Professional Documents
Culture Documents
Institute of Mathematical Statistics
Institute of Mathematical Statistics
Your use of the JSTOR archive indicates your acceptance of the Terms & Conditions of Use, available at .
http://www.jstor.org/page/info/about/policies/terms.jsp
.
JSTOR is a not-for-profit service that helps scholars, researchers, and students discover, use, and build upon a wide range of
content in a trusted digital archive. We use information technology and tools to increase productivity and facilitate new forms
of scholarship. For more information about JSTOR, please contact [email protected].
Institute of Mathematical Statistics is collaborating with JSTOR to digitize, preserve and extend access to
Statistical Science.
http://www.jstor.org
235
and He, Graco and Yao (1999) describedtheuse of accounting andmanagement fraudin contexts broader
neuralnetworks, geneticalgorithms andnearestneigh- thanthoseof moneylaundering. Digit analysistools
bormethodsto classifythepracticeprofiles ofgeneral have foundfavorin accountancy(e.g., Nigriniand
practitionersin Australiaintoclasses fromnormalto Mittermaier, 1997;Nigrini,1999).Statistical sampling
abnormal. methods are important in financial audit, and screen-
Medical fraudis oftenlinkedto insurancefraud: ingtoolsareappliedto decidewhichtaxreturns merit
TerryAllen, a statistician withthe Utah Bureau of detailedinvestigation. We mentioned insurancefraud
Medicaid Fraud, estimatedthatup to 10% of the in thecontextof medicine,butit clearlyoccursmore
$800 millionannual claims may be stolen(Allen, widely.Artis,Ayusoand Guillen(1999) describedan
2000). Major and Riedinger(1992) createda know- approachtomodelling fraudbehaviorincarinsurance,
ledge/statistical-based systemto detect healthcare andFanning,CoggerandSrivastava (1995) andGreen
fraudby comparingobservationswith those with and Choi (1997) examined neural network classifica-
whichtheyshouldbe mostsimilar(e.g.,havingsimi- tionmethodsfordetecting management fraud.Statis-
largeodemographics). Brockett, Xia andDerrig(1998) ticaltoolsforfrauddetectionhave also been applied
used neuralnetworks to classifyfraudulent and non- to sporting events.For example,Robinsonand Tawn
fraudulent claims for automobilebodily injuryin (1995), Smith(1997) and Barao and Tawn(1999) ex-
healthcareinsuranceclaims.Glasgow (1997) gave a aminedtheresultsofrunning eventsto see ifsomeex-
shortdiscussionof riskand fraudin theinsurancein- ceptional times were out of line withwhatmightbe
dustry.A glossaryof severalof thedifferent typesof expected.
medicalfraudis availableat http://www.motherjones. Plagiarism is also a typeoffraud.Webriefly referred
com/mother-jones/MA95/davis2.html. to the use of statistical tools for author verification
Of course,medicineis nottheonlyscientific area and such methodscan be applied here. However,
wheredata have sometimesbeen fabricated, falsified statisticaltools can also be applied more widely.
or carefullyselectedto supporta pettheory. Problems For example,withtheevolutionof the Internet it is
of fraudin scienceare attracting increasedattention, extremely easy for students to plagiarize articles and
but theyhave alwaysbeen withus: errantscientists pass them off as their own in school or university
havebeenknowntomassagefigures fromexperiments coursework.The websitehttp://www.plagiarism.org
to pushthrough development of a productor reacha describesa systemthatcan take a manuscript and
magicalsignificance level fora publication.Dmitriy compare it against their "substantial database" of
Yuryevdescribedsuch a case on his webpages at articles from the Web. A statistical measureof the
http://www.orc.ru/-yur77/statfr.htm. Moreover,there originality of the manuscript is returned.
are many classical cases in which the data have As we commented in theIntroduction, frauddetec-
been suspectedof being massaged (includingthe tion is a post hoc strategy, being applied afterfraud
workof Galileo,Newton,Babbage,Kepler,Mendel, prevention has failed.Statistical toolsare also applied
Millikanand Burt).Pressand Tanur(2001) presented in some fraud prevention methods. For example,so-
a fascinating discussionof therole of subjectivity in called biometric methods of fraud detection areslowly
thescientificprocess,illustrating withmanyexamples. becoming more widespread. These include computer-
The borderline betweensubconscious selectionofdata ized fingerprint and retinal identification, and also face
andout-and-out distortion is a fineone. recognition (although thishas received most publicity
in thecontext ofrecognizing footballhooligans).
8. CONCLUSIONS In many of the applications we havediscussed,speed
ofprocessing is oftheessence.Thisis particularly the
The areas we have outlinedare perhapsthosein case in transaction processing, especiallywithtelecom
whichstatisticaland otherdata analytictools have and intrusion data,wherevastnumbers of recordsare
madethemostimpacton frauddetection. Thisis typi- processedeveryday,but also appliesin creditcard,
callybecausetherearelargequantities ofinformation, bankingandretailsectors.
andthisinformation is numerical orcan easilybe con- A keyissue in all of thisworkis how effective the
vertedintothenumerical intheformofcountsandpro- statisticaltoolsarein detecting fraudanda fundamen-
portions.However,otherareas,notmentioned above, tal problemis thatone typicallydoes notknowhow
have also used statisticaltoolsforfrauddetection. Ir- manyfraudulent cases slipthrough thenet.In applica-
infinancial
regularities statements canbe usedtodetect tionssuchas bankingfraudandtelecomfraud,where
speedof detection matters, measuressuchas average BARAO,M. I. andTAWN,J.A. (1999). Extremal analysisofshort
timeto detection after fraud starts(in minutes,num- serieswithoutliers:Sea-levelsand athleticsrecords.Appl.
Mea- Statist.48 469-487.
bersoftransactions, etc.)shouldalso be reported.
BLUNT,G. and HAND,D. J. (2000). The UK creditcardmarket.
suresofthisaspectinteract withmeasuresof finalde- Technicalreport, ImperialCollege,Lon-
Dept. Mathematics,
tectionrate:in manysituations an account,telephone don.
andso forth, willhavetobe usedforseveralfraudulent BOLTON,R. J. and HAND,D. J. (2001). Unsupervised profiling
transactionsbeforeitis detectedas fraudulent, so that methodsforfrauddetection. In Conferenceon CreditScoring
and CreditControl7, Edinburgh,UK, 5-7 Sept.
severalfalsenegative willnecessarily
classifications be
BRAUSE, R., LANGSDORF, T. and HEPP, M. (1999). Neural data
made. miningforcreditcardfrauddetection.In Proceedingsof the
An appropriate overallstrategy is to use a graded 11thIEEE International on Tools withArtificial
Conference
systemof investigation. Accountswith very high Intelligence103-106. IEEE ComputerSocietyPress,Silver
suspicionscoresmeritimmediateand intensive(and Spring,MD.
BREIMAN, L., FRIEDMAN, J. H., OLSHEN, R. A. and
expensive)investigation, while thosewithlargebut and RegressionTrees.
STONE, C. J. (1984). Classification
less dramaticscoresmeritcloser(butnotexpensive) Wadsworth,Belmont,CA.
observation. Once again,it is a matterof choosinga BROCKETT, P. L., XIA, X. and DERRIG, R. A. (1998). Using
suitablecompromise. mapto uncoverautomobile
feature
Kohonen'sself-organising
Finally,itis worthrepeating theconclusions reached bodilyinjuryclaimsfraud.TheJournalofRiskand Insurance
65 245-274.
by Schonlauet al. (2001), in the contextof statisti- BURGE, P. and SHAWE-TAYLOR, J. (1997). Detectingcellular
cal toolsforcomputer intrusiondetection:"statistical In AAAI Workshop
fraudusing adaptiveprototypes. on Al
methods can detectintrusions, evenindifficultcircum- Approachesto FraudDetectionand RiskManagement 9-13.
stances,"butalso "manychallengesand opportunities AAAI Press,MenloPark,CA.
remain."We believethis BUYSE, M., GEORGE, S. L., EVANS, S., GELLER, N. L.,
forstatisticsand statisticians
RANSTAM,J., SCHERRER, B., LESAFFRE, E., MURRAY,G.,
positiveconclusionholdsmoregenerally. Frauddetec- EDLER, L., HUTTON, J., COLTON, T., LACHENBRUCH, P.
tionis an important area,one in manywaysideal for and VERMA,B. L. (1999). The role of biostatisticsin the
theapplication ofstatisticalanddataanalytic tools,and prevention,detection of fraudin clinicaltrials.
and treatment
onewherestatisticians can makea verysubstantial and inMedicine18 3435-3451.
Statistics
CAHILL, M. H., LAMBERT, D., PINHEIRO, J. C. and SUN, D. X.
important contribution.
fraudintherealworld.InHandbookofMas-
(2002). Detecting
siveDatasets(J.Abello,P. M. PardalosandM. G. C. Resende,
ACKNOWLEDGMENT eds.). Kluwer,Dordrecht.
CHAN, P. K., FAN, W., PRODROMIDIs, A. L. and STOLFO, S. J.
The work of RichardBolton was supportedby (1999). Distributeddataminingin creditcardfrauddetection.
a ROPA award fromthe Engineering and Physical IEEE IntelligentSystems 14(6) 67-74.
SciencesResearchCounciloftheUnitedKingdom. CHAN, P. and STOLFO, S. (1998). Towardscalable learning
withnon-uniform A case study
class and cost distributions:
in creditcard frauddetection.In Proceedingsof theFourth
REFERENCES InternationalConference on KnowledgeDiscoveryand Data
Mining164-168.AAAI Press,MenloPark,CA.
ALESKEROV, E., FREISLEBEN, B. and RAO,B. (1997). CARD- CHARTIER,B. and SPILLANE,T. (2000). Money laundering
WATCH:A neuralnetwork baseddatabaseminingsystemfor detectionwitha neuralnetwork. In BusinessApplicationsof
creditcardfrauddetection.In Computational for
Intelligence NeuralNetworks (P. J.G. Lisboa,A. VellidoandB. Edisbury,
FinancialEngineering. Proceedingsof theIEEE/IAFE 220- eds.) 159-172.WorldScientific, Singapore.
NJ.
226. IEEE, Piscataway, CHHIKARA,R. S. and McKEoN, J. (1984). Lineardiscriminant
ALLEN,T. (2000). A dayinthelifeofa Medicaidfraudstatistician. analysis with misallocationin trainingsamples. J. Amer.
Stats29 20-22. Statist.Assoc.79 899-906.
ANDERSON, D., FRIVOLD, T. and VALDES, A. (1995). Next- CLARK,P. andNIBLETT,T. (1989). TheCN2 induction algorithm.
generationintrusion
detectionexpertsystem(NIDES): A sum- MachineLearning3 261-285.
mary.TechnicalReportSRI-CSL-95-07,ComputerScience COHEN,W. (1995). Fasteffective In Proceedings
ruleinduction. of
Laboratory, MenloPark,CA.
SRI International, the12thInternational Conference on MachineLearning115-
ANDREWS,P. P. and PETERSON,M. B., eds. (1990). Criminal 123.MorganKaufmann, Palo Alto,CA.
Intelligence Loomis,CA.
Analysis.PalmerEnterprises, CORTES, C., FISHER, K., PREGIBON, D. and ROGERS, A.
ARTiS, M., Ayuso, M. and GUILLEN,M. (1999). Modelling (2000). Hancock:A languageforextracting from
signatures
differenttypesofautomobileinsurancefraudbehaviourin the data streams.In Proceedingsof the SixthACM SIGKDD
Spanishmarket.InsuranceMathematics and Economics24 International
Conferenceon KnowledgeDiscoveryand Data
67-81. Mining9-17. ACM Press,New York.
LACHENBRUCH,P. A. (1974). Discriminantanalysis when theini- PATIENT, S. (2000). Reducing online credit card fraud.
misclassifica-
II: Non-random
tial samplesare misclassified. Web Developer's Journal. Available at http://www.
tionmodels.Technometrics 16 419-424. webdevelopersjournal.com/articles/card_fraud.html
LANE, T. and BRODLEY, C. E. (1998). Temporal sequence learn- of
PRESS, S. J. and TANUR, J. M. (2001). The Subjectivity
inganddatareduction In Proceedings
foranomalydetection. and theBayesianApproach.Wiley,New York.
Scientists
ofthe5thACM Conferenceon Computerand Communications PROVOST, F. and FAWCETT,T. (2001). Robust classificationfor
(CCS-98) 150-158.ACM Press,New York.
Security imprecise MachineLearning42 203-210.
environments.
LEE, W. and STOLFO, S. (1998). Data mining approaches for Qu, D., VETTER, B. M., WANG, F., NARAYAN,R., Wu, S. F.,
InProceedings
detection.
intrusion ofthe7thUSENIXSecurity Hou, Y. F., GONG,F. and SARGOR,C. (1998). Statistical
Symposium, San Antonio,TX 79-93. USENIX Association, anomalydetection routing
forlink-state protocols.In Proceed-
Berkeley,
CA. ingsoftheSixthInternational Conference on Network Proto-
cols 62-70. IEEE Computer SocietyPress,Los Alamitos,CA.
LEONARD,K. J. (1993). Detectingcreditcardfraudusingexpert
QUINLAN,J. R. (1990). Learninglogical definitions fromrela-
systems.Computersand IndustrialEngineering25 103-106.
tions.MachineLearning5 239-266.
LIPPMANN, R., FRIED, D., GRAF, I., HAINES, J.,
QUINLAN, J. R. (1993). C4.5: Programs for MachineLearning.
KENDALL, K., MCCLUNG, D., WEBER, D., WEBSTER, S.,
MorganKaufmann, San Mateo,CA.
WYSCHOGROD, D., CUNNINGHAM, R. and ZISSMAN, M.
Recognition
RIPLEY, B. D. (1996). Pattern and NeuralNetworks.
(2000). Evaluatingintrusiondetectionsystems:The 1998
Cambridge Univ.Press.
DARPA off-line evaluation.Unpublished
intrusion-detection
ROBINSON, M. E. and TAWN,J. A. (1995). Statisticsforexcep-
manuscript,MIT LincolnLaboratory.
records.Appl.Statist.44 499-511.
tionalathletics
MAJOR, J. A. and RIEDINGER, D. R. (1992). EFD: A hybrid
ROSSET, S., MURAD, U., NEUMANN, E., IDAN, Y. and
systemforthedetection
knowledge/statistical-based of fraud.
PINKAS, G. (1999). Discovery of fraud rules for
JournalofIntelligent
International Systems7 687-703. and solutions. In Pro-
telecommunications-challenges
MARCHETTE,D. J. (2001). ComputerIntrusionDetectionand Conference
ACM SIGKDD International
ceedingsoftheFifth
Network Monitoring: Springer,
A StatisticalViewpoint. New on KnowledgeDiscoveryand Data Mining409-413. ACM
York. Press,New York.
MCCARTHY, J.(2000). Phenomenal datamining.Comm.ACM 43 RYAN, J., LIN, M. and MIIKKULAINEN, R. (1997). Intrusion
75-79. detectionwithneuralnetworks.In AAAI Workshopon Al
McLACHLAN, G. J.(1992). Discriminant Analysisand Statistical 72-79.
ApproachestoFraudDetectionand RiskManagement
PatternRecognition.Wiley,New York. AAAI Press,MenloPark,CA.
MOBILE EUROPE (2000). New IP world, new dangers. Mobile SCHONLAU, M., DUMOUCHEL, W., Ju, W.-H., KARR, A. F.,
Europe,March. THEUS, M. and VARDI, Y. (2001). Computer intrusion:
MOREAU, Y., PRENEEL, B., BURGE, P., SHAWE-TAYLOR, J., Detectingmasquerades.Statist.Sci. 16 58-74.
STOERMANN, C. and COOKE, C. (1996). Novel techniques SENATOR,T. E. (2000). Ongoingmanagement and application
InACTSMobile
inmobilecommunications.
forfrauddetection of discoveredknowledgein a largeregulatory organization:
Summit,Grenada. A case studyof the use and impactof NASD regulation's
MOREAU, Y., VERRELST, H. and VANDEWALLE,J. (1997). De- advanceddetectionsystem(ADS). In Proceedingsof the
tectionof mobilephonefraudusingsupervisedneuralnet- SixthACM SIGKDD International Conference on Knowledge
works:A first
prototype.In Proceedingsof 7thInternational Discoveryand Data Mining44-53. ACM Press,New York.
on Neural
Artificial Networks (ICANN'97) 1065- SENATOR, T. E., GOLDBERG, H. G., WOOTON, J., COT-
Conference
Berlin.
1070.Springer, TINI, M. A., UMAR KHAN, A. F., KLINGER, C. D., LLA-
MAS, W. M., MARRONE, M. P. and WONG, R. W. H. (1995).
MURAD, U. and PINKAS, G. (1999). Unsupervised profilingfor
network
crimesenforcement
Thefinancial Al system
(FAIS)-
superimposed
identifying fraud.Principlesof Data Mining
potentialmoneylaundering
Identifying fromreportsof large
and KnowledgeDiscovery.LectureNotesinArtificialIntelli-
Al Magazine16 21-39.
cashtransactions.
Berlin.
gence1704 251-261. Springer,
SHAWE-TAYLOR, J., HOWKER, K., GOSSET, P., HYLAND,
NEURAL TECHNOLOGIES (2000). Reducing telecoms fraud and
M., VERRELST, H., MOREAU, Y., STOERMANN, C. and
churn.Report,NeuralTechnologies, U.K.
Ltd.,Petersfield, and fraud
BURGE,P. (2000). Novel techniquesforprofiling
NIGRINI,M. J. (1999). I've gotyournumber.JournalofAccoun- detectionin mobiletelecommunications. In BusinessAppli-
tancyMay 79-83. cationsof NeuralNetworks (P. J.G. Lisboa, A. Vellidoand
NIGRINI, M. J. and MITTERMAIER, L. J. (1997). The use of B.Edisbury,eds.) 113-139.WorldScientific,Singapore.
Benford'slaw as an aid in analyticalprocedures. A
Auditing: SHIEH, S.-P. W. and GLIGOR, V. D. (1991). A pattern-oriented
JournalofPracticeand Theory16 52-67. In Proceedings
modelanditsapplications.
intrusion-detection
NORTEL(2000). Nortelnetworks fraudsolutions.FraudPrimer, ofthe1991IEEE Computer SocietySymposium onResearchin
Issue 2.0. NortelNetworksCorporation. SecurityandPrivacy327-342.IEEE Computer SocietyPress,
PAK, S. J. and ZDANOWICZ, J. S. (1994). A statisticalanalysis of SilverSpring,MD.
theU.S. MerchandiseTradeDatabase and its uses in trans- SHIEH, S.-P. W. and GLIGOR, V. D. (1997). On a pattern-
ferpricingcomplianceand enforcement.Tax Management, modelforintrusion
oriented on
IEEE Transactions
detection.
May 1. 9 661-667.
Knowledgeand Data Engineering
SMITH, R. L. (1997). Commenton "Statisticsforexceptional TANIGUCHI, M., HAFT, M., HOLLMEN, J. and TRESP, V.
athleticsrecords,"by M. E. Robinsonand J.A. Tawn.Appl. (1998). Fraud detectionin communication networksusing
Statist.46 123-128. neuraland probabilistic
methods.In Proceedingsofthe1998
STOLFO, S. J.,FAN, D. W., LEE, W., PRODROMIDIS, A. L. and IEEE InternationalConferenceon Acoustics,Speech and
CHAN, P. K. (1997a). Creditcardfrauddetection usingmeta- SignalProcessing(ICASSP'98) 2 1241-1244.IEEE Computer
learning:Issues and initialresults.In AAAI Workshop on Al SocietyPress,SilverSpring,MD.
Approachesto FraudDetectionand RiskManagement 83-90. U.S. CONGRESS (1995). Information technologies forthecontrol
AAAI Press,MenloPark,CA. of moneylaundering. Officeof TechnologyAssessment, Re-
STOLFO, S., FAN, W., LEE, W., PRODROMIDIS, A. L. and portOTA-ITC-630,U.S. Government PrintingOffice,Wash-
CHAN, P. (1999). Cost-basedmodeling forfraudandintrusion ington,DC.
detection:ResultsfromtheJAMProject.In Proceedings ofthe WASSERMAN, S. andFAUST,K. (1994). Social NetworkAnalysis:
DARPAInformation SurvivabilityConference and Exposition MethodsandApplications. Cambridge Univ.Press.
2 130-144.IEEE Computer Press,New York. WEBB, A. R. (1999). StatisticalPatternRecognition.Arnold,
STOLFO, S. J., PRODROMIDIS, A. L., TSELEPIS, S., LEE, W., London.
FAN,D. W. and CHAN, P. K. (1997b). JAM:Javaagentsfor WHEELER, R. and AITKEN, S. (2000). Multiplealgorithms
meta-learning overdistributed databases.In AAAI Workshop for fraud detection.Knowledge-BasedSystems 13(2/3)
on Al Approachesto FraudDetectionand RiskManagement 93-99.
91-98. AAAI Press,MenloPark,CA.
Comment
Foster Provost