Anomaly Rule Extraction via Decision Tree Interpretation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection systems face challenges in generating effective rules for identifying anomalous transactions, as they either rely on manual expert knowledge, which is time-consuming and limited in capturing complex patterns, or machine learning models that are difficult for non-experts to tune and interpret.
Innovation Solution
A data-driven approach that integrates anomaly analysis data from multiple sources, extracts features using domain knowledge, trains machine learning models, and generates human-readable rules that can be configured by users, enabling the detection of complex fraud patterns while being intelligible and adaptable to specific business scenarios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual expert knowledge is used to define rules for anomaly detection, then the rules are interpretable and adaptable to specific business scenarios, but the process is time-consuming and limited in capturing complex patterns
Solution Approach 1:
The system performs preliminary actions by automatically generating candidate rules from historical anomaly data and machine learning models before expert review. This pre-generation of rules with predicted performance metrics allows experts to focus on refining and selecting rules rather than creating them from scratch, significantly reducing the time required while maintaining adaptability to specific business scenarios.
2Reliability
If machine learning models are used for anomaly detection, then complex fraud patterns can be detected, but the models are difficult for non-experts to tune and interpret
Solution Approach 1:
The system introduces an intermediary layer that translates complex machine learning model outputs into human-readable rules with clear business logic. This intermediary process includes extracting decision paths from trained models, converting them into interpretable rule formats, and providing performance predictions to guide expert selection. This maintains the high detection capability of ML models while making the results accessible and actionable for non-expert users.
3Reliability
If multiple machine learning models are trained with different feature combinations, then the ability to detect various fraud patterns improves, but the system complexity increases
Solution Approach 1:
The system segments the complex task of detecting various fraud patterns into multiple specialized machine learning models, each trained on different feature combinations tailored to specific fraud types. This segmentation allows each model to focus on particular patterns, improving overall detection reliability. The complexity is managed by automatically generating rules from each segmented model and presenting them as separate, manageable rule sets that can be independently evaluated and deployed.
Data Source
AI summary
Techniques are provided for extracting anomaly related rules from organizational data. One method comprises obtaining anomaly analysis data integrated from multiple data sources of an organization, wherein the multiple data sources comprise at least one set of labeled anomaly data related to anomalous transactions; extracting features from the integrated anomaly analysis data that correlate with an indication of an anomaly; training multiple machine learning models using the extracted features, where the machine learning models are trained using different combinations of the extracted features; evaluating a performance of the trained machine learning models; and extracting rules from the trained machine learning models based on the performance, wherein the extracted rules are used to classify transactions as anomalous. The trained machine learning models comprise a decision tree comprising paths to an anomaly classification. The extracted rules are optionally in a human-readable format.