2024-05-26-国际清算银行-大海捞针_一种用于支付系统异常检测的机器学习框架（英）_33页_2mb

BIS Working Paper Summary: "Finding a Needle in a Haystack: A Machine Learning Framework for Anomaly Detection in Payment Systems"

Authors

Ajit Desai, Anneke Kosse, Jacob Sharples

Date

May 2024

Abstract

A novel two-layer machine learning framework is proposed for monitoring high-value payment systems (HVPSs). The first layer uses supervised learning to filter typical transactions, and the second layer applies unsupervised learning to detect anomalies. Tested on Canadian HVPS data, the framework shows high accuracy in detecting anomalies and provides interpretable insights.

Key Points

• Problem Addressed: Real-time monitoring of HVPS transactions to detect anomalies (cyber attacks, operational outages) with high volume and rarity of events.
• Proposed Solution: A layered machine learning framework combining supervised and unsupervised learning.
  • Layer 1: Supervised classification using LightGBM to identify "typical" payments.
  • Layer 2: Unsupervised anomaly detection using the Isolation Forest algorithm on misclassified payments.
• Findings:
  • The LightGBM model achieved ~97% accuracy in classifying normal transactions.
  • The framework successfully detected manipulated anomalous transactions with ~92% accuracy.
  • The SHAP method provided insights into transaction feature impacts on anomalous behavior.
• Applicability:
  • Tested on both the aging Large Value Transfer System (LVTS) and the newer Lynx HVPS in Canada.
  • Demonstrates flexibility for application to other HVPS designs.
• Limitations/Next Steps:
  • Scalability issues with feature dimension as participant count increases.
  • Potential for high misclassification on specialized days if model lacks recent adaptation.
  • Future scope includes regression models and improved handling of edge cases.

Conclusion

The framework offers a promising, flexible, and interpretable solution for HVPS transaction monitoring, effectively addressing data scarcity and high dimensionality challenges through its layered architecture.