Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Deep Anomaly Detection
From research to production
Leveraging Spark and TensorFlow
Davit Bzhalava, Shaheer Mansoor, Erik E...
Introduction
Sweden
Population: 10.2 million
Private customers: 4.0 million
Corporate customers: 335 000
Branches: 248
Employees: 8 600...
Swedbank HQ, Stockholm
Analytics & AI
R&D
Data exploration, advanced
analytics discovery and AI
research.
Long term.
Delivery & Service
Deliver o...
Why this now?
0
10
20
30
40
50
60
70
80
2010 2011 2012 2013 2014 2015 2016 2017 2018 2019
The police Univers ities Healthc...
Our approach to data science
A multi-lingual team
Data
scientists
Python
Statisticians
R
Data
analysts
Python
SQL
Machine learning
engineers
Java
Scala
A platform- and framework
agnostic approach
Collect
data
Feature
engineer
Analyse
Model
Deploy
Monitor
Act
From R&D to production
Research-research
platform
Prepare datasets
Build and train model
Production-research
platform
Tran...
Production-research
platform
Production
platform
Translate and package model Publish and run model
From R&D to production
...
Anomaly detection
Why Deep Anomaly Detection?
Fraud schemes are living organisms, far from static
scenarios.
Complexity of schemes on the gr...
Contrasting old and new
IF
Transactions count > 3
AND
Transactions amount > 50 000 SEK
AND
Country is on red list
THEN
Fla...
Feature engineering
F
e
a
t
u
r
e
e
n
g
i
n
e
e
r
i
n
g
:
t
r
a
n
s
a
c
t
i
o
n
s
2
v
e
c
Writing to the feature store
val transactionsFeature...
Generative Adversarial Networks
for anomaly detection
Generative Adversarial Networks cheat sheet
R: Real data
G: Generator
(forger)
D: Discriminator
GANs in anomaly detection
R: Normal
transactions
G: Random
noise
D: Discriminator
Probability
FakeReal
GANs in anomaly detection
D: Discriminator
R: Normal
transactions
G: Imitation of
normal transactions
Probability
FakeReal...
GANs in anomaly detection
D: DiscriminatorAll transactions
Probability
CriminalNormal
GAN estimator API
def build_gan():
fake_input = generator_network(noise)
d_logit_real = discriminator_network(real_input)
...
GAN estimator API
def build_gan():
fake_input = generator_network(noise)
d_logit_real = discriminator_network(real_input)
...
GAN estimator API
def build_gan():
fake_input = generator_network(noise)
d_logit_real = discriminator_network(real_input)
...
F
e
a
t
u
r
e
e
n
g
i
n
e
e
r
i
n
g
:
t
r
a
n
s
a
c
t
i
o
n
s
2
v
e
c
GAN estimator API
def model_fn():
gan_network = buil...
F
e
a
t
u
r
e
e
n
g
i
n
e
e
r
i
n
g
:
t
r
a
n
s
a
c
t
i
o
n
s
2
v
e
c
GAN estimator API
def model_fn():
gan_network = buil...
Proof-of-concept results:
Rule-based approach
True positives
False positives
GAN-based approach
Model Deployment (TensorFlow serving)
TF graph in map function
val path: Path = new Path(inputFrozenGraph)
val hadoopConfig: Configuration = new Configuration()...
TF graph in map function
val path: Path = new Path(inputFrozenGraph)
val hadoopConfig: Configuration = new Configuration()...
Analytical Ops
From R&D to production
Prepare datasets
Build and train model
Translate and package model Publish and run model
Analytical...
From R&D to production
Research-research
platform
Production-research
platform
Production
platform
Capacity High Medium Lo...
Analytical Ops at Swedbank v1.0
Training ScoringEvaluate
Business
acceptance
Manual task
Automated taskConfigure
model tra...
Analytical Ops at Swedbank today
Training ScoringEvaluate
Business
acceptance
Configure
model trainer
Run training
Execute...
Analytical Ops at Swedbank today
Self-service framework
component
The framework provides the
toolbox to achieve the goal, ...
Learnings
Conclusion
› Data science and engineering needs to go hand in hand. A push in industry towards
separating the two, but tha...
Thank you.
Davit Bzhalava, Shaheer Mansoor, Erik Ekerot
Analytics & AI, Swedbank
 Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow
 Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow
 Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow
 Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow
Upcoming SlideShare
Loading in …5
×

of

 Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 1  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 2  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 3  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 4  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 5  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 6  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 7  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 8  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 9  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 10  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 11  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 12  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 13  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 14  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 15  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 16  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 17  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 18  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 19  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 20  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 21  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 22  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 23  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 24  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 25  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 26  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 27  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 28  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 29  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 30  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 31  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 32  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 33  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 34  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 35  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 36  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 37  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 38  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 39  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 40  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 41  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 42  Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow Slide 43
Upcoming SlideShare
What to Upload to SlideShare
Next
Download to read offline and view in fullscreen.

0 Likes

Share

Download to read offline

Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow

Download to read offline

Anomaly detection has numerous applications in a wide variety of fields. In banking, with ever growing heterogeneity and complexity, the difficulty of discovering deviating cases using conventional techniques and scenario definitions is on the rise. In our talk, we’ll present an outline of Swedbank’s ways of constructing and leveraging scalable pipelines based on Spark and Tensorflow in combination with an in-house tailor-made platform to develop, deploy and monitor deep anomaly detection models. In summary, this talk will present Swedbank’s approach on building, unifying and scaling an end-to-end solution using large amounts of heterogeneous imbalanced data. In this talk we will include sections with the following topics: Feature engineering: transactions2vec; Anomaly detection and its applications in banking; Deep anomaly detection methods: Deep SVDD and Generative adversarial networks, Model overview and code snippets in Tensorflow estimator API; Model Deployment: An overview of how the different puzzle pieces outlined above are put together and operationalized to create and end-to-end deployment.

  • Be the first to like this

Deep Anomaly Detection from Research to Production Leveraging Spark and Tensorflow

  1. 1. Deep Anomaly Detection From research to production Leveraging Spark and TensorFlow Davit Bzhalava, Shaheer Mansoor, Erik Ekerot What’s in this talk: We present our work on anomaly detection: describe overall results, how Swedbank goes from research to production, and what we think is important when building AI infrastructure.
  2. 2. Introduction
  3. 3. Sweden Population: 10.2 million Private customers: 4.0 million Corporate customers: 335 000 Branches: 248 Employees: 8 600 Estonia Population: 1.3 million Private customers: 0.9 million Corporate customers: 141 000 Branches: 35 Employees: 2 600 Latvia Population: 2.0 million Private customers: 0.9 million Corporate customers: 91 000 Branches: 41 Employees: 1 800 Lithuania Population: 2.9 million Private customers: 1.5 million Corporate customers: 86 000 Branches: 65 Employees: 2 500 The leading bank in our home markets
  4. 4. Swedbank HQ, Stockholm
  5. 5. Analytics & AI R&D Data exploration, advanced analytics discovery and AI research. Long term. Delivery & Service Deliver on-demand analytics and AI applications addressing immediate business requirements. Short term. Business development Effective support and execution of prioritized value streams and strategic business projects. Medium term. › Established in 2016, consolidating disparate analytics functions across the organization. › Today 30 colleagues. › A mix of data scientists, business analysts, developers, engineers and project managers. › A center of excellence, promoting a data-driven mindset in the bank.
  6. 6. Why this now? 0 10 20 30 40 50 60 70 80 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 The police Univers ities Healthc are National bank Royal house Radio & TV The church The parliam ent Unions Gov ernment The press Large companies EU com mis sion Bank s Political parties Source: Kantar SIFO, Medieakademin, Trust Barometer. Share high/quite high trust. %
  7. 7. Our approach to data science
  8. 8. A multi-lingual team Data scientists Python Statisticians R Data analysts Python SQL Machine learning engineers Java Scala
  9. 9. A platform- and framework agnostic approach Collect data Feature engineer Analyse Model Deploy Monitor Act
  10. 10. From R&D to production Research-research platform Prepare datasets Build and train model Production-research platform Translate and package model Production platform Publish and run model
  11. 11. Production-research platform Production platform Translate and package model Publish and run model From R&D to production Research-research platform Prepare datasets Build and train model Production-research platform Production platform Translate and package model Publish and run model
  12. 12. Anomaly detection
  13. 13. Why Deep Anomaly Detection? Fraud schemes are living organisms, far from static scenarios. Complexity of schemes on the growth due to variety of disruptions. Lack of access to abundant/any recent cases. We don’t always know what we are exactly looking for – but we do know what we are not looking for.
  14. 14. Contrasting old and new IF Transactions count > 3 AND Transactions amount > 50 000 SEK AND Country is on red list THEN Flag model.compile(…) model.fit(…) model.evaluate(…) model.predict(…)
  15. 15. Feature engineering
  16. 16. F e a t u r e e n g i n e e r i n g : t r a n s a c t i o n s 2 v e c Writing to the feature store val transactionsFeatureDs = rawTransactionDs.map( (rawTransaction: RawTransaction) => TransactionFeature( amount = rawTransaction.amount, destination = rawTransaction.destimation, type_of_transaction = rawTransaction.type_of_transaction )) Hops.createFeaturegroup(TRANSACTIONS_FEATUREGROUP) .setDataframe(transactionsFeatureDs.toDF) .setVersion(1) .setDescription("Features of card transactions") .setPrimaryKey("customer_id") .write() Reading from the feature store val transactions_featuresDF = Hops. getFeaturegroup( "Features of card transactions") .read() Hops. createTrainingDataset( "card_transactions_prediction") .setDataframe(transactions_featuresDF) .setVersion(1) .write() val latestVersionTrainDF = Hops. getLatestTrainingDatasetVersion( "card_transactions_prediction") .read()
  17. 17. Generative Adversarial Networks for anomaly detection
  18. 18. Generative Adversarial Networks cheat sheet R: Real data G: Generator (forger) D: Discriminator
  19. 19. GANs in anomaly detection R: Normal transactions G: Random noise D: Discriminator Probability FakeReal
  20. 20. GANs in anomaly detection D: Discriminator R: Normal transactions G: Imitation of normal transactions Probability FakeReal Probability FakeReal
  21. 21. GANs in anomaly detection D: DiscriminatorAll transactions Probability CriminalNormal
  22. 22. GAN estimator API def build_gan(): fake_input = generator_network(noise) d_logit_real = discriminator_network(real_input) d_logit_fake = discriminator_network(fake_input) return d_logit_real, d_logit_fake def gan_loss(): real_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_real, labels=tf.ones_like(d_logit_real))) fake_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_fake, labels=tf.zeros_like(d_logit_fake))) d_loss = real_loss + fake_loss g_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_fake, labels=tf.ones_like(d_logit_fake))) return d_loss, g_loss def gan_optimizer(d_loss, g_loss, d_learning_rate, opt_type): return d_opt, g_opt
  23. 23. GAN estimator API def build_gan(): fake_input = generator_network(noise) d_logit_real = discriminator_network(real_input) d_logit_fake = discriminator_network(fake_input) return d_logit_real, d_logit_fake def gan_loss(): real_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_real, labels=tf.ones_like(d_logit_real))) fake_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_fake, labels=tf.zeros_like(d_logit_fake))) d_loss = real_loss + fake_loss g_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_fake, labels=tf.ones_like(d_logit_fake))) return d_loss, g_loss def gan_optimizer(d_loss, g_loss, d_learning_rate, opt_type): return d_opt, g_opt
  24. 24. GAN estimator API def build_gan(): fake_input = generator_network(noise) d_logit_real = discriminator_network(real_input) d_logit_fake = discriminator_network(fake_input) return d_logit_real, d_logit_fake def gan_loss(): real_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_real, labels=tf.ones_like(d_logit_real))) fake_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_fake, labels=tf.zeros_like(d_logit_fake))) d_loss = real_loss + fake_loss g_loss = tf.reduce_mean(tf.nn.sigmoid_cross_entropy_with_logits(logits=d_logit_fake, labels=tf.ones_like(d_logit_fake))) return d_loss, g_loss def gan_optimizer(d_loss, g_loss, d_learning_rate, opt_type): return d_opt, g_opt
  25. 25. F e a t u r e e n g i n e e r i n g : t r a n s a c t i o n s 2 v e c GAN estimator API def model_fn(): gan_network = build_gan() gan_optimizer = gan_optimizer() estimator = tf.estimator.Estimator( model_fn(), run_config(), params=hparams ) experiment = tf.contrib.learn.Experiment( estimator, train_input_fn = train_input_fn(), eval_input_fn = eval_input_fn() ) experiment.train_and_evaluate() hparams = tf.contrib.training.HParams( n_neurons, n_layers, activation_fn, batch_norm, batch_dropout, …, dropout_rate, kernel_bias_reg, L1_rate, L2_rate, learning_rate, loss_type, opt_type )
  26. 26. F e a t u r e e n g i n e e r i n g : t r a n s a c t i o n s 2 v e c GAN estimator API def model_fn(): gan_network = build_gan() gan_optimizer = gan_optimizer() estimator = tf.estimator.Estimator( model_fn(), run_config(), params=hparams ) experiment = tf.contrib.learn.Experiment( estimator, train_input_fn = train_input_fn(), eval_input_fn = eval_input_fn() ) experiment.train_and_evaluate() hparams = tf.contrib.training.HParams( n_neurons, n_layers, activation_fn, batch_norm, batch_dropout, …, dropout_rate, kernel_bias_reg, L1_rate, L2_rate, learning_rate, loss_type, opt_type )
  27. 27. Proof-of-concept results: Rule-based approach True positives False positives GAN-based approach
  28. 28. Model Deployment (TensorFlow serving)
  29. 29. TF graph in map function val path: Path = new Path(inputFrozenGraph) val hadoopConfig: Configuration = new Configuration() val fileSystem: FileSystem = FileSystem.get(hadoopConfig) val reader: FSDataInputStream = fileSystem.open(path) val length: Int = reader.available() val graph = new Array[Byte](length) reader.readFully(graph) val model: TFModel = ModelFromByteArray.read (graph) val server = TFModelServer.create (model) t val scored_dataset: DataFrame = df.rdd.map(rdd => (sever.serve(RDD2Tensor(rdd), inputNodeName, outputNodeName))).toDF()
  30. 30. TF graph in map function val path: Path = new Path(inputFrozenGraph) val hadoopConfig: Configuration = new Configuration() val fileSystem: FileSystem = FileSystem.get(hadoopConfig) val reader: FSDataInputStream = fileSystem.open(path) val length: Int = reader.available() val graph = new Array[Byte](length) reader.readFully(graph) val model: TFModel = ModelFromByteArray.read (graph) val server = TFModelServer.create (model) t val scored_dataset: DataFrame = df.rdd.map(rdd => (sever.serve(RDD2Tensor(rdd), inputNodeName, outputNodeName))).toDF()
  31. 31. Analytical Ops
  32. 32. From R&D to production Prepare datasets Build and train model Translate and package model Publish and run model Analytical Ops framework Research-research platform Production-research platform Production platform
  33. 33. From R&D to production Research-research platform Production-research platform Production platform Capacity High Medium Low Service level Low Medium High Accessibility High Medium Low Capability High Medium Low Organization R&D R&D + Many
  34. 34. Analytical Ops at Swedbank v1.0 Training ScoringEvaluate Business acceptance Manual task Automated taskConfigure model trainer Run training Execute data scripts Collect artefacts Collect diagnostics Sample testingRun evaluation Collect diagnostics Dashboarding Configure model scoring Run model scoring
  35. 35. Analytical Ops at Swedbank today Training ScoringEvaluate Business acceptance Configure model trainer Run training Execute data scripts Collect artefacts Collect diagnostics Sample testing Run evaluation Collect diagnostics Dashboarding Configure model scoring Run model scoring Download model artefacts NEW Configure model evaluator NEW Collect diagnostics NEW Self-service framework component The framework provides the toolbox to achieve the goal, but workflows need to be run manually. Automated framework component The framework takes care of creating necessary workflows to reach the desired outcome. Training ScoringEvaluate Business acceptance User Interface A data scientist-friendly UI that enables an easy way from training to scoring.
  36. 36. Analytical Ops at Swedbank today Self-service framework component The framework provides the toolbox to achieve the goal, but workflows need to be run manually. Automated framework component The framework takes care of creating necessary workflows to reach the desired outcome. Training ScoringEvaluate Business acceptance User Interface A data scientist-friendly UI that enables an easy way from training to scoring. Data Compute ■ Diagnostics ■ GPU ■ CPU■ Feature store ■ Datasets ■ Model metadata ■ ■ Spark batch ■ TF serving
  37. 37. Learnings
  38. 38. Conclusion › Data science and engineering needs to go hand in hand. A push in industry towards separating the two, but that’s not our model. P-R is the meeting place. › Feature store. Good for decreasing redundant computation and work. One point of truth. › Infrastructure that enables effective hyper parameter tuning is important. GANs are very sensitive to hyper parameter change.
  39. 39. Thank you. Davit Bzhalava, Shaheer Mansoor, Erik Ekerot Analytics & AI, Swedbank

Anomaly detection has numerous applications in a wide variety of fields. In banking, with ever growing heterogeneity and complexity, the difficulty of discovering deviating cases using conventional techniques and scenario definitions is on the rise. In our talk, we’ll present an outline of Swedbank’s ways of constructing and leveraging scalable pipelines based on Spark and Tensorflow in combination with an in-house tailor-made platform to develop, deploy and monitor deep anomaly detection models. In summary, this talk will present Swedbank’s approach on building, unifying and scaling an end-to-end solution using large amounts of heterogeneous imbalanced data. In this talk we will include sections with the following topics: Feature engineering: transactions2vec; Anomaly detection and its applications in banking; Deep anomaly detection methods: Deep SVDD and Generative adversarial networks, Model overview and code snippets in Tensorflow estimator API; Model Deployment: An overview of how the different puzzle pieces outlined above are put together and operationalized to create and end-to-end deployment.

Views

Total views

592

On Slideshare

0

From embeds

0

Number of embeds

0

Actions

Downloads

41

Shares

0

Comments

0

Likes

0

×