Simulating and classifying behavior in adversarial environments based on action-state traces: an application to money laundering
This work addresses the challenge of preemptively mitigating risks in anti-money laundering for financial institutions, representing an incremental advance over existing transaction-based models.
The paper tackles the problem of detecting adversarial strategies like money laundering by proposing a behavior-based model that classifies action-state traces, achieving successful inference of behavior types despite partial observability.
Many business applications involve adversarial relationships in which both sides adapt their strategies to optimize their opposing benefits. One of the key characteristics of these applications is the wide range of strategies that an adversary may choose as they adapt their strategy dynamically to sustain benefits and evade authorities. In this paper, we present a novel way of approaching these types of applications, in particular in the context of Anti-Money Laundering. We provide a mechanism through which diverse, realistic and new unobserved behavior may be generated to discover potential unobserved adversarial actions to enable organizations to preemptively mitigate these risks. In this regard, we make three main contributions. (a) Propose a novel behavior-based model as opposed to individual transactions-based models currently used by financial institutions. We introduce behavior traces as enriched relational representation to represent observed human behavior. (b) A modelling approach that observes these traces and is able to accurately infer the goals of actors by classifying the behavior into money laundering or standard behavior despite significant unobserved activity. And (c) a synthetic behavior simulator that can generate new previously unseen traces. The simulator incorporates a high level of flexibility in the behavioral parameters so that we can challenge the detection algorithm. Finally, we provide experimental results that show that the learning module (automated investigator) that has only partial observability can still successfully infer the type of behavior, and thus the simulated goals, followed by customers based on traces - a key aspiration for many applications today.