Machine learning approach for external fraud detection

If we take a very brief timeline of noteworthy fraudulent incidents, there are hundreds of incidents over the last few decades. But one thing we may not be aware of is the first computer virus in 1971, after the invention of the first electronic general-purpose giant computer ENIAC in 1945, the very first computer virus known as the Creeper virus came to exist. From there, 1991, Michelangelo virus, which was designed to infect DOS systems, was perceived as digital apocalypse at that times. Fortunately, it did not have as much of an impact as people were kind of screaming about, but it was really one of the first widespread viruses that everyone started to kind of learn about and be a little bit fearful of. Then forge ahead a few years, we had the Melissa worm in 1999. That was an email-based worm targeting Microsoft Outlook spreading at an excessive speed. Let us fast forward one more year to the "ILoveYou" worm which was very similar in nature and scope and also one of the most damaging, quickly replicating and spreading fraudulent incident of all time. Again back in 2000, within the first few hours of that kind of worms release it infected and spread to millions of computers around the world. Forward another decade, the malicious computer worm uncovered in 2010, Stuxnet, which was generated to attack SCADA systems causing substantial damage to Isan's nuclear program. It was initially intruded into the network via an infected USB drive, and from there it quickly mapped the internal network mapping out internal resources and so forth. But the operators never knew they were spinning out of control because the alarms were disabled. In these way, it destroyed a large piece of the infrastructure around that nuclear facility setting their program back many years. Fast forward a few more years to 2013, we had the advent of the Cryptolocker virus causing millions of dollars in loss to various companies. When Cryptolocker virus is activated, using cryptography name RSA public-key, malware encrypts definite categories of document files deposited on drives of a local network, with the private key deposited only on the control servers belonging to malware. Intruders can only decrypt the data if the payment they required is made by the expressed deadline, threatening victims to delete the private key if the deadline passes. And then lastly, fast forward to more or less present time, 2016 we had the Locky ransomware, which is very similar to Cryptolocker, and that has over 60 different derivatives of that specific piece of malware, exposing financial havoc on any number of systems, companies large and small, law enforcement agencies, and so forth. So fraudulent incidents as malware, whether it would be viruses, worms, and so forth, have been around for over four decades. So it is extremely necessary to detect or prevent these kinds of large-scale breaches efficiently. Generally speaking, it is also necessary to consider the incredible cost of malware infections. In 2014, a few years ago, $491 billion were spent on the recovery of malware infections and $25 billion spent by the consumers as a result of security threats. That is an incredible number to try to wrap our arms around, but it has a huge impact on the economy at large on a global scale. And something that is even perhaps a little more interesting is the fact the specialists spent 1.2 billion hours dealing with the after-effects of malware and malware infections. That is a lot of time obviously. So fraud is not just an annoyance. It is big business, and it costs a lot of money to companies and to consumers to combat malware infections. So it is not just hackers, and it is not just script codes trying to inconvenience people. It is actually criminal organizations; it is a very organized and intentional process. Whether it is Cryptolocker and ransomware, whether it is stealing information, proprietary secrets and competitive advantages from inside of companies, and so forth, it is a really big business and it costs a lot of money of companies and consumers to combat malware infections. So when it comes to positioning our organization or IT infrastructure and so forth, to be in the best position to ward off malware infections and to perhaps prevent from occurring in the first place, it is very important to understand how malware can affect the related PC or the security systems like IDS, how it can get into our network, how it can affect our organizations, and then the things we need to do. It is vital that everyone understands the nature true of this threat and take ideal measures to mitigate or minimize the risks. In addition to these staggering cost of fraudulent incidents, detection and prevention of all kind of malware should be taken into consideration as fast as possible in an efficient way. As we all know, as far as anti-virus and anti-malware software is considered fairly effective. But when we install A/V software, it should be kept updated and also needs us to take the precautions. It couldn't prevent the security system from getting hacked or intruded like a firewall. Other cost-effective countermeasures designed to detect, prevent or block fraudulent malicious activities all over the network could be intrusion detection and prevention systems. After identifying abnormal traffics, IDS or IPS would write to log files when suspicious activity is detected, then would send event notifications taking preventative measures. However, some kind of destructive drawbacks, like misclassification of genuine traffics as anomalies, and incompetence to configure unknown attacks, make intrusion detection and prevention systems run inefficiently. All mentioned striking evidence lends support to the view that we determine to use the combination of two different type of IDSs, identifies as network-based IDS and anomaly-based IDS for the methodology of this research. Network-based IDSs are positioned within the network to mainly detect abnormal malicious traffics by examining passing network transactions. Anomaly-based IDSs is also responsible for the unknown attack traffics, it could detect unknown external frauds, developing non-signature-based IDSs. A number of factors of this combined IDSs could contribute to the success in detecting external unknown frauds that have not been identified previously and minimizing false positive rate. It is indisputable that, machine learning technique which is the subset of artificial intelligence have gained significant awareness in the past few decades. With the contributions of machine learning techniques, we can analyze a tremendous amount of network traffic data with high performance in a short time, and generate reliable external fraud detection and classification model. Taking into account all these factors, we safely plan to present a comprehensive review of external fraudulent attacks and corresponding detection systems and also demonstrate a set of experimental works analyzing the execution of supervised machine learning techniques.