Internet traffic exhibits self-similarity and long-range dependence (LRD) on various timescales. A well studied issue is the estimation of statistical parameters characterizing traffic selfsimilarity and LRD, such as the Hurst parameter H. In this paper, we propose to adapt the Modified Allan Variance (MAVAR), a time-domain quantity originally conceived to discriminate fractional noise in frequency stability measurement, to estimate the Hurst parameter of LRD traffic traces and, more generally, to identify fractional noise components in network traffic. This novel method is validated by comparison to one of the best techniques for analyzing self-similar and LRD traffic: the logscale diagram based on wavelet analysis. Both methods are applied to pseudo-random LRD data series, generated with assigned values of H. The superior spectral sensitivity of MAVAR achieves outstanding accuracy in estimating H, even better than the logscale method. The behaviour of MAVAR with most common deterministic signals that yield nonstationarity in data under analysis is also studied. Finally, both techniques are applied to a real IP traffic trace, providing a sound example of the usefulness of MAVAR also in traffic characterization, to complement other established techniques as the logscale method. NoteThis paper is based in part on ideas presented in the preliminary version "The Modified Allan Variance as Time-Domain Analysis Tool for Estimating the Hurst Parameter of Long-Range Dependent Traffic", by S. Bregni and L.

Monitoring financial transactions is a critical Anti-Money Laundering (AML) obligation for financial institutions. In recent years, machine learning-based transaction monitoring systems have successfully complemented traditional rule-based systems to reduce the high number of false positives and the effort needed to review all the alerts manually. Unfortunately, machine learning-based solutions also have disadvantages: while unsupervised models can detect novel fraudulent patterns, they are usually characterized by a high number of false alarms; supervised models, instead, usually offers a higher detection rate but require a large amount of labeled data to achieve such performance. In this paper, we present Amaretto, an active learning framework for money laundering detection that combines unsupervised and supervised learning techniques to support the transaction monitoring processes by improving the detection performance and reducing the fraud management costs. Amaretto exploits novel selection strategies to target a subset of transactions for investigation, making more efficient use of the feedback provided by the analyst. We perform the experimental evaluation on a synthetic dataset provided by the industrial partner, which simulates the profiles of clients trading in international capital markets. We show that Amaretto outperforms state-of-the-art solutions by reducing money laundering risk and improving detection performance. In particular, we compare state-of-the-art unsupervised and supervised techniques commonly used in the AML domain with the ones implemented in this work. We show that the Isolation and Random Forests of Amaretto perform best in the task under analysis, with an AUROC of 0.9 for the first (20% better on average) and a detection rate of 0.793 for the second (30% better on average). In addition, both methods are characterized by a lower costs computed in terms of the daily number of transactions to be examined and the number of false positives and negatives. Finally, we compare Amaretto against a state-of-the-art active learning fraud detection system, achieving better detection performances and lower costs in all the scenarios under analysis. Worth mentioning, Amaretto improves the detection rate up to 50% and reduces the overall cost by 20% in the most realistic scenario under analysis.