[PPT] - COPE : : S PO POTTING M ONE ONEY L AU AUNDERING B AS ON G RAP ASED PowerPoint Presentation

SLIDE 1

FLO

LOWSCO COPE:

: SPO

POTTING MONE ONEY LAU AUNDERING

BAS

ASED ED ON ON GRAP RAPHS

Xiangfeng Li1, Shenghua Liu2, Zifeng Li3, Xiaotian Han4, Chuan Shi1,Bryan Hooi5, He Huang6, Xueqi Cheng2

1Beijing University of Post and Telecommunication 2Institute of Computing Technology, Chinese Academy of Sciences 3University of Surrey 4Texas A&M University 5School of Computer Science, National University of Singapore 6China Citic Bank

SLIDE 2

Motivation

Typical method of money laundering (ML)

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion integration save dirty money enters the financial system illegal income consumption

Our Focus

2/28

SLIDE 3

ML Forms a Multipartite Dense Subgraph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Adjacency Matrix 3/28

Inner account

Inner account Outer account Outer account Inner account

?

SLIDE 4

Problem: Natural Dense Subgraph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion Adjacency Matrix

5/28

Inner account

Inner account Outer account Outer account Inner account

?

natural dense blocks

(core, community, etc.) suspicious dense blocks formed by fraudsters

l Question. How can we distinguish them?

SLIDE 5

Solution: Multipartite Dense Subgraph

Natural dense transfer not always form a multipartite

dense subgraph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

6/28

Inner account

Inner account Outer account Outer account Inner account

?

Only dense in receive

Only dense in transfer out

ML characteristic

Both dense in and out

f the bank

SLIDE 6

Solution: Multipartite Dense Subgraph (cont.)

Our FlowScope catches exactly multipartite dense subgraph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Fraudar HoloScope-! Our FlowScope 7/28

SLIDE 7

Problem formulation

Given
! = (", # ): a graph of money transfers
":

accounts as nodes

#:

money amount as edges weight

$:

number of middle layers

Find
a dense flow of money transfers (i.e. a subgraph of ! ),
Such that
1) the flow involves high-volume money transfers into the bank,

and out of the bank to the destinations;

2) it maximizes density as defined in our ML metric.

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

! = suspicious flow in the graph $ + 1 matrices 8/28 dense flow detection

SLIDE 8

Requirements

Our goal is to design an algorithm which is

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Fast: runs in near-linear time Accurate: provides an accuracy guarantee Effective: produces meaningful results in practice FlowScope, our proposed method, satisfies all the requirements

9/28

SLIDE 9

Outer account (X)

Inner account (W)
Inner account (W)
Outer account (Y)
Inner account (W)

Inner account (W)

Model
Graph
! is the inner accounts of the bank, and " and # are sets of
uter accounts
Generate multipartite graph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion $ = (%, & ) , % = " ⋃ ! ⋃ #

Inner account

Inner account (W) Outer account (Y) Outer account (X) Inner account(W)

?

Duplicate for k-3 times

%k = " ⋃ ! ⋃ … ⋃ ! ⋃ #

( - 2 $k = (%k, &k ) , 10/28

SLIDE 10

Model (cont.)

Out/in degree of each middle-layer node
Definition of min and max flow
Suspicious metric

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

~ flow

retention/deficit

!"

# $ = ∑'(∈*+,-⋀ ",0 ∈1 2"0

!"

3 $ = ∑'4∈*+5-⋀ 6," ∈1 26"

7

" $ = min{ !" # $ , !" 3 $ }, ∀ >" ∈ ?@

A" $ = max { !"

# $ , !" 3 $ }, ∀ >" ∈ ?@

D6 $ = 1 $ F

@GH 63I

F

'J∈*+

7

" $ − L(A" $

− 7

" $ )

= 1 $ F

@GH 63I

F

'J∈*+

(L + 1)7

" $ − LA" $

, P ≥ 3

11/28 balance parameter

SLIDE 11

Algorithm

Input: Graph ! = (", # )
Output: Node set of dense multipartite flow: $
Key idea: priority tree and greedy deletion

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Step 1. initialize Step 2. greedy deletion Step 3. get the result 12/28

SLIDE 12

Algorithm (cont.)

Step 1. initialize

§ 1. generate the !-partite graph, " ← $, %& ← ', … , %()* ← ', + ← , § 2. initialize subset - ← " ⋃%&⋃ … ⋃ M()* ⋃ + § 3. calculate the priority of node § 4. build priority tree for S with 23 S

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

23 S = 5 6

3 -

− 8 8 + 1 ;3 - , if ?3 ∈ %A , B ∈ {1, 2, … , ! − 2} ;3 - = F3 - , if ?3 ∈ " ⋃ + Priority tree

20 20 1 1 10 10 10 10 2

Outer account(!) Inner account(") Outer account(#) Inner account(")

13/28

SLIDE 13

4.5 4.7 4.9 5.1 5.3 5.5 1 2 3 4 5 6 7 8 9

Density Iteration new !(") after the first deletion

Algorithm (cont.)

Step 2. greedy deletion

§ 1. get the node ! with minimum weight § 2. delete the selected node, update the value of " # and update node’s weight that corelated with ! § 3. repeat 1 and 2 until one of $, &', … , &)*+, , is empty

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Delete minimum weighted node Update priority of node Update " #

20 4 20 4 40 20 4 40 40 40 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

A M C

∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ 20 2 4 0.2 20 4 1 40 20 2 0.2 1 40 2 0.2 40 0.2 40 0.2 1 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

A M C

∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞ ∞

2 20 20

20 20 1 1 10 10 10 10 2

Outer account(!) Inner account(") Outer account(#) Inner account(")

4 4 0.2 1 1 40 0.2 4 4

14/28

SLIDE 14

Algorithm (cont.)

Step 3. get the result

§ 1. find the maximum value of ! " § 2. recover correspond node set Ŝ corresponding to maximum ! "

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Recover Ŝ

# $ : {0,1}, % & : {0,1}, # ' : {2}

1 2 3 4 5 6 7 8 9 1 2 3 4 5 6 7 8 9

Density Iteration ! " ：8 maximum of

20 20 1 1 10 10 10 10 2

Outer account (!) Inner account(") Outer account(#) Inner account (")

Result Ŝ:

15/28

SLIDE 15

Algorithm (cont.)

Theorem [Approximation Guarantee]
in 3-step ML (tripartite)

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

g( Ŝ ) ≥ Ｍ’ #’ ( g(#*) - $% )

amount of camouflage transfers node set just before the first optimal node removed FlowScope middle counts in #ʹ

ptimal

Fast: runs in near-linear time Accurate: provides an accuracy guarantee Effective: produces meaningful results in practice

Properties of FlowScope:

16/28

SLIDE 16

Real-world performance

Performance on synthetic data With ground-truth labelled

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

FlowScope Wins

17/28

SLIDE 17

Effectiveness: one middle layer

FlowScope: Spotting Money Laundering Based on Graphs

Good performance under variety of topologies

Introduction Algorithm Experiments Model Conclusion

18/28

SLIDE 18

Effectiveness: one middle layer (cont.)

FlowScope: Spotting Money Laundering Based on Graphs

Summary in table

Introduction Algorithm Experiments Model Conclusion

F l

w

S c

p

e W i n s

19/28

SLIDE 19

Robustness against longer transfer chains

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

20/28

SLIDE 20

Effectiveness: varies topologies and labelled data

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Fast: runs in near-linear time Accurate: provides an accuracy guarantee Effective: produces meaningful results in practice

Properties of FlowScope:

21/28

SLIDE 21

Sensitivity and Scalability

FlowScope: Spotting Money Laundering Based on Graphs

FlowScope is robustness to parameter FlowScope runs in near-linear time with the # of edges

Introduction Algorithm Experiments Model Conclusion

22/28

SLIDE 22

Conclusion

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

FlowScope detects money laundering fast and

effectively Accurate Reproducible Effective Fast

https://github.com/aplaceof/FlowScope

g( Ŝ ) = Ｍ’ "’ ( g("*) - #$ )

24/28

SLIDE 23

Reference

FlowScope: Spotting Money Laundering Based on Graphs

[Charikar M, 2000] Charikar, Moses. "Greedy approximation algorithms for finding dense

components in a graph." International Workshop on Approximation Algorithms for Combinatorial Optimization, 2000.

[Asahiro et al, SWAT'96] Asahiro, Yuichi, et al. "Greedily finding a dense subgraph." Algorithm

TheorySWAT'96 (1996): 136-148.

[B Hooi et al, KDD’16] Bryan Hooi, Hyun Ah Song, Alex Beutel, Neil Shah, Kijung Shin, and

Christos Faloutsos. 2016. Fraudar: bounding graph fraud in the face of camouflage. KDD 2016

[M-Zoom] Kijung Shin, Bryan Hooi, and Christos Faloutsos. M-Zoom: Fast Dense- Block

Detection in Tensors with ality Guarantees. ECML-PKDD. 2016, 264–280.

[D-Cube] Kijung Shin, Bryan Hooi, Jisu Kim, and Christos Faloutsos. 2017. D-Cube: Dense-

Block Detection in Terabyte-Scale Tensors. WSDM ’17. 2017.

[SpokEn] B Aditya Prakash, Mukund Seshadri, Ashwin Sridharan, Sridhar Machiraju, and

Christos Faloutsos. Eigenspokes: Surprising patterns and scalable community chipping in large

graphs. PAKDD 2010, 290–295.
[Holoscope] Liu, S.; Hooi, B.; and Faloutsos, C. 2017. Holoscope: Topology-and-spike aware

fraud detection. In Proceedings of the 2017 ACM on Conference on Information and Knowledge Management, 1539–1548. ACM.

[RRCF] Guha, S.; Mishra, N.; Roy, G.; and Schrijvers, O. 2016. Robust random cut forest based

anomaly detection on streams. In International conference on machine learning, 2712–2721.

26/28

SLIDE 24

Thank you

Questions and Answers

FlowScope: Spotting Money Laundering Based on Graphs

28/28