Modeling Users’ Behavior Sequences with Hierarchical Explainable Network for Cross-domain Fraud Detection

Given a user’s behavior event sequence $E=[e_{1},e_{2},\cdots,e_{T}]$, where $T$ is the the length of the sequence. Each behavior event $e$ has $n$ fields, such as IP_address, Event_category, Issuer, etc. The behavior event is denoted as $e_{t}=[x^{t}_{1},x^{t}_{2},\cdots,x_{n}^{t}],(1\leq t\leq T)$, where $x^{t}_{i}$ denotes the value of the $i$-th field. The task is to predict whether the target payment event $e_{T}$ is fraud ($y=1$ denotes $e_{T}$ is fraud) with the user’s historical behavior event sequence $[e_{1},e_{2},\cdots,e_{T-1}]$ and available information of the target event $e_{T}$. In such setting, the task can be formulated as a binary prediction task.

Look-up embedding has been widely adopted to learn dense representations from raw data for prediction (He and Chua, 2017; Tang and Wang, 2018). In practice, we have two types of fields, categorical fields that have a limited number of distinct values (such as Issuer, Event_category) and numerical fields which are continuous values (such as Balance_amount). For the two types of fields, the methods of look-up embedding are different. We formulate the embedding matrix or the look-up table of the $i$-th field as:

where $k$ denotes the dimension of the embedding vectors, and $m$ denotes the number of distinct values in a categorical field $\{1,2,\cdots,m\}$. Then, we obtain the embedding vector of $x_{i}^{t}$ by:

where $\Phi_{i}[x_{i}^{t}]$ denotes the $x_{i}^{t}$-th row of $\Phi_{i}$.

The field-level extractor aims to extract the event representations from the embedding vectors of fields. However, some existing methods (Zhang et al., 2018; Wang et al., 2017c; Tang et al., 2019) only use a simple dense layer and the embedding concatenation as the field-level extractor, which could not effectively extract the internal information of each behavior event. In addition, the results of the above methods are hard to interpret. We aim to design a novel field-level extractor that could not only extract the internal information of each behavior event more effective but also score the importance of different fields.

Recent studies (Rendle, 2010; Wang et al., 2017b; He and Chua, 2017; Lian et al., 2018) find that the high-order feature interaction is very useful. Inspired by the success of factorization machines (Rendle, 2010) which captures the second-order feature interaction, we design a novel field-level extractor that captures both the first- and second-order feature interaction, and the event representations could be fed into the event-level extractor and MLP to capture higher-order feature interaction. The field-level extractor is formulated as:

$\bm{e}_{t}\in\mathbb{R}^{k}$ denotes the event embedding of the $t$-th event $e_{t}$, and $\bm{v_{i}^{t}}$ denotes the $i$-th field embedding of the $t$-th event. $\odot$ represents Hadamard product. $w_{i}^{t}$ is the attention weight for $\bm{v_{i}^{t}}$ which is computed as:

where $a^{i}_{x_{i}^{t}}$ is a learnable parameter for the embedding of $x_{i}^{t}$ of the $i$-th field. In other words, for each value of each categorical field and each numerical field, the model learns a learnable parameter. Note that for all values $x_{i}^{t}$ of a numerical field, the $a^{i}_{x_{i}^{t}}$ is the same parameter (not related to the values of $x_{i}^{t}$). Due to all pairwise interactions need to be computed, the complexity of straight forward computation of Equation 3 is in $O(kn^{2})$. Actually, it can be reformulated to linear runtime $O(kn)$ (Rendle, 2010):

Our field-level extractor is able to choose informative fields. $\bm{w}^{t}=[w_{1}^{t},\cdots,w_{n}^{t}]$ indicates the attention distribution of field embeddings that could explain which field embedding is more important to represent event embedding.

The event-level extractor aims to extract the sequence embedding from the historical event embedding vectors $[\bm{e}_{1},\cdots,\bm{e}_{T-1}]$. Some existing approaches (He and McAuley, 2016; Tang and Wang, 2018; Wang et al., 2017c; Zhang et al., 2018) use such as Markov chains, CNN, RNN as the event-level extractor. These methods only capture the sequential information, however, they suffer from the problem of lacking explainability. With the attention mechanism, we design an explainable event-level extractor as:

where $u_{t}$ is the attention weight which is formulated as:

where $<\cdot,\cdot>$ denotes the inner product. $f_{1}(\cdot)$, $f_{2}(\cdot)$ and $f_{3}(\cdot)$ represent the feed-forward networks to project the input event vector $\bm{e}_{t}$ to one new vector representation. Actually, there are lots of ways to design $f_{1}(\cdot)$, $f_{2}(\cdot)$ and $f_{3}(\cdot)$. In this paper, we use one simple dense layer as $f_{1}(\cdot)$, $f_{2}(\cdot)$ and $f_{3}(\cdot)$.

With the attention mechanism, our event-level extractor is able to score the event importance, and from the score, we could find which event is more important to represent the sequence embedding. To analyze the score of fraud samples, we could find some high-risk behavior sequences.

We concatenate the sequence embedding $\bm{s}$ and the target event embedding $\bm{e}_{T}$ as $[\bm{s},\bm{e}_{T}]$. And then, we feed $[\bm{s},\bm{e}_{T}]$ into a multi-layer perceptron (MLP) to get the final prediction $\hat{y}$:

where $l(\cdot)$ is the linear part just like the “wide” part in Wide & Deep (Cheng et al., 2016) to capture the first-order information:

where $c_{i}(\cdot)\in\mathbb{R}(i\in\{1,\cdots,n\})$ indicates the mapping function of the $i$-th field which could denote the importance of the feature. Actually, $c_{i}(\cdot)$ is a look-up embedding layer as Section 3.2 with the dimension $k=1$. With the fraud sample $e_{T}$, it is easy to understand that the value of $c_{i}(x_{i}^{T})$ should be big. Hence, the wide layer of HEN could help to identify specific value of fields with high-risk/low-risk, which could be used as whitelist/blacklist. For example, the $i$-th categorical field has two distinct values $x_{1},x_{2}$, and $c_{i}(x_{1})>c_{i}(x_{2})$ indicates $x_{1}$ is higher-risk than $x_{2}$.

For binary prediction tasks, we need to minimize the negative log-likelihood:

where $N$ is the number of samples, $y$ is the label of sample $e_{T}$, $\theta$ is the parameters set and $\mathcal{D}$ is the dataset. The overall structure of HEN is shown in Figure 2.

In cross-domain fraud detection problem, we are given a source domain $\mathcal{D}^{src}=\{(E^{src}_{i},y^{src}_{i})\}_{i=1}^{N^{src}}$ of $N^{src}$ labeled samples ($E^{src}_{i}$ has the same definition as Section 3.1 and $y^{src}_{i}$ denotes the label of $e^{src}_{T}$ in $E^{src}_{i}$). Similarly, we have a target domain $\mathcal{D}^{tgt}=\{(E^{tgt}_{i},y^{tgt}_{i})\}_{i=1}^{N^{tgt}_{train}}\bigcup\{(E^{tgt}_{i})\}_{i=1}^{N^{tgt}_{test}}$. Note that $N_{train}^{tgt}\ll N^{src}$ which is also called semi-supervised transfer problem (Tzeng et al., 2015). The transfer task aims to improve the model performance on the unlabeled test set $\{(E^{tgt}_{i})\}_{i=1}^{N^{tgt}_{test}}$ with the help of $\mathcal{D}^{src}$.

We find that some fields of different domains have unshared values, such as IP_address, City, while some fields share the same values, such as Event_category, Card_type. In addition, we conduct experiments to train a model on $\mathcal{D}^{s}$, and the performance of the model on $\{(E^{t}_{i})\}_{i=1}^{N^{tgt}_{test}}$ is unsatisfying. The main reason for the unsatisfying performance is that models trained on source samples could not learn the embedding of the unshared fields. Hence, we consider to share the embedding of the fields’ shared values and learn the embedding of the unshared values respectively (named domain-shared embedding layer as shown in Figure 3).

With more samples, the domain-shared embedding layer could learn the shared embedding better. However, it has some negative influence. For example, even though the Issuer bank information is shared by both domains, the Issuer distribution of the fraudsters may differ a lot in the two domains. Since the source samples are much more than the target samples, the domain-shared embedding would more focus on Issuer1 which would lose the domain-specific information. Hence, we also design a source- and target-specific embedding layer to capture the domain-specific information.

The behavior sequence extractor aims to extract the sequence feature from the embedding of fields for prediction. It is easy to consider sharing the behavior sequence extractor for all domain-shared, source- and target-specific embedding. However, there are two bottlenecks with single shared behavior sequence extractor: (1) The distributions of the domain-shared, source- and target-specific embedding are completely different, which may affect the performance of the network. (2) The shared behavior sequence extractor could not capture all sequential information of both domains, and it misses some domain-specific sequential information.

Hence, we propose domain-shared and domain-specific behavior sequence extractors as shown in Figure 3. There are three main advantages of the structure: (1) The domain-shared behavior sequence extractor focuses on common sequential information. (2) The target-specific extractor can make up for the disadvantages of the domain-shared extractor which ignores the target-specific knowledge, and it could capture sufficient target-specific sequential information. (3) The source-specific extractor could capture sufficient source-specific sequential information. Here, we formulate the representations extracted by domain-shared, target-specific and source-specific extractors as $\bm{z}_{share},\bm{z}^{tgt}_{spe},\bm{z}^{src}_{spe}$, respectively.

The shared behavior sequence extractor could extract sequence representations that contain domain-shared sequential information. In addition, the domain-specific behavior sequence extractor could extract more specific sequential information which could make up for the disadvantages of the domain-shared extractor. By combining the two representations $\bm{z}_{share},\bm{z}_{spe}$, it could contain more useful knowledge. The simplest methods to combine the two representations are such as average and concatenation. However, for different samples, the weights of the shared and specific knowledge would be different. Meanwhile, they could not explain from which part the knowledge is more important for target prediction. Hence, we also propose a domain attention mechanism to combine the two representations:

where $o\in\{tgt,src\}$ denotes the domain of the representations $\bm{z}$, and $b^{o}$ is the attention weight which is formulated as:

where $p\in\{share,spe\}$, $g_{1}(\cdot)$, $g_{2}(\cdot)$ and $g_{3}(\cdot)$ are the feed-forward networks to project the input representations $\bm{z}$ to new representations. Domain attention module is capable of learning the importance of domain-shared and domain-specific representations.

Note that the distributions of representations $\bm{z}^{src}$ and $\bm{z}^{tgt}$ are different. We could feed them into a source MLP and a target MLP, respectively. However, we find the performance is unsatisfying, and the reason would be the limitation of target samples which lead to the target MLP overfitting. Thus we consider aligning the distributions of representations $\bm{z}^{src}$ and $\bm{z}^{tgt}$, and feeding them into the same MLP to avoid overfitting. Most existing transfer approaches (Long et al., 2015; Tzeng et al., 2015; Sun and Saenko, 2016; Ganin et al., 2016; Xie et al., 2018) aim to align the marginal and conditional distributions. However, in our scenario, the class distribution is extremely unbalanced that the number of non-fraud samples is about 100 times more than fraud samples. Hence, aligning the marginal and conditional distributions would lead to unsatisfying performance. For our scene, we propose Class-aware Euclidean Distance which explicitly takes the class information into account and measures the intra-class and inter-class discrepancy across domains. First, we formulate Euclidean Distance between two classes as:

where $c_{1}$ and $c_{2}$ denote the class label (fraud and non-fraud), and $N^{o_{1}}_{c_{1}},N^{o_{2}}_{c_{2}}$ represent the numbers of samples of classes $c_{1},c_{2}$ in $o_{1}$ and $o_{2}$ domains, respectively. The $d(\mathcal{D}^{o_{1}}_{c_{1}},\mathcal{D}^{o_{2}}_{c_{2}})$ denotes the Euclidean Distance between the embeddings of class $c_{1}$ in $o1$ domain and class $c_{2}$ in $o_{2}$ domain. Note that $o_{1}$ and $o_{2}$ could denote the same domain. Then, we formulate Class-aware Euclidean Distance as:

where the numerator represents the sum of intra-class distance and the denominator denotes the sum of inter-class distance. Existing transfer methods that align marginal distributions ignore the class information (Long et al., 2015; Tzeng et al., 2015; Sun and Saenko, 2016). The transfer methods which match conditional distributions consider the intra-class information without considering the inter-class information (Xie et al., 2018). By minimizing the left part of Equation (14), the intra-class domain discrepancy is minimized to compact the feature representations of samples within a class, whereas the inter-class domain discrepancy is maximized to push the representations of each other further away from the decision boundary. Hence, Class-aware Euclidean Distance could achieve better performance in our scene.

The general transfer framework as shown in Figure 3 could be applied upon various existing models in the Embedding & MLP paradigm. The most important thing to apply the transfer framework is to define the behavior sequence extractor. For our HEN, the behavior sequence extractor contains a field-level extractor and an event-level extractor as shown in Figure 2. For neural factorization machines (NFM) (He and Chua, 2017), we use the FM module as the behavior sequence extractor. For wide & deep (Cheng et al., 2016), we use a dense layer as the behavior sequence extractor. For all models, we feed the output of the behavior sequence extractor into an MLP to get the final prediction. Other details are easy to understand as shown in Figure 3.

The training mainly follows the back-propagation algorithm. The target loss is formulated as:

where $\lambda$ is a trade-off parameter, $L_{cls}$ denotes the classification loss and $L_{da}$ denotes the domain adaptation loss. In this paper, we choose the Class-aware Euclidean Distance in Equation (14) as $L_{da}$. $L_{cls}$ can choose most classification loss, such as negative log-likelihood, Least Square loss, Pair-wise loss. In this paper, we adopt negative log-likelihood for training as Equation (10).

The fraud detection dataset ²²2In order to comply with the data protection regulation in each country, multiple approaches have been taken in the data processing step, which include but are not limited to: personally identifiable information (PII) encrypted with salted MD5, data abstraction, data sampling, etc. By doing so, no original data could be restored and the statistics in this manuscript does not represent any the real business status. Meanwhile the dataset is generated only for research purpose in our study and will be destroyed after the experiments. is collected from one of the world-leading cross-border e-commerce company, which utilizes the risk management system to detect the transaction frauds. The dataset contains the card transaction samples from four countries (C1, C2, C3, C4), across a timespan of 10 weeks in 2019. For samples in each country, we utilize users’ historical behavior sequences of the last month. The task is to detect whether the current payment event is a card-stolen case, with knowing users’ historical sequential information. The fraud labels are collected from the chargeback reports from card issuer banks (e.g., the card issuer receives claims on unauthorized charges from the cardholders and report related transaction frauds to the merchants) and label propagation (e.g., the device and card information are also utilized to mark similar transactions). The details of the dataset are listed in Table 1.

To show the effectiveness of HEN, we choose 4 prediction models as baselines.

• •

  W & D (Cheng et al., 2016): In real industrial applications, Wide & Deep model has been widely accepted. It consists of two parts: i) wide model, which handles the manually designed cross-field features, ii) deep model, which automatically extracts nonlinear relations among features.

• •

  NFM (He and Chua, 2017): It is a recent state-of-the-art simple and efficient neural factorization machine model. It feeds dense embedding into FM, and the output of FM is fed to MLP for capturing higher-order feature interactions.

• •

  LSTM4FD (Zhang et al., 2018; Wang et al., 2017c): Some work has applied LSTM for the sequence-based fraud detection tasks, and we called these methods as LSTM4FD.

• •

  M3R (Tang et al., 2019): It is a most recent hierarchical sequence-based model (M3R and M3C) which deals with both short-term and long-term dependencies with mixture models. We choose the better hierarchical model M3R as the baseline.

Note that our transfer framework is a general framework that can be applied upon various existing models in the Embedding & MLP paradigm. To show the compatibility of our transfer framework, we apply our transfer framework upon both non-hierarchical models (W & D, NFM) and hierarchical models (LSTM4FD, M3R, HEN). For W & D, we add a dense layer as the behavior sequence extractor before MLP. For NFM, we use the FM as the extractor before MLP. For hierarchical models, we use the combination of event-level and field-level extractor as the behavior sequence extractor.

To demonstrate how each component contributes to the overall performance, we now present an ablation test on our transfer framework. To prove the effectiveness of the transfer framework, we not only compare each component but also compare it with some baselines. We divide the ablation study into three parts: (1) Only use samples of single domain: target (only use data of target domain), source (only use data of source domain). (2) Considering the design of structure: pretrain (Hinton et al., 2006) (first train a model on source domain and then fine-tune on target domain), domain-shared (combine source and target dataset into single dataset, and share the common embedding and network), our structure (the structure designed by us contains domain-shared, domain-specific parts and the domain attention without domain adaptation loss). (3) Based on our structure, compare different domain adaptation loss: Coral (Sun and Saenko, 2016) (align the second-order statistics of the source and target distributions), Adversarial (Ganin et al., 2016) (adversarial training), MMD (Long et al., 2015; Zhu et al., 2019a) (a kernel two-sample test), CMMD (Long et al., 2013; Wang et al., 2017a; Zhu et al., 2019b) (conditional MMD), ED (Euclidean Distance), CED (Xie et al., 2018) (Conditional Euclidean Distance), ours (use the Class-aware Euclidean Distance to align the distributions, which also denotes the overall transfer framework).

We conduct experiments for ablation study with dataset C1 as the source domain and dataset C4 as the target domain. Besides, all experiments are based on HEN, and the results are shown in Table 2. From the results, we can make interesting observations:

• •

  The performance of ‘our structure’ is better than ‘target’, which proves the domain-shared and domain-specific structure is useful. ‘ours’ outperforms ‘our structure’ that proves the aligning distributions with Class-aware Euclidean Distance is effective. Hence, each component of the transfer framework is useful and effective.

• •

  In the first part, the performance of ‘source’ is largely worse than ‘target’ which proves the domain shift between source and target domains could seriously destroy the performance. Thus it is necessary to use effective transfer methods.

• •

  Comparing ‘our structure’ with ‘pretrain’ and ‘domain-shared’, we could find ‘our structure’ is more effective. ‘pretrain’ and ‘domain-shared’ are simple and generally adopted transfer methods. The results show ‘ours’ outperforms the general transfer methods which demonstrate our transfer framework is more suitable for cross-domain fraud detection.

• •

  Comparing different domain adaptation loss, we could find ‘ours’ outperforms both marginal and conditional methods which prove the effectiveness of Class-aware Euclidean Distance in this scene. Besides, the performance of ‘Coral’, ‘Adversarial’, ‘MMD’, ‘CMMD’ is worse than ‘our structure’ without domain adaptation loss, which reveals that the inappropriate aligning methods could lead to negative transfer.

Overall, we observe each component of the transfer framework is effective, and the Class-aware Euclidean Distance is more suitable than previous marginal and conditional aligning methods for our scenario.