Unauthorised Session Detection with RNN-LSTM Models and Topological Data Analysis

Sammanfattning

This thesis explores the possibility of using session-based customers data from Svenska Handelsbanken AB to detect fraudulent sessions. Tools within Topological Data Analysis are employed to analyse customers behavior and examine topological properties such as homology and stable rank at the individual level. Furthermore, a RNN-LSTM model is, on a general behaviour level, trained to predict the customers next event and investigate its potential to detect anomalous behavior. The results indicate that simplicial complexes and their corresponding stable rank can be utilized to describe differences between genuine and fraudulent sessions on individual level. The use of a neural network suggests that there are deviant behaviors on general level concerning the difference between fraudulent and genuine sessions. The fact that this project was done without internal bank knowledge of fraudulent behaviour or historical knowledge of general suspicious activity and solely by data handling and anomaly detection shows great potential in session-based detection. Thus, this study concludes that the use of Topological Data Analysis and Neural Networks for detecting fraud and anomalous events provide valuable insight and opens the door for future research in the field. Further analysis must be done to see how effectively one could detect fraud mid-session.