[Paper Review] Detection of Anomalies in Large Scale Accounting Data using Deep Autoencoder Networks

Marco Schreyer, Timur Sattarov+3 more|arXiv (Cornell University)|Sep 15, 2017

Anomaly Detection Techniques and Applications32 references79 citations

TL;DR

The paper uses deep autoencoder networks to detect anomalous journal entries in large-scale accounting data by combining reconstruction error with attribute-value probabilities, evaluated on two real SAP ERP datasets. It outperforms several baselines in precision and maintains high recall.

ABSTRACT

Learning to detect fraud in large-scale accounting data is one of the long-standing challenges in financial statement audits or fraud investigations. Nowadays, the majority of applied techniques refer to handcrafted rules derived from known fraud scenarios. While fairly successful, these rules exhibit the drawback that they often fail to generalize beyond known fraud scenarios and fraudsters gradually find ways to circumvent them. To overcome this disadvantage and inspired by the recent success of deep learning we propose the application of deep autoencoder neural networks to detect anomalous journal entries. We demonstrate that the trained network's reconstruction error obtainable for a journal entry and regularized by the entry's individual attribute probabilities can be interpreted as a highly adaptive anomaly assessment. Experiments on two real-world datasets of journal entries, show the effectiveness of the approach resulting in high f1-scores of 32.93 (dataset A) and 16.95 (dataset B) and less false positive alerts compared to state of the art baseline methods. Initial feedback received by chartered accountants and fraud examiners underpinned the quality of the approach in capturing highly relevant accounting anomalies.

Motivation & Objective

• Motivate the need for unsupervised anomaly detection in ERP/journal-entry data due to limitations of red-flag rules and fraud adaptations.
• Propose a deep autoencoder-based approach to model normal journal-entry patterns and detect anomalies.
• Develop a novel anomaly scoring mechanism that combines reconstruction error with attribute-value probabilities.
• Evaluate the method on real-world SAP ERP datasets and compare against baselines to assess effectiveness and practicality.

Proposed method

• Represent journal entries as binary (one-hot) encoded attribute vectors to capture categorical accounting features.
• Train deep autoencoder networks with bottleneck architectures to learn compressed representations of normal journal entries.
• Compute reconstruction error E for each entry and normalize it to obtain RE as a measure of deviation.
• Compute an attribute-value probability score AP from the frequency of individual attribute values and normalize it.
• Define an anomaly score AS combining RE and AP via AS = alpha * RE + (1 - alpha) * AP, and flag anomalies when AS exceeds a threshold beta.
• Compare multiple architectures (AE1–AE9) to study depth effects, optimizing for recall of synthetic anomalies and precision.

Experimental results

Research questions

• RQ1 Can deep autoencoder-based reconstruction error, regularized by attribute probabilities, effectively detect anomalous journal entries in large ERP datasets?
• RQ2 How does model depth affect anomaly detection performance and false-positive rates on real-world accounting data?
• RQ3 How does the proposed autoencoder-based approach compare to standard unsupervised anomaly detection methods in this domain?
• RQ4 What qualitative insights do practitioners gain when reviewing detected anomalies (global vs. local) using this method?

Key findings

• The deepest architecture (AE9) achieved the highest recall (100%) on synthetic anomalies across datasets, with relatively few detected anomalies (0.16% in dataset A and 0.62% in dataset B).
• The autoencoder-based approach achieved strong precision relative to baselines, significantly reducing false positives (e.g., 176 fewer in dataset A and 97 fewer in dataset B for OC-SVM comparisons).
• Compared with PCA, LOF, OC-SVM, and DBSCAN baselines, the autoencoder (AE9) provided competitive ROC-AUC while yielding substantially better anomaly precision.
• Qualitative analysis showed detected global anomalies often involved rare attribute values or incorrect postings, while local anomalies captured unusual combinations of otherwise common attributes; auditors found these entries relevant for forensic review.