[Paper Review] Modeling the Field Value Variations and Field Interactions Simultaneously for Fraud Detection

Dongbo Xi, Bowen Song+6 more|arXiv (Cornell University)|Aug 8, 2020

Imbalanced Data Classification Techniques4 citations

TL;DR

This paper proposes Dual Importance-aware Factorization Machines (DIFM), a model that simultaneously captures field value variations across user events and field interactions within each event to improve fraud detection. It achieves state-of-the-art performance on real industrial data and provides explainable predictions by learning importance weights for field variations and events.

ABSTRACT

With the explosive growth of e-commerce, online transaction fraud has become one of the biggest challenges for e-commerce platforms. The historical behaviors of users provide rich information for digging into the users' fraud risk. While considerable efforts have been made in this direction, a long-standing challenge is how to effectively exploit internal user information and provide explainable prediction results. In fact, the value variations of same field from different events and the interactions of different fields inside one event have proven to be strong indicators for fraudulent behaviors. In this paper, we propose the Dual Importance-aware Factorization Machines (DIFM), which exploits the internal field information among users' behavior sequence from dual perspectives, i.e., field value variations and field interactions simultaneously for fraud detection. The proposed model is deployed in the risk management system of one of the world's largest e-commerce platforms, which utilize it to provide real-time transaction fraud detection. Experimental results on real industrial data from different regions in the platform clearly demonstrate that our model achieves significant improvements compared with various state-of-the-art baseline models. Moreover, the DIFM could also give an insight into the explanation of the prediction results from dual perspectives.

Motivation & Objective

• To address the challenge of effectively leveraging internal field information—both within events and across user behavior sequences—for fraud detection.
• To improve the performance of fraud detection models by capturing both field value variations and field interactions in a unified framework.
• To provide explainable predictions by learning importance weights for field variations and events, enabling actionable insights for risk management.
• To overcome limitations of existing models that fail to differentiate field-level dynamics or provide interpretable results.

Proposed method

• DIFM employs a dual-branch architecture: one branch models field value variations between any two events using a Field Value Variations module with importance-aware weighting.
• The second branch models field interactions within each event using a Field Interactions module, also equipped with importance-aware weighting for events.
• An importance-aware module assigns learnable weights to field value variations and events, reflecting their contribution to fraud risk.
• The wide component of DIFM scores individual field values directly, enabling use as blacklist/whitelist entries for real-time risk screening.
• The model integrates Factorization Machines to efficiently learn second-order feature interactions while preserving interpretability.
• The final prediction combines contributions from both perspectives, with attention-like weighting to highlight high-risk patterns.

Experimental results

Research questions

• RQ1 How can field value variations across user events be effectively modeled to detect fraudulent behavior?
• RQ2 To what extent do field interactions within individual events contribute to fraud detection beyond sequential patterns?
• RQ3 Can a unified model simultaneously exploit both field variation and interaction signals to improve fraud detection performance?
• RQ4 Can the model provide interpretable explanations by learning the importance of specific field variations and events?

Key findings

• DIFM achieves significant performance improvements over state-of-the-art baselines on real industrial datasets from a leading e-commerce platform.
• The model outperforms RNN-based and other sequential modeling approaches by capturing fine-grained value variation patterns that are strong fraud indicators.
• Field value variations—such as changes in IP, card bin, or email suffix—were found to be highly predictive, with specific values like 'Email suffix #2' showing 100% fraud rate in the dataset.
• The importance weights learned by DIFM successfully identify high-risk events and fields, such as multiple field changes in a single user’s history, which correlate strongly with fraud.
• The model’s explainability enables direct integration into risk systems, where high-risk field values can be added to blacklists and low-risk ones to whitelists.
• Case studies confirm that DIFM accurately identifies fraud patterns through visualized importance maps, demonstrating its utility in expert-driven risk analysis.