Algorithm Shop (original) (raw)

2014-02-04

Fraud Detection

As more and more work is being crowdsourced, it is important to ensure that tasks are actually being honestly completed. During the 2012 US presidential election for example, both campaigns had online phone-banking tools for volunteers to make calls to voters. How do you ensure that these volunteer calls are legitimate contacts though and not the work of Teaparty sabateurs 1? Other companies, such as YouGov, will pay folks for consumer survey data. It's important for them that the respondent is actually putting effort into their responses instead of clicking through as quickly as possible. The most effective way to start to solve the problem is to build a model for detecting fraudulent behavior. Below we will start to create a very simple model built from real survey data and talk about ways to extend it.

The Setup

I gathered example data for this by running a survey of my own. I wrote some nonsense questions (e.g. "Would you rather have 10 kids, 1 evil kid, 0 kids, or 2 bad kids?") that sometimes required a little bit of thought before giving an answer. I then hacked together a server to gather responses. I wanted to just use Survey Monkey, but they do not give time spent on each question or allow free access to raw CSVs of the data. The server along with deployment scripts is in github, so feel free to use it for any purpose you want.

Then came the fun part: I ran this survey using Amazon's Mechanical Turk infrastructure. I removed all competency requirements for respondents and had two different prompts. One asked participants to complete the survey and submit their code. The other was told to complete the survey, but that I don't really care about their answers and that they should just complete it as quickly as possible. The way that these two different groups of people worked through the survey was used to train a model, with the later being used as the more "fraudulent" activity type. We can then classify whether someone is more like the normal participant that thinks about each question, or if they are like the person who is just trying to rush through the survey as quickly as possible.

Results

The results definitely showed a difference between those who were asked to quickly go through the survey, and those who gave it more thought. I broke down the distributions by question. The more the timings differs for a question, the more useful that questions timings are for building our model. For example, I had one question asking someone to recall their first political memory. This should probably take a reasonable person a little bit of time, and there should be a story with it. Looking at the two distributions, we do indeed see a nice spread:

For the "good" reviewers, they are most likely going to take around 25 seconds. It is not unlikely for bad reviewers to take that much time either. But as the duration increases, it is more and more reasonable to expect the reviewer to be good. It is twice as likely for a good reviewer to take 60 seconds on this question as a bad reviewer. Beyond that, this difference continues to grow.

Some questions though really don't matter. The easy questions are going to be answered about the same regardless of which group you are in:

Timings for a question like this give very little insight into whether someone is fraudulent or not.

Using these distributions to create a model, we can compute fraud probabilities for each person that took the survey. The distribution of probabilities from this simple model looks like so:

We see in that some separation between the scores, a very useful property when constructing a binary classifier. To sanity check a model like this, it's also useful to actually look at some of the real results.

Let's pick someone at random from the low and high probability buckets and get a sense of what the answers look like.

A low fraud probability response

Farrell obviously put actual effort into her responses, and the timings show that. This is amongst the least fraudulent results, and we got that just from timing data.

A high fraud probability response

Brandon on the other hand is very rushed and doesn't give any response much effort. Even with the slower response on the last question, his prior probability of being a "fraudster" is so high that he does not come down much in score. Continuing on like this, we see that the users with high fraud probability also say things like "no clue brah", mash keys for answers, and fill in all fields identically. Each of these would be another signal to add to the model as we make it more robust.

These are extreme examples, but it's interesting that we picked them out with no manual feature specification, and just using timing. It's also important to note that distributions do not need to be disjoint for a classifier to work. The more disjoint the better, but with Bayesian reasoning and enough data, you will eventually figure out what distribution someone actually belongs in. Even with just a simple model, you can dig into the data and start getting better ideas on how to further create signals.

An Interactive Example

Below is the actual survey I ran, along with the simple model that was generated. It will tell you after every question what it believes your current level of fraud is. Take the survey twice, the first time answering it normally (giving thought to each question) and once where you try to just get through it as quickly as possible. See how the results differ.

Try out this survey. Click NEXT Below to start.

{{question.question}}

Thanks for completing the survey.

Fraud Probability: {{fraudProbability}}. Nonfraud Probability: {{1 - fraudProbability}}.

The Math

The model type here is a basic Bayesian classifier. Timings for the different classes were converted into a distribution via Kernel Density Estimation. We then just use that probability density function in computing the likelihood of different timings for each class. That is then multiplied by our prior belief that the respondent was in that class (and then probabilities are normalized to sum to 1). The IPython notebook is checked into github and available on nbviwer. If you want to learn about Bayesian modeling, the best first book on the subject is Allen Downey's Think Bayes. The book is available as a free pdf, but I suggest you give him some money anyways.

Extensions

This is of course a simplistic model built on just one variable: the amount of time it takes for someone to answer a question. There are many confounding issues here that weaken the utility of our model. If someone is on a mobile device or behind a slow ISP, they will have longer answer times just by virtue of how they are answering the survey. If you had enough data though, you could start to account for those factors in your model. Additionally, you should want to start to add other signals, such as the variety of responses someone does when assigning scores (all 1s or all 10s is not a great sign), and you would probably want to start to build some predictions around keymashing. Everything though can fit in cleanly to a Bayesian framework like this, and each further bit of information should help to further separate fraudsters from legit workers. Another interesting aspect that comes up is that we do expect users to get better at tasks over time. In the context of tracking phone bank time for example, it would be helpful to build different models for different experience levels of callers.

Takeaways

1. If you need basic training data for fraud, you can create incentives that encourage fraudy data. Mechanical Turk is excellent here.
2. A probabilistic model is useful since it will generally be resilient to noise. If I complete one question quickly, that's not suspicious. If I complete all questions quickly, I'm probably dodgy.
3. You should contact me if you want help with any simmilar tasks! My contact details are below, and here's some more info about what I've worked on before. Hope to talk to you soon!