Anomaly detection for internet banking using supervised learning on high dimensional data

Abstract

Nowadays, a high number of transactions are performed via internet banking. Rabobank processes more than 10 million transactions per day. Most of these transactions are (part of) normal behaviour. On the other hand, some transactions are considered to be out of the ordinary. These anomalous events occur relatively infrequently (less than 10 per day). Employees, that try to find these anomalous events, combine the transactions data, historical knowledge of the anomalous events and their expertise to detect and quantify them. Several types of anomalies are considered to be interesting and so they are labelled. These anomalies need to be detected, so they can be prevented in the future. The employees try to find events similar to known anomalies. Characteristics of anomalies change over time and employees also need to detect this slightly changed, but similar, behaviour. It is not our goal to detect completely new types of anomalies. In this thesis, the focus lies on finding events similar to the known anomalies. In order to assist these employees, a model that uses the transaction data and incorporates known anomalous events is built. Our model is able to score new incoming transactions and use these to update the model parameters. The scores can be returned to the employees to assist them in finding transactions that are similar to a particular type of anomaly. The AdaGrad algorithm with diagonal matrices is used. Also, l1-regularization is used on the parameter to create a more sparse solution.