1. 1 AT&T Proprietary Data Mining A pproach to Subscription Fraud Detection for AT&T Cards Hyunsook Lee, Summer Intern Risk and Revenue Modeling Group, AT&T Labs Supervised by Colin Goodall

2. 2 AT&T Proprietary Objective: finding patterns in subscription fraud Contents a. Background b. Graphics c. Association Rules Discussion

3. 3 AT&T Proprietary Data mining My definition : finding patterns or systematic relationships exploring data and TRANSFORMING them to indicators of interest Graphical Analysis Using DATA MINING TOOLS SAS Enterprise Miner

4. 4 AT&T Proprietary Subscription Fraud Detection Analysis What is Fraud Subscription? Why the analysis is needed How to do it? a. Detecting subscription fraud from patterns of usage b. High Usage : Thresholding, but not only that… c. Other peculiar usage patterns : such as… d. Understanding calling cards e. Factors are possibly correlated Design and create new signatures graphics and association rules will help

5. 5 AT&T Proprietary Data Sets & properties data sets: FASC, CARM FRAT : contains fraudulent info FPD : 1 st default payment data ( ):indicates business focus on FRAT data to find specific patterns of fraudsters FRATFPD #calls604141(8040)173234 #cards7927(50)917 #accounts5053(34)551 Period358 days158 days

6. 6 AT&T Proprietary Graphics.. # cards/(Paccount or BTN)

7. 7

8. 8 AT&T Proprietary Association Rules What are Association Rules ? a. customers’ item buying patterns b. support : P(A  B), confidence: P(A|B) How do we apply? a. analyze calls of each card and generate variables b. Variable generation based on idea from graphics and thresholding

9. 9 AT&T Proprietary Variable generation & logics Possible characters of fraudulent cards a.Many international calls b.Zero Length calls, No Recorded calls c.Many calls d.Long duration, High rate e.Peculiar usage after certain period(such as 1 month) f.Satisfy $ based threshold, etc.

10. 10 AT&T Proprietary NAMEDescriptionReference NonUSAAt least one calls made outside USAFPD, 3 rd INT> 4.3% international calls madeFPD, 3 rd Tint> 1.5% calls terminated to outside USAFPD, 3 rd OintAt least one calls originated to outside USAFPD, 3 rd NoRecAt least one calls recorded -1FPD, out ZeroLAll calls are zero lengthFPD, 3 rd BusH>54.5% calls made during business hoursFPD,3 rd LeisH>65.2% calls made during leisure hours(evening, weekend)FPD,3 rd NightH>8.9% calls made during night hoursFPD,3 rd WkEnd> 50% calls made during weekend WkDay> 50% calls made during weekdays TLNcard10 or 17 digits of card number TCcard6,7,8,9,16 digits of card number AT&T, Commercial, LEC : Billing Number Content …More variable can be generated…

11. 11 AT&T Proprietary Results from by SAS Enterprise Miner

12. 12 AT&T Proprietary Frequency of items

13. 13 AT&T Proprietary Items generated by usage patterns, 60% confidence

14. 14 AT&T Proprietary Future work Various approaches to generate Variables and Association Rules Classification methods are challenges: TREE, Random Forest…