Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing this collection of information.
NPS-CS-12-002
SPONSORING / MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSOR/MONITOR'S ACRONYM(S)Defense Threat Reduction Agency, 8725 John J Kingman Rd., Stop 6201, Fort Belvoir VA 22060-6201
SPONSOR/MONITOR'S REPORT NUMBER(S)
DISTRIBUTION / AVAILABILITY STATEMENTApproved for public release; distribution unlimited.
SUPPLEMENTARY NOTESThe views expressed in this report are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government.
ABSTRACTThis paper describes a technique for behavioral and temporal pattern detection within financial data, such as credit card and bank account data, where the required information is only partially visible. Typically, transaction amount, transaction date, merchant name and type, and location of transaction are all visible data items, i.e., they are readily available in the financial institutions database. In contrast, the transaction status as a business transaction (using a personal card), a personal transaction, an investment related transaction, or perhaps a suspicious transaction, is information not explicitly available in the database. Our behavioral pattern detection technique combines well-known Hidden Markov Model (HMM) techniques for learning and subsequent identification of hidden artifacts, with run-time pattern detection of probabilistic UML-based formal specifications. The proposed approach entails a process in which the end-user first develops his or her deterministic patterns, s/he then identifies hidden artifacts in those patterns. Those artifacts induce the state set of the identifying HMM, whose remaining parameters are learned using standard frequency analysis techniques. In the run-time pattern detection phase, the system emits visible information, used by the HMM to deduce invisible information, and sequences thereof; both types of information are then used by a probabilistic pattern detector to monitor the pattern.
SUBJECT TERMS