Try neural networks for that. As a test, try matlab nprtool that will provide you with the details on all the parameters as it generates an advanced code (on your choice) to play with the parameters.

Random forest would be a good choice (SVM is hard to scale to 1 million records). Your feature representation will also be of great importance for the final performances, no matter which learning algorithm you use.

If you like coding in python, scikit-learn have a great parallel implementation of random forest, as well as extra-tree and gradient tree boosting (other variants of the same idea).

Currently, my database is Oracle and I've been using the 'Oracle R Enterprise' for the implementation of the algorithm. Would be better with Random Forest? I'm asking again because I've read about 10/12 papers suggesting to use SVM.

On a benchmark I made (using the Poisson binomial test on 20 dataset) SVM with RBF kernel and Random Forest have equivalent generalization performances.

The choice of the learner now depends on how can you encode prior knowledge (if you have any) and how well does it scale to the size of your dataset. Putting aside prior knowledge for the moment, we are left with the scaling problem.

With m = 1000000 samples, if you use the standard SVM, you'll have to store a 1000000 x 1000000 matrix in memory (4000 GB of Ram if using single precision floats). Also the optimization algorithm is \Omega(m^2) so it may take forever to converge. However, there is plenty of large scale implementation of SVM that perform some sort of approximation. But finding a good version may be challenging.

On the other side, Random Forest uses O(m) for memory and have a computational complexity of ~O(k *m log(m) ). It is also easy to implement and to parallelize. Therefore I recommend Random Forest or one of its friend.

P.S.: Don't forget the feature extraction phase, it may help your generalization performances.

Jivan,

I would suggest an analysis of the problem first to determine the relevant features based on the problem domain. A commonly accepted dogma is that fraud transactions are outliers, but this may not be necessarily true if the fraudster is aware of the underlying security and tries to avoid it (e.g. adversarial data mining).

Some typical examples of patterns of fraudsters are:

*Frequency of money extraction under X interval (may have some false positives but may be a basic rule)

*Frequency of output and going just underneath the maximum withdrawal of money

*Geographic spread of the ATMs on which the frequent withdrawal is made

You can also use deviation of frequency,amount, specific machine, etc. as source of further patterns on which to test your specific algorithm. After you decide the patterns that you are interested in you can assign weights to them if necessary.

Once you decide the underlying pattern , then decide on the particular encoding, and then you can go into the question on which classifier to use.

Hope this helps

I would like to suggest u to apply clustering technique. Density based approaches would be best for this kind of detection. Try DBSCAN algorithm.

The post of Arturo Geigel made me think of another important element. You may be in the positive and unlabeled paradigm. So, if I understand correctly you have 1e6 samples and they are all labeled fraud or non-fraud. I'm assuming that there is some unidentified fraud in the non-fraud class. If this is the case, this is a positive and unlabeled scenario.

This means that you cannot rely directly on the binary classification of your predictor to categorize into fraud or non-fraud. You should take into account the probability P(y|x) (given by let's say the averaging of the trees in the forest) and adjust the threshold accordingly (see Elkan's work in attache).

If the threshold would be a parameter manually adjusted by the user, you don't need to recalibrate P(y|x) but, it might be useful to bootstrap your dataset as described in Mordelet and Vert instead of the standard bootstrap of random forest (i.e. bootstrap only the non-fraud class and keep the fraud class fixed).

F. Mordelet and JP. Vert, A bagging SVM to learn from positive and unlabeled examples.

Conference Paper Learning classifiers from only positive and unlabeled data

Thanks to all, for your response. Currently, I've about 1 million data in target tables relating ATM transactions, as my project is related to data warehousing & data mining. I have identified about 7 features as suggested by Geigel for anomaly detection and all the data are unlabeled and I need to find the anomalous data from the data distribution & I'm much careful that it is probabilistic approach. Are these features sufficient for modeling the anomalous pattern?