Towards Explainable Occupational Fraud Detection

Feature relevance XAI in anomaly detection: Reviewing approaches and challenges

“…We utilize their run normal 2 that contains 32, 337 data points of purely normal operation for training the anomaly detector and evaluating explanations on the 86 different fraud cases contained in their run fraud 3 . We choose these runs following the experimental setup of Tritscher et al ( 2022b ), again using fraud 3 as the dataset with highest performance of the used anomaly detection model and the corresponding normal behavior of normal 2 .…”

“…For the ERP dataset, Tritscher et al ( 2022b ) conduct a hyperparameter study of multiple anomaly detectors on the data, finding architectures that yield good results on the dataset. For our showcases, we select their second best performing model, the autoencoder neural network (Goodfellow et al, 2016 ) architecture, with their found hyperparameters as they show that their best performing one-class support vector machine (Schölkopf et al, 2001 ) exibits an erratic decision process that may influence a quantitative XAI evaluation and autoencoder networks are commonly studied in the domain of explainable anomaly detection (Antwarg et al, 2021 ; Ravi et al, 2021 ; Müller et al, 2022 ).…”

“…For datasets with high dimensionality d and a known hierarchy between dimensions (e.g., local dependencies in images), "partition-SHAP" extends this approach to groups of features through the gametheoretic extensions to Owen values (Owen, 1977) and achieves faster run times as a result. Shapley value explanations are some of the most used approaches in anomaly detection, with multiple applications on reconstructionbased anomaly detectors such as autoencoder neural networks (Antwarg et al, 2021;Ravi et al, 2021;Müller et al, 2022;Tritscher et al, 2022b). While Ravi et al (2021) and Tritscher et al (2022b) apply Shapley value estimation directly on the final anomaly score of the reconstruction-based anomaly detection model, Antwarg et al (2021) first identify the features with highest reconstruction errors and apply kernel-SHAP directly on the most deviating features.…”

“…Shapley value explanations are some of the most used approaches in anomaly detection, with multiple applications on reconstruction-based anomaly detectors such as autoencoder neural networks (Antwarg et al, 2021 ; Ravi et al, 2021 ; Müller et al, 2022 ; Tritscher et al, 2022b ). While Ravi et al ( 2021 ) and Tritscher et al ( 2022b ) apply Shapley value estimation directly on the final anomaly score of the reconstruction-based anomaly detection model, Antwarg et al ( 2021 ) first identify the features with highest reconstruction errors and apply kernel-SHAP directly on the most deviating features. Müller et al ( 2022 ) further extend this approach to categorical one-hot encoded data by averaging over groups of one-hot encoded features.…”

“…In areas where explainability is considered as a requirement of anomaly detectors, this may limit the performance of available detectors in cases where a model-specific explanation framework is not available for the best performing anomaly detection architecture. Especially on ERP data, hyperparameter studies of Tritscher et al ( 2022b ) show isolation forests and PCA-based anomaly detection to perform considerable worse than other architectures, which limits the application of model-specific XAI approaches such as DIFFI or the Takeishi ( 2019 ) method for explaining anomaly detection of PCA. Beyond potential limitations of anomaly detection performance, the promising procedure of Kauffmann et al ( 2020a ), who map anomaly detectors to different architectures, also comes with the limitations of the XAI approach that is applied after the mapping, requiring not only the mapping itself but also an XAI approach that is capable of producing reliable explanations on the resulting mapped architecture.…”