Identification of suspicious, unknown event patterns in an event cloud

ABSTRACT

This paper describes an approach to detect unknown event patterns. In this context, an event is not only something that happens, but also something that can be analysed. This task is processed by a Complex Event Processing (CEP) engine. CEP is an emerging technology for detecting known patterns of events and correlating them to complex events in real-time. In order to reach the goal of finding unknown patterns, several known detection algorithms are discussed. In our work, we focus on discriminant analysis used for recognizing unknown patterns for the use case of credit card transactions and the fraud problem connected with this kind of payment. It is necessary to develop new methods of fraud detection and prevention because of the negative impacts for vendors and customers caused by credit card fraudsters at present. At the same time we would like to make provisions for the more sophisticated fraud methods that will occur in the future.

REFERENCES

• 1: Alon, N., Joel, H., and Spencer, J. The Probabilistic Method. Wiley InterScience, New York, 2000.
• 2: AptSoft Corporation. CEP Solution. http://www.aptsoft.com, accessed 2006-12-22.
• 3: Bass, T. Fraud Detection and Event Processing for Predictive Business. http://www.tibco.com/resources/mk/fraud_detection_in_cep_wp.pdf, accessed 2007-01-31.
• 4: Tim Bass, Intrusion detection systems and multisensor data fusion, Communications of the ACM, v.43 n.4, p.99-105, April 2000 [doi>10.1145/332051.332079]
• 5: Brugger, T. Data Mining Methods for Network Intrusion Detection. University of California at Davis, 2004.
• 6: CEP Interest Group. http://tech.groups.yahoo.com/group/CEP-Interest, Blog entry Thu Oct 5 2006 4:01 pm form leondong1982, accessed 2006-12-09.
• 7: Complexevents.com. http://complexevents.com/?cat=15, accessed 2006-12-06.
• 8: CyberSource. Third Annual UK Online Fraud Report. http://www.cybersource.co.uk/resources/fraud_report_2007, accessed 2007-02-07.
• 9: Demers, A., Gehrke, J., Panda, B., Riedewald, M., Sharma, V., and White, W. Cayuga: A General Purpose Event Monitoring System. In Proceedings of the third Biennial Conference on Innovative Data Systems Research, Asilomar, 2007.
• 10: Earman, J. A Primer on Determinism. Springer-Verlag, Dordrecht, 1986.
• 11: Fernandes, L. Mainstream BI: A dashboard on every desktop?. http://www.it-director.com/enterprise/content.php?cid=9035, accessed 2006-12-06.
• 12: First Event Processing Symposium. http://complexevents.com/?p=150, accessed 2006-12-29.
• 13: Gottwald, S. A Treatise on Many-Valued Logics. Research Studies Press LTD, Baldock, Hertfordshire, 2001.
• 14: Gyllstrom, D., Diao, Y., Stahlberg, P., Chae, H., Anderson, G., and Wu, E. SASE: Complex Event Processing over Streams. In Proceedings of the third Biennial Conference on Innovative Data Systems Research, Asilomar, 2007.
• 15: Hayes-Roth, F. Model-based communication networks and VIRT: Orders of magnitude better for information superiority. In Proceedings of the Military Communications Conference, Washington, 2006.
• 16: Howard, P. The market for event processing is growing and at some point, it will explode. http://www.bloor-research.com/research/research_report/802/event_processing.html, accessed 2006-12-22.
• 17: IBM Autonomic Computing, Best practices for problem determination mean faster problem resolution. http://www.03.ibm.com/autonomic/pd/pdf/AC_PD_whitepaper_V4.pdf, accessed 2007-02-10.
• 18: Finn V. Jensen, Bayesian Networks and Decision Graphs, Springer-Verlag New York, Inc., Secaucus, NJ, 2001
• 19: Lee, W., Stolfo, S., Chan, P., Eskin, E., Fan, W., Miller, M., Hershkop, S., and Zhang, J. Real Time Data Mining-based Intrusion Detection. In Proceedings of the second DARPA Information Survivability Conference and Exposition, Anaheim, 2000, pp. 85--100.
• 20: Luckham, D. The power of events. Addison Wesley, San Francisco, New York, 2002.
• 21: Mardia, K. V., Kent, J. T., and Bibby, J. M. Multivariate Analysis. Academic Press, San Diego, San Francisco, New York, Boston, London, Sidney, Tokyo, 1979.
• 22: McCallum, A., and Kamal, N. A Comparison of Event Models for Naive Bayes Text Classification. AAAI--98 Workshop on "Learning for Text Categorization". http://www.kamalnigam.com/papers/multinomial-aaaiws98.pdf, accessed 2007-02-15.
• 23: Rabiner, L. A Tutorial on Hidden Markov Models and Selected Applications in Speech Recognition. In Proceedings of the IEEE 77(2), 1989, pp. 257--286.
• 24: Raden, N. Ambient Business Intelligence: Pervasive technology to surround and inform. http://www.hiredbrains.com/Ambient%20Business%20%Int elligence.pdf, accessed 2006-12-06.
• 25: Romesburg, C. Cluster Analysis for Researchers. Lulu Press, Morrisville, 2004.
• 26: Schloss Dagstuhl. Event Processing Seminar. http://www.dagstuhl.de/en/program/calendar/semhp/?semid=32202, accessed 2006-12-28.
• 27: Schoder, D. Ambient Business, http://www.wim.unikoeln.de/Ambient-Business.430.0.html, accessed 2006-12-21.
• 28: Shafer, G. A Mathematical Theory of Evidence. Princeton University Press, Princeton, 1976.
• 29: Joerg Wallrafen , Peter Protzel , Heribert Popp, Genetically Optimized Neural Network Classifiers for Bankruptcy Prediction- An Empirical Study, Proceedings of the 29th Hawaii International Conference on System Sciences (HICSS) Volume 2: Decision Support and Knowledge-Based Systems, p.419, January 03-06, 1996

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.5 PATTERN RECOGNITION
      I.5.2 Design Methodology
          Subjects: Pattern analysis

Additional Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.2 Types of Systems
          Subjects: Decision support (e.g., MIS)

General Terms:
Algorithms, Design, Experimentation, Languages, Security

Keywords:
business activity monitoring, complex event processing, discriminant analysis, event driven architecture, fraud detection, service oriented computing