12/8/2022

Introduction to
To d a y ’s 01 Financial Fraud
FITE7410 Agenda Analytics

Introduction to 01 Introduction
Financial Fraud 02 Credit Card Fraud to Financial
Scheme Fraud Data
Analytics - Intro to Exploratory
Lecturers: Dr. Vivien Chan, Annie Chan
Data Analysis (EDA) Analytics
Tutor: Yanan Gong
Dr. Vivien CHAN
Date: 7 & 8 Sep 2022

Department of Computer Science

The University of Hong Kong 03 Tutorial of R
1-hour tutorial of R

http://www.free-powerpoint-templates-design.com

Definition of “Fraud” Related ordinances of financial crimes in HK

• The main offences are included in the Crimes Ordinance
(Cap. 200) (CO) and the Theft Ordinance (Cap. 210) (TO).
English Dictionary definition
• Additional offences can be found in various ordinances,
• “the crime of getting money by deceiving people” including the:
•(Ref: “Cambridge Dictionary: fraud”. https://dictionary.cambridge.org/) • Securities and Futures Ordinance (Cap. 571) (SFO).
• Companies Ordinance (Cap. 622) (COMPO).
Legal Dictionary definition • Telecommunications Ordinance (Cap. 106) (TELEO).
• “the intentional use of deceit, a trick or some • Inland Revenue Ordinance (Cap. 112) (IRO).
dishonest means to deprive another of his/her/its
money, property or a legal right. ” This is not a legal course,
• (Ref: "Legal Dictionary: fraud". Law.com)
details would not be discussed.

HK legal definition HK legal definition Types of Financial Frauds

• CAP 210 THEFT ORDINANCE Section 16A Fraud • Under HK’s law, The Theft Ordinance contains a range of • There is no single definition of financial fraud type.
(Ref: HKLII, https://www.hklii.hk/cgi-bin/sinodisp/eng/hk/legis/ord/210/s16A.html) specific offences relating to fraud, including: • One of the categorization by FBI is as follows ( selected from the list
(1)If any person by any deceit (whether or not the deceit is the sole or main provided in the Federal Bureau of Investigation, Financial Crimes Report (2010–2011), United
inducement) and with intent to defraud induces another person to commit an act States ):
or make an omission, which results either • section 17: Obtaining property by deception
(a)in benefit to any person other than the second-mentioned person; or • section 18: Obtaining pecuniary advantage by deception
(b)in prejudice or a substantial risk of prejudice to any person other than the first- • section 18A: Obtaining services by deception Bank Corporate Insurance
mentioned person, Fraud Fraud Fraud
• section 18B: Evading liability by deception
the first-mentioned person commits the offence of fraud and is liable on conviction Credit Health
upon indictment to imprisonment for 14 years. • section 18C: Making off without payment Mortgage Money Financial Securities and Automobile
Card Statement Insurance Care
• section 18D: Procuring false entries in records of banks and Fraud Laundering Commodities
Fraud Fraud Fraud Fraud
deposit-taking companies Fraud
(2)For the purposes of subsection (1), a person shall be treated as having an
intent to defraud if, at the time when he practises the deceit, he intends that he will • section 19: False accounting
by the deceit (whether or not the deceit is the sole or main inducement) induce
another person to commit an act or make an omission, which will result in either or • section 22: Suppression of documents. Fraud Analytics of these financial frauds to
both of the consequences referred to in paragraphs (a) and (b) of that subsection. be discussed in upcoming lectures
 12/8/2022

Fraud Triangle What is Financial Fraud Data Analytics?

• First leg and concerns the main
The Fraud Triangle motivation for committing fraud
• In this course, Financial Fraud Analytics is:
Pressure • The process of using machine learning/data mining techniques to
Theory is developed • A pressure or a problem is experienced
by criminologist, of financial, social, or any other nature analyse financial fraud data for red flags that correlate to financial
• It cannot be resolved or relieved in an frauds
Donald Cressey authorized manner • The end product of fraud analytics is a sample of transactions that
have a higher probability of containing one fraudulent transaction
• Second leg and versus a random sample of transactions used to test control
concerns the effectiveness
precondition for • To answer the question:
committing fraud Opportunity Rationalization • Is there credible evidence that a fraud scenario is occurring? Should we
perform an investigation?
• Opportunity exists to
resolve or relieve the • Psychological mechanism that explains why
experienced pressure fraudsters do not refrain from committing • In this course, Financial Fraud Analytics is NOT:
in an unauthorized but fraud and think of their conduct as acceptable
• about forensic fraud investigation
concealed or hidden
manner

Good Practice of Financial Fraud Analytics What is a Red Flag?

• Plan before you act – a good fraud analytics plan is • A red flag is an observable condition that relates to the act
required before jumping into data analysis of a specific fraud scenario
• Well-defined scope for fraud analytics • Fraudsters may be detected by deviant behaviours from
non-fraudsters. These deviations from normality are red
• Good understanding of fraud data, e.g. flags of fraud, i.e. anomality or variation from predictable
• correct identification of red flags vs error in data patterns of normal behaviours
• ability to identify false positives and false negatives, and how to
handle these observations • A red flag exists in:
• Data
• Jumping to conclusions without correct and logical linkage
• Documents
to evidence found
• Internal controls
• Behaviours
• Public records
• Digital footprints
• … etc.

What is a Red Flag? Examples of Red Flags False Positive vs False Negative
False Positive False Negative
• Examples of anomality: Definition Red flags identified in the fraud data profile Red flags NOT identified in the fraud data
• Outliers but the transaction is NOT a fraudulent profile but the transaction is a fraudulent
• Inliers where they are not expected transaction. transaction.

• Too many or too few transactions

Effects Too many false alarms might render the Missing out too many actual fraudulent
• Unexplained items fraud analytics results not useful. transactions means the fraud data analytics
• Unusual relationships between items is useless.
• Unexpected timing of transactions or events Reasons Threshold of red flags too sensitive • Not understanding well about the fraud
• Inconsistencies scenarios
• Data integrity issues, lack of data, etc.
• Gaps or duplicates of item numbers
• Unexpected payment methods Strategies 1. To reduce the number of false positives 1. To review the fraud data analytics plan
• Unreasonable items to resolve through fraud data analytics plan; so as to have a better understanding of
2. To allow user to resolve the false the fraud scenarios;
positives through manual procedures. 2. To review the issues related to data,
from data collection, pre-processing, to
data analysis.
 12/8/2022

Overview: Fraud Data Analytics Methodology

An Overview of Staring point. Define scope of Fraud

BUT the process is cyclical,
Fraud Data NOT linear.
Data Analytics

Analytics Selection of Fraud Fraud Scenario

Methodology Data Analytics Model Identification

Dr. Vivien CHAN

Data Analytics
Strategies for Fraud
Detection

1: Define the scope of fraud analysis Overview: Fraud Data Analytics Methodology 2: Fraud Scenario Identification
A few examples: • Inherent Fraud Schemes
• If the fraud data analytics is used in a whistle blower • The theory states that the number of inherent scheme and scenarios
are finite and predictable
allegation, Staring point. Define scope of Fraud
BUT the process is cyclical, Data Analytics • Comprises a committing person, an entity structure and a fraudulent
• then the fraud data analytics plan is designed to refute or
action
corroborate the allegation. NOT linear.
• Each inherent fraud scheme has a finite and predictable list of fraud
• If the fraud data analytics plan is used in a control audit, permutations
• then the fraud data analytics would search for internal control Selection of Fraud Fraud Scenario • Each fraud scheme permutation creates a finite and predictable list of
compliance or internal control avoidance. Data Analytics Model Identification fraud scenarios
• If the fraud data analytics is used for fraud testing, • How the inherent scheme occurs will be influenced by the business
• then the fraud data analytics is used to search for a specific fraud processes and internal controls
Data Analytics
scenario that is hidden in your database. Strategies for Fraud • Fraud is predictable, with regard to the schemes that occur
Detection • Number of schemes is finite, that can occur in a given
business system

2: Fraud Scenario Identification 2: Fraud Scenario Identification Overview: Fraud Data Analytics Methodology
• The person committing the fraud • Fraud scenario - Create the permutation of fraud scenarios
• The person can be from internal or
Committing Committing person Fraudulent action Entity
external
person
• The person who have direct or Staring point. Define scope of Fraud
indirect access to the database BUT the process is cyclical, Data Analytics
Overbilling
Fake Vendor NOT linear.
• Attachment of transaction in the
business system
• E.g. in payroll system, ‘employee’ is the
Selection of Fraud Fraud Scenario
entity
Data Analytics Model Identification
Fraud • In credit card system, ‘card number’ is Real Complicit Vendor
scenario the entity Company Multiple procurements
• Fraudulent action links Procurement
committing person Cardholder
Data Analytics
and entity Fraudulent Strategies for Fraud
Entity
• E.g. payment of action Real Non-Complicit Detection
vendor without Conflict-of-interests Vendor
purchase order
 12/8/2022

3: Data Analytics Strategies for Fraud Detection The world’s best auditor What are “Fraud Data”?
• There are 2 steps using the world’s best • Which of the following are “Fraud Data”?
• Bank Statements?
audit program cannot • Network logs?
• Step 1: Handling the raw data
• Obtaining the raw data
NOTE: detect fraud unless their • Customer data?
Techniques for handling • Firewall logs?
• Cleaning the data raw data will be discussed sample includes a • Email?
• Data pre-processing later
• … fraudulent transaction. • Whatsapp/Wechat/LINE or any other IM messages?
• FB/IG/MeWe or any other social media pages?
• Public information, e.g. news?
• Step 2: Strategies for data analytics • Documentation, e.g. user guides?
• Server room check-in and check-out logbook?
• CCTV?
• …
30

Example of raw data – user login access log Example of raw data – CRM records Example of raw data - email

Sample raw data

files extracted
from Enron case
31 32 33

“Data” used in Fraud Detection “Data” used in Fraud Detection

• What are the problems with real-life data? • What are the types of data sources?
• Inconsistencies • Structured
• Incompleteness • Transactional data
• Duplication • Contractual, subscription, or account data
• Surveys
• Merging
• Behavioural information
• Data size too big to handle
• … and many more • Unstructured
• Text documents, e.g. emails, web pages, claim forms or multimedia
contents
• Thus, it is critical to pre-process the raw data before
• Contextual or network information
proceeding to conduct the analysis steps • Qualitative expert-based data
• Publicly available data

• Semi-structured
35 36
 12/8/2022

Some Basic Concepts - Data Table Basic Concepts – Data types Basic Concepts – Data types
Columns = variables, fields, characteristics,
attributes, features, etc.
Continuous data Categorical data
Rows = Example: Nominal Ordinal Binary
instances, Defined on • amount of • limited set of values • take on a limited set • can only take on two
With or with no meaningful of values with a values
observations, an interval, transactions
without a • balance on
ordering in between meaningful ordering • e.g. yes/no
lines, records, Sample data records with limited • e.g. marital status; in between
extracted from natural zero savings payment type; • e.g. age coded as
tuples, etc. Enron case or unlimited
value account country of origin young, middle-age,
value • similarity index and old

37 38 39

Data Analytics Strategies Overview: Fraud Data Analytics Methodology 4: Selection of Fraud Data Analytics Model
• 1/ Specific identification strategy
Predictive analytics
• Usually this is based on the fraud scenarios to identify specific issues Descriptive analytics
• Linear/Logistic
• 2/ Internal control avoidance
Supervised
Learning
Unsupervised
Learning • Clustering (k-means)
Staring point. Regression
Define scope of Fraud • Autoencoder
• To check the data against any company internal control policies BUT the process is cyclical, Data Analytics • Decision Tree
• … many more
• 3/ Data interpretation NOT linear. • Ensemble Method
Semi- Social
• Random Forest supervised Network
Network analytics
• To identify patterns of behaviours from the data Learning Analysis
• Neural Network • Social Network
• 4/ Number anomaly Selection of Fraud Fraud Scenario
• Support Vector
Data Analytics Model Identification Analysis
• There are several statistical techniques, e.g. Benford’s law (to be discussed in Machines
later lecture). • … many more Statistical analytics
• Benford’s law : search for anomaly in the first, second, etc. integers of an • Outlier detection techniques
amount. The anomaly is based on Benford’s distribution table. Data Analytics
Strategies for Fraud • Break-Point Analysis
Detection • Peer-group Analysis
• Benford’s Law

ML algorithms classification Fraud Detection Classification Models ML algorithms classification

• Input data : labelled
• Learning process : learning based on labelled input data, compares the predicted • Fraud detection models can be broadly divided into:

Unsupervised Learning Supervised Learning

results with the actual results, and adjusts the predictive model until the predicted
Supervised Learning results of the model reach an expected accuracy. • Classification – when the output variable is a category, e.g. “fraud”
• Applicable to : classification and regression problems. or “non-fraud”
• Common algorithms : decision trees, linear regression, logistic regression, support
vector machines, neural networks, and so on. • Regression – when the output variable is a real value, e.g.
• Input data : not labelled probability score of fraud case
Un-supervised • Learning process: to infer the intrinsic links of data, such as clustering and
Learning association rule learning. • In essence, we have input X, model D, output Y
• Common algorithms : cluster analysis, auto-encoder.
• Input data : partly labelled
Semi-supervised • Learning process: an extension of supervised learning, or combination with un-
Learning supervised learning X1 •Class labels
• Applicable to : classification and regression (Y =1 or Y
• Input data : as feedback to the model X2 Supervised Unsupervised =0)
•or Fraud
• Learning process: emphasizing how to act based on the environment to maximize scores (Y)
Reinforcement the expected benefits. The difference between supervised learning is that it does not X3
require the correct input/output pairs and does not require precise correction of sub-
Learning optimal behaviour.
• Applicable to: online planning and application that requires a balance between
exploration (in the unknown) and compliance (existing knowledge). Input X Model D Output Y Image courtesy of blogs.sas.com
 12/8/2022

Fraud Detection Techniques Credit Card Frauds – some example scenarios

• These techniques are not mutually exclusive but • Credit Card fraud, 2 subtypes
complement each other (Bolton and Hand, 2002)
• Application fraud
• involving individuals obtaining new credit
• An effective fraud detection and prevention system may 02 Credit Card cards from issuing companies by using
false personal information
combine the use of these different techniques
Fraud Scheme • spending as much as possible in a short
space of time
• Behavioral fraud
• where details of legitimate cards are
obtained fraudulently and sales are made
Dr. Vivien CHAN on a “Cardholder Not Present” basis
• does not required stealing physical card
• behavioral fraud concerns most credit
card fraud

Overview: Fraud Data Analytics Methodology Case Background

• Background:
• Credit card division of a large international bank in Brazil
Staring point. Define scope of Fraud
• Credit card holders who don’t want to pay the annual fees may call
BUT the process is cyclical, Data Analytics the bank asking for cancelation or a fee reduction
NOT linear. • Bank representatives negotiate with the clients about the fees.
During the discount negotiation process, bank representatives
should follow the bank policy; they cannot offer discounts higher
Selection of Fraud Fraud Scenario than their authority. And within their jurisdiction, they should also
Data Analytics Model Identification give top priority to the benefit of the bank. In other words,
they should offer the lowest discounts acceptable to the clients.

Data Analytics
Strategies for Fraud
Detection

1: Define scope of Fraud Data Analytics 2: Fraud Scenario Identification 2: Fraud Scenario Identification
• What is the type of credit card fraud scenario? • Example#1: Credit card renewal discount offer • Create the permutation of fraud scenarios
• Example: Credit card renewal discount offer • Who is the committing person?
• Credit card representatives High discount outside
company guideline
• What are the objectives of the fraud data analytics? • What are the possible entities involved?
• To identify any non-compliance behaviours of credit card • Cardholder (can be real of fake) Real cardholder
representatives that would case revenue loss of the credit card
company
• What are the possible fraudulent actions? High discount without
• Offering higher discounts than allowed negotiation
Credit card
• Offering high discounts without making an effort to negotiate with representatives
cardholder
• Offering discounts without negotiation with cardholder High discount without
• Conflict-of-interests making effort for
negotiation Fake cardholder
•…
Source: Liu, Qi. (2019). An Application of Exploratory Data Analysis in Auditing – Credit Card Retention Case. 10.1108/978-1-78743-085-320191001.
 12/8/2022

3: Data Analytics Strategies for Fraud Detection 3: Data Analytics Strategies for Fraud Detection 3: Data Analytics Strategies for Fraud Detection
• The account master data is a large dataset with 60,309,524 • Data pre-processing 4 data analytics strategies
records and 504 fields. • E.g. Data transformation • 1/ Specific identification strategy
• achieved by the logarithm function.
• Description of 8 selected attributes in this credit card case • E.g. credit card holder with credit card numbers inconsistent with
• E.g. Feature re-engineering: Creation of new attributes – the company’s offer
‘Discount’
• 2 attributes related to ‘Discount’ • 2/ Internal control avoidance:
• Original fee = original annual fee • E.g. offer of discount that is not complied with company policy
• Actual fee = actual annual fee paid • 3/ Data interpretation
• E.g. any questionable discount offer
Q: What does the following values mean?
• 4/ Number anomaly
Case 1: Discount = 0% • E.g. pattern and frequency of discount offer by credit card
Case 2: Discount = 100% representatives
Case 3: Discount = -ve value
Source: Liu, Qi. (2019). An Application of Exploratory Data Analysis in Auditing – Credit Card Retention Case. Source: Liu, Qi. (2019). An Application of Exploratory Data Analysis in Auditing – Credit Card Retention Case. 10.1108/978-1-78743-085-320191001.

4: Selection of Fraud Data Analytics Model Exploratory Data Analysis (EDA)

• NO single rule for model selection • Exploratory Data Analysis (EDA, Tukey, 1977) is the
Introduction to process of using quick and simple methods for the
visualization and examination of small data sets, e.g.
• 1st technique : Exploratory Data Analysis (EDA) Exploratory boxplots, histograms, etc.

Data Analysis • However, with the growing size (5Vs) of data sets
(EDA) nowadays, it is not feasible to use only traditional EDA to
analysis data sets
Dr. Vivien CHAN

59 60

Exploratory Data Analysis (EDA) Step-by-step EDA EDA – Step 1: Distinguish Attributes
• Purpose of EDA: Objective
• to have a better understanding of the data before building the • To identify the attributes in a dataset in order to formulate a clearer goal of the
fraud detection model data analytics process
• to detect problems in data • To understanding the meaning of each attribute before analyzing the data

Explore what?
• When performing EDA, fraud analyst need to keep the
following in mind: • Attribute names, datatypes, number of attributes, etc.
• What is the purpose of this fraud analysis? • Continuous vs Categorical data types
• What are the insights or in-depth knowledge about the fraud that
can be derived?
Techniques
• Are the objectives of EDA aligned with the problem on hand?
• Descriptive summary of the dataset

61 Ref: Ghosh et al. (2018). A comprehensive review of tools for exploratory analysis of tabular industrial datasets
 12/8/2022

Statistics Summarizing EDA – statistics examples EDA – Step 2: Univariate Analysis

• Make use of descriptive statistics, including, mean, median, • Basic statistics measurement Objective
standard deviations, percentile distribution, etc. • Gain a better or deeper understanding of each attribute
• Mean value and median value are basic descriptive statistics for • Identify combinations of attributes for subsequent analysis
continuous variables; while mode (i.e. most frequently occurring • Identify “noise” in the dataset, e.g. missing values, outliers
value) is used for categorical variables • Discretize continuous variables, i.e. convert continuous variables into
• Standard deviation can provide insight with respect to how much categorical variables
data is spread around the mean.
• Percentile value like 10, 25, 75, 90 percentile provide information Explore what?
about the distribution of the data • Centrality: i.e. mean, median, mode
• In additional to calculating the above statistics for the whole • Dispersion: i.e. range, variance, standard deviation, skewness and kurtosis
sample set, can also calculating for each target set (i.e.
• Descriptive statistics can be used as a preview to check the fraud and non-fraud cases) to observe the differences Techniques
symmetry or asymmetry of the distribution, i.e. skewness of between the target sets (e.g. different average age)
the data. • Visualization tools, e.g. histogram, boxplot, scatter-plot

Visualization EDA – visualization example EDA – visualization example

• Descriptive statistics sometimes may be difficult to interpret,
visual plots of the distributions of the involved variables will • Pie Charts – represents a
give insights about the data and problem variable’s distribution
• Missing data, outliers, and distribution can be more easily • Histogram – visualize the
identified using visualization of the data central tendency and variability
of the data
• Visualization might include plotting of histograms, box plots,
etc. • Scatter plot – visualize the
correlation patterns in data
•…

EDA – Step 3: Bi-/Multi-variate Analysis Correlation Analysis Correlation Analysis - Example

Objective
To detect interactions among attributes • It is a powerful technique that helps you
• Understand relations among the attributes understand the relations between
• Identify incompatibilities among attribute values different variables, i.e. whether the
• Generate optimal feature combinations variables are positively or negatively
correlated
Explore what?
• Pearson correlation is most commonly
• Bivariate analysis : analyses the associations between 2 attributes only
• Multivariate analysis : analyses the associations among more than 2 attributes
used
• the covariance of the two variables divided
by the product of their standard deviations
Techniques
• If the coefficient lies between ±0.5 to ±1.0,
• Visualization tools, e.g. histogram, boxplot, scatter-plot, heatmap it is highly correlated • Looking at the heatmap of correlation, many of the Why?
• Correlation analysis, e.g. Pearson correlation • If the coefficient is below ±0.29, the
• Performs bivariate analysis BEFORE multivariate analysis. With bivariate analysis, will have
variables are NOT significantly correlated with each
a clear idea of the compatibility of an attribute pair. Then, can combine more attributes with
correlation is low other and the Class variable
pairs for further analysis
Source: Wikipedia
 12/8/2022

EDA – Step 4: Detect aberrant & missing values Data Cleaning Aberrant and Missing Data
Objective • Raw data contains noise, inconsistencies and • Reasons of aberrant and
• Aberrant and missing values may result in biased analysis of data. Thus, incompleteness. missing data
need to identify and detect any outliers and missing values in the dataset • “Dirty” data can cause confusion for the data analytics • Human input error
procedure. • Intentionally hiding some
Explore what? information
• Incomplete/Missing data
• Aberrant values : Erroneous values which occur as a result of incorrect user • Not applicable values, e.g. if
• Noisy data (outliers or errors)
inputs or calculation errors there are records without visa
• Missing values : Occur in a dataset during data extraction and/or data • Data inconsistencies (similar to data conflict in data integration) card, visa card transactions will
collection. • Duplicate records (similar to data duplication in data integration) be not applicable
• Thus, data cleaning is an essential process in data pre- • Not matching search or filter
Techniques criteria, e.g. if transaction > 1
processing.
• Performs AFTER multivariate analysis when you have a clearer idea about billion
the attributes
• Detection of abnormalities in univariate, bivariate and multivariate
visualizations

How to handle missing data? Handling Missing Data - deletion Handling Missing Data - deletion
Likewise Deletion Pairwise Deletion
Likewise Pairwise
Supervised Learning
Deletion Deletion
Omits the variables with
Simplest way to handle missing value and all
Un-supervised Learning missing data records are involved in the
Techniques

analysis

A record is completely Keeps all the records in the

Semi-supervised Learning removed if it is missing the
dataset
value of one of its variables

Problem with this is

Reinforcement Learning Still have the problem of
reduced sample size and
possibility of missing some drawing conclusions based
important information on a subset of data only

Handling Missing Data-Imputation EDA – Step 5: Detect outliers Outliers

• Data Imputation : Fill in the missing data MICE – a package in R Objective • Outliers – extreme observations that are dissimilar to the
• 4 techniques rest of the population
• Outliers might result in biased analysis of data
Simple imputation Synthetic distribution Model-based estimation Multiple imputation • Reasons of outliers
Fill in the missing Fill in the missing data Use a predictive or statistic Use the distribution of the
Explore what? • Valid observations: e.g. salary of senior management > US$1M
data by based on a synthetic model to impute the observed data to estimate a set of
mean/median/mode distribution curve missing data, e.g. plausible values for the missing • Invalid observations: e.g. age > 300
regression, random forest, data. Random components are • Outliers in a dataset can be primarily of three types namely: univariate,
knn incorporated into these estimated
values to show their uncertainty.
bivariate, and multivariate outliers
Can keep the Easy to understand and Keeps all the records and Keeps the variability and
sample mean value communicate avoids altering the mean or uncertainty of missing data, Techniques
distribution resulting in more valid statistical
inference • Univariate outliers : can be detected by calculation of the Inter-Quartile
May lead to bias if Assumes outcome Missing value is created by Need to build separate models for Range (IQR)
the sample is not remains unchanged by prediction based on values data imputation, in addition to the • Bivariate and multivariate outliers : need to inspect correlations among
completely random missing data, but in real- from other variables, that analysis model
world this usually is not means no actual novel
different attributes
the case information is included
 12/8/2022

Detection of outliers Outliers or Red Flags Handling outliers

• Calculate minimum, maximum, z-score values for each • In cases of fraud analysis, outliers may sometimes be • Treatment
attribute. Define outliers when absolute value of z-score is actually the fraud cases that concern us • For invalid observations, treat the outlier as missing value and can
larger than 3. use one of the techniques for handling missing value to deal with
• Behaviours of fraudsters usually deviant from normal non- outlier value
• Use visualization, e.g. histogram, box plots fraudsters. • For valid observations, truncation/capping/winsorizing, i.e. set
• These deviations from normal patterns are Red Flags of upper and lower limits on a variable.
fraud, e.g. • Z-socre (stand deviation), e.g. upper/lower limit = M ± 3 x z-score
• Identical financial statements may be Red Flag for tax evasion • IQR (interquartile range), e.g. upper/lower limit = M ± 3 x IQR/(2 x 0.6745)
(Van Gestel and Baesens, 2009)
• Small payment followed by a large payment immediately after may
be Red Flag for credit card fraud
• Caution should be taken when treating outliers, or marked
these observations as outliers for further analysis

EDA – Step 6: Feature Engineering Feature Engineering

Objective Last step of EDA after obtaining detailed insights of the • It is a technique transforming
dataset a given set of input features to
• Creation and transformation of variables Normalization
generate a new set of more Variable
• Dimensionality reduction powerful features which are
Techniques
Variable
Transformation
Discretization
then used for prediction Transformation
Techniques FEATURE ENGINEEERING
• Purposes of feature
• Variable creation : To ease the data analysis process through a/ turning non- Variable Extraction
linear relation into linear relation; b/ help to simplify the understanding of (Principle construction
Dimensionality Component Analysis • Dimensionality reduction
complex attributes in the dataset reduction (PCA))
• Variable transformation : a/ binning or categorization strategies on split up • Prediction performance
continuous variables into categories to gather more insight from them; b/ improvement
normalization - a type of variable transformation that helps to convert skewed Variable Selection
distributions into more symmetric distributions.

Data Transformation Techniques of Data Transformation Normalization - Simple transformation

• Data Transformation is the process of converting the data 1/ Normalization • For continuous variables
from one format to another easy-to-read format so as to use • It is a technique to change the values of • Min-Max Normalization (Range Normalization)
for data analysis. attributes to a common scale, without distorting
Variable Transformation

• Also known as ETL (Extract, Transform, Load) – data is differences in the ranges of attribute.
extracted from multiple sources, transformed to a single • Z-score Standardization
Normalization • It is required only when attributes have different
format, and loaded into a data warehouse for data analysis ranges. For example,
process. Discretization • AGE range from 0 – 100; INCOME range from
• (natural) log or base-10 log
• It serves several purposes: 10,000 – 100,000
• Problem : INCOME might have larger affect on the • Square root
• For easy comparison among different data sets with diverse format
predictive power of the model due to its larger value • Inverse
• For easy combination with other data sets to provide insights
(100 times larger than AGE) • Square
• To perform aggregation of data
• Exponential
• Centring (subtract mean)
 12/8/2022

Techniques of Data Transformation Binning transformation

2/ Discretization • Methods
• It is a technique to replace the values of numeric • Equal interval binning
attribute (continuous variable) by conceptual • Equal frequency binning Dimensionality
Variable Transformation

CUSTOMER INCOME
values (discrete/categorical variable). • For example,
• Method : Binning transformation (or • Create 2 bins of equal range:
A
B
1,000
1,200
Reduction
Normalization
categorization) • BIN 1 (range 1,000 – 1,500) : A, B, C, F
C 1,300
• BIN 2 (range 1,500 – 2,000) : D, E FEATURE ENGINEERING
Discretization D 2,000
• Examples • Create 2 bins of equal frequency:
E 1,800
• replace AGE (numeric value) with AGEGROUP • BIN 1 : A, B, C
(children, youth, adult, elderly) F 1,400
• BIN 2 : D, E, F
• group rare levels into one discrete group “OTHER”,
e.g. use “OTHER” to represent those with values that • The above methods do not take into consideration the
occur less than a specified cutoff value (e.g. less than
5%) target variable (e.g. FRAUD)

Dimensionality Reduction Variable selection Principle Component Analysis (PCA)

• Purposes
• Input variables are selected (or filtered) based on the • PCA is a technique :
• Operational efficiency, with reduced amount of time and memory required
usefulness or relation with Target variables (e.g. fraud • to reduce the dimensionality of data by forming new variables
• Better interpretability with easier visualization using fewer variables
vs non-fraud, risk index, etc) that are linear composites of the original variables
• Eliminate irrelevant features. For example, on average only 10-15
Variable • Methods include: • useful for exploratory data analysis, allowing you to better
variables are useful in fraud detection models.
Variable Creation
Variable

Variable Creation
Selection Selection visualize the variation present in a dataset with many variables
Techniques:
• Correlation with target variable
Dimensionality • Feature Elimination: • Information criteria
Reduction • Drop some features that may be unimportant. Variable • Clustering of variables Variable • Basics of PCA are as follows:
• While the approach is simple, may lose useful information present Extraction TARGET VARIABLE Extraction
• A dataset with many variables
in those dropped features.
• Feature Extraction: • Simplify that dataset by turning the original variables into a
Variable Variable • Transform the original set of features into another set of features. smaller number of "Principal Components"
Selection Extraction • To pack the most important information into as few derived features

INPUT
as possible
• Reduce the number of dimensions by dropping some of the derived
features. But don't lose complete information from the original
features: derived features are a linear combination of the original
features.

Principle Component Analysis (PCA) PCA – explained #1 PCA – explained #2

Step1 : Draw a random line that
• Theoretically, the number of Principle Components is goes through the origin
Step2 :
the same as the number of variables or number of
samples, whichever is smaller. BUT, we usually only PC2(15%)

Variable keep those principle components that have high

Variable Creation

Selection correlations Variable 1

PC1(79%)
Variable 3
Variable
Extraction • Formula : Z = YV ,where Z is matrix of principal components scores (n x m) PC1 (principal component 1) Variable 2
Y is standardized data matrix (n x p) - accounts for 79% of variation
V is matrix of eigenvectors (p x m) - data points spread more along 2-D graph (right-side of the figure) using just
p is the number of variables PC1 & PC2
• PC1, the first principal component, is the straight line that shows the most substantial variance in variable 1 PC1 and PC2:
n is the number of observations account for
the data. - variable 1 is more important • would be a good approximation of 3-D graph
m is the first m principle components the vast
• This linear transformation fits this dataset to a new coordinate system in such a way that the most than variable 2 and 3 (left-side of the figure)
amount of
significant variance is found on the first coordinate, and each subsequent coordinate is orthogonal - linear combination of variable • since it would account for 94% (PC1+PC2) of
variation
The mathematics underlying PCA are somewhat to the last and has a lesser variance. 1,2 and 3 the variation in the data
complex, so I won't go into too much detail
Source: https://www.youtube.com/watch?app=desktop&v=FgakZw6K1QQ Source: https://www.youtube.com/watch?app=desktop&v=FgakZw6K1QQ
 12/8/2022

PCA - example Step-by-step EDA

• From the above graph, the first few principal components

are most important
• Thus, we can use the first few principal components for
building the model instead of using 50+ variables
Ref: Ghosh et al. (2018). A comprehensive review of tools for exploratory analysis of tabular industrial datasets

Univariant Analysis Univariate Analysis : ‘Discount’ Multivariate Analysis : Discount vs Fee

Data transformation:
• Descriptive statistics used in this study include frequency • Original Fee & Actual Fee => logarithmic value
distribution, summary statistics (mean and standard • -ve discount => absolute logarithmic value
deviation), and categorical summarization.
• Looking at the following one by one: Any insights you get EDA => Scatter plot
• ‘Discount’ offer patterns and frequencies from this initial
• ‘Discount’ by agent number (i.e. credit card representatives)
• ‘Discount’ by call lengths
univariate analysis?
• ‘Discount’ by call locations
• ….

Univariate Analysis : ‘Call duration’ References

• Bart Baesens, Veronique Van Vlasselaer, Wouter Verbeke (2015). Fraud Analytics using Descriptive,
Predictive, and Social Network Techniques, 1st ed, John Wiley & Sons Inc.
• Leonard W. Vona (2017). Fraud Data Analytics Methodology: The Fraud Scenario Approach to
Uncovering Fraud in Core Business Systems, John Wiley & Sons, Inc.

• Aindrila Ghosh, Mona Nashaat, James Miller, Shaikh Quader, Chad Marston (2018). A
comprehensive review of tools for exploratory analysis of tabular industrial datasets. Visual
Informatics 2 (2018) 235–253.
Any insights you get
• Lunardon, N., Menardi, G., & Torelli, N. (2014). ROSE: a Package for Binary Imbalanced
from this initial Learning. R J., 6, 79.

univariate analysis? • G. Menardi and N. Torelli. (2014). Training and assessing classification rules with imbalanced
data. Data Mining and Knowledge Discovery, 28(1):92–122.

Call duration in seconds

12/8/2022