LINK-用数据挖掘理解、预测、阻止ATM欺诈..ppt

CRISP-DM Business Understanding Data Understanding Data preparation/visualisation Modelling Evaluation Deployment Interative process Two stages to implementation Stage one - Set up automated data processing - Determine Fraud criteria based on business rules - Build initial Clementine streams - Suspect archive table developed Stage two (ongoing) - Data mining to model ‘suspects’ - Deploy model scores to transactions (overnight process) Business Rule stream example High value, quick succession withdrawals/attempted withdrawals Next steps Include more transaction predictors in modelling process Update models on reported cases of fraud as opposed to suspect cases Expand other approaches - Clustering of ATM transaction behaviour to pick up Lebanese Loop fraud Changes in a number of situations over recent years meant that we were able to react to the Embargo type situation much more effectively than we would have been able to do previously. Gradual migration to a single network has resulted in a far higher proportion of transactions going across one network, and therefore being logged in one place. This obviously makes data analysis quicker and more thorough. Greater cooperation between members has meant that their efforts are employed fighting fraudsters, and not each other. This has also meant that we receive data more quickly. TARDIS is an Oracle database containing 12 months of LINK transaction data. This facility has enabled us to analyse data more thoroughly and quickly, enabling us to perform searches on card numbers, ATM details or even specific times and dates. Access to the system is also available to members through a Web Browser interface. This therefore enables them to analyse their own LINK transactions. One of the key lessons that we learnt from the Embargo attack was the requirement for a dedicated team at LINK who have the tools to identify fraud at an early stage rather than having to wait for it to be identifie