Areas of Expertise
- Data Mining and Knowledge Discovery in Databases (KDD) techniques
- Link Analysis
- Time Sequence Matching
- Peer Comparison and Outlier Detection
- Decision Trees
- Association Rules
- Clustering and Kohonen Maps
- Neural Nets
- Fraud & Money Laundering Detection
- Residential Mortgage
- Auto Insurance
Steve Donoho, PhD
My work involves finding "interesting" behaviors in large amounts of data. Behaviors can be "interesting" for a number of reasons. They may be part of a fraud. They may be an attempt to conceal a crime or terrorist plot. On the other hand they may represent a business opportunity. Some examples of "interesting" behaviors include:
Most real data mining problems are not easily solved by running the data through off-the-shelf data mining tools. Instead, creative problem solving is required to formulate the problem in a way that maximizes the value of the data and makes standard tools useful. I work closely with domain experts to find creative approaches that leverage each domain's peculiarities.
- Insider Trading. The option trading in a company becomes very abnormal one day. The volume increases, the implied volatility increases, the ratio between calls and puts becomes abnormal, the volume is abnormally skewed toward options that expire in the next month. All this happens without any news about the company. Perhaps these behaviors indicate that some people know that the company is going to release important news soon, and they are trading on that information (KDD2004 paper on this topic).
- Money Laundering. A money launderer wants to convert his illegally-gained cash into money orders. He goes to several convenience stores and post offices and buys money orders. In order to avoid showing his ID, he alway purchases just under $3000 at each stop. When he deposits his money orders at his bank, they show up in the data as short series of sequential serial numbers that add up to just under $3000. "Normal" people don't exhibit this behavior, only money launderers.
- Excessive Mark-up. A bond trader wants to conceal that he is charging his customer an excessive mark-up in the price of a bond. So he sells the bond to another trader for a medium-sized mark-up. That trader sells the bond to another trader for another medium-sized mark-up. And so on ... In the end, the customer pays an excessive mark-up, but no individual trader charged an excessive mark-up. At some future date, the other traders return the favor and give the first trader a share of the mark-up on their customer.
- Customer Attrition. In a short period, a retail bank customer changes several of his behaviors. His paycheck stops being automatically deposited into his account. The number of checks he writes decreases. His number of ATM visits drops off. He makes a large payment to a different bank. The behaviors taken together may indicate that he's switching to a different bank.