Detection and Explanation of Anomalous Payment …...Detection and Explanation of Anomalous Payment...

Detection and Explanation of AnomalousPayment Behavior in Real-Time Gross Settlement

Systems

Ron Triepels1,2 Hennie Daniels1,3 Ronald Heijmans2

15th Payment System Simulator SeminarHelsinki, Finland

31 August - 1 September 2017

1Tilburg University, 2De Nederlandsche Bank, 3Erasmus University

Triepels, Daniels and Heijmans Detection and Explanation of Anomalous Payment Behavior in Real-Time Gross Settlement Systems

Introduction

RTGS Systems:

Facilitate the settlement of financial transactions

Settle transactions gross and (almost) real-time

Systemic Risk:

”The risk associated with any event that threatens the stabilityof a financial system as a whole” (Berndsen, et al., 2016).

Research Goal:

Apply Machine Learning to analyze payment data

Automatically identify anomalies (stress or undesired behavior)


Anomaly Detection

Anomaly:

”A pattern that does not conform to expected behavior”(Chandola et al., 2009).

Unsupervised Anomaly Detection:

The task of automatically identifying anomalies in a set ofunlabeled data.

Components:

Model of ’normal’ behavior

Distance function


Lossy Compression

Lossy compression preserves the most important features of data.

Original Picture Reconstructed Picture


Definitions

Let B = {b1, . . . , bn} be a set of n banks and T =< t1, . . . , tm > be anordered set of m time intervals.

We extract D = {A(1), . . . ,A(m)} a set of m liquidity matrices from aRTGS system where each A(k) ∈ D is:

A(k) =

a(k)11 · · · a

(k)1n

.... . .

...

a(k)n1 · · · a

(k)nn

(1)

Each element a(k)ij is the liquidity flow between bi and bj at tk .

Liquidity Vector:

a(k) = [a(k)11 , . . . , a

(k)n1 , . . . , a

(k)1n , . . . , a

(k)nn ]T (2)


Anomaly Detection Task

Let M be a lossy compression model. We measure the reconstructionerror of a(k) after its compressed and reconstructed by M by:

RE(a(k)) =1

2||a(k) − a(k)||22 (3)

Accordingly, we classify a(k) by:

h(a(k)) =

{1 if RE(a(k)) ≥ ε)0 otherwise

(4)

Here, ε > 0 is a threshold.


Autoencoder

We employ a three-layered autoencoder to compress and reconstructliquidity vectors. The autoencoder can be defined by two functions:

Encoder function φ:

φ(a(k)) = f (l)(W1a(k) + b1) (5)

Decoder function ψ:

ψ(φ(a(k))) = g (n2)(W2φ(a(k)) + b2) (6)


Autoencoder Architecture

a(k)11

...

a(k)nn

h(k)1

...

h(k)l

a(k)11

...

a(k)nn

φ(a(k)) ψ(φ(a(k)))

RE(a(k))


Model Learning

Parameters θ = {W1,W2,b1,b2} are estimated from historic liquidityvectors. We do this by minimizing the following cost function:

J (θ) =1

2m

m∑k=1

||ψ(φ(a(k)))− a(k)||22 +λ

2

2∑i=1

||Wi ||2F (7)

Here, λ is a regularization parameter.

We apply stochastic gradient descent in conjunction withback-propagation to solve this optimization problem: I.o.w anoptimization algorithm.


Experimental Setup

Payment Data:

2.3 million client payments from TARGET2-NL

Jan 2014 - Oct 2015

Aggregated over 4,680 consecutive hours

20 largest banks

Two autoencoders:

Linear (AE-L) with (linear/linear) activations

Non-linear (AE-S) with (sigmoid/linear) activations

Data partitioning:

Holdout set (2 months)

Training set (16 months)

Test set (4 months)


Grid search (1/2)

The number of neurons was optimized by a grid search.

0.6

5.0

10.0

15.0

20.025.030.035.0

10 40 70 100 130 160 190 220 250 280 310 340 370 400Neurons

MR

E (

Hol

dout

Set

) AE-LAE-SAE-T


Commercial Bank Run Simulation

Choose a bank bi and increase its outflow to each bj ∈ B over time:

a(k)ij := a

(k)ij + c

(k)ij d

(k)ij (8)

where:

c(k)ij ∼ B(1, p

(k)ij ) determines if liquidity is added.

d(k)ij ∼ Exp(δ

(k)ij ) is the amount of additional liquidity.

Multipliers

Rate Duration ps pe δs δe

Baseline 2 140 1 2 0.1 0.01


Baseline Simulation of AE-L

10

20

30

40

50

3390 3590 3790 3990 4190 4390 4590

Time Interval

RE

Bank Run Original

AE−L


Anomalies in real data (1/3)

A B C

0

1

2

3

4

5

6

3032

3025

2971

2952

2943

2934

2880

2863

2853

2821

2778

2767

2744

2722

2713

2698

2678

2666

2651

2622

Time Interval

RE

(T

est

Set)



5

10

15

20

288028632853Time Interval

Ban

k

(0%,25%] (25%,50%] (50%,75%] (75%,100%]

Outflow

5

10

15

20

288028632853Time Interval

Ban

k

(0%,25%] (25%,50%] (50%,75%] (75%,100%]

Inflow



Bank run did not follow ‘normal’ pattern because of:

Initially continuous outflow.

Part of the ‘gaps’ had no payments (no liquidity, clients no access toaccounts).

Increased flows still considered ‘normal’.


Conclusions

Autoencoder can detect anomalous flows reasonably well.

Start of bank run well detected.

However, part of the anomalous flows during bank run missed.


Questions?


Date post:	07-May-2020
Category:	Documents
Upload:	others
View:	10 times
Download:	0 times

Detection and Explanation of Anomalous Payment …...Detection and Explanation of Anomalous Payment...

Documents