Machine Learning for Network Security & Fraud Detection

Generative Inpainting for Shapley-Value-Based Anomaly Explanation. Tritscher, Julian; Lissmann, Philip; Wolf, Maximilian; Krause, Anna; Hotho, Andreas; Schlör, Daniel. In The World Conference on eXplainable Artificial Intelligence (xAI 2024) - to appear. 2024.

[ Abstract ]
[ BibTeX ]
[ Download ]

Feature relevance explanations currently constitute the most used type of explanation in anomaly detection related tasks such as cyber security and fraud detection. Recent works have underscored the importance of optimizing hyperparameters of post-hoc explainers which show a large impact on the resulting explanation quality. In this work, we propose a new method to set the hyperparameter of replacement values within Shapley-value-based post-hoc explainers. Our method leverages ideas from the domain of generative image inpainting, where generative machine learning models are used to replace parts of a given input image. We show that these generative models can also be applied to tabular replacement value generation for Shapley-value-based feature relevance explainers. Experimentally, we train a denoising diffusion probabilistic model for generative inpainting on two tabular anomaly detection datasets from the domains of network intrusion detection and occupational fraud detection, and integrate the generative inpainting model into the SHAP explanation framework. We empirically show that generative inpainting may be used to achieve consistently strong explanation quality when explaining different anomaly detectors on tabular data.

@article{tritscher2024generative,
  abstract = {Feature relevance explanations currently constitute the most used type of explanation in anomaly detection related tasks such as cyber security and fraud detection. Recent works have underscored the importance of optimizing hyperparameters of post-hoc explainers which show a large impact on the resulting explanation quality. In this work, we propose a new method to set the hyperparameter of replacement values within Shapley-value-based post-hoc explainers. Our method leverages ideas from the domain of generative image inpainting, where generative machine learning models are used to replace parts of a given input image. We show that these generative models can also be applied to tabular replacement value generation for Shapley-value-based feature relevance explainers. Experimentally, we train a denoising diffusion probabilistic model for generative inpainting on two tabular anomaly detection datasets from the domains of network intrusion detection and occupational fraud detection, and integrate the generative inpainting model into the SHAP explanation framework. We empirically show that generative inpainting may be used to achieve consistently strong explanation quality when explaining different anomaly detectors on tabular data.},
  author = {Tritscher, Julian and Lissmann, Philip and Wolf, Maximilian and Krause, Anna and Hotho, Andreas and Schlör, Daniel},
  journal = {The World Conference on eXplainable Artificial Intelligence (xAI 2024) - to appear},
  keywords = {xai},
  month = {04},
  title = {Generative Inpainting for Shapley-Value-Based Anomaly Explanation},
  year = 2024
}

Feature relevance XAI in anomaly detection: Reviewing approaches and challenges. Tritscher, Julian; Krause, Anna; Hotho, Andreas. In Frontiers in Artificial Intelligence, 6. 2023.

[ Abstract ]
[ BibTeX ]
[ URL ]
[ DOI ]
[ Download ]

With complexity of artificial intelligence systems increasing continuously in past years, studies to explain these complex systems have grown in popularity. While much work has focused on explaining artificial intelligence systems in popular domains such as classification and regression, explanations in the area of anomaly detection have only recently received increasing attention from researchers. In particular, explaining singular model decisions of a complex anomaly detector by highlighting which inputs were responsible for a decision, commonly referred to as local post-hoc feature relevance, has lately been studied by several authors. In this paper, we systematically structure these works based on their access to training data and the anomaly detection model, and provide a detailed overview of their operation in the anomaly detection domain. We demonstrate their performance and highlight their limitations in multiple experimental showcases, discussing current challenges and opportunities for future work in feature relevance XAI for anomaly detection.

@article{tritscher2023feature,
  abstract = {With complexity of artificial intelligence systems increasing continuously in past years, studies to explain these complex systems have grown in popularity. While much work has focused on explaining artificial intelligence systems in popular domains such as classification and regression, explanations in the area of anomaly detection have only recently received increasing attention from researchers. In particular, explaining singular model decisions of a complex anomaly detector by highlighting which inputs were responsible for a decision, commonly referred to as local post-hoc feature relevance, has lately been studied by several authors. In this paper, we systematically structure these works based on their access to training data and the anomaly detection model, and provide a detailed overview of their operation in the anomaly detection domain. We demonstrate their performance and highlight their limitations in multiple experimental showcases, discussing current challenges and opportunities for future work in feature relevance XAI for anomaly detection.},
  author = {Tritscher, Julian and Krause, Anna and Hotho, Andreas},
  journal = {Frontiers in Artificial Intelligence},
  keywords = {xai},
  month = {02},
  title = {Feature relevance XAI in anomaly detection: Reviewing approaches and challenges},
  volume = 6,
  year = 2023
}

Evaluating feature relevance XAI in network intrusion detection. Tritscher, Julian; Wolf, Maximilian; Hotho, Andreas; Schlör, Daniel. In The World Conference on eXplainable Artificial Intelligence (xAI 2023). 2023.

[ Abstract ]
[ BibTeX ]
[ Download ]

As machine learning models become increasingly complex, there is a growing need for explainability to understand and trust the decision-making processes. In the domain of network intrusion detection, post-hoc feature relevance explanations have been widely used to provide insight into the factors driving model decisions. However, recent research has highlighted challenges with these methods when applied to anomaly detection, which can vary in importance and impact depending on the application domain. In this paper, we investigate the challenges of post-hoc feature relevance explanations for network intrusion detection, a critical area for ensuring the security and integrity of computer networks. To gain a deeper understanding of these challenges for the application domain, we quantitatively and qualitatively investigate the popular feature relevance approach SHAP when explaining different network intrusion detection approaches. We conduct experiments to jointly evaluate detection quality and explainability, and explore the impact of replacement data, a commonly overlooked hyperparameter of post-hoc feature relevance approaches. We find that post-hoc XAI can provide high quality explanations, but requires a careful choice of its replacement data as default settings and common choices do not transfer across different detection models. Our study showcases the viability of post-hoc XAI for network intrusion detection systems, but highlights the need for rigorous evaluations of produced explanations.

@article{tritscher2023evaluating,
  abstract = {As machine learning models become increasingly complex, there is a growing need for explainability to understand and trust the decision-making processes. In the domain of network intrusion detection, post-hoc feature relevance explanations have been widely used to provide insight into the factors driving model decisions. However, recent research has highlighted challenges with these methods when applied to anomaly detection, which can vary in importance and impact depending on the application domain. In this paper, we investigate the challenges of post-hoc feature relevance explanations for network intrusion detection, a critical area for ensuring the security and integrity of computer networks. To gain a deeper understanding of these challenges for the application domain, we quantitatively and qualitatively investigate the popular feature relevance approach SHAP when explaining different network intrusion detection approaches. We conduct experiments to jointly evaluate detection quality and explainability, and explore the impact of replacement data, a commonly overlooked hyperparameter of post-hoc feature relevance approaches. We find that post-hoc XAI can provide high quality explanations, but requires a careful choice of its replacement data as default settings and common choices do not transfer across different detection models. Our study showcases the viability of post-hoc XAI for network intrusion detection systems, but highlights the need for rigorous evaluations of produced explanations.},
  author = {Tritscher, Julian and Wolf, Maximilian and Hotho, Andreas and Schlör, Daniel},
  journal = {The World Conference on eXplainable Artificial Intelligence (xAI 2023)},
  keywords = {xai},
  title = {Evaluating feature relevance XAI in network intrusion detection},
  year = 2023
}

Occupational Fraud Detection through Agent-based Data Generation. Tritscher, Julian; Roos, Alexander; Schlör, Daniel; Hotho, Andreas; Krause, Anna. In The 8th Workshop on MIning DAta for financial applicationS MIDAS 2023. 2023.

[ Abstract ]
[ BibTeX ]
[ Download ]

Occupational fraud is an increasing concern for enterprises that is estimated to cause losses of around 5% of company revenue each year. With the increasing data tracked by companies through enterprise resource planning systems, recent research has taken interest in the automated detection of occupational fraud. Automated detection is however hindered by the unavailability of labeled fraud cases which require known occupational frauds within company data and costly expert annotation. Even despite the existence of anomaly detection methods that can be trained on unsupervised data, selecting the ideal preprocessing techniques, the most suitable model, and the optimal hyperparameters necessitates the availability of labeled data for evaluation purposes. To alleviate this issue, we propose to use simulation through multi-agent systems for generating business processes according to best practices from economics and creating labeled synthetic data that closely matches a given unlabeled real-world dataset. We extend an existing simulation by incorporating functionality for including, tracking and automatic labeling of occupational fraud cases. Using this simulation, we propose a framework that decides on important design choices for fraud detection models in enterprise resource planning data and does not require labeled real-world data. We demonstrate in multiple experiments that the framework can aid automated occupational fraud detection through data generation.

@article{tritscher2023occupational,
  abstract = {Occupational fraud is an increasing concern for enterprises that is estimated to cause losses of around 5% of company revenue each year. With the increasing data tracked by companies through enterprise resource planning systems, recent research has taken interest in the automated detection of occupational fraud. Automated detection is however hindered by the unavailability of labeled fraud cases which require known occupational frauds within company data and costly expert annotation. Even despite the existence of anomaly detection methods that can be trained on unsupervised data, selecting the ideal preprocessing techniques, the most suitable model, and the optimal hyperparameters necessitates the availability of labeled data for evaluation purposes. To alleviate this issue, we propose to use simulation through multi-agent systems for generating business processes according to best practices from economics and creating labeled synthetic data that closely matches a given unlabeled real-world dataset. We extend an existing simulation by incorporating functionality for including, tracking and automatic labeling of occupational fraud cases. Using this simulation, we propose a framework that decides on important design choices for fraud detection models in enterprise resource planning data and does not require labeled real-world data. We demonstrate in multiple experiments that the framework can aid automated occupational fraud detection through data generation.},
  author = {Tritscher, Julian and Roos, Alexander and Schlör, Daniel and Hotho, Andreas and Krause, Anna},
  journal = {The 8th Workshop on MIning DAta for financial applicationS MIDAS 2023},
  keywords = {mas},
  title = {Occupational Fraud Detection through Agent-based Data Generation},
  year = 2023
}

Open ERP System Data For Occupational Fraud Detection. Tritscher, Julian; Gwinner, Fabian; Schlör, Daniel; Krause, Anna; Hotho, Andreas. In arxiv. 2022.

[ BibTeX ]
[ URL ]
[ Download ]

@article{tritscher2022erpData,
  author = {Tritscher, Julian and Gwinner, Fabian and Schlör, Daniel and Krause, Anna and Hotho, Andreas},
  journal = {arxiv},
  keywords = {author:hotho},
  title = {Open ERP System Data For Occupational Fraud Detection},
  year = 2022
}

Detecting Anomalies in Transaction Data. Technical Report (PhD dissertation), . Schlör, Daniel. PhD dissertation. Universität Würzburg, 2022.

[ BibTeX ]
[ DOI ]
[ Download ]

@phdthesis{Schloer2022,
  author = {Schlör, Daniel},
  keywords = {from:daschloer},
  school = {Universität Würzburg},
  title = {Detecting Anomalies in Transaction Data},
  type = {Doctoral Thesis},
  year = 2022
}

Towards Explainable Occupational Fraud Detection. Tritscher, Julian; Schlör, Daniel; Gwinner, Fabian; Krause, Anna; Hotho, Andreas. In Machine Learning and Principles and Practice of Knowledge Discovery in Databases. ECML PKDD 2022, Communications in Computer and Information Science(1753), pp. 79–96. 2022.

[ BibTeX ]
[ URL ]
[ DOI ]
[ Download ]

@article{tritscher2022towards,
  author = {Tritscher, Julian and Schlör, Daniel and Gwinner, Fabian and Krause, Anna and Hotho, Andreas},
  journal = {Machine Learning and Principles and Practice of Knowledge Discovery in Databases. ECML PKDD 2022},
  keywords = {xai},
  number = 1753,
  pages = {79-96},
  title = {Towards Explainable Occupational Fraud Detection},
  volume = {Communications in Computer and Information Science},
  year = 2022
}

Malware detection on windows audit logs using LSTMs. Ring, Markus; Schlör, Daniel; Wunderlich, Sarah; Landes, Dieter; Hotho, Andreas. In Computers & Security, 109, p. 102389. 2021.

[ Abstract ]
[ BibTeX ]
[ URL ]
[ DOI ]
[ Download ]

Malware is a constant threat and is continuously evolving. Security systems try to keep up with the constant change. One challenge that arises is the large amount of logs generated on an operating system and the need to clarify which information contributes to the detection of possible malware. This work aims at the detection of malware using neural networks based on Windows audit log events. Neural networks can only process continuous data, but Windows audit logs are sequential and textual data. To address these challenges, we extract features out of the audit log events and use LSTMs to capture sequential effects. We create different subsets of features and analyze the effects of additional information. Features describe for example the action-type of windows audit log events, process names or target files that are accessed. Textual features are represented either as one-hot encoding or embedding representation, for which we compare three different approaches for representation learning. Effects of different feature subsets and representations are evaluated on a publicly available data set. Results indicate that using additional information improves the performance of the LSTM-model. While different representations lead to similar classification results, analysis of the latent space shows differences more precisely where FastText seems to be the most promising representation.

@article{RING2021102389,
  abstract = {Malware is a constant threat and is continuously evolving. Security systems try to keep up with the constant change. One challenge that arises is the large amount of logs generated on an operating system and the need to clarify which information contributes to the detection of possible malware. This work aims at the detection of malware using neural networks based on Windows audit log events. Neural networks can only process continuous data, but Windows audit logs are sequential and textual data. To address these challenges, we extract features out of the audit log events and use LSTMs to capture sequential effects. We create different subsets of features and analyze the effects of additional information. Features describe for example the action-type of windows audit log events, process names or target files that are accessed. Textual features are represented either as one-hot encoding or embedding representation, for which we compare three different approaches for representation learning. Effects of different feature subsets and representations are evaluated on a publicly available data set. Results indicate that using additional information improves the performance of the LSTM-model. While different representations lead to similar classification results, analysis of the latent space shows differences more precisely where FastText seems to be the most promising representation.},
  author = {Ring, Markus and Schlör, Daniel and Wunderlich, Sarah and Landes, Dieter and Hotho, Andreas},
  journal = {Computers & Security},
  keywords = {author:hotho},
  pages = 102389,
  title = {Malware detection on windows audit logs using LSTMs},
  volume = 109,
  year = 2021
}

A financial game with opportunities for fraud. Tritscher, Julian; Krause, Anna; Schl{\"o}r, Daniel; Gwinner, Fabian; von Mammen, Sebastian; Hotho, Andreas. In IEE COG 2021, 2021. 2021.

[ Abstract ]
[ BibTeX ]
[ URL ]
[ Download ]

Even though companies store large amounts of business data in enterprise resource planning (ERP) systems, obtaining data for financial fraud detection is prohibitively difficult due to privacy concerns and companies protecting trade secrets. One possible solution is game-based generation of synthetic ERP data, which poses the challenge of designing an environment that generates realistic ERP data and allows players to commit many different types of fraud. In this work, we design a multiplayer game that allows players to cooperatively run a fictional company, while simultaneously challenging them to maximize their personal gain. We introduce an approach for letting players explore fraud scenarios through emergent gameplay and present a prototype that may be primed with information from real world ERP systems to generate realistic data.

@article{tritscherfinancial,
  abstract = {Even though companies store large amounts of business data in enterprise resource planning (ERP) systems, obtaining data for financial fraud detection is prohibitively difficult due to privacy concerns and companies protecting trade secrets. One possible solution is game-based generation of synthetic ERP data, which poses the challenge of designing an environment that generates realistic ERP data and allows players to commit many different types of fraud. In this work, we design a multiplayer game that allows players to cooperatively run a fictional company, while simultaneously challenging them to maximize their personal gain. We introduce an approach for letting players explore fraud scenarios through emergent gameplay and present a prototype that may be primed with information from real world ERP systems to generate realistic data.},
  author = {Tritscher, Julian and Krause, Anna and Schl{\"o}r, Daniel and Gwinner, Fabian and von Mammen, Sebastian and Hotho, Andreas},
  journal = {IEE COG 2021},
  keywords = {research_imbalanced_data},
  title = {A financial game with opportunities for fraud},
  volume = 2021,
  year = 2021
}

A financial game with opportunities for fraud. Tritscher, Julian; Krause, Anna; Schlör, Daniel; Gwinner, Fabian; Von Mammen, Sebastian; Hotho, Andreas. In 2021 IEEE Conference on Games (CoG), pp. 1–5. 2021.

[ BibTeX ]
[ URL ]
[ DOI ]
[ Download ]

@inproceedings{Tritscher:2021aa,
  author = {Tritscher, Julian and Krause, Anna and Schlör, Daniel and Gwinner, Fabian and Von Mammen, Sebastian and Hotho, Andreas},
  booktitle = {2021 IEEE Conference on Games (CoG)},
  keywords = {from:daschloer},
  pages = {1-5},
  title = {A financial game with opportunities for fraud},
  year = 2021
}

Evaluation of Post-hoc XAI Approaches Through Synthetic Tabular Data. Tritscher, Julian; Ring, Markus; Schlör, Daniel; Hettinger, Lena; Hotho, Andreas. In Foundations of Intelligent Systems, D. Helic, G. Leitner, M. Stettinger, A. Felfernig, Z. W. Raś (eds.), pp. 422–430. Springer International Publishing, Cham, 2020.

[ Abstract ]
[ BibTeX ]
[ Download ]

Evaluating the explanations given by post-hoc XAI approaches on tabular data is a challenging prospect, since the subjective judgement of explanations of tabular relations is non trivial in contrast to e.g. the judgement of image heatmap explanations. In order to quantify XAI performance on categorical tabular data, where feature relationships can often be described by Boolean functions, we propose an evaluation setting through generation of synthetic datasets. To create gold standard explanations, we present a definition of feature relevance in Boolean functions. In the proposed setting we evaluate eight state-of-the-art XAI approaches and gain novel insights into XAI performance on categorical tabular data. We find that the investigated approaches often fail to faithfully explain even basic relationships within categorical data.

@inproceedings{tritscher2020evaluation,
  abstract = {Evaluating the explanations given by post-hoc XAI approaches on tabular data is a challenging prospect, since the subjective judgement of explanations of tabular relations is non trivial in contrast to e.g. the judgement of image heatmap explanations. In order to quantify XAI performance on categorical tabular data, where feature relationships can often be described by Boolean functions, we propose an evaluation setting through generation of synthetic datasets. To create gold standard explanations, we present a definition of feature relevance in Boolean functions. In the proposed setting we evaluate eight state-of-the-art XAI approaches and gain novel insights into XAI performance on categorical tabular data. We find that the investigated approaches often fail to faithfully explain even basic relationships within categorical data.},
  address = {Cham},
  author = {Tritscher, Julian and Ring, Markus and Schlör, Daniel and Hettinger, Lena and Hotho, Andreas},
  booktitle = {Foundations of Intelligent Systems},
  editor = {Helic, Denis and Leitner, Gerhard and Stettinger, Martin and Felfernig, Alexander and Raś, Zbigniew W.},
  keywords = {xai},
  pages = {422–430},
  publisher = {Springer International Publishing},
  title = {Evaluation of Post-hoc XAI Approaches Through Synthetic Tabular Data},
  year = 2020
}

Financial Fraud Detection with Improved Neural Arithmetic Logic Units. Schlör, Daniel; Ring, Markus; Krause, Anna; Hotho, Andreas. Vol. Fifth Workshop on MIning DAta for financial applicationS. 2020.

[ BibTeX ]
[ Download ]

@proceedings{schlr2020financial,
  author = {Schlör, Daniel and Ring, Markus and Krause, Anna and Hotho, Andreas},
  keywords = {inalu},
  number = 5,
  title = {Financial Fraud Detection with Improved Neural Arithmetic Logic Units},
  volume = {Fifth Workshop on MIning DAta for financial applicationS},
  year = 2020
}

Flow-based network traffic generation using Generative Adversarial Networks. Ring, Markus; Schlör, Daniel; Landes, Dieter; Hotho, Andreas. In Computers & Security, 82, pp. 156–172. 2019.

[ Abstract ]
[ BibTeX ]
[ URL ]
[ DOI ]
[ Download ]

Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.

@article{RING2019156,
  abstract = {Flow-based data sets are necessary for evaluating network-based intrusion detection systems (NIDS). In this work, we propose a novel methodology for generating realistic flow-based network traffic. Our approach is based on Generative Adversarial Networks (GANs) which achieve good results for image generation. A major challenge lies in the fact that GANs can only process continuous attributes. However, flow-based data inevitably contain categorical attributes such as IP addresses or port numbers. Therefore, we propose three different preprocessing approaches for flow-based data in order to transform them into continuous values. Further, we present a new method for evaluating the generated flow-based network traffic which uses domain knowledge to define quality tests. We use the three approaches for generating flow-based network traffic based on the CIDDS-001 data set. Experiments indicate that two of the three approaches are able to generate high quality data.},
  author = {Ring, Markus and Schlör, Daniel and Landes, Dieter and Hotho, Andreas},
  journal = {Computers & Security},
  keywords = {selected},
  pages = {156 - 172},
  title = {Flow-based network traffic generation using Generative Adversarial Networks},
  volume = 82,
  year = 2019
}

Machine Learning for Network Security & Fraud Detection

Projects

Occupational Fraud Detection

Concluded Projects

Publications

Data privacy protection

Data privacy protection

Picture credits