Detection and Explanation of Anomalous Payment …...Detection and Explanation of Anomalous Payment...
Transcript of Detection and Explanation of Anomalous Payment …...Detection and Explanation of Anomalous Payment...
Detection and Explanation of AnomalousPayment Behavior in Real-Time Gross Settlement
Systems
Ron Triepels1,2 Hennie Daniels1,3 Ronald Heijmans2
15th Payment System Simulator SeminarHelsinki, Finland
31 August - 1 September 2017
1Tilburg University, 2De Nederlandsche Bank, 3Erasmus University
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Introduction
RTGS Systems:
Facilitate the settlement of financial transactions
Settle transactions gross and (almost) real-time
Systemic Risk:
”The risk associated with any event that threatens the stabilityof a financial system as a whole” (Berndsen, et al., 2016).
Research Goal:
Apply Machine Learning to analyze payment data
Automatically identify anomalies (stress or undesired behavior)
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Anomaly Detection
Anomaly:
”A pattern that does not conform to expected behavior”(Chandola et al., 2009).
Unsupervised Anomaly Detection:
The task of automatically identifying anomalies in a set ofunlabeled data.
Components:
Model of ’normal’ behavior
Distance function
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Lossy Compression
Lossy compression preserves the most important features of data.
Original Picture Reconstructed Picture
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Definitions
Let B = {b1, . . . , bn} be a set of n banks and T =< t1, . . . , tm > be anordered set of m time intervals.
We extract D = {A(1), . . . ,A(m)} a set of m liquidity matrices from aRTGS system where each A(k) ∈ D is:
A(k) =
a(k)11 · · · a
(k)1n
.... . .
...
a(k)n1 · · · a
(k)nn
(1)
Each element a(k)ij is the liquidity flow between bi and bj at tk .
Liquidity Vector:
a(k) = [a(k)11 , . . . , a
(k)n1 , . . . , a
(k)1n , . . . , a
(k)nn ]T (2)
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Anomaly Detection Task
Let M be a lossy compression model. We measure the reconstructionerror of a(k) after its compressed and reconstructed by M by:
RE(a(k)) =1
2||a(k) − a(k)||22 (3)
Accordingly, we classify a(k) by:
h(a(k)) =
{1 if RE(a(k)) ≥ ε)0 otherwise
(4)
Here, ε > 0 is a threshold.
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Autoencoder
We employ a three-layered autoencoder to compress and reconstructliquidity vectors. The autoencoder can be defined by two functions:
Encoder function φ:
φ(a(k)) = f (l)(W1a(k) + b1) (5)
Decoder function ψ:
ψ(φ(a(k))) = g (n2)(W2φ(a(k)) + b2) (6)
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Autoencoder Architecture
a(k)11
...
a(k)nn
h(k)1
...
h(k)l
a(k)11
...
a(k)nn
φ(a(k)) ψ(φ(a(k)))
RE(a(k))
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Model Learning
Parameters θ = {W1,W2,b1,b2} are estimated from historic liquidityvectors. We do this by minimizing the following cost function:
J (θ) =1
2m
m∑k=1
||ψ(φ(a(k)))− a(k)||22 +λ
2
2∑i=1
||Wi ||2F (7)
Here, λ is a regularization parameter.
We apply stochastic gradient descent in conjunction withback-propagation to solve this optimization problem: I.o.w anoptimization algorithm.
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Experimental Setup
Payment Data:
2.3 million client payments from TARGET2-NL
Jan 2014 - Oct 2015
Aggregated over 4,680 consecutive hours
20 largest banks
Two autoencoders:
Linear (AE-L) with (linear/linear) activations
Non-linear (AE-S) with (sigmoid/linear) activations
Data partitioning:
Holdout set (2 months)
Training set (16 months)
Test set (4 months)
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Grid search (1/2)
The number of neurons was optimized by a grid search.
0.6
5.0
10.0
15.0
20.025.030.035.0
10 40 70 100 130 160 190 220 250 280 310 340 370 400Neurons
MR
E (
Hol
dout
Set
) AE-LAE-SAE-T
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Commercial Bank Run Simulation
Choose a bank bi and increase its outflow to each bj ∈ B over time:
a(k)ij := a
(k)ij + c
(k)ij d
(k)ij (8)
where:
c(k)ij ∼ B(1, p
(k)ij ) determines if liquidity is added.
d(k)ij ∼ Exp(δ
(k)ij ) is the amount of additional liquidity.
Multipliers
Rate Duration ps pe δs δe
Baseline 2 140 1 2 0.1 0.01
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Baseline Simulation of AE-L
10
20
30
40
50
3390 3590 3790 3990 4190 4390 4590
Time Interval
RE
Bank Run Original
AE−L
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Anomalies in real data (1/3)
A B C
0
1
2
3
4
5
6
3032
3025
2971
2952
2943
2934
2880
2863
2853
2821
2778
2767
2744
2722
2713
2698
2678
2666
2651
2622
Time Interval
RE
(T
est
Set)
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Anomalies in real data (2/3)
5
10
15
20
288028632853Time Interval
Ban
k
(0%,25%] (25%,50%] (50%,75%] (75%,100%]
Outflow
5
10
15
20
288028632853Time Interval
Ban
k
(0%,25%] (25%,50%] (50%,75%] (75%,100%]
Inflow
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Anomalies in real data (3/3)
Bank run did not follow ‘normal’ pattern because of:
Initially continuous outflow.
Part of the ‘gaps’ had no payments (no liquidity, clients no access toaccounts).
Increased flows still considered ‘normal’.
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Conclusions
Autoencoder can detect anomalous flows reasonably well.
Start of bank run well detected.
However, part of the anomalous flows during bank run missed.
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems
Questions?
Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems