Mining for Prioritizing Investigation of Suspicious Behaviors

In this presentation, we describe our data mining work for government customers to prioritize investigation resources and point them in the right direction with clues and similar cases as to what to focus the investigation on. The goal of data mining within these customers is neither to replace human inspectors nor to fully automate the suspicious behavior detection process. Instead, it is intended to assist human analysts in identifying potential suspects for further inspections. However, in addition to the challenge of identifying the "needle in the haystack", our customers are faced with another challenge of tackling the problem with a limited number of resources. Because of the limited number of available inspectors, it is not feasible for their inspectors to conduct detailed inspection on all targeted suspects identified by their predictive models. Therefore, providing a ranking (or priority) and clues of all potential suspicious activities is critical for effective use of the available inspectors. We also address other challenges in suspicious behavior detection such as highly unbalanced data distributions, unlabeled negative examples, and changing patterns. The talk will end with Q/A and a dialogue with participants on generalizability of the issues and techniques for suspicious behavior analysis in different fraud management applications.