OVERVIEW OF FRAUD DETECTION SYSTEMS AND PERFORMANCE KPI DEVELOPMENT

Abstract

In this article overview was provided on several fraud detection systems, analysis result of common scheme and development of KPIs to detect performance degradation or improvement from business logic point of view. Four different systems were reviewed. Following FMS were developed by Gigamon and Argyle Data cooperation, AWS, Subex, Cvidya Amdocs. Solution developed by Gigamon and Argyle Data consists of Gigamon fabric for information collection/filtering/enrichment and Argyle Data Fraud detection system, which is based on Hadoop technology to store collected data and analysis results by application. AWS Fraud Detection collects NRTRDE flow and process it by using ML technics provided by AWS. Subex fraud management system provides flexible ETL for data collection from different sources with adjustable detection rules and ML for suspicious behavior learning. FraudView by Cvidya Amdocs collects information from varying points like OSS/BSS, CRM customer details, Prepaid platforms, HLR, Switch CDRs, Probe (SS7, VoIP, IP) and process it by different detection engines. Simplified processing FMS processing scheme and KPIs based on different timestamps were made. Following conclusions were made: In reviewed FMS was noticed that instead of using traditional NRTRDE and TAP3 file formats, data can be collected directly from network by using network tap or port mirroring with next data enrichment, cleaning, formatting for fraud detection system to consume. Following real time method can be realized by using probes to perform data preparation or some complex solution described by Gigamon; Detection is performed by rules, provided by vendor or by ML modules, which learns behavior of subscriber in order to create detection rules. Most of systems allow to modify threshold of following rules in order to meet system user demands to check data within specific time (for example fraudster night calls to subscriber) or detect specific number of suspicious sessions, etc; In order speedup fraud detection hotlists, whitelists can be used for enrichment to filter out fraudsters, emergency or business numbers. Geographical location can be used to identify fraudster’s location within network and make correlation with other possible fraud sessions; During analysis of each FMS architecture, 3 processing stages were highlighted, which allowed to create simple KPIs for business logic and data arrival check; Developed methodology allows to check data arrival and fraud recognition with used data type to define which information provides better detection or view on rules for detection in order to show, which of them should be adjusted.