COPE : : S PO POTTING M ON ONEY L AU AUNDERING B AS ON G RAP ASED - - PowerPoint PPT Presentation

β–Ά
cope
SMART_READER_LITE
LIVE PREVIEW

COPE : : S PO POTTING M ON ONEY L AU AUNDERING B AS ON G RAP ASED - - PowerPoint PPT Presentation

Jun 05, 2023 659 likes β€’958 views

F LO LOW S CO COPE : : S PO POTTING M ON ONEY L AU AUNDERING B AS ON G RAP ASED ED ON RAPHS Xiangfeng Li 1 , Shenghua Liu 2 , Zifeng Li 3 , Xiaotian Han 4 , Chuan Shi 1 ,Bryan Hooi 5 , He Huang 6 , Xueqi Cheng 2 1 Beijing University of Post and

slide-1
SLIDE 1

FLO

LOWSCO COPE:

: SPO

POTTING MON ONEY LAU AUNDERING

BAS

ASED ED ON ON GRAP RAPHS

Xiangfeng Li1, Shenghua Liu2, Zifeng Li3, Xiaotian Han4, Chuan Shi1,Bryan Hooi5, He Huang6, Xueqi Cheng2

1Beijing University of Post and Telecommunication 2Institute of Computing Technology, Chinese Academy of Sciences 3University of Surrey 4Texas A&M University 5School of Computer Science, National University of Singapore 6China Citic Bank

FlowScope: Spotting Money Laundering Based on Graphs

1/28

slide-2
SLIDE 2

Motivation

  • Typical method of money laundering (ML)

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion integration save dirty money enters the financial system illegal income consumption

2/28

slide-3
SLIDE 3

ML Forms a Multipartite Dense Subgraph

FlowScope: Spotting Money Laundering Based on Graphs (by Xiangfeng Li)

Introduction Algorithm Experiments Model Conclusion

Adjacency Matrix 3/28

？

slide-4
SLIDE 4

ML Forms a Multipartite Dense Subgraph

  • Example: tripartite subgraph formed by money

laundering accounts from a real bank.

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

4/28

slide-5
SLIDE 5

Problem: Natural Dense Subgraph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

natural dense blocks (core, community, etc.) suspicious dense blocks formed by fraudsters

l Question. How can we distinguish them?

Adjacency Matrix

5/28

slide-6
SLIDE 6

Solution: Multipartite Dense Subgraph

  • Natural dense transfer not always form a multipartite

dense subgraph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion Both dense in and out

  • f the bank

Only dense in transfer out Only dense in receive

6/28

slide-7
SLIDE 7

Solution: Multipartite Dense Subgraph (cont.)

  • Our FlowScope catches exactly multipartite dense subgraph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Fraudar HoloScope-𝛃 Our FlowScope 7/28

slide-8
SLIDE 8

Problem formulation

  • Given
  • 𝘏 = (π‘Š, 𝐹 ): a graph of money transfers
  • π‘Š:

accounts as nodes

  • 𝐹:

money amount as edges weight

  • 𝑙:

number of middle layers

  • Find
  • a dense flow of money transfers (i.e. a subgraph of 𝘏 ),
  • Such that
  • 1) the flow involves high-volume money transfers into the bank,

and out of the bank to the destinations;

  • 2) it maximizes density as defined in our ML metric.

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

𝘏 = suspicious flow in the graph 𝑙 + 1 matrices 8/28 dense flow detection

slide-9
SLIDE 9

Requirements

  • Our goal is to design an algorithm which is

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Fast: runs in near-linear time Accurate: provides an accuracy guarantee Effective: produces meaningful results in practice FlowScope, our proposed method, satisfies all the requirements

9/28

slide-10
SLIDE 10

Model

  • Graph
  • 𝑋 is the inner accounts of the bank, and 𝘠 and 𝑍 are sets of
  • uter accounts
  • Generate multipartite graph

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion 𝘏 = (π‘Š, 𝐹 ) , π‘Š = 𝘠 ⋃ 𝑋 ⋃ 𝑍

Duplicate for k-3 times

π‘Šk = 𝘠 ⋃ 𝑋 ⋃ … ⋃ 𝑋 ⋃ 𝑍

𝑙 - 2 𝘏k = (π‘Šk, 𝐹k ) , 10/28

slide-11
SLIDE 11

Model (cont.)

  • Out/in degree of each middle-layer node
  • Definition of min and max flow
  • Suspicious metric

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

~ flow

retention/deficit

𝑒*

+ 𝑇 = βˆ‘

𝑓*1

  • 34∈6789β‹€ *,1 ∈<

𝑒*

= 𝑇 = βˆ‘

𝑓>*

  • 3?∈67@9β‹€ >,* ∈<

𝑔

* 𝑇 = min{ 𝑒* + 𝑇 , 𝑒* = 𝑇 }, βˆ€ 𝑀* ∈ 𝑁J

π‘Ÿ* 𝑇 = max { 𝑒*

+ 𝑇 , 𝑒* = 𝑇 }, βˆ€ 𝑀* ∈ 𝑁J

𝑕> 𝑇 = 1 𝑇 P P 𝑔

* 𝑇 βˆ’ πœ‡(π‘Ÿ* 𝑇 βˆ’ 𝑔 * 𝑇 )

  • 3U∈67

>=V JWX

= 1 𝑇 P P (πœ‡ + 1)𝑔

* 𝑇 βˆ’ πœ‡π‘Ÿ* 𝑇

  • 3U∈67

>=V JWX

, 𝑙 β‰₯ 3

11/28 balance parameter

slide-12
SLIDE 12

Algorithm

  • Input: Graph 𝘏 = (π‘Š, 𝐹 )
  • Output: Node set of dense multipartite flow: 𝑇
  • Key idea: priority tree and greedy deletion

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Step 1. initialize Step 2. greedy deletion Step 3. get the result 12/28

slide-13
SLIDE 13

Algorithm (cont.)

  • Step 1. initialize

Β§ 1. generate the 𝑙-partite graph, 𝐡 ← π‘Œ, 𝑁X ← 𝑋, … , 𝑁>=V ← 𝑋, 𝐷 ← 𝑍 Β§ 2. initialize subset 𝑇 ← 𝐡 ⋃𝑁X⋃ … ⋃ M>=V ⋃ 𝐷 Β§ 3. calculate the priority of node Β§ 4. build priority tree for S with π‘₯* S

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

π‘₯* S = d𝑔

* 𝑇 βˆ’

πœ‡ πœ‡ + 1 π‘Ÿ* 𝑇 , if 𝑀* ∈ 𝑁J , π‘š ∈ {1, 2, … , 𝑙 βˆ’ 2} π‘Ÿ* 𝑇 = 𝑒* 𝑇 , if 𝑀* ∈ 𝐡 ⋃ 𝐷 Priority tree 13/28 𝐡 𝑁 𝐷

slide-14
SLIDE 14

Algorithm (cont.)

  • Step 2. greedy deletion

Β§ 1. get the node 𝑀 with minimum weight Β§ 2. delete the selected node, update the value of 𝑕 𝑇 and update node’s weight that corelated with 𝑀 Β§ 3. repeat 1 and 2 until one of 𝐡, 𝑁X, … , 𝑁>=V, 𝐷 is empty

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Delete minimum weighted node Update priority of node Update 𝑕 𝑇 14/28

𝐡 𝑁 𝐷 𝐡 𝑁 𝐷

slide-15
SLIDE 15

Algorithm (cont.)

  • Step 3. get the result

Β§ 1. find the maximum value of 𝑕 𝑇 Β§ 2. recover correspond node set Ŝ corresponding to maximum 𝑕 𝑇

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Recover Ŝ

𝐡 h : {0,1}, 𝑁 i : {0,1}, 𝐷 h : {0,1}

Result Ŝ:

15/28

slide-16
SLIDE 16

Algorithm (cont.)

  • Theorem [Approximation Guarantee]
  • in 3-step ML (tripartite)

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

g( Ŝ ) β‰₯ Ｍ’ 𝑇’ ( g(𝑇*) - πœ‡πœ )

amount of camouflage transfers node set just before the first optimal node removed FlowScope middle counts in 𝑇ʹ

  • ptimal

Fast: runs in near-linear time Accurate: provides an accuracy guarantee Effective: produces meaningful results in practice

Properties of FlowScope:

16/28

slide-17
SLIDE 17

Real-world performance

Performance on synthetic data With ground-truth labelled

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

17/28

slide-18
SLIDE 18

Effectiveness: one middle layer

FlowScope: Spotting Money Laundering Based on Graphs

Good performance under variety of topologies

Introduction Algorithm Experiments Model Conclusion

18/28

slide-19
SLIDE 19

Effectiveness: one middle layer (cont.)

FlowScope: Spotting Money Laundering Based on Graphs

Summary in table

Introduction Algorithm Experiments Model Conclusion

19/28

slide-20
SLIDE 20

Robustness against longer transfer chains

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

20/28

slide-21
SLIDE 21

Effectiveness: varies topologies and labelled data

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Fast: runs in near-linear time Accurate: provides an accuracy guarantee Effective: produces meaningful results in practice

Properties of FlowScope:

21/28

slide-22
SLIDE 22

Sensitivity and Scalability

FlowScope: Spotting Money Laundering Based on Graphs

FlowScope is robustness to parameter FlowScope runs in near-linear time with the # of edges

Introduction Algorithm Experiments Model Conclusion

22/28

slide-23
SLIDE 23

Sensitivity and Scalability(cont.)

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

Fast: runs in near-linear time Accurate: provides an accuracy guarantee Effective: produces meaningful results in practice

Properties of FlowScope:

23/28

slide-24
SLIDE 24

Conclusion

FlowScope: Spotting Money Laundering Based on Graphs

Introduction Algorithm Experiments Model Conclusion

  • FlowScope detects money laundering fast and

effectively Accurate Reproducible Effective Fast

https://github.com/aplaceof/FlowScope

g( Ŝ ) = Ｍ’ 𝑇’ ( g(𝑇*) - πœ‡πœ )

24/28

slide-25
SLIDE 25

More information about FlowScope

FlowScope: Spotting Money Laundering Based on Graphs

  • AAAI 2020
  • Supplement
  • https://github.com/aplaceof/FlowScope/blob/master/Flo

wScope-supplement.pdf

  • Source code
  • https://github.com/aplaceof/FlowScope

25/28

slide-26
SLIDE 26

Reference

FlowScope: Spotting Money Laundering Based on Graphs

  • [Charikar M, 2000] Charikar, Moses. "Greedy approximation algorithms for finding dense

components in a graph." International Workshop on Approximation Algorithms for Combinatorial Optimization, 2000.

  • [Asahiro et al, SWAT'96] Asahiro, Yuichi, et al. "Greedily finding a dense subgraph." Algorithm

TheorySWAT'96 (1996): 136-148.

  • [B Hooi et al, KDD’16] Bryan Hooi, Hyun Ah Song, Alex Beutel, Neil Shah, Kijung Shin, and

Christos Faloutsos. 2016. Fraudar: bounding graph fraud in the face of camouflage. KDD 2016

  • [M-Zoom] Kijung Shin, Bryan Hooi, and Christos Faloutsos. M-Zoom: Fast Dense- Block

Detection in Tensors with ality Guarantees. ECML-PKDD. 2016, 264–280.

  • [D-Cube] Kijung Shin, Bryan Hooi, Jisu Kim, and Christos Faloutsos. 2017. D-Cube: Dense-

Block Detection in Terabyte-Scale Tensors. WSDM ’17. 2017.

  • [SpokEn] B Aditya Prakash, Mukund Seshadri, Ashwin Sridharan, Sridhar Machiraju, and

Christos Faloutsos. Eigenspokes: Surprising patterns and scalable community chipping in large

  • graphs. PAKDD 2010, 290–295.
  • [Holoscope] Liu, S.; Hooi, B.; and Faloutsos, C. 2017. Holoscope: Topology-and-spike aware

fraud detection. In Proceedings of the 2017 ACM on Conference on Information and Knowledge Management, 1539–1548. ACM.

  • [RRCF] Guha, S.; Mishra, N.; Roy, G.; and Schrijvers, O. 2016. Robust random cut forest based

anomaly detection on streams. In International conference on machine learning, 2712–2721.

26/28

slide-27
SLIDE 27

Future work: using temporal information

  • Given
  • tuples (account, account, amount , time stamp)
  • Find
  • multi-partite flow
  • Such that
  • not only contains high-volume money, but high frequency

in a shot time

  • new metric

FlowScope: Spotting Money Laundering Based on Graphs

27/28

slide-28
SLIDE 28

Thank you

Questions and Answers

FlowScope: Spotting Money Laundering Based on Graphs

28/28