RFP for Research on Asset Movement Pattern Recognition

1
RFP for Research on Asset Movement Pattern
Recognition

• Elisa Bertino, Jerry Grochow, Stan Jarecki, David
  Jensen, Phoebe Papageorgiou, Foster Provost, Ted
  Senator
• fprovost_at_stern.nyu.edu

2
Agenda

• Background
• Three research topics for RFP
• Economics of Asset Movement Attacks
• Asset Movement Pattern Recognition
• Privacy Confidentiality
• Data sets and other research infrastructure
• Collaborations

3
BackgroundDifferent objectives of adversaries

• Laundering money
• for conventional crimes
• drug trafficking, organized crime, etc.
• for financing overseas terrorist operations
• Financing domestic terrorist operations
• Attacks
• to disrupt particular firms/markets/institutions
• to disrupt greater financial system(s)/society
• for profit

4
BackgroundWhats new regarding asset movement?

• New asset movement modalities
• eCommerce systems (eBay )
• new payment systems (PayPal, Indian-PayPal)
• possibility to generate massive numbers of
  (small) transactions automatically
• Liquid market for identities (thanks Scott)
• note relationships to authentication, massive
  identity theft
• special issue for asset movement pattern
  recognition
• Implication for covert asset movement
• easier to move/more difficult to detect
• bypassing CTR requirements
• not having large non-cash transactions
• using large numbers of different identities

5
classic money laundering
modern covert asset movement
financing domestic terrorist operations
6
Agenda

• Background
• Three research topics for RFP
• Economics of Asset Movement Attacks
• Asset Movement Pattern Recognition
• Privacy Confidentiality
• Data sets and other research infrastructure
• Collaborations

7
Economic analyses of asset movement and impact

• Research topics
• Analysis of failure modes in complex
  (distributed-ownership) networks
• especially modes dependent on user/consumer
  confidence and targeted attacks
• worse than the internet, since no confidence
  issue
• How big does an attacker have to be?
• Can a small group seriously destabilize the
  financial system or does it have to be a
  nation-state?
• Would any nation-state thats large enough be so
  interlinked that it would be mutual assured
  destruction?
• are there lessons from rogue traders bringing
  down financial institutions? Would it be worse
  if they were trying?
• What would destabilizing cascades in complex
  networks look like?
• Risk scoring applied to networks
• can the risk associated with a network be
  characterized?

8
Asset movement pattern recognition

• Research topics
• Identifying/discovering collectives
• Identity matching
• not necessarily based on identity commonalities
  (as with deduplication/record linkage) or direct
  behavior (as with fraud detection)
• based on collective activity
• Group detection in structured data
• High-level consolidation (perhaps without
  identity matching)
• Defining suspicious patterns
• from domain knowledge?
• from looking at SARs?
• how to learn with limited training sets (few
  positive examples)?
• how do they change?
• Structured inference with patterns
• requires chaining of inference and collective
  inference
• requires reasoning about network dynamics
• massive multithreaded streaming data
• heterogeneous data (multiple entities of many
  types)
• NB substantially more difficult than for
  traditional fraud detection

9
Privacy Confidentiality

• Question must analysis of small transactions be
  Orwellian?
• can cryptography be used
• to keep transactions as ciphertext so central
  agency does not have the data (in aggregate or
  individual transactions themselves)
• then central agency operates only on encrypted
  data
• only if a pattern is discovered (something will
  happen)
• subquestion will this nevertheless be acceptable
  to the public
• develop awareness of what cryptography has to
  offer
• the ciphertext is not the data (can be proved
  )
• develop awareness to technical community of what
  wll/will not be acceptable ? lead to
  new/interesting research
• decentralized, cooperative distributed solution
  no central agency
• pattern recognition?
• Patriot act allows financial institutions to
  share data if it is related to terrorist
  financing/money laundering
• other advantages to distributed solution
• minimize data shipped around
• dont have to process entire data set
• combination of two
• e.g., minor suspicion - crypto sharing -
  increase/decrease suspicion
• intelligence community also important for info
  sharing among

10
Short-to-medium term actionData sets, research
infrastructure

• Data on legitimate but hidden asset movement
• lots of potential data
• could regulatory agencies provide after the fact?
• is it even available (e.g., pension fund making
  large divestiture)
• existing work?
• if trading company (e.g., hedge fund) has done
  research on this (for profit), would they be
  willing to share strategies (that are their
  competitive advantage) for purposes of national
  security?
• does stock market intelligence generalize to
  other markets? (E.g., eBay)
• Market simulators
• in the model of Penn/Lehman automated trading
  simulator?
• simulated data
• real data
• game playing participants (e.g., devising
  strategies for hidden asset movement)
• eBay monitoring?

11
Shortest-term actionCollaborations needed

• Access to experts (USG, private sector) to
  provide details on what are the
• problems (exactly)
• e.g., how exactly would eBay/PayPal be used?
• existing solutions
• (potential) patterns
• political-policy issues
• commercial-policy issues
• data that are/could be available
• or would never be available
• potential players for simulator