The paper proposes a method for fraud detection analysis in databases. The main idea of the method is to use fractal analysis of numerical information in databases to identify anomalies caused by substitution or distortion of initial data.In this paper, a criterion based on fractal analysis is used. The results of experiments on simulated data are presented.
The task of identifying fraud in corporate and government databases is one and the most important in
data mining. In recent years, a large number of methods for solving this problem have been developed
[
Classiciterated function systems (IFS) algorithm for images searches the best affine transformation
from domain to range block for every range block[
I* =F (I ) =C1,4I + c5,6 , (1) where I* = (i* , j* )T , I = (i, j)T – ) is the coordinates of pixel from domain and range block accordingly, C1,4 =c12 , c5,6
c c3 c4 =– c5 transformation coefficients, ui*, j , ui, j – is the pixel brightness from range c6 and domain area, а c7 , c8 – contrast and brightness shift parameter.
The transformation is conducted in a class of contraction mapping to obtain a unique and stable fractal image. Parameters of transformations c1 − c8 are computed by IFS fractal compression algorithm: c1 − c4 are selected from the possible sets, c5 , c6 are calculated in the process of searching the best affine transformation from domain to range block, c7 , c8 – are calculated on the average brightness of domain and range blocks. Specificity analysis of numerical and textual data requires adaptation of this approach. The main element for the analysis was selected rows of database tables. First, the source data in the database tables often contain heterogeneous information: text, numbers, images, binary data, etc. In our experiments, only text and numeric information was used, and in the preprocessing phase, the text was converted into numbers in accordance with the character encoding table. As a result of preprocessing, each row of the table was represented as a one-dimensional array of numbers. After that, each line of the database is divided into one-dimensional range and domain areas, and by analogy with the formula (1), self-similar data sections are searched. As a result, at the training stage, we select from the database knowingly genuine and correct rows, and form a set of corresponding transformations. At the stage of recognition of fraudulent records in the database, using sets of received transformations, we find the distance: where I * – initial database row, Is* – size of initial database row, Fi* – set of transformations for correct rows, d - Euclidean norm. A distance value significantly greater than the average value for a particular table in the database means that the current row can be fraudulent.
To test the approach described above, we used test database tables describing pension contributions in the corporate enterprise database.An example of the initial data is shown in Figure 1.
Di = d (Fi*I *, I * )
Is* , (2)
To train the method, 10,000 rows were used from the database.Then, we changed the database, in the first version we added 100 new lines with the correct information, in the second version we added 100 lines with false and fraud information.And counted the distance by formula (2) for both versions.The results of the distribution of distances are shown in Figure 2.
As a result of the experiment, it was found that for 73% of false rows, the distance was significantly larger than the correct ones.In future work planned to find the area of applicability of this approach and to conduct experiments on a large sample of data.