基於帳戶身份關聯之不確定圖演算法於詐騙偵測

AI-URG: Account Identity Based Uncertain Graph Algorithm for Fraud Detection

施星宇(Hsing-Yu Shih)

指導教授 ： 林宗男

國立臺灣大學/電機資訊學院/電信工程學研究所/碩士(2022年)

https://doi.org/10.6342/NTU202203410

摘要

近年來線上金融服務的影響力變得越來越大，然而，惡意犯罪集團可能會控制線上金融服務的帳號以進行詐騙行為，由於這些惡意帳戶經常由相同的犯罪集團帳控，這類帳戶之間可以被觀察到不同於一般帳戶的關聯性，使得這些帳戶能被聚集形成一個帳戶群，藉由發掘這些可疑的帳戶群將可以達到偵測惡意帳戶的目的。

為了要發掘帳戶之間的關聯性以將帳戶群聚，過去的研究著重於使用單一身份特徵來確認帳戶背後是否由同一人或是同一集團所控制，然而單一身份特徵容易因為特徵可能因為巧合發生共用而造成關聯上雜訊，相對的，若使用多個身份特徵來建立帳戶關聯，因有更多證據可推論關聯性的存在，能有更少的關聯上的雜訊。

在這篇論文中，我們提出AI-URG演算法來偵測線上銀行服務中可疑的異常帳戶群，AI-URG基於不確定圖技術建立帳戶身份關聯，考慮到單一身份特徵對於帳戶存在關聯性提供的證據不足，以及考慮到身份特徵得對應與真實世界的身份實體仍存在不確定性，我們提出multi-factor identity modeling能將帳戶間因由同一群人所操控而存在關聯之機率以不確定圖表示。

為了要從帳戶關聯的不確定圖中偵測出可疑帳戶群，我們提出了DeepURGE，DeepURGE基於建立關聯圖中帳戶的特徵向量，來找出高相關性的帳戶群，此外，聚類後的高關聯性帳戶群並非皆為可疑帳戶群，我們基於惡意帳戶偵測的基礎知識設計了篩選策略，以從決定帳戶群是否為可疑帳戶群。

我們以真實世界線上銀行服務的資料集驗證AI-URG的有效性，結果顯示AI-URG可以有效的偵測資料集中78.2%已標示的惡意帳戶，且與其他方法比較，AI-URG能得到更高的F1 score(58.0%)以及更高的精確度(46.0%)。

關鍵字

詐騙偵測 ； 不確定圖 ； 帳戶關聯性網路 ； 身份追蹤 ； 節點嵌入

並列摘要

Online banking has been increasingly important nowadays. Unfortunately, some malicious groups may control accounts to conduct fraud activities. Because the same criminal group holds malicious accounts, suspicious accounts form the communities and can be observed. Previous works focus on related accounts with single-factor identity to find those suspicious communities, while multi-factor identity is less susceptible to noise. In this work, we proposed AI-URG for detecting suspicious account groups with account identity uncertain graph. Because of the insufficient single-factor identity and uncertainty binding between accounts and identity, we model identity level relations with multi-factor identity modeling an uncertain graph. To detect suspicious account groups in the uncertain graph, we propose DeepURGE produce account representation and find the account communities. Since some communities are benign, we determine whether it is suspicious with a strategy based on domain knowledge. We evaluate AI-URG with a real-world dataset. The result shows that it can detect labeled suspicious accounts and outperform alternatives with higher F1 score(58.0%) and precision(46.0%).

並列關鍵字

fraud detection ； uncertain graph ； account identity relation ； identity tracking ； ode embedding

參考文獻

[1] A. Khan, Y. Ye, and L. Chen, “On uncertain graphs,” Synthesis Lectures on Data Management, vol. 10, no. 1, pp. 1–94, 2018.

[2] G. Stringhini, P. Mourlanne, G. Jacob, M. Egele, C. Kruegel, and G. Vigna,“{EVILCOHORT}: Detecting communities of malicious accounts on online services,” in 24th USENIX Security Symposium (USENIX Security 15), pp. 563–578,2015.

[3] M. Ceccarello, C. Fantozzi, A. Pietracaprina, G. Pucci, and F. Vandin, “Clustering uncertain graphs,” Proc. VLDB Endow., 2017.

[4] A. Almaatouq, E. Shmueli, M. Nouh, A. Alabdulkareem, V. K. Singh, M. Alsaleh, A. Alarifi, A. Alfaris, and A. Pentland, “If it looks like a spammer and behaves like a spammer, it must be a spammer: analysis and detection of microblogging spam accounts,” International Journal of Information Security, vol. 15, no. 5, pp. 475–491, 2016.

[5] C. Xiao, D. M. Freeman, and T. Hwa, “Detecting clusters of fake accounts in online social networks,” in Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security, pp. 91–101, 2015.