Combatting financial fraud: a coevolutionary anomaly detection approach

ABSTRACT

A major difficulty for anomaly detection lies in discovering boundaries between normal and anomalous behavior, due to the deficiency of abnormal samples in the training phase. In this paper, a novel coevolutionary algorithm which attempts to simulate territory establishment in ecology is conceived to tackle anomaly detection problems. Two species in normal and abnormal behavior pattern space coevolve competitively and cooperatively. Competition prevents individuals in one species from invading the other's territory; cooperation aims to achieve complete pattern coverage by adjusting the evolutionary environment according to the pressure coming from neighbors. In a sense, we extend the definition of cooperative coevolution from "coupled fitness" to "interaction of the evolutionary environment". This coevolutionary algorithm, enhanced with features like niching inside of species, global and local fitness, and fuzzy sets, tries to balance overfitting and overgeneralization. This provides an accurate boundary definition. Experimental results on transactional data from a real financial institution show that this coevolutionary algorithm is more effective than the evolutionary algorithm in evolving normal or abnormal behavior patterns only.

REFERENCES

• 1: E. S. Adams. Territory size and shape in fire ants: a model based on neighborhood interactions. Ecology, 79(4):1125--1134, June 1998.
• 2: S. Balachandran, D. Dasgupta, F. Nino, and D. Garrett. A general framework for evolving multi-shaped detectors in negative selection. In IEEE Symposium Series on Computational Intelligence, Honolulu, Hawaii, April 2007.
• 3: Pierre Collet , Evelyne Lutton , Frédéric Raynal , Marc Schoenauer, Polar IFS+Parisian Genetic Programming=Efficient IFS Inverse Problem Solving, Genetic Programming and Evolvable Machines, v.1 n.4, p.339-361, October 2000 [doi>10.1023/A:1010065123132]
• 4: D. Dasgupta and F. Gonzalez. An immunity-based technique to characterize intrusions in computer networks. IEEE Transactions on Evolutionary Computation, 6(3):281--291, June 2002.
• 5: E. Dunn, G. Olague, and E. Lutton. Automated photogrammetric network design using the parisian approach. In Applications on Evolutionary Computing, pages 356--365. Springer Berlin / Heidelberg, 2005.
• 6: Stephanie Forrest , Robert E. Smith , Brenda Javornik , Alan S. Perelson, Using genetic algorithms to explore pattern recognition in the immune system, Evolutionary Computation, v.1 n.3, p.191-211, Fall 1993
• 7: Stephanie Forrest , Robert E. Smith , Brenda Javornik , Alan S. Perelson, Using genetic algorithms to explore pattern recognition in the immune system, Evolutionary Computation, v.1 n.3, p.191-211, Fall 1993
• 8: Stephanie Forrest , Robert E. Smith , Brenda Javornik , Alan S. Perelson, Using genetic algorithms to explore pattern recognition in the immune system, Evolutionary Computation, v.1 n.3, p.191-211, Fall 1993
• 9: F. Gonzalez, J. Gomez, M. Kaniganti, and D. Dasgupta. An evolutionary approach to generate fuzzy anomaly signatures. In Proceedings of the Fourth Annual IEEE Information Assurance Workshop, pages 251--259. West point, NY, 2003.
• 10: Fabio A. González , Dipankar Dasgupta, Anomaly Detection Using Real-Valued Negative Selection, Genetic Programming and Evolvable Machines, v.4 n.4, p.383-403, December 2003 [doi>10.1023/A:1026195112518]
• 11: Xiaoshu Hang , Honghua Dai, Applying both positive and negative selection to supervised learning for anomaly detection, Proceedings of the 2005 conference on Genetic and evolutionary computation, June 25-29, 2005, Washington DC, USA [doi>10.1145/1068009.1068064]
• 12: Steven Andrew Hofmeyr , Stephanie Forrest, An immunological model of distributed detection and its application to computer security, The University of New Mexico, 1999
• 13: Z. Ji. A boundary-aware negative selection algorithm. In Proceedings of the 9th IASTED International Conference on Artificial Intelligence and Soft Computing (ASC 2005), Benidorm, Spain, 2005.
• 14: Z. Ji and D. Dasgupta. Real-valued negative selection using variable-sized detectors. In Genetic and Evolutionary Computation Conference (GECCO '04), Seattle, Washington, 26-30 June 2004.
• 15: Z. Ji and D. Dasgupta. Real-valued negative selection using variable-sized detectors. In Genetic and Evolutionary Computation Conference (GECCO '04), Seattle, Washington, 26-30 June 2004.
• 16: J. Kim and P. J. Bentley. Evaluating negative selection in an artificial immune system for network intrusion detection. In Genetic and Evolutionary Computation Conference (GECCO '01), 2001.
• 17: J. R. Krebs and N. B. Davies. An Introduction to Behavioural Ecology. Sinauer Associates Inc., 1981.
• 18: Marek Ostaszewski , Franciszek Seredynski , Pascal Bouvry, Immune anomaly detection enhanced with evolutionary paradigms, Proceedings of the 8th annual conference on Genetic and evolutionary computation, July 08-12, 2006, Seattle, Washington, USA [doi>10.1145/1143997.1144018]
• 19: M. Ostaszewski, F. Seredynski, and P. Bouvry. Coevolutionary-based mechanisms for network anomaly detection. Journal of Mathematical Modelling and Algorithms, 6:411--431, 2007.
• 20: S. T. Powers and J. He. Evolving discrete-valued anomaly detectors for a network intrusion detection system using negative selection. In The 6th Annual Workshop on Computational Intelligence (UKCI '06), pages 41--48, 2006.
• 21: Joseph M. Shapiro , Gary B. Lamont , Gilbert L. Peterson, An evolutionary algorithm to generate hyper-ellipsoid detectors for negative selection, Proceedings of the 2005 conference on Genetic and evolutionary computation, June 25-29, 2005, Washington DC, USA [doi>10.1145/1068009.1068063]
• 22: M. Toneguzzi. Theft, fraud cost retailers $8 million a day. Ottawa Citizen, March 2 2007. Newspaper.

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.2 ARTIFICIAL INTELLIGENCE
      I.2.8 Problem Solving, Control Methods, and Search
          Subjects: Heuristic methods

General Terms:
Algorithms, Experimentation

Keywords:
anomaly detection, coevolutionary algorithms, ecology, financial fraud, fuzzy logic, parisian approach, self-nonself space pattern construction