Join this tech talk to learn how Curve is leveraging tools such as Sagemaker and Amazon Machine Learning to detect fraudulent transactions on AWS.

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Dr Steve Turner
Head of Emerging Technologies
@stevenpturner
November 2018
Fraud Prevention and
Detection on AWS

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What we will cover in this session
• Fraud Detection
• Machine Learning @ Amazon
• Amazon SageMaker
• Using SageMaker to Detect Fraud

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Payment Fraud is an ongoing concern for FS organizations
In 2016…
$9b of fraud losses
in the US*
$22.8b of fraud
losses globally*
In 2021…
$32.96b of projected
fraud losses globally*
* From The Nilson Report, October 2017, Issue 1118 (https://nilsonreport.com/upload/content_promo/The_Nilson_Report_Issue_1118.pdf)

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Types of Fraudulent Behaviour
Endpoint Authentication
☞ stolen card or machine
Layer 1

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Types of Fraudulent Behaviour
Endpoint Authentication
☞ stolen card or machine
Layer 1
Anomaly within a session
☞ Irregular behaviour within a session—e.g. transfer before balance
Layer 2

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Types of Fraudulent Behaviour
Endpoint Authentication
☞ stolen card or machine
Layer 1
Anomaly within a session
☞ Irregular behaviour within a session—e.g. transfer before balance
Layer 2
Anomaly within an account
☞ Irregular transactions—e.g. spike in transfer and recipients
Layer 3

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Types of Fraudulent Behaviour
Endpoint Authentication
☞ stolen card or machine
Layer 1
Anomaly within a session
☞ Irregular behaviour within a session—e.g. transfer before balance
Layer 2
Anomaly within an account
☞ Irregular transactions—e.g. spike in transfer and recipients
Layer 3
Anomaly within multiple channels of the same account
☞ Irregular transactions across channels—e.g. spike in transfer and recipients
Layer 4

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Types of Fraudulent Behaviour
Endpoint Authentication
☞ stolen card or machine
Layer 1
Anomaly within a session
☞ Irregular behaviour within a session—e.g. transfer before balance
Layer 2
Anomaly within an account
☞ Irregular transactions—e.g. spike in transfer and recipients
Layer 3
Anomaly within multiple channels of the same account
☞ Irregular transactions across channels—e.g. spike in transfer and recipients
Layer 4
Anomaly within multiple channels of multiple accounts
☞ Irregular transactions across channels and accounts
Layer 5

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Rule-Based Fraud Detection
DENY
Over
Limit
High
Rate
Stolen
Card
?
APPROVE

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Rule-Based Fraud Detection – Shortcomings
Static Rules Bug-Prone Complicated Cannot ScaleAlways Behind

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Requirements for a modern solution
Self Improving Easy to Maintain ScalableReal-timeDynamic Rules

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Machine Learning – Supervised Learning
Understand
your data
Algorithmically
discover hidden
patterns
Generalize
solution
algorithm
Apply solution
to unseen
patterns
Make
predictions

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ML @ AWS
OUR MISSION
Put machine learning in the
hands of every developer
and data scientist

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Machine Learning at Amazon: A long heritage
Voice driven
interactions
Fulfillment automation
& inventory management
Personalized
recommendations
Drones
Inventing entirely new
customer experiences

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tens of thousands of customers running Machine Learning on AWS

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cloud Computing – The best infrastructure choice for AI/ML workloads
Fast Deployments
Access highly performant computing
infrastructure in minutes
Performance
Run your AI/ML workload on the fastest
and most powerful compute instances to
reduce training and simulation times
Scale
Scale out and scale up to meet
all AI/ML workload requirements.
Cost Efficiency
Pay as you go model and more
efficient training saves cost
Framework Flexibility
Support for frameworks – TensorFlow,
PyTorch, MXNet, Caffe2
Access to Data
High speed connection to data
used for training

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The AWS Machine Learning Stack
PLATFORMS
APPLICATION SERVICES
R E K O G N I T I O N R E K O G N I T I O N
V I D E O
P O L L Y T R A N S C R I B E T R A N S L A T E C O M P R E H E N D L E X
Amazon SageMaker Amazon Mechanical Turk
FRAMEWORKS KERAS
P3
NVIDIA Tesla V100 GPU
accelerated for AI/ML training
Machine Learning
AMIs
INFRASTRUCTURE
&
Greengrass
ML
Amazon Deep Learning AMIs
Compute intensive instances for
AI/ML Inference
C5

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
EC2 Compute Instance Types
Well suited for AI/ML simulation
and inference workloads
Well suited for AI/ML
training workloads

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ML is still too complicated for everyday
developers
Collect and prepare
training data
Choose and
optimize your ML
algorithm
Set up and manage
environments for
training
Train and tune
model
(trial and error)
Deploy model
in production
Scale and manage
the production
environment

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
A managed service
that provides the quickest and easiest way for
data scientists and developers to get
ML models from idea to production.
Amazon SageMaker

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon SageMaker
Collect and prepare
training data
Choose and
optimize your ML
algorithm
Set up and manage
environments for
training
Train and tune
model
(trial and error)
Deploy model
in production
Scale and manage
the production
environment
Easily build, train, and deploy machine learning models

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon SageMaker
Pre-built
notebooks for
common
problems
K-Means Clustering
Principal Component Analysis
Neural Topic Modelling
Factorization Machines
Linear Learner – Regression
DeepAR Forecasting
XGBoost
Latent Dirichlet Allocation
Image Classification
Seq2Seq
Linear Learner – Classification
BlazingText
Random Cut Forest
ALGORITHMS
Apache MXNet
TensorFlow
Caffe2, CNTK,
PyTorch, Torch
FRAMEWORKS
Set up and manage
environments for
training
Train and tune
model (trial and
error)
Deploy model
in production
Scale and manage the
production environment
Built-in, high-
performance
algorithms
Build

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon SageMaker
Pre-built
notebooks for
common
problems
Built-in, high-
performance
algorithms
One-click
training
Hyperparameter
optimization
Build Train
Deploy model
in production
Scale and manage
the production
environment

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon SageMaker
Fully managed
hosting with auto-
scaling
One-click
deployment
Pre-built
notebooks for
common
problems
Built-in, high-
performance
algorithms
One-click
training
Hyperparameter
optimization
Build Train Deploy

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon SageMaker for Fraud Detection

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Model hosting (SM)
Calculate
features
Reader
Cleanser
Processor
Data
Look-up
Training
Feature store
Model training (SM)
Model
Client serviceAmazon EMR
Real-time Fraud Detection in AWS
with Amazon SageMaker

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Training algorithm / inference code is
packaged in a Docker image published on
Amazon ECR
• SageMaker pulls the training algorithm
image from Amazon ECR into the Model
Training Service
• Amazon SM downloads or streams the
training data and runs the training
algorithm on the data.
• After training, Amazon SM uploads
model artifacts to Amazon S3
• For inference, Amazon SM pulls the
model artifacts and the inference image
from Amazon ECR, into the Model
Hosting Service
• Amazon SM exposes an inference
endpoint for client applications to send
prediction requests to check Fraud
• Ground truth data collected from the
client application could be sent into the
training bucket to retrain and update the
model
Deploying a Model on Amazon SageMaker

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Linear Learner
Regression:
Estimate a real valued function
Binary classification:
Predict a 0/1 class

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!