Fraud Formalization and Detection

A fr.ludsler can be an impersonator or a swindler. An impersonator is an illegitimate user who steals resources from the victims by "laking over" their accounts. A swindler is a Icgilimllle user who intentionally harms the system or olber users by deception. Previous rescart:h efforts in fraud detection concenrrnle on identifYing frauds caused by impersonators. Detecting fmuds conducted by swindlers is a challenging issue. In this paper, three types of deceiving iDleDlions, namely uncovered deceiving intention, trapping intention, and illusive inlenLion, are defined. We propose an architecture that integrates deceiving intention prediction with frnud detection to catch swindlers. It consists of four components: profile-based anomaly detector, state tmnsition llDalysis, deceiving intention prediclor, and decision-making component. Profile-based anomaly detector outputs fmud confidence indicating the possibility of freud when there is a sharp deviation from usual pallems. Slate transition analysis provides SUlle description to users when an activity results in entering a danger stote leading to fraud. Deceiving intention predictor discovers malicious intentions. DI-eonfidenee is used to characterize the belief that a target entity has such intentions. An algorithm is developed to cvoluate DI-confidence by analyzing an entity's behaviors. Its effectiveness is investigated via experimenr.al study. A user· conIigurable risk evaluation function is designed for decision-making eomponenl. The decision.making component raises a mud alarm when expected risk is greater than fraud-investigating cos\.