An Unsupervised Neural Network Approach to Profiling the Behavior of Mobile Phone Users for Use in Fraud Detection

This paper discusses the current status of research on fraud detection undertaken as part of the European Commission-funded ACTS ASPeCT (Advanced Security for Personal Communications Technologies) project, by Royal Holloway University of London. Using a recurrent neural network technique, we uniformly distribute prototypes over toll tickets, sampled from the U.K. network operator, Vodafone. The prototypes, which continue to adapt to cater for seasonal or long term trends, are used to classify incoming toll tickets to form statistical behavior profiles covering both the shortand the long-term past. We introduce a new decaying technique, which maintains these profiles such that short-term information is updated on a per toll ticket basis whilst the update of the long-term behavior can be delayed and controlled by the user. The new technique ensures that the short-term history updates the long-term history applying an even weighting to each toll ticket. The behavior profiles, maintained as probability distributions, form the input to a differential analysis utilizing a measure known as the Hellinger distance between them as an alarm criterion. Fine tuning the system to minimize the number of false alarms poses a significant task due to the low fraudulent nonfraudulent activity ratio. We benefit from using unsupervised learning in that no fraudulent examples are required for training. This is very relevant considering the currently secure nature of GSM where fraud scenarios, other than subscription fraud, have yet to manifest themselves. It is the aim of ASPeCT to be prepared for the would-be fraudster for both GSM and UMTS. 2001 Academic Press