This contribution summarizes the state of the art of fraud detection in
practice and shows the relations between the technology for fraud detection and
intrusion detection. We identify prospective directions for further investigation
and imminent challenges

Bitz, Gunter

Flegel, Ulrich

Dagstuhl Research Online Publication Server

Fraud Detection from a Business Perspective:Future Directions and ChallengesUlrich Flegel1 and Julien Vayssière1 and Gunter Bitz21 SAP Research Center Karlsruhe, Germany2 SAP Fraud Prevention Competence Center, Walldorf, Germany{ulrich.flegel|julien.vayssiere|gunter.bitz}{@}sap.comAbstract. This contribution summarizes the state of the art of fraud detection inpractice and shows the relations between the technology for fraud detection andintrusion detection. We identify prospective directions for further investigationand imminent challenges.1 IntroductionWith the introduction of IT to conduct business we accepted the loss of a human controlstep. For example, orders would leave the company electronically and fully automated,with no human intervention. For this reason, the introduction of new IT systems wasaccompanied by the development of the authorization concept. That is why it is ofparamount importance that due care is exercised in analyzing this system for risks andthen minimizing them. This is, of course, also supported by software nowadays. Butsince, in reality, there is no such thing as 100 per cent security; auditors are commis-sioned to examine all transactions for misconduct. Since the data exists in digital formalready, it makes sense to use computer-based processes to analyze it. Such processesallow the auditor to carry out extensive checks within an acceptable timeframe and withreasonable effort. Once the algorithm has been defined, it only takes sufficient comput-ing power to evaluate larger quantities of data.2 State of the Art in PracticeThe research community has come up with a number of different approaches over theyears to the problem of fraud detection: data mining, machine learning, signature-basedor anomaly detection. However, the state of the practice of fraud detection by profes-sional auditors is very different: most of the tools used are simple tools for data importand analysis that leave the detection and classification of potential fraud cases entirelyto the human being. In a recent survey, nearly half the auditors who responded reportedusing generic tools such as Microsoft Excel or Microsoft Access to do their work. Thisis clearly a sign that the current offering of Computer-Assisted Auditing Tools (CAATS)is not sufficient, and that existing research results have failed to transfer into usable toolsfor auditors.We distinguish between generic, specialized and custom-built fraud detection tools.Studying the offers in detail, we realized that the seemingly primitive state of the fieldDagstuhl Seminar Proceedings 08302 Countering Insider Threats http://drops.dagstuhl.de/opus/volltexte/2008/17952can be explained by the fact that most of the advanced tools developed are eithercustom-built, and therefore very rarely publicized, or are used in very specialized solu-tions that, for commercial reasons, like to remain discrete on how exactly they achievefraud detection. Another thing to keep in mind is that the target audience for fraud de-tection tool, i.e. fraud auditors, cannot be described as tech-savvy. As a result, it is hardto find people with the right combination of computer science expertise and auditingexpertise to match the various approaches to the actual problems faced by auditors.3 Relation to Intrusion DetectionAn approach that has been tried in the past is to apply techniques developed for Intru-sion Detection Systems (IDS) to the problem of fraud detection. The art and science ofdetecting intrusions and fraud in monitoring and transaction data has a history of over25 years. We roughly distinguish 3 approaches of detection methods: (1) misuse detec-tion, modelling the behavior to be detected (by specification) and matching the modelsto current behavior; (2) anomaly detection, modelling the normal behavior (by train-ing) and detecting deviations from current behavior; (3) specification-based detection,modelling allowed behavior (by specification) and detecting deviations from currentbehavior.All three approaches have been used for intrusion detection purposes and were ap-plied to to lower level system concepts, such as network packets, system call sequencesand parameters, as well as web application parameters. In the domain of fraud detec-tion, anomaly detection techniques are mainly used to flag unusual behaviour that needsfurther manual examination, and misuse detection heuristics that are employed to de-tect known application level, domain-specific fraud schemes. Such solutions for frauddetection are by necessity highly specific to the application at hand and in extensionalso to the specific business model of the company and to its industry sector. Widelyapplicable solutions have currently not been developed.We also argue that the detection of insider fraud is a very different problem from thatof detecting intrusion at host or network level. One reason may be that attacks againstnetworks are more automated and frequent than attempts at perpetrating fraud throughenterprise information systems, which we believe show more variability. However, asnetworks attacks become more sophisticated, through polymorphic exploit code andmulti-step attacks, and as fraudsters have the possibility to automate attacks by leverag-ing service-oriented architectures and business process engines, we could see the twotypes of attacks eventually converge. The fact remains, however, that we have very littledata available to study patterns of fraud in enterprise systems.3.1 Future Directions for Fraud Detection in SOA-enabled Business ProcessesWe intend to cross-fertilise both areas – intrusion detection and fraud detection – byaddressing the gaps of missing specification-based methods for fraud detection, andfor missing applications at the level of business processes. We propose investigatingspecification-based detection methods for detecting business process level fraud, wherebusiness services are orchestrated by means of Web Services SOA technology. This3approach bears the promise of low false positive and low false negative rates, whiledetecting previously unknown fraud schemes. Our novel idea involves exploiting theWeb service description models developed during design-time in order to automaticallygenerate specifications of allowed behaviour for fraud detection and possibly manuallyenrich them. In order to bridge the syntactic gap between incident situations detectedduring run-time and existing fraud models, an appropriate ontology is required. Wepropose to use the ontology to map the current incident situation to known fraud modelsto enable enriching the incident alarm with information.4 ChallengesWe would like to list a number of challenges faced today by the designers of frauddetection solutions, which we hope will help steer the community in the right direction.The first challenge is to bridge the gap between existing fraud detection tools andthe business level. We need tools that any auditor can use. Tools that the auditor can pa-rameterize using concepts that make sense at a business, and tools that output potentialfraud cases at the same level of abstraction.Another challenge that appeared in the last decade is the increasing outsourcing ofnon-core functions of a company to external entities. Even if the legal frameworks inplace extend auditing requirements to these outsourcing companies, lots of technicaland sometimes legal barriers exist to cross-company fraud detection. Classical inter-operability problems come in the way here, and even mundane issues of clock syn-chronization can cause headaches. In addition, data protection regulations on employeeprivacy laws sometimes restrain the scope of what can be done.Finally, and this is more of a business issue than strictly a research one, the en-terprise applications industry needs to lower the Total Cost of Ownership of detectingfraud in enterprises. We need to come to the point when installing and using anti-fraudtools pays for itself through the money recovered. This is not an inaccessible goal whenone knows that, according to the American Association of Certified Fraud Examiners,companies loose on average 5% of their revenues to fraud.

Fraud Detection from a Business Perspective: Future Directions and Challenges

http://drops.dagstuhl.de/opus/volltexte/2008/1795/pdf/08302.FlegelUlrich.ExtAbstract.1795.pdf

Fraud Detection from a Business Perspective: Future Directions and Challenges

Abstract

Similar works

Full text

Available Versions

Dagstuhl Research Online Publication Server