COPE : : S PO POTTING M ON ONEY L AU AUNDERING B AS ON G RAP ASED - PowerPoint PPT Presentation

F LO LOW S CO COPE : : S PO POTTING M ON ONEY L AU AUNDERING B AS ON G RAP ASED ED ON RAPHS Xiangfeng Li 1 , Shenghua Liu 2 , Zifeng Li 3 , Xiaotian Han 4 , Chuan Shi 1 ,Bryan Hooi 5 , He Huang 6 , Xueqi Cheng 2 1 Beijing University of Post and Telecommunication 2 Institute of Computing Technology, Chinese Academy of Sciences 3 University of Surrey 4 Texas A&M University 5 School of Computer Science, National University of Singapore 6 China Citic Bank 1/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Motivation • Typical method of money laundering (ML) save dirty money enters the financial system illegal income consumption integration 2/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion ML Forms a Multipartite Dense Subgraph ？ Adjacency Matrix 3/28 FlowScope: Spotting Money Laundering Based on Graphs (by Xiangfeng Li)

Introduction Model Algorithm Experiments Conclusion ML Forms a Multipartite Dense Subgraph • Example: tripartite subgraph formed by money laundering accounts from a real bank. 4/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Problem: Natural Dense Subgraph suspicious dense blocks formed by fraudsters natural dense blocks (core, community, etc.) l Question. How can we distinguish them? Adjacency Matrix 5/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Solution: Multipartite Dense Subgraph • Natural dense transfer not always form a multipartite dense subgraph Both dense in and out of the bank Only dense in transfer out Only dense in receive 6/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Solution: Multipartite Dense Subgraph (cont.) • Our FlowScope catches exactly multipartite dense subgraph HoloScope- 𝛃 Fraudar Our FlowScope 7/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Problem formulation • Given ◦ 𝘏 = ( 𝑊 , 𝐹 ): a graph of money transfers ◦ 𝑊 : accounts as nodes ◦ 𝐹 : money amount as edges weight ◦ 𝑙 : number of middle layers • Find ◦ a dense flow of money transfers (i.e. a subgraph of 𝘏 ), • Such that ◦ 1) the flow involves high-volume money transfers into the bank, and out of the bank to the destinations; ◦ 2) it maximizes density as defined in our ML metric. dense flow detection 𝘏 = suspicious flow in the graph 𝑙 + 1 matrices 8/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Requirements • Our goal is to design an algorithm which is Fast : runs in near-linear time Accurate : provides an accuracy guarantee Effective : produces meaningful results in practice 0 FlowScope , our proposed method, satisfies all the requirements 9/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Model • Graph 𝘏 = ( 𝑊 , 𝐹 ) , 𝑊 = 𝘠 ⋃ 𝑋 ⋃ 𝑍 ◦ 𝑋 is the inner accounts of the bank, and 𝘠 and 𝑍 are sets of outer accounts • Generate multipartite graph 𝑊 k = 𝘠 ⋃ 𝑋 ⋃ … ⋃ 𝑋 ⋃ 𝑍 𝘏 k = ( 𝑊 k , 𝐹 k ) , 𝑙 - 2 Duplicate for k-3 times 10/28 FlowScope: Spotting Money Laundering Based on Graphs

� � � � Introduction Model Algorithm Experiments Conclusion Model (cont.) • Out/in degree of each middle-layer node + 𝑇 = ∑ 𝑒 * 𝑓 *1 3 4 ∈6 789 ⋀ *,1 ∈< = 𝑇 = ∑ 𝑒 * 𝑓 >* 3 ? ∈6 7@9 ⋀ >,* ∈< • Definition of min and max flow + 𝑇 , 𝑒 * = 𝑇 }, ∀ 𝑤 * ∈ 𝑁 J 𝑔 * 𝑇 = min{ 𝑒 * + 𝑇 , 𝑒 * = 𝑇 }, ∀ 𝑤 * ∈ 𝑁 J 𝑟 * 𝑇 = max { 𝑒 * ~ flow • Suspicious metric balance parameter >=V 𝑕 > 𝑇 = 1 𝑇 P P 𝑔 * 𝑇 − 𝜇(𝑟 * 𝑇 − 𝑔 * 𝑇 ) retention/deficit JWX 3 U ∈6 7 >=V = 1 𝑇 P P (𝜇 + 1)𝑔 * 𝑇 − 𝜇𝑟 * 𝑇 , 𝑙 ≥ 3 JWX 3 U ∈6 7 11/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Algorithm • Input: Graph 𝘏 = ( 𝑊 , 𝐹 ) • Output: Node set of dense multipartite flow: 𝑇 • Key idea: priority tree and greedy deletion Step 1. initialize Step 2. greedy deletion Step 3. get the result 12/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Algorithm (cont.) ◦ Step 1. initialize § 1. generate the 𝑙 -partite graph, 𝐵 ← 𝑌 , 𝑁 X ← 𝑋 , … , 𝑁 >=V ← 𝑋 , 𝐷 ← 𝑍 § 2. initialize subset 𝑇 ← 𝐵 ⋃ 𝑁 X ⋃ … ⋃ M >=V ⋃ 𝐷 § 3. calculate the priority of node 𝜇 𝑥 * S = d𝑔 * 𝑇 − 𝜇 + 1 𝑟 * 𝑇 , if 𝑤 * ∈ 𝑁 J , 𝑚 ∈ {1, 2, … , 𝑙 − 2} 𝑟 * 𝑇 = 𝑒 * 𝑇 , if 𝑤 * ∈ 𝐵 ⋃ 𝐷 § 4. build priority tree for S with 𝑥 * S Priority tree 𝐵 𝑁 𝐷 13/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Algorithm (cont.) ◦ Step 2. greedy deletion § 1. get the node 𝑤 with minimum weight § 2. delete the selected node, update the value of 𝑕 𝑇 and update node’s weight that corelated with 𝑤 § 3. repeat 1 and 2 until one of 𝐵, 𝑁 X , … , 𝑁 >=V , 𝐷 is empty Update priority of node Delete minimum 𝐵 𝑁 𝐷 weighted node Update 𝑕 𝑇 𝐵 𝑁 𝐷 14/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Algorithm (cont.) ◦ Step 3. get the result § 1. find the maximum value of 𝑕 𝑇 § 2. recover correspond node set Ŝ corresponding to maximum 𝑕 𝑇 Recover Ŝ Result Ŝ: h : {0,1}, 𝑁 i : {0,1}, 𝐷 h : {0,1} 𝐵 15/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Algorithm (cont.) • Theorem [Approximation Guarantee] ◦ in 3-step ML (tripartite) middle counts in 𝑇 ʹ g ( Ŝ ) ≥ Ｍ ’ 𝑇 ’ ( g ( 𝑇 *) - 𝜇𝜁 ) amount of camouflage FlowScope transfers node set just before the optimal first optimal node removed Properties of FlowScope: Fast : runs in near-linear time Accurate : provides an accuracy guarantee Effective : produces meaningful results in practice 0 16/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Real-world performance With ground-truth labelled Performance on synthetic data 17/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Effectiveness: one middle layer Good performance under variety of topologies 18/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Effectiveness: one middle layer (cont.) Summary in table 19/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Robustness against longer transfer chains 20/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Effectiveness: varies topologies and labelled data Properties of FlowScope: Fast : runs in near-linear time Accurate : provides an accuracy guarantee Effective : produces meaningful results in practice 0 21/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Sensitivity and Scalability FlowScope is robustness to FlowScope runs in near-linear parameter time with the # of edges 22/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Sensitivity and Scalability(cont.) Properties of FlowScope: Fast : runs in near-linear time Accurate : provides an accuracy guarantee Effective : produces meaningful results in practice 0 23/28 FlowScope: Spotting Money Laundering Based on Graphs

Introduction Model Algorithm Experiments Conclusion Conclusion • FlowScope detects money laundering fast and effectively Accurate Fast g ( Ŝ ) = Ｍ ’ 𝑇 ’ ( g ( 𝑇 *) - 𝜇𝜁 ) Reproducible Effective https://github.com/aplaceof/FlowScope 24/28 FlowScope: Spotting Money Laundering Based on Graphs

More information about FlowScope • AAAI 2020 • Supplement ◦ https://github.com/aplaceof/FlowScope/blob/master/Flo wScope-supplement.pdf • Source code ◦ https://github.com/aplaceof/FlowScope 25/28 FlowScope: Spotting Money Laundering Based on Graphs