Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
www.inspirient.com
/company/inspirient
@inspirient
Digital Crime Scene Investigation
Dr. Georg Wittenburg ▪ Inspirient GmbH
Sicherheitskooperation CyberCrime 2022
Mainz ▪ 31 May 2022
Winner BNP Paribas
International Hackathon 2017
Winner BARC
Startup Award 2016
Winner
Startups@Reeperbahn 2017
Top 10 NATO ACT
Innovation Challenge 2018
Top 10 Deloitte
RegTech Universe 2019
Selected for 2021/22
AI German Landscape
Trusted AI Startup 2020
European AI Startup Landscape
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
1
Source: BNP Paribas / Social Media
Celebrating with Consorsbank / BNP Paribas Risk Team
Sample alert (sanitized)
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Agenda
Fraud Detection with AI in Four Steps
• Automated Data Analysis
• AI-supported Anomaly Detection
• The Human Factor
• Real-time Fraud Detection
31.05.2022 2
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
The Crime Scene
3
Definition, for this talk
• Crime scene is digital, but not organized
• Data is structured but not consolidated,
with varying data quality
Examples
• Business data on a laptop
• Data dumps from corporate IT
• Externally acquired, gray market dataset
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Manual Search is not an Option
31.05.2022 4
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Automated Analytics
31.05.2022 5
Inspirient’s Automated Analytics Engine
Hybrid AI that autonomously applies analytical reasoning
Structured / tabular data
SQL / CSV / Excel / SPSS / JSON
Analytical results
Webapp to browse deduced insights
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Example #1
Basic Automated Data Analysis
31.05.2022 6
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Four nodes identified as very central to network between
'Account ID' and 'IP address'
Powered
by
Inspirient
(www.inspirient.com)
10010
192.168.0.1
192.168.0.2
192.168.0.3
10011
192.168.1.1
192.168.1.2
192.168.1.3
192.168.1.4
192.168.1.5
10012
192.168.2.1
192.168.2.2
192.168.2.3
10013
192.168.3.1
192.168.3.2
192.168.3.3
10014
192.168.4.1
192.168.4.2
192.168.4.3
10015
192.168.5.1
192.168.5.2
192.168.5.3
10016
192.168.6.1
192.168.6.2
192.168.6.3
192.168.6.4
192.168.6.5
10017
192.168.7.1
192.168.7.2
192.168.7.3
10018
192.168.8.1
192.168.8.2 192.168.8.3
10019
192.168.9.1
192.168.9.2
192.168.9.3
Account ID
IP address
Most central node
Note: A node is more central to the network if it is on the path between many other nodes (so-called betweenness centrality)
Current Analytical Capabilities of AI
Selection Focused on Anomaly Detection
7
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Agenda
Fraud Detection with AI in Four Steps
• Automated Data Analysis
• AI-supported Anomaly Detection
• The Human Factor
• Real-time Fraud Detection
31.05.2022 8
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Difficulty in Adversarial Detection…
Established AI approaches struggle with adversarial setting specific to fraud
Established Approach #1
Rule-based Fraud Detection
Traditional rule-based fraud detection results in cat-and-
mouse game with fraudsters:
Established Approach #2
ML-based Fraud Detection
Current Machine Learning (ML) fraud detection suffers
from model instability in adversarial conditions:1
9
To reliable detect fraud, we need to think beyond
traditional AI silos – we need Hybrid AI
“We published the rule on Friday –
the fraudsters knew it by Monday!”
—Head of Risk, Top 10 global bank
1. Source: “Why deep-learning AIs are so easy to fool” (Nature, Oct 2019)
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
…Calls for a Hybrid Approach
Blend of Machine Learning and Expert System combines strengths of both approaches
31.05.2022 10
Unsupervised learning
+ Effortless training without
human resources
− Requires significant
training dataset (or ability
to generate training data)
Rule-supported
supervised learning
• Strikes balance between
upfront human training and
required training data
• Can be trained
incrementally, as part of
regular business
operations
Supervised learning
+ Applicable if little training
data is available
− Results improve slowly
after multiple iterations
with human feedback
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Example #2
Real-world Anomaly Detection
31.05.2022 11
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Agenda
Fraud Detection with AI in Four Steps
• Automated Data Analysis
• AI-supported Anomaly Detection
• The Human Factor
• Real-time Fraud Detection
31.05.2022 12
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
The Actual Problem
Cognitive Bias: The Streetlight Effect
13
Streetlight Effect—Type of observational bias that occurs when people only search
for something where it is easiest to look
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Knowledge Intuition Knowable Facts
Patterns in data
Evidence, Leads, … Hypotheses
Reach of
traditional analytics
Added reach with Inspirient’s
AI-supported analytics
Working around Human Intuition
How do we ask the right questions?
31.05.2022 14
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Example #3
Collaborative Prioritization
31.05.2022 15
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Hands-on Collaborative Prioritization
31.05.2022 16
Example: Prioritization workshop at Deutsche Bahn
Source: Bitkom Big Data Summit 2017
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Agenda
Fraud Detection with AI in Four Steps
• Automated Data Analysis
• AI-supported Anomaly Detection
• The Human Factor
• Real-time Fraud Detection
31.05.2022 17
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Team / AI Setup at BNP Paribas
31.05.2022 18
AI-supported Analytics
Anti-fraud / risk team
Feedback data Transaction data
Client master data
General-
purpose
statistical
reasoning
Fraud-
specific
reasoning
Generated alerts
Hybrid AI combines
rule-based reasoning
with supervised learning
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Deep dive: Feedback Loop
31.05.2022 19
Determine
target column
Train
classifiers
Select best
classifier
Identify
predictors
1. A target column can be specified by adding the PRIORITY annotation to the column label in the input table
2. Leave-one-out cross validation (LOOCV) is used for classifier selection
Step #1:
Target column(s) can be
specified by user1 or will be
chosen automatically by
Inspirient
Step #3:
Inspirient automatically
chooses appropriate
predictive models for target
variable and builds them
from the predictor columns
Step #4:
The models built in step #3
are systematically tested
through cross-validation2 to
identify the best classifier
Step #2:
Predictor columns, i.e.
dimensions used to build
classification model, are
automatically identified by
Inspirient
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Deep-dive: Case Workflow
New phishing workflow automatically alerts risk team upon suspicious activity
20
User notification alert
List of auto-detected suspicious activities for investigation
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Sample Results (1/2)
Money Laundering
21
29.08.2017 30.08.2017
28.08.2017
Transactions to [x] on 29 August
2017 stand out against typical
daily distribution
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Sample Results (2/2)
Phishing, Conspiracy, Wire Fraud
31.05.2022 22
Fraudsters will scout multiple
accounts, and often overlap,
allowing us to uncover a
‘fraudster network’
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Outlook: Quantifying Evidence
Next step is to measure collected datasets to prioritize investigations
31.05.2022 23
Please get in touch if this use case
is relevant to you / your team!
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Dr. Georg Wittenburg
Phone: +49 30 2007 4820
Email: georg.wittenburg@inspirient.com
Web: www.inspirient.com
24
31.05.2022
Appendix
25
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Inspirient’s Hybrid AI
for Fraud Detection and Prevention
Selected milestones
• 2016 – Established in Berlin by Dr. Georg Wittenburg
(ex-BCG) and Dr. Guillaume Aimetti (ex-Deloitte)
• 2016 – Minority investment from Prof. A.-W. Scheer
• 2017 – Won group-level BNP Paribas Intl. Hackathon
with hybrid fraud prevention solution1
• 2019 – Boosted expense appraisal accuracy to +95%
at “Big 4” auditor at +70% cost reduction2
• 2021 – Launched analyst-2.ai for fully autonomous
analysis of public data, incl. data quality assessment
Inspirient’s Automated Analytics Engine
• Award-winning Hybrid AI system that employs proba-
bilistic reasoning and procedural generation to fully
automate data analyses and pattern detection
• Focus on communicating results to non-technical
audience, e.g., as business presentation3
• World’s first AI-generated slide discussed in board
meeting of German insurance company in 2018
26
1. Special commendation for scalability and integration (press release) 2. On 20 FTE out-sourced team, while also increasing decision transparency and closing process gaps
3. Profit optimization example at https://youtu.be/G1NR2LCQFtw
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Hybrid AI
“Inspirient is a leader in this trend”
27
“After years of Deep Learning (DL) hype, the AI
community is now shifting towards hybrid DL + X
approaches to achieve real-world applicability. In
Germany, Inspirient is a leader in this trend.”
—Prof. Dr. rer. nat. Dr. h.c. mult. Wolfgang Wahlster
Founding Director and Chief Executive Advisor
German Research Center for Artificial Intelligence (DFKI)
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
Won inaugural
BARC Startup Award
for analytics and data
management
Presentation available online
Won group-level
BNP Paribas Hackathon
for intl. integration and
scalability of our fraud
prevention solution
Press release available online
Only German startup in
Top 10 of NATO Allied
Command Transformation
(ACT) innovation chal-
lenge on data analysis
Press release available online
Top 10 in Deloitte’s
RegTech Universe for
compliance work in
cyber fraud and AML1
Full list available online
28
Inspirient’s Award-winning AI
Winner BARC
Startup Award 2016
Winner BNP Paribas
Intl. Hackathon 2017
Top 10 NATO
ACT Innovation
Challenge 2018
Global Top 10
Deloitte RegTech
Universe 2019
INNOVATION HUB
1. Anti-Money Laundering
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
• Setting – German branch of BNP Paribas
was concerned about evolving identify theft,
account hijacking and money laundering
• Approach – Continuously monitor stream of
financial transactions for abnormalities, while
learning through feedback loop with risk team
• Result – Highly accurate alerts to risks team,
in time before money leaves the bank;
uncovered unknown network of fraudsters
Reference Case (1/4)
Cyber Fraud Prevention in Banking
29
Client Impact – ~€12M operational cost
reduction across five entities (FTEs / IT cost)
Client financial transactions (sanitized)
Fraud alert
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
• Setting – Top 3 German bank asked for
data-driven review of their internal processes
for handling business loans
• Approach – Comprehensive pattern mining
incl. AI-supported ranking across all
dimensions of provided data sample
• Result – In first iteration, identified previously
unknown process gap for high-risk cases that
led to ~8K mishandled business loans
Reference Case (2/4)
Process Mining: Finance / Risk
30
Client Impact – Reduced financial risk
by quantifying critical process gap
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
• Setting – Anticipating regulation, client
wanted to understand potential of chemical
processing plants to reduce CO2 emissions
• Approach – Full multi-year and multi-
configuration plant telemetry was mined for
process drivers of CO2-related KPIs
• Result – Key driver analysis of target KPIs
highlights underperforming process steps
and sequences
Reference Case (3/4)
Anomaly Detection: Plant Optimization
31
Client Impact – Optimized plant procedures
allow to reach target results with less CO2
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
• Setting – “Big 4” auditor wanted to reduce
operational cost by automating outsourced
20-FTE expense appraisal process
• Approach – Split process in sub-decisions
and used client process documentation and
historical data to train ~35 neural networks
• Result – Automated system reached +95%
decision accuracy, a ~20% improvement
over outsourced human process
Reference Case (4/4)
Process Automation: Controlling
32
Client Impact – ~75% cost reduction,
while increasing process accuracy
Client process
owners and users
Client process
documentation
+ − ≥
× ÷ ≤
Rule-based processing
Machine Learning
+ − ≥
× ÷ ≤
+ − ≥
× ÷ ≤
+ − ≥
× ÷ ≤
Hybrid AI
31.05.2022
Copyright
©
2022
by
Inspirient
GmbH.
All
rights
reserved.
31.05.2022 33
Inspirient’s web-based user interface

Digital Crime Scene Investigation