clerk Prev. Current little implication in security 14/25

15 Feasible portfolios Associated unit costs q 1,q 2,q 3,q 4. d 5 {0,1} (d 5 = 1 clerks involved, incurred costs q 5 ). q 1 d 1 + q 2 d 2 + q 3 d 3 + q 4 d 4 B, d 1,d 2,d 3,d 4 0, d 1,d 2,d 3,d 4 integer, d 4 d 4, d 5 {0,1}, ( d 4 maximum # of doors that may be replaced). 15/25

16 Defender s problem Operator invests d = (d 1,d 2,d 3,d 4,d 5 ). (Constraints) Fare evasion costs (partly mitigated by fines). φ (d) evaders proportion. q(d 1 ) inspection proportion ( φ(d) = φ 0 exp 5 k=1 γ k d k ) + φ r. γk s effect of (d 1,d 2,d 3,d 4,d 5 ) on fraud proportion. (φ 0 + φ r ) current fraud proportion. φ r residual proportion even with infinite resources. Each new inspector # inspected tickets (nonlinear increase). 1 φ(d) N 1 civic customers pay ticket. φ(d)[1 q(d 1 )] N 2 not pay, not caught (loss v). φ(d)q(d 1 ) N 3 do not pay but caught (income f ). 16/25

17 Attacker s problem Colluders see security investments d (Seq D-A). Fare evasion proportion r r, inspection proportion q A (d 1 ) 1 r M 1 pay, abortion (income v). r (1 q A (d 1 )) M 2 not pay, not caught (loss v). r q A (d 1 ) M 3 not pay, caught (income f ). Operational costs, including preparation costs q c A = v(m 2 M 1 ) fm 3 rqm. Colluders risk prone in benefits u A (c A ) = exp(k A c A ), k A > 0. Target: Assess h(r d), Defender s beliefs over proportion of evasion attempts given d. 17/25

18 Solving the Defender s problem Operator benefit/cost balance c D (N 1,N 2,N 3,M 1,M 2,M 3,d) = v(n 2 + M 2 ) + f (N 3 + M 3 ) Operator risk averse to increase in income, u D (c D ) = exp( k D c D ). Evaluate security plan d maximizing expected utility 5 k=1 q k d k. [ ] 1 ψ D (x) = p M1M2M3d pn 1 d p2 N 2 d p3 N 3 d u D(c D ) N 1,N 2,N 3 M 1,M 2,M 3 h(r d)dr. 18/25

19 Results 0.5 3% 3% 6% 6% 12% 12% Expected utility x * x * x * Portfolio 19/25

20 Results p 0 + p r = 0.03,M = p 0 + p r = 0.06,M = p 0 + p r = 0.12,M = x Invest. ψ(x) Income x Invest. ψ(x) x Invest. ψ(x) (1,0,0,0,0) (1,2,0,0,0) (1,3,0,0,0) (1,0,0,0,0) (1,0,0,0,0) (1,0,0,0,0) (0,3,0,0,0) (0,3,0,0,0) (0,3,0,0,0) (0,0,2,0,0) (0,0,2,0,0) (0,0,2,0,0) (0,0,0,1,0) (0,0,0,1,0) (0,0,0,1,0) (0,0,0,0,1) (0,0,0,0,1) (0,0,0,0,1) (0,3,2,1,1) (0,3,2,1,1) (0,3,2,1,1) (0,3,2,1,0) (0,3,2,1,0) (0,3,2,1,0) Optimal portfolio d = (1,0,0,0,0), with ψ(x) = 1.12, associated investment 50,000 euros, and expected losses 22,826 euros (investment plus expected balance between fraud and collected fines, +27, 174 euros). Results sensitive to variations in evasion proportion φ r + φ 0. Operator needs higher investments for higher proportions. Essential that inspectors really carry out their task. 20/25

21 Conclusions RA+ARA methodology. Sequential Defend-Attack model as basic template. Expand basic template with additional uncertainty nodes. Case study in metro security fare evasion. 21/25

22 Current methodological developments ARA (Ríos Insua et al., 2009) approach for multithreat problem over multiple sites. (Ríos Insua et al., 2014b) Multiple uncoordinated attacks. Outcome of attacks might affect each other. Extension to multiple sites. Sequential Defend-Attack for each site/threat. Models related by resource constraints and value aggregation. No particular spatial structure. Case study: metro network protection against Fare evasion. (Ríos Insua et al., 2014a) Pickpocketing by a team. 22/25

23 Future developments Multiple defenders and eventual coordination. Coordination and rationality type of attacks. More complex interactions between defenders and attackers. Mobility of resources. 23/25

24 Acknowledgments This project has received funding from the European Union s Seventh Framework Programme for Research, Technological Development and Demonstration under grant agreement no Work has been also supported by the Spanish Ministry of Economy and Innovation program MTM C03-01, the Government of Madrid RIESGOS-CM program S2009/ESP-1685 and the AXA-ICMAT Chair on Adversarial Risk Analysis. Grateful to TMB experts and stakeholders for fruitful discussion about modeling issues. 24/25

25 Bibliography Ríos Insua, D., J. Cano, M. Pellot, R. Ortega Current Trends in Bayesian Methodology with Applications, chap. From Risk Analysis to Adversarial Risk Analysis. CRC Press, To appear. Ríos Insua, D., J. Cano, M. Pellot, R. Ortega Multithreat Multisite Protection: A Case Study in Metro Security. Submitted for publication. Ríos Insua, D., J. Ríos, D. Banks Adversarial risk analysis. Journal of the American Statistical Association 104(486) /25