Security Evaluation of a Banking Fraud Analysis System

Abstract

The significant growth of banking frauds, fueled by the underground economy of malware, raised the need for effective detection systems. Therefore, in last the years, banks have upgraded their security to protect transactions from frauds. State-of-the-art solutions detect frauds as deviations from customers' spending habits. To the best of our knowledge, almost all existing approaches do not provide an in-depth model's granularity and security analysis against elusive attacks. In this paper, we examine Banksealer, a decision support system for banking fraud analysis, evaluating the influence on the detection performance of the granularity at which the spending habits are modeled and its security against evasive attacks. First, we compare user-centric modeling, which builds a model for each user, with system-centric modeling, which builds a model for the entire system, from the point of view of the detection performance. Then, we assess the robustness of Banksealer against malicious attackers that are aware of the structure of the models in use. To this end, we design and implement a proof-of-concept attack tool that performs mimicry attacks, emulating a sophisticated attacker that cloaks frauds to avoid detection. We experimentally confirm the feasibility of such attacks, their cost and the effort required to an attacker in order to perform them. In addition, we discuss possible countermeasures. We provide a comprehensive evaluation on a large, real-world dataset obtained from one of the largest Italian banks.

Amaretto: An Active Learning Framework for Money Laundering Detection

“…BankSealer [15], [16] works in an unsupervised setting, extracting local, global, and temporal profiles [17] for each user to capture their behaviors. The same authors also study the security of fraud detection systems against mimicry and adversarial attacks [18], [19].…”

“…Financial datasets are known to be extremely unbalanced, usually containing from 0.1% to 1% [18] of anomalous transactions. This information was also confirmed by the domain experts we interviewed.…”

The Adjusted Histogram-Based Outlier Score - Ahbos

“…The result of an anomaly detection algorithm can be a label or a score; semi-supervised and unsupervised methods generally output a score that can be transformed into a label using a threshold [7]. Histogram and kernel-based approaches are the most common unsupervised anomaly detection methods, especially in network security and fraud detection domains [9][10][11][12][13]. In addition, the data to be processed in these domains is usually very large.…”

Abnormal Detection of User Behavior in Online Banking

“…As discussed in [1], one of the most difficult issues researcher faces is because of the limited availability of malicious samples (owing to obvious privacy concerns). Therefore, abnormal detection is of the essence to resolve security issues of online banking.…”

“…Therefore, abnormal detection is of the essence to resolve security issues of online banking. However, there are remaining issues of abnormal detection as described in [1], one of which is how to calculate the distance between data samples.…”