[[alternative]]線上拍賣詐騙之有效偵測

博士[[abstract]]近年來，線上拍賣的蓬勃發展有目共睹，儼然成為電子商務最成功的典範之一。然而，龐大的商業利益也引起許多非法人士的注意，詐騙者開始利用各種偽裝來詐取財物，讓消費者防不勝防。長此以往，將嚴重影響線上拍賣的交易安全，並限制其未來發展。有鑒於此，本研究發展出一系列有效的拍賣詐騙早期偵測方法，希望在詐騙發生前便能對使用者提出警訊。此外，為了提升這些方法的實用性，也針對成本考量，提出了多種不同的偵測模式。這些方法的特點如下: (1) 針對早期預警的需求，本論文提出階段性特徵描述法(phased profiling)，在塑模之前，以不同方法切割交易歷史。如此，便可呈現詐騙者在潛伏期不同階段的行為特徵，並有利於詐騙行為變化之觀察。 (2) 考量詐騙者在潛伏期可能展現不同行為，本研究發展出混合階段塑模法(hybrid phased modeling)，以提升早期偵測的效能。有別於傳統方法，混合塑模排除詐騙者在爆發期的交易紀錄，萃取其在潛伏期不同階段的行為特徵，混合之後再行塑模，以加強早期詐騙之偵測能力。同時，我們設計出兩階段偵測流程，以更精細的方式檢驗可疑帳號，進一步提升準確性。 (3) 為降低偵測成本，本研究以前人研究提出的詐騙指標為基礎，利用改良式wrapper approach篩選出一組精簡的指標集，再以此為基礎，建立偵測模型。搭配精簡指標集，本研究進一步發展補集塑模法(complement phased modeling)，以更少量的交易紀錄來塑模。結果不僅提高偵測準確率，同時也減少資料下載的負荷，有利於低成本、高效能之偵測系統的發展。 (4) 為了瞭解詐騙者行為的演進，本研究利用分群技術(clustering)與階段行為描述來進行分析。分析結果不僅對詐騙行為有更進一步的了解，也有助於發展新的詐騙偵測系統，並加強更詐騙偵測的解析能力。 為驗證提出方法之有效性，我們搜集台灣雅虎拍賣網站實際交易資料進行實驗。結果顯示，與前人研究相較，本論文提出之方法能有效提升詐騙偵測準確性，並具有早期偵測效果。若搭配所挑選的精簡指標集，也可達到幾近相同的效果。上述結果說明本研究提出方法確實能兼具成本與效用，有助於增進詐騙偵測系統的實用性，提供線上拍賣使用者更安全、更實際的保障。[[abstract]]In recent years, online auction has become one of the most successful business models; however, the tremendous profit also appeals to many fraudsters. Schemed fraudsters camouflage their malicious intent to distract customers for profit, seriously threatening online auction security. This dissertation aims to develop a set of methods for constructing an effective early fraud detection system. This research proposes various detection methods taking detection cost into account to enhance the practicality of such a system, including the following: (1) To satisfy the need of early fraud detection, a phased profiling approach partitions the transaction histories of traders before detection model construction. The latent behavior of uncovered fraudsters can be extracted from these segmented transaction histories presenting different periods of lifespan that is helpful in observing fraudulent behavior fluctuation. (2) To address the diversity of latent behavior, a hybrid phased modeling method increases the detection accuracy for latent fraudsters. This method extracts features from different phases of the latency period to construct models for enhancing the capability of early fraud detection. To further improve accuracy, a two-stage detection procedure uses various detection models to carefully examine the behavior of a suspicious account. (3) To reduce detection costs, a modified wrapper approach is used to select a concise set of measured attributes, which is then used to construct the model. In addition, a complement phased modeling method increases the accuracy while facilitating the data downloading from the auction site, providing a cost-effective detection procedure. (4) To analyze the evolution of fraudulent behavior, clustering methods incorporated with phased profiling are used to classify the types of fraudsters. This analysis helps to parse fraudulent behavior with greater granularity and resolution. To test the effectiveness of the methods we proposed, real transaction records were collected from Yahoo!Taiwan. The proposed methods not only improve the accuracy of fraud detection but can also identify latent fraudsters, a necessary requirement for early detection. The results show that these methods improve the practicality of fraud detection system, allowing online auction participants and the trading environment to be secured in a cost-effective way.[[tableofcontents]]Table of Contents Chapter 1. Introduction 1 1.1 Motivation and Purpose 3 1.2 Research Scope 8 1.3 Contributions of the Dissertation 9 1.4 Organization of the Dissertation 11 Chapter 2. Literature Review 13 2.1 Reputation Systems used by Auction Houses 13 2.2 Online Auction Fraud Schemes 15 2.3 Early Fraud Detection in Online Auctions 18 2.4 Measured Attributes for Detecting Online Auction Fraud 20 2.5 Modeling Algorithms 23 2.6 Training Data Preparation 28 Chapter 3. Two-Stage Phased Modeling Framework for Early Fraud Detection 30 3.1 Lifespan of a Fraudster 30 3.2 Phase Partitioning Transaction History 33 3.3 Phased Modeling Method 34 3.4 Successive Filtering Procedure 38 3.5 Hybrid-Phased Modeling to Cope with Inconsistent Features of Fraudsters 41 3.6 Two-Stage Fraud Detection Procedure 44 3.7 Experiment of Applying Phased Models 45 3.7.1 Single Phased Models 46 3.7.2 Evaluation Of The Hybrid Phased Detection Model 51 3.7.3 Evaluation of Two-stage Fraud Detection Procedure 53 3.7.4 Phase Prediction 54 Chapter 4. Cost-Effective Methods for Fraud Detection 57 4.1 Candidate Pool of Measured Attributes 57 4.2 Measured Attribute Selection Procedure 61 4.3 Results Applying Single Detection Model 71 4.4 Complement Phased Models 72 4.4.1 The Concept of Late-Profiling 73 4.4.2 Complement phased modeling 76 4.5 Experiment of Applying HCM 81 4.5.1 Data Preparation and Performance Metrics 81 4.5.2 Experimental Results 82 4.6 Discussion on the effect of cost reduction 85 Chapter 5. Fraudulent Behavior Flipping Observation 88 5.1 Fraudulent Behavior Camouflage 88 5.2 Fraudulent Behavior Clustering 90 5.3 Experiment Results of Fraudulent Behavior Clustering 92 5.4 Discussion on Behavior Flipping 97 5.5 Association Rule Mining for Fraudulent Behavior Fluctuation Analysis 100 Chapter 6. Conclusions and Future Work 103 Appendix A- Statistics of Internet Crime Report in 2011 121 Appendix B- Top 10 Internet crime complaint categories 122 Appendix C- Hybrid-phased models vs. individual phased test sets 123 Appendix D- The all 44 measured attribute candidates 124 Appendix E- Behavior difference between the first part and the last part 126 Appendix F- Count of proven fraudsters in Yahoo!Taiwan 127 Publication List 128 List of Tables Table 1 An example data set profiled by four common attributes 22 Table 2 Transaction history of fraudster momo123 32 Table 3 Results of MC&F (100%) to test T(r%) 48 Table 4 Results of single phased M(r%) to test T(r%) 49 Table 5 Results of applying the successive filtering procedure only 50 Table 6 Results of fraud detection by hybrid-phased models only 51 Table 7 Detecting phase 80% fraudsters with hybrid-phased models only 52 Table 8 Results of two-stage fraud detection procedure 53 Table 9 Performance comparison of phase prediction 55 Table 10 Counts of being detected fraudsters by phased models 56 Table 11 Categories of measured attributes 58 Table 12 Top 5 promising measured attribute in 5 phases 66 Table 13 The 10 selected measured attributes 68 Table 14 The seven selected measured attributes 69 Table 15 Performance comparison of different number of measured attributes 70 Table 16 Results of potential fraudster identification using hybrid phased models 71 Table 17 Distribution of the located phase of break point 83 Table 18 Averaged results of ten runs of hybrid complement phased models 84 Table 19 Performance comparison of the six algorithms 86 Table 20 Results of clustered phased profiles 93 Table 21 Counts of being identified by phased profiles 94 Table 22 Outcome of applying c4.5 decision trees 97 Table 23 Prediction errors 97 Table 24 Fraudulent behavior switching patterns 98 Table 25 The 10 best association rules generated by Apriori 101 List of Figures Figure 1 An example of classification tree for fraud detection 26 Figure 2 IB1 algorithm 27 Figure 3 Conventional fraud detection methods 31 Figure 4 Phase partitioning based on accumulated ratings 34 Figure 5 Phased r % Model 35 Figure 6 Partition transaction histories for building phased models 37 Figure 7 Using phased models to detect fraudsters 38 Figure 8 Successive filtering procedure 39 Figure 9 Concept of the hybrid-phased models 42 Figure 10 Hybrid-phased models construction 43 Figure 11 Two-stage fraud detection procedure 45 Figure 12 A wrapper by Kohavi & John (1997) 62 Figure 13 The modified wrapper (originated from Kohavi & John, 1997) 64 Figure 14 Attribute selection procedure for early fraud detection in pseudo code 65 Figure 15 Illustration of an identity theft 74 Figure 16 Differences of fraudster profiles and legitimate user profiles 75 Figure 17 Procedure of cost-effective detection 76 Figure 18 Complement phased models 77 Figure 19 Complement phased models inspection 79 Figure 20 Complement phased model construction in pseudo code 80 Figure 21 Different cluster presentations 92 Figure 22 General types of fraudulent behavior 95 Figure 23 Examples of fraudulent behavior switching 98[[note]]學號: 893560424, 學年度: 10