SCARFF: A scalable framework for streaming credit card fraud detection with spark

Highlights

• The open source / Big Data nature of the framework.

• The capability to deal with nonstationarity, class imbalance and verification latency.

• The distributed on-line feature engineering functionality included in the framework.

• The scalability, efficiency and accuracy assessed over a big stream of transactions.

Abstract

The expansion of the electronic commerce, together with an increasing confidence of customers in electronic payments, makes of fraud detection a critical factor. Detecting frauds in (nearly) real time setting demands the design and the implementation of scalable learning techniques able to ingest and analyse massive amounts of streaming data. Recent advances in analytics and the availability of open source solutions for Big Data storage and processing open new perspectives to the fraud detection field. In this paper we present a Scalable Real-time Fraud Finder (SCARFF) which integrates Big Data tools (Kafka, Spark and Cassandra) with a machine learning approach which deals with imbalance, nonstationarity and feedback latency. Experimental results on a massive dataset of real credit card transactions show that this framework is scalable, efficient and accurate over a big stream of transactions.

Introduction

The increasing adoption of electronic payments is opening new perspectives to fraudsters and asks for innovative countermeasures to their criminal activities. If on the one hand fraudsters continuously improve their techniques to emulate genuine behaviour, on the other hand it becomes affordable for the companies managing transactional services to collect data about customers and monitor their behavior.

The need of automatic systems able to detect frauds from historical data led to the design of a number of machine learning algorithms for fraud detection [1], [2], [3]. Supervised methods, typically based on binary classification, as well as unsupervised and one-class classification [4], [5] have been proposed in literature. Most of these works address some specific issues of fraud detection, notably class imbalance [6], [7], [8] (the percentage of fraudulent transactions is usually very small), concept drift [9], [10], [11], [12], [13], [14] (the distribution of fraudulent transactions might change in time) and stream processing [15], [16].

The authors of this paper studied and analysed in detail the existing literature in previous works [17], [18], [19], [20] and proposed an original solution for accurate classification of fraudulent credit card transactions in imbalanced and non-stationary settings. In particular we assessed the superiority of undersampling versus oversampling techniques in our specific problem, we proposed a sliding window approach to effectively tackle concept-drift and we addressed in [19], [20] an issue often overlooked in literature: the verification latency due to the fact that in real settings the transaction label is obtained only after that human investigators contacted the card holders.

Though a large number of learning techniques have been proposed, most solutions assume a conventional setting where the entire dataset is resident in memory. It follows that very few studies made the implementation of these techniques scalable and studied their performances. Also what exists is typically related to other domains than the fraud: for instance [21] and [22] studied already the issue of data imbalance in a Hadoop/MapReduce framework¹ but only for public and bioinformatics data.

In domains closer to fraud detection most of the existing works are preliminary or in progress. Hormoz et al. [23] made a comparison between a serial implementation and a Hadoop/MapReduce batch processing solution based on Artificial Immune Systems (AIS). The same authors made some tests on cloud services and provided accuracy measurements [24]. A web service framework for near real-time credit card fraud detection is described, together with some preliminary results, in [25]. A big data architecture based on Flume, Hadoop and HDFS is proposed in [26] but no validation results are provided. An example of application in a non banking environment is presented in [27] where Chen et al. describe the Hadoop based fraud detection infrastructure at Alibaba. Other works in progress can be found on several git servers [28], [29], [30], [31], [32], [33], [34].

In this paper we start from the conclusions of our published works [17], [19], [20] and we propose a realistic and scalable implementation of a fraud detection system. SCARFF (Scalable Real-time Fraud Finder) is an open source platform which processes and analyses streaming data in order to return reliable alerts in a nearly real-time setting. These are the main original contributions:

• The design, implementation and test of an entirely open-source solution integrating state-of-the-art components from the Apache ecosystem. This architecture deals seamlessly with data ingestion, streaming, feature engineering, storage and classification;

• A scalable learning solution able to provide accurate classification in a context characterized by nonstationarity, class imbalance and verification latency. This is obtained by implementing in a scalable and distributed manner an ensemble solution able to deal with concept drift and delayed feedback;

• The design of a distributed on-line feature engineering functionality, which constantly updates historical features relevant to better identify fraud patterns. This on-line functionality relies on a MapReduce programming model;

• A real-world extensive assessment, in terms of scalability, computational performance and precision, carried out by testing the platform on a stream of more than 8 millions of transactions (corresponding to more than 1.9 millions of cards) provided by our industrial partner;

• The virtualisation of the complete workflow proposed in this article as a Docker container, making the workflow fully reproducible.

The paper is organized as follows. Section 2 introduces the main characteristics of real-world Fraud-Detection Systems. Section 3 gives an overview of the big data tools from the Apache ecosystem that are integrated in our framework. Section 4 details the learning and the streaming functionalities of the platform. Finally, in Section 5 we assess the scalability, computational speed and precision on a real dataset, as a function of allocated resources and incoming transaction rates.