{'fraction_non_alphanumeric': 0.028033918724804225, 'fraction_numerical': 0.007622445669802141, 'mean_word_length': 4.859761064349715, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 2, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Streaming Active Learning Strategies for Real-Life Credit Card Fraud Detection: Assessment and Visualization

Credit card fraud detection is a very challenging problem because of the specific nature of transaction data and the labeling process. The transaction data is peculiar because they are obtained in a streaming fashion, they are strongly imbalanced and prone to non-stationarity. The labeling is the outcome of an active learning process, as every day human investigators contact only a small number of cardholders (associated to the riskiest transactions) and obtain the class (fraud or genuine) of the related transactions. An adequate selection of the set of cardholders is therefore crucial for an efficient fraud detection process. In this paper, we present a number of active learning strategies and we investigate their fraud detection accuracies. We compare different criteria (supervised, semi-supervised and unsupervised) to query unlabeled transactions. Finally, we highlight the existence of an exploitation/exploration trade-off for active learning in the context of fraud detection, which has so far been overlooked in the literature.


Introduction
The use of machine learning for credit card fraud detection requires to address a number of challenges. Some of them are related to the data distribution, notably the class imbalance of the training set (many more genuine transactions than fraudulent ones), the non-stationarity of the phenomenon (due to changes in the behavior of customers as well as in fraudsters), the large dimensionality and the overlapping classes (while fraudsters try to emulate cardholders behavior, genuine behaviors of cardholders might look strange or anomalous). The labeling process is constrained, as every day human investigators may contact only a small number of cardholders associated with the riskiest transactions and obtain the class (fraud or genuine) of the related transactions. The high cost of human labour, for assessing the transaction labels, leads to the labeling bottleneck [2]. In this context, an automatic Fraud Detection System (FDS) should support the activity of the investigators by letting them focus on the transactions with the highest fraud probability. From the perspective of the transactional service company, this is crucial in order to reduce the costs of the investigation activity and to retain the customer confidence. From a machine learning perspective it is important to keep an adequate balance between exploitation and exploration, i.e. between the short-term needs of providing good alerts to investigators, and the long-term goal of maintaining a high accuracy of the system (e.g. in the presence of concept drift). The issue of labeling the most informative data by minimizing the cost has been extensively addressed by active learning which can be considered as a specific instance of semi-supervised learning [8,41], the domain studying how unlabeled and labeled data can both contribute to a better learning process. The Active Learning (AL) literature have proposed a number of techniques to select, within a large set of unlabeled instances, the most informative to label. AL can be typically described by the iteration of three steps [41]: 1. Selection: given a query budget of size k, a model is used to choose which k data points, once labeled, could better describe the data generating process; 2. Querying: selected points are submitted to an oracle (in our case an investigator) for labeling; 3. Training: the labeled data points are used to train and update the model; The Selection and Querying steps differentiate active learning from conventional (passive) learning, which is limited to the Training step. Note also that, in order to bootstrap the procedure, a random initialization or an unsupervised model is used [41]. A first classification of AL methods can be done according to the model used for the Selection step. In this paper, we will distinguish between methods using only supervised information and methods integrating other sources of information, notably unsupervised or semisupervised. Additionally, according to the nature of the dataset, we can distinguish between two main AL approaches: pool-based and streaming AL. In pool-based AL, the algorithm performs queries in the same set of unlabeled points, while in stream-based AL, the set of unlabeled data points is periodically updated. The accuracy of a pool-based AL classifier is expected to grow in time, since more and more labeled data points, from the original dataset, are used for the Training. This is not always true in the case of the streaming approach, since data received in different periods may differ significantly (e.g. concept drift). Though AL is widely addressed in the literature [11,25], few articles mention the aspects of credit card fraud detection (Section 2.2), notably the class imbalance [17,56] (in our case study approximately only 0.2% of transactions 2 are fraudulent), the restricted labeling budget [37,49] and the specific nature of the assessment [42]. It is worth to remark that in credit card fraud detection, though the observations are at the level of transactions, the ultimate goal is to detect fraudulent cards. There exists a one-to-many relation between cards and transactions. A peculiarity of fraud detection is that the labeling and the assessment phase are coincident and consequently strongly dependent. For the transactional ser-vice provider it is important that the investigations are as successful as possible (i.e. low false positive rate). This means that the accuracy of a FDS is measured in terms of precision over the top k alerted credit cards [5,33]. This is not always the case in other AL tasks where the labels of the k queried points are not directly related to the accuracy of the training process. In a FDS, it is not only important to minimize the labeling cost but also that this labeling allows to discover as many frauds as possible. The nature and the intensity of the exploration step has a strong impact on the final accuracy of detection and, accordingly, the set of stateof-the-art AL strategies which are effective in practice is much more limited than expected. In other terms no real-life FDS can afford a totally random labeling process since this would necessarily imply an unacceptable short-term random performance. This exploitation/exploration trade-off inherent to fraud detection, to the best of our knowledge, has not been addressed in the research literature.
The contributions of this article are: i) a taxonomy of streaming AL strategies (and a number of their variants) for credit card fraud detection, ii) an extensive comparison of these techniques for the detection of both fraudulent transactions and cards, iii) an experimental assessment on the basis of a massive set of 12 million transactions in terms of real-life criteria (defined by our industrial partner, Worldline, a leader company in transactional services) and iv) a two-dimensional visualisation of the effects of active learning on the distribution of the training set. The outcome is an original analysis of the exploitation/exploration trade-off in the context of a real-world FDS. In particular, we expect that visualization represents a valuable insight on the evolution of the training set during active learning. In fact, though the rationale of active learning is explicit, it is not always evident to understand how active learning modifies the distribution of the training set, notably in a task, like credit card fraud detection, characterized by large noise, nonlinearity and non separability. Also, we expect that potential bias of AL sampling strategies are easier to assess in a visual setting.
The work is organized as follows. Section 2 presents the related state-of-the-art. Section 3 provides the general outline of our Fraud Detection System. Section 4 introduces the visualization technique used throughout the manuscript. Section 5 discusses a number of AL strategies (as well as possible variants) for dealing with streaming credit card transactions. Finally, Section 6 presents an extensive experimental session based on a real stream of transactions.

Related work
In this section, we will present some important state-ofthe-art works in fraud-detection. The review of conventional passive learning for fraud detection is presented in the Section 2.1, while active learning techniques and their application to fraud detection are introduced in Section 2.2.

Passive learning for fraud detection
Credit card fraud detection belongs to the largest domain of outlier detection [1,7,32] also called anomaly or novelty detection. The main approaches to anomaly detection are: 1. Classification based: these supervised techniques make the assumption that a classifier of anomalies can be learnt from a training set and that the test set distribution is not significantly different from the training one. Several supervised machine learning algorithms have been discussed in literature [40,43,53]. In most cases an optimal detection can be obtained by combining multiple supervised machine learning techniques. For instance, Wei et al. [51] introduce ContrastMiner, a fraud detection framework which combine the use of contrast pattern mining, neural network and decision forest to have a high precision in the detection. In our previous research we have used and assessed several binary classifiers for fraud detection [33,13]. Also one-class classifiers, like one-class SVM and Isolation Forest, belong to this category. One-class SVM [38] fits a boundary around the known set of normal points, and then classifies as outlier everything which stands over the boundary. The Isolation Forest [27] uses the length of the path between the root and the leaves in the trees of a Random forest as outlier score. 2. Nearest neighbor based: the rationale is that the distribution of the neighbors (or local density) of a point characterizes the genuine or anormal nature of a point. In particular, normal instances stand in dense areas while outliers are located far from dense areas. Local Outlier Factor (LOF) is a wellknown density/neighbour based technique proposed by Breunig et al. in [4]. Variants of LOF have been proposed in [23,34,46,54]. 3. Clustering based: once the training set is properly clustered, outliers are expected to be located much farther away from the clusters center than normal ones. 4. Statistically based: they require the estimation of the multivariate distribution of data and return a score of outlierness which is inversely proportional to the density of a point. Gaussian Mixture Models (GMM) [16,19,26,55] are commonly used in this context because of their flexible semi-parametric nature. Hidden Markov Models have been used in [45] for credit card outlier detection. Bolton et al. [3] presented two statistical approaches which rely on monitoring the anomalous behavior of a cardholder compared to a group of peers (peer group analysis) or to cardholder behavior (break point analysis). 5. Information theoretic: they rely on the fact that anomalies create irregularities in the dataset and can be detected with information theoretic measures. 6. Spectral anomaly detection: these techniques transform the original dataset in a way that facilitate the separation of normal instances and outliers. A commonly used transformation technique is the Principal Component Analysis (PCA) [12,28,50]. Shuy et al. [44] proposed to combine the effect of the major component and the minor component. While the major component is used to find extreme values, the minor component highlights those observations which do not conform to the normal correlation structure. 7. Outlier detection combined with feature selection: unsupervised outlier detection has been recently combined with feature selection. Pang et al. proposed a filter-based feature selection framework for unsupervised outlier selection [29]. This approach improved the outlier detection rates while substantially reducing the number of features by 46% (on average). The same authors proposed a novel wrapper-based outlier detection framework [30] to iteratively optimize the feature subset selection and the outlier score. The results showed that the framework improved not only the AUC-ROC, but also the precision over the top-n ranked instances.

Active learning
Unlike passive learning, active learning modifies the size and nature of the training set by choosing from a unlabeled set a subset of points whose label is expected to improve the classifier. The AL setting is particularly promising in fraud detection because of the cost and the delay related to the labeling of instances. However, the adaptation of active learning to the specific characteristics of fraud detection data has only been partially addressed in the research literature. Fan et al. [18] carried out an empirical analysis on a fraud detection dataset to assess AL approach in presence of concept drift. They have focused on the adaptation ability of the AL strategy, but did not address the detection accuracy. Pichara et al. [31] tested a large scale anomaly detection approach in a synthetic dataset emulating the fraud process. Their AL schema has been able to detect the whole subset of frauds using a number of queries smaller than a Bayesian Network detection approach. Multiple tests were repeated using different data-noise levels, and their AL approach consistently outperformed the other techniques. However, the use a synthetic dataset reduces the impact of these results. It is very difficult to create a reliable and synthetic credit card dataset, since transactions (frauds and genuine) are very diverse and evolve in an unpredictable way. Van Vlasselaer et al. [48] applied active inference, a network-based algorithm, to fraud discovery in social security real data. They found that committee-based strategies, based on uncertainty, result in a slightly better classification performance than expert-based strategies. Nevertheless, expert-based strategies are often preferred in order to obtain unbiased training sets from queries. The relationship between active learning and streaming data, notably the sampling bias issue, is discussed in [14]. The authors showed that in stream-based active learning, the estimated input-output dependency changes over time and depends on the instances previously queried. Since those instances are typically selected next to the class decision boundary of the classifier, this may lead to a biased representation of the underlying data distribution. AL and concept drift is also addressed in [57]. Here, the authors stressed how concept drift may be missed in regions far from where AL queries normally take place (e.g. boundary regions between classes). The authors showed that techniques based on classical uncertainty sampling favor close concept drift adaptation while techniques based on random sampling are more effective in dealing with remote concept drift. The best performing techniques can strongly depend on the characteristics of the data and the size of the query budget. The issue of sampling bias is specifically discussed in [20]. Jacobusse and Veenman present multiple solutions to tackle the sampling bias on highly imbalanced datasets and screening applications. In such conditions, a small group of targets need to be detected among the non-targets vast majority. A random selection would lead to a very poor detection. So, usually an expert knowledge driven selection is preferred (medical screening application, law enforcement, screening of job applicants, ...). The authors emphasize that this selection is prone to suffer of a strong bias towards the previous knowledge of the expert, causing the classifier to be trained on a non representative dataset. A similar problem is faced in fraud detection, since only a small subset of transactions can be labeled in the short term and the selection of this subset corresponds to the riskiest credit card transactions. The integration of AL and semi-supervised learning is discussed in Xie and Xiong [52]. They introduced a Stochastic Semi-Supervised Learning (SSSL) process to infer labels in case of large imbalanced datasets with small proportion of labeled points. The approach relies on the consideration that since the number of unlabeled points is huge and the minority class is rare, the probability of making a wrong majority assignment is very low. Consequently, they proposed the assignment of the majority class to random selection of points and adopted it with success in the context of a data competition.
Finally, an original approach that may be used to deal with the one-to-many relationships between cards and transactions is discussed in [42]. They present an AL approach for multiple-instance problems where instances are organized into bags. Typical examples of multipleinstance problems are found in text classification and content-based image retrieval. In these type of problems a bag is said to be positive if it includes at least one instance which is positive, while the bag is negative if no positive instances are observed in it.

The fraud detection system classifier
Let us consider a Fraud Detection System (FDS) whose goal is to detect automatically frauds in a stream of transactions. Let x ∈ R n be the vector coding the transaction (e.g. including features like the transaction amount, the terminal) and y ∈ {+, −} the associated label, where + denotes a fraud and − a genuine transaction. A detection strategy needs a measure of risk (score) associated to any transaction. In a machine learning approach this score is typically provided by the estimation of the a posteriori probability P C (+|x) returned by a classifier C. We consider a streaming setting where unlabeled transactions arrive one at a time or in small batches. The FDS goal is to raise every day a fixed and small number of k alerts. In our industrial case study, n = 32 and k is set to 100 on the basis of cost and work organization considerations. The issuing of those alerts has two consequences: the trigger of an investigation and the consequent labeling of the associated transactions. The outcome of the investigation determines both the success rate of the FDS and the new set of labeled transactions. We will present in section 6 two levels of experimental validations: the first concerns the detection of fraud-ulent transactions, while the second focuses on fraudulent cards. In the first experiment, the classifier C is implemented by a conventional Random Forest, while in the second, we use a more complex approach (ensemble of classifiers) dictated by the more challenging nature of the detection tasks. This approach has been presented in [5,33] and consists of the weighted average of two classifiers where D t and F t stand for Delayed classifier and Feedback classifier respectively and w A ∈ [0, 1] is the weight controlling the contribution of the two classifiers. D t is implemented as an ensemble of Balanced Random Trees [10,35] trained on old transactions for which we can reasonably consider the class as known. F t is trained on recently alerted transactions, for which a Feedback was returned by investigators. It is therefore alimented by the active learning component of the fraud detection system. This Feedback component is very important to address concept drift. This architecture is the result of an extensive model selection and assessment procedure which has been discussed in our previous work [5,33]. The aim of this paper is to discuss the impact of different AL strategies, so we will not take into consideration alternative classifier architectures.

Dataset visualization
Credit Card Fraud Detection deals with high-volume (millions of transactions) and large dimensionality (n = 32 in our example) datasets. So, it is difficult to have a visual insight of the data distribution and the nature (e.g. non-separability) of the classification task. As a consequence most papers rely only on predictive accuracy (e.g. ROC curves) to assess the difficulty of the task. Given the dynamic and sampling nature of AL , it is however relevant to visualize the location of the selected query points with respect to the original data distribution in order to better illustrate the differences between alternative strategies. In the following section we will complement the presentation of the different AL strategies with a visual representation of our experimental dataset (details are in Section 6) in the space of the two first Principal Components (denoted by PC1 and PC2). Fig. 1 shows the Class Conditional distributions of the two classes (Fraud in red and Genuine in blue) in the PC1/PC2 space. This visualization provides interesting insights about the distribution of Frauds and Genuine transactions: i) the two classes appear to be only partially overlapping in the space, ii) the density of the fraudulent set appears to have a higher variance than the genuine set and iii) as far as the first principal component is concerned, frauds have a distribution skewed to the left. However, the class-conditional nature plot should not mislead us to the conclusion that the problem is easy to solve. In fact, given the high imbalance of the classes, a large number of genuine transactions still occur in the left part of the plot (mostly red). In Section 5 we will use Fig. 1 as a template for illustrating the distribution of the queries issued by the different AL strategies taken into consideration.

Active learning strategies
The rationale of AL is to select (on the basis of current information) unlabeled training samples which, once labeled, can improve the accuracy. However, there are two main unknowns concerning the effectiveness of AL in credit card fraud detection. The first concerns the strong imbalance of the class distribution: as the selection of adequate queries is the most important step of an AL procedure. This step should take into account that in such a large imbalanced problem, selecting majority class points will inevitably have a negligible impact on accuracy. The second concerns the definition of accuracy: measures of detection accuracy are strictly related to the capacity of discovering frauds, i.e. querying minority class samples. This means that an AL strategy for fraud detection requires some specific tuning for being successful.   To illustrate the impact of AL on FDS, we will start by considering a baseline strategy which simply queries the highest risk transactions on the basis of the cur-rent classification model. This strategy will be denoted as the Highest Risk Querying (HRQ). Thereafter, we will introduce and assess a number of modifications of HRQ according to several principles. In order to make the comparison easier we will define each AL strategy as an instance of a generic AL strategy detailed in Algorithm 1. The Algorithm requires the specification of three parameters: the budget k of queries (i.e. maximum number of transactions that can be investigated per day), the number of q queries defined for exploration purposes and the number m of unlabeled transactions that can be set as genuine without investigation (see 5. 3). When q > 0, the choice of the queries demands a selection criterion which plays a major role in the final accuracy of AL. Note that the criteria used by the methods discussed in the following sections can be regrouped in three classes: supervised (i.e. relying on labeled data), unsupervised and semi-supervised. The entire list of discussed AL strategies is presented in Table 1.

Highest risk querying
The idea of Highest Risk Querying (HRQ) is simple: given a classifier C and a budget of queries, HRQ returns the unlabeled transactions with the highest estimated a posteriori probability P C (+|x i ). HRQ is the most in-tuitive active learning strategy for our problem if we consider that the final FDS accuracy depends on the amount of minority class querying. Note that in terms of the pseudocode in Algorithm 1, HRQ is obtained by setting q = 0 and m = 0. HRQ is expected to have a positive impact on accuracy by discovering new instances from the minority class and improving consequently the balance of the training set. It has also some drawbacks: since its querying strategy relies on the classifier accuracy, this selection step could be inaccurate especially at the very beginning. Fig. 2 represents a set of 200 query points returned by HRQ. As expected, the classifier C selects points located in areas where the class conditional density of frauds is high (red areas). The training of a new classifier using exclusively this subset of points may suffer of selection bias, since the sample is not representative of the distribution of the genuine class.

Exploratory active learning
Exploratory Active Learning (EAL) strategies modify HRQ by trading exploitation for exploration. The idea is to convert a subset of the labeling budget in explorative queries. The size of the exploration budget is represented by 0 < q ≤ k in Algorithm 1.
We may consider a number of exploration techniques for selecting the q exploratory transactions. The simplest one is random querying (denoted by EAL-R) which consists in choosing randomly the q query points. This selection is unsupervised and sub-optimal since it may query points for which the classifier is already highly confident about the class. A less naive unsupervised strategy (denoted by EAL-P) consists in using an unsupervised algorithm (e.g. PCA) to select the q queries. An alternative with a supervised selection criterion is represented by uncertainty querying (EAL-U) which returns unlabeled data points for which the current classifier has low confidence [24]. The selection criterion is therefore supervised: given a binary classifier C, the uncertainty querying strategy gives priority to the transactions x i for which P C (+|x i ) ≈ 0.5. This value may be affected by class imbalance and an higher threshold may be chosen in the fraud detection setting. Nevertheless, it is a good practice to balance the dataset before training the classifier. In the experimental section, we will implicitly refer to a classifier C which is trained on a balanced dataset.  The transactions are expected to be selected in areas where the classifier C is the most uncertain. As a consequence, selected transactions will lie in areas which present a high density for both classes.
Zliobaitė et al. [57] proposed the mix of the two techniques, uncertainty querying and randomization, to tackle remote concept drift (Section 2). The technique (denoted by EAL-M) consists in querying by uncertainty most of the points and in querying random points from time to time.

Stochastic semi-supervised learning
The Stochastic Semi-Supervised Learning (SSSL) strategy has been introduced by Xie and Xiong [52] to infer labels in case of highly imbalanced datasets with a large number of unlabeled points. The strategy relies on a simple consideration: since the ratio between the number of frauds and the total number of transactions is very small, the probability of randomly selecting a fraud is very low. The resulting AL learning schema is made of four steps: 1. Selection: the current model is used to annotate all unlabeled transactions with an estimated risk; 2. Querying: the highest risk transactions are labeled by the investigators; 3. Majority assumption: a number of transactions are labeled as genuine by majority assumption; in this paper we explore a number of criteria to attribute the majority class: pure random attribution (SR), uncertainty (SU), mix of randomness and uncertainty (SM) and low predicted risk (SE). 4. Training: the labeled data points, obtained by the previous steps, are used to train/update a supervised model.
Though the selection strategy is supervised as in EAL, SSSL differs in terms of the usage of the current model C: the predicted risk is not only used to alert and trigger the investigation but also to label (without investigation) a number of low risk transactions. In order to illustrate the reliability of the majority assumption, we report in Fig. 4 the distribution of the scores P C (+|x i ) over 15 days. In particular the histograms (a), (b) and (c) refer to the score distribution for all transactions, genuine and fraudulent transactions, respectively. The plot (d) represents the proportion of fraudulent and genuine transactions for a given score in the range [0, 1]. Note that, though the a priori proportion of fraudulent cards in the dataset is 0.13%, it becomes 23.33% for scores higher than 0.95 and 61.90% for scores beyond 0.99. Note also that, in the area of maximal uncertainty for C (e.g between 0.49 and 0.51), we find only 0.35% of frauds. On the basis of those considerations, it is possible to define a number of Stochastic Semi-Supervised strategies:

Total scores
Normalized scores Additional variants can be created by simply allowing an exploration budget (q > 0). The SR-U, SR-R and SR-M strategies are hybrid strategies which combine an exploration strategy (e.g. U in SR-U) and a SSSL strategy (e.g. SR in SR-U). domly, and independently of the classifier C. It is important to note that this sampling strategy basically follows the class conditional density of the Genuine class. This is a consequence of the high imbalance of the dataset, since the distribution of frauds is negligible compared to the distribution of genuine transactions. In [20], Jacobusse and Veenman presented additional variants of the SSSL. They partition the original dataset D under study in three subsets: -D + : the subset of known positive samples, which corresponds in our scenario to the subset of frauds in the feedback set received by the investigators; -D − : the subset of known negative samples, which corresponds to the subset of genuine transactions in the feedback set received by the investigators; -D 0 : the subset of unlabeled samples, which corresponds to the set of unlabeled transactions.
While SSSL proposes to add part of the samples in D 0 and all the labeled samples in D + and D − , the variant proposed by Jacobusse and Veenman suggests to remove D − or part of it. The idea is to reduce the selection bias which can arise when the process of selection is driven in an expert knowledge way. In our context the expert knowledge selection is replaced by the classifier C. In the experimental section, we will refer to this approach as SRN[p], with p being the percentage of negative samples retained from the feedback set.

Oversampling
It is worth noting that a side-effect of the adoption of SSSL (Section 5.3) is to add a number of majority class samples to the training set. This goal is typically achieved by oversampling techniques, with the main difference that here the target class is the majority class and not the minority one. In order to assess how SSSL situates with respect to conventional oversampling, we also consider a comparison with the two main oversampling techniques: Random Oversample (ROS) [21] and SMOTE [9]. ROS consists in duplicating some random instances from the class to be oversampled until a given sample size is reached. SMOTE creates artificial instances from the target class in the following manner: once the k nearest neighbors from the same class have been identified, new artificial transactions are generated moving along the line segment joining the original instance and its k neighbors.

Multiple instance learning
This section deals with another specificity of the credit card fraud detection problem: the observations take place at the level of transactions but what is relevant for the company is the detection at the card level, since the investigation is performed at the card level and not at the transaction level. From an AL perspective, since multiple transactions map to the same card, we could select query points by taking advantage of such one-to-many relationship.

Querying by frequent uncertainty
The rationale of Querying by Frequent Uncertainty (QFU) boils down to query those cards which are mapped to the largest number of uncertain transactions. We associate to each card c a counter representing how many of its associated transactions x i ∈ c are uncertain, i.e. have a score P Ct where v determines the size of the uncertainty range. The counters are updated in real-time and the AL selection returns the k cards with the highest counters.

Combining function
A more advanced strategy to deal with card detection is inspired by [42]. A combining function can be used to aggregate all the posterior probabilities p c i = P C (+|x i ) of the transactions x i ∈ c and derive the posterior probability P C (+|c).
The simplest combining function is the max function (denoted MF), which returns Alternatively, authors in [42] propose the softmax combining function: where α is a constant that determines the extent to which softmax approximates a max function.
In order to i) increase the sensitivity of the card risk to high risk transactions and to ii) reduce its sensitivity to low risk transactions, we propose a logarithmic combining function returning the score and is a very small number.   Table 3 illustrates the scores associated to the transactions of Table 2 for the three combining functions presented above. It appears that, unlike the max function, the other two functions are able to take into account the impact of multiple risky transactions on the overall risk of a card. In other terms two high risk transactions weight more than a simple one with a marginal higher risk. However, the softmax and the logarithmic functions differ in the importance they give to low risk transactions. Suppose we add a low risk transaction (Table   4) for card "B" to the set of transactions of Table 2. Table 5 shows that the sensitivity of the card risk to such additional transaction is much larger in the softmax than in the logarithmic case. The counter-intuitive consequence is that according to the softmax function the card "B" becomes now less risky than the card "A".

Experiments
This section relies on a large imbalanced dataset of 12 million credit card transactions provided by our industrial partner Worldline.
In this realistic case-study, only a very small number (k = 100) of cards per day can be queried, amounting to roughly 0.2% of labeled points. The dataset has 32 features and it covers 60 days, each day including roughly 200K transactions. Two sets of experiments are performed: the first measures the detection accuracy at the level of the transactions, while the second measures the detection accuracy at the card level. In the first study, for the sake of simplicity, the classification model C is a conventional random forest model RF while a more realistic model A (discussed in [33] and in Section 3) is used for the cards 3 . Since the randomization process in RF and A may induce variability in the accuracy assessment, we present the results of twenty repetitions of the streaming.
All the AL strategies are compared in identical situations and initialized with the same random and balanced set (initial training set D presented in algorithm In all the plots, the dark boxes are used to denote the most accurate AL strategy as well as the ones which do not differ significantly from it (paired Wilcoxon signed rank test with 5% significance level). The precision over the Top100 alerts is expected to be larger for RF than A since multiple positive alerts for the same card will be accounted as several true positives in the transaction case but as a single success in the card case. We made all the code available on Github 4 .

Transaction-based fraud detection
In order to better situate the results of AL techniques, we start by reporting the accuracy of several passive (Section 2.1) unsupervised methods. In Fig. 6 In Fig. 7, we report the fraud detection accuracy of the AL techniques discussed in Section 5. A horizontal line is added in order to make the comparison with the baseline strategy HRQ easier. The experiments are performed with k = 100, q = 5 and m = 1000. These hyper-parameters have been set by trial-and-error and are compatible with the kind of exploration effort that our industrial partner could ask to its investigators. The first remark is that AL (Fig. 7) significantly outperforms passive learning unsupervised techniques (Fig. 6).
Second, it appears that exploratory AL alone is not able to outperform the standard HRQ strategy. In particular unsupervised explorations are of no use: the PCA based exploration EAL-P as well as random exploration EAR are significantly worse than the baseline HRQ. The highest accuracy is obtained by SSSL (SR) or by combining SSSL with uncertainty sampling (SR-U). The SR strategy leads to an improvement in precision of 5.84%, while SR-U leads to an improvement of 5.15%. Similar improvement are observed for the AUC-PR (Fig. 7b)  form better in terms of AUC-ROC curve (Fig. 7c). The most efficient combination in our setting is therefore obtained by a combination of stochastic semi-supervised approach with the standard HRQ strategy for active learning (Fig. 9). We have also compared the semi-supervised technique SR with the standard Random Oversample and SMOTE oversampling techniques. As shown in Fig. 8, SR appears to be better in terms of Top100 Precision, AUC-PR and AUC-ROC. ROS and SMOTE outperform HRQ only in terms of AUC-ROC. In Fig. 10 [20]. They have used a synthetic dataset with an imbalance ratio of 1% and they have observed a higher AUC-ROC for the SRN[p] strategy in case of very small p. In Fig. 12, we report the impact on precision of the proportion of daily transactions selected by SR. The SR experiments reported in Fig. 7 refer to a selection of 1000 points (0.50% of the daily transactions) while the highest precision (statistically significant) is attained for 2% of the daily transactions. The figure shows then the existence of a trade-off in precision between a configuration corresponding to HRQ (i.e. no additional selected points, on the left-side) and a configuration with many added points (right side). Our interpretation is that both selection bias (left-side configuration) and excessive imbalance (right-side configuration) may be detrimental to precision. An accurate tuning of such trade-off is expected to be beneficial for the final performance.

Card-based fraud detection
In this second case study, we retain the most promising techniques form the transaction assessment (namely, SR and SR-U), and we compare them with the Multiple Instance Learning strategies described in Section 5.5.1 (v = 0.05) and 5.5.2 ( = 1e − 3). Fig. 11 summarizes the results for the card detection study, using Top100 Card Precision, AUC-PR and AUC-ROC as accuracy metrics.
When the Top100 Precision is considered as performance metric, stochastic semi-supervised with random labeling and max combining function (MF-SR) returns the best result with a detection improved by 3.21%. The strategy also performs well in terms of AUC-ROC, but is outperformed (by a small margin) by the logarithmic combining function when considering AUC-PR as the performance metric.
Similarly to the results obtained at the transaction level, the best strategies are those combining the baseline High Risk Querying with stochastic semisupervised with random labeling (SR) or uncertainty labeling (SU). The addition of an exploratory part (QFU, or SR-U strategies) did not allow to improve the detection accuracy. The performances are even slightly decreased in terms of Top100 Precision for SR-U strategies.
The results show that the combining function plays an important role. While the max and logarithmic performed best overall, the softmax clearly hampered the fraud detection accuracy.
In Fig. 13 we show the impact on money savings related to the adoption of the MF-HRQ and MF-SR techniques respectively. Fig. 13a reports the daily amount of fraudulent money detected by two approaches (as a percentage of daily transacted money). Fig. 13b     (as a percentage of daily fraudulent transacted money). However, we are not able to measure the amount of fraudulent transactions detected later than our partner since from the historical data we cannot reconstruct if the fraud was indeed detected by the industrial FDS (or labeled after a claim of the cardholder).
To conclude, stochastic semi-supervised labeling (SR and SU) combined with HRQ remained the best strategies, confirming the results obtained at the transaction level. Regarding the combining functions, the logarithmic function provided the best performance in terms of AUC-ROC, but the max function significantly outperformed in terms of Top100 Precision. Overall, the max combining function was observed to provide the most stable improvement throughout the range of explored performance metrics.

Conclusion and future work
This paper investigates the impact of active learning strategies on the fraud detection accuracy in credit cards. Using a real-world dataset of several millions of transactions over sixty days, we provided an extensive analysis and comparison of different strategies, involving standard active learning, exploratory active learning, semi-supervised learning and combining functions 5 . 5 We made the StreamingActiveLearningStrategies repository available in github.com/fabriziocarcillo/ In particular we assessed the importance of different selection criteria (supervised, unsupervised or semisupervised). Moreover, we provided a two-dimensional visualization of the complexity (e.g. non separability) of the fraud detection problem as well as a visualization of the distribution of the query points issued by the different strategies. Our results show that unsupervised outlier detection has very low accuracy in the context of credit card fraud detection. This is especially true for a context where only a very small number of cards can be investigated every day and high precision is required. Furthermore we find that the baseline active learning for fraud detection, the Highest Risk Querying, can be noticeably improved by combining it with Stochastic Semi-supervised Learning, thereby allowing to increase the fraud detection accuracy by up to five percent. Exploratory active learning techniques (including supervised or unsupervised selection criteria) have not improved the fraud detection task. This can be attributed to the highly imbalanced nature of the data and the small exploration budget that can be reasonably allocated in a fraud detection system. Last, our results on combining functions for bags of transactions showed that the baseline strategy, implemented with the max strategy, was the most stable across different accuracy metrics, but that alternative functions could be worth considering. Future work will focus on two main directions, the stratification of the dataset according to the properties of transactions or cardholders, the design and assessment of hybrid strategies to combine unsupervised (notably outlier detection) and supervised methods.