データドリブンな組織の不正検知

by fkubota

Slide 1

Slide 1 text

σʔλυϦϒϯͳ૊৫ͷ ෆਖ਼ݕ஌ Fumihiro Kubota MoT/ίωώτ/Kanmu ͕ޠΔ ϓϩμΫτ։ൃxσʔλ෼ੳ

Slide 2

Slide 2 text

Slide 3

Slide 3 text

Slide 4

Slide 4 text

Slide 5

Slide 5 text

ϓϩμΫτʹ͍ͭͯ 1

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Copyright Kanmu, Inc. All right reserved. ޙ෷͍αʔϏεͱ͸ ● ࠓ͙͢ങ͍͍ͨͷʹ࢒ߴ͕଍Γͳ͍Αʙͱ͍͏ͱ͖ʹ࢖͑Δ ● গֹ(3000ԁʙ50000ԁ)νϟʔδ͢Δ͜ͱ͕Ͱ͖Δ ● ͦͷޙظݶ೔·ͰʹίϯϏχͳͲͰࢧ෷͍ ● େ͖ͳಛ௃ͱͯ͠਎෼ূఏग़ΛߦΘͳͯ͘΋ར༻͢Δ͜ͱ͕ Ͱ͖Δ ○ ※ ޙ෷͍αʔϏεΛఏڙ͢Δηϒϯ౳ͷ৹ࠪʹΑͬͯར༻Ͱ͖ͳ͍Ϣʔβʔ ͸ଘࡏ͢Δ

Slide 10

Slide 10 text

Slide 11

Slide 11 text

ෆਖ਼ͱରࡦ 2 ෆਖ਼ͱ͍͏σϦέʔτͳ࿩୊ͳͷͰɺৄࡉʹ৮ΕΒΕͳ͍෦෼͕ଟ͋͘Γ·͕ྃ͢͝ঝ͍ͩ͘͞ɻ

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Copyright Kanmu, Inc. All right reserved. ͱʹ͔͘Ұ࣍৘ใΛݟΔ ● Ճ޻͞Ε͍ͯͳ͍σʔλΛͱʹ͔͘ݟ·͢ɻ(టष͘) ● ͳʹ͔ͱ͔͔ͬΓ͕௫ΊΕ͹ɺԾઆΛཱͯͯΫϩεूܭͳͲͰ σʔλΛ෼ੳ͠·͢ ○ ͜ͷಛ௃ྔA ͷ a1~a5 ʹଐ͢ΔϢʔβ܈͕ո͍͠ͷͰ͸ʁʁ ● ಘΒΕͨ৘ใ͔ΒԾઆΛΞοϓσʔτͯ͠·ͨσʔλΛݟΔ ֶͼ ͱ ڞ༗ ෼ੳ ੜσʔλ Ծઆ ͙Δ͙Δճ͢

Slide 15

Slide 15 text

Copyright Kanmu, Inc. All right reserved. σʔλυϦϒϯͳνʔϜͰઓ͏ ● ෼ੳΛ͍ͯ͠Δؒʹ΋ͲΜͲΜ࢖͑ͦ͏ͳσʔλީิ͕νʔ Ϝϝϯόʔ͔Βू·͖ͬͯ·͢ ● ΧϯϜ͸ࣾһͷ΄΅શһ͕SQLΛॻ͚ΔͷͰඞཁͳ৘ใ͸ ֤ࣗͰऔΓߦ͘ͱ͍͏จԽ͕͋Γ·͢ ● ৬छʹΑͬͯීஈ࢖͏σʔλ(ςʔϒϧ)͕ҟͳΔͷͰɺ஌Β ͳ͔ͬͨ৘ใ͕ͨ͘͞Μू·Δ ΄΅શһ͕ɺ ϛχσʔλΞφϦετʁ ͜ͷϩάݟΕ͹ ͳʹ͔Θ͔ΔΜ͡Όͳ͍͔ͳ ͜ͷςʔϒϧͷ ͜ͷσʔλ࢖͑Δ͔΋ ໾һ Ϛʔέλʔ Πϯϑϥ σβΠφʔ PdM ϑϩϯτΤϯυ Biz/Dev

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Copyright Kanmu, Inc. All right reserved. a. Ͳͷ࣌఺Ͱݕ஌͍ͨ͠ͷ͔ʁ ● ୔ࢁσʔλ͕͋ͬͯ΋ෆਖ਼ݕ஌λΠϛϯάʹΑͬͯ࢖͑ͳ ͍Մೳੑ΋͋ΔͷͰ৻ॏʹ(ϦʔΫ) ● ͕࣌ؒܦա͢Δ΄Ͳ࢖͑Δ৘ใ͸ଟ͍ ● ૣ͍λΠϛϯάͩͱෆਖ਼༧ଌͱͯ͠ػೳͯ͠ෆਖ਼͕ى͜Δ લʹࢭΊΒΕΔ ● ଎౓ͱ৘ใྔͷτϨʔυΦϑ ొ࿥ ෆਖ਼ νϟʔδ ܾࡁ ? ? ? ? ? ৘ใྔ

Slide 19

Slide 19 text

Copyright Kanmu, Inc. All right reserved. b. ྑ͍ݕ஌ͱ͸ͳʹ͔ ● ෆਖ਼ͷΈΛશ݅ݟ͚ͭΔͷ͸ͱͯ΋Ή͔͍ͣ͠ ● શ݅ݟ͚ͭΑ͏ͱ͢Δͱ ○ →ר͖ࠐΜͰ͠·͏Ϣʔβ͕૿͑Δ ● ר͖ࠐ·ͳ͍Α͏ʹ͢Δͱ ○ →ෆਖ਼Λಀͯ͠͠·͏ ● Α͋͘Δ Precision vs Recall ໰୊ ● ͋Δ1ͭͷධՁࢦඪͷ࠷େԽͰ୯७ʹܾΊΒΕͳ͍͜ͱ΋͋Δ ● ͜͜͸టष͘

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Copyright Kanmu, Inc. All right reserved. ࠓճͷղ͖͍ͨ໰୊͸ ● 3ཁૉ ○ Ͳͷ࣌఺Ͱݕ஌͍ͨ͠ͷ͔ ■ ͋Δఔ౓৘ใ͕ू·Δ࣌఺͔ͭɺΦϖϨʔγϣϯͷ؍఺͔Βܾఆ ○ ྑ͍ݕ஌ͱ͸ͳʹ͔ ■ ෆਖ਼Λݕ஌ͭͭ͠ɺଞͷϢʔβΛͰ͖Δ͚ͩר͖ࠐ·ͳ͍Α͏ʹ͢Δ ■ ݶքརӹ΍աڈͷӡ༻͖ͯͨ͠ϧʔϧϕʔεͷܦݧ͔ΒɺνʔϜͰ૯߹త ʹ൑அˡ͋ΔҰͭͷࢦඪͷ࠷େԽͱ͍͏୯७ͳ໰୊Ͱ͸ͳ͍ ○ ӡ༻໘ ■ ࣮૷·Ͱͷ଎౓ɺ͜Ε·Ͱͷӡ༻ͱͷ਌࿨ੑɺਫ਼౓͔ΒMLϞσϧͰ͸ͳ ͘ɺϧʔϧϕʔεͰे෼ͩͱ൑அ ● Next Action ○ ݕ஌ͷλΠϛϯά͔Β࢖͑Δσʔλ͕ܾ·ͬͨɻ ○ ͜ΕΒΛ࢖ͬͯɺଞͷϢʔβΛͰ͖Δ͚ͩר͖ࠐ·ͳ͍ܗͰෆਖ਼Λݕ஌Ͱ͖ ΔϧʔϧϕʔεΛܾఆ͢Δɻ

Slide 22

Slide 22 text

ϧʔϧϕʔεͷܾఆ 3

Slide 23

Slide 23 text

Copyright Kanmu, Inc. All right reserved. ϧʔϧϕʔεͷܾఆ ● ࢖͑ͦ͏ͳσʔλ(ಛ௃ྔ)͸ͨ͘͞Μ͋Δ ● ͲΕΛϧʔϧͱͯ͠࢖͏͔ܾΊͳ͚Ε͹ͳΒͳ͍ ○ ྫ: ಛ௃ྔA͕aҎ্Λෆਖ਼ͱ͢Δ ● ͔͋͠͠Δಛ௃ྔ1ͭͰෆਖ਼ͩͱ൑அ͢Δ͚ͩͷܾఆతͳಛ ௃ྔ͸ݟ͔͍ͭͬͯͳ͍ ● ෳ਺ͷಛ௃ྔΛ࢖ͬͨଟ࣍ݩతͳϧʔϧʹ͢Δඞཁ͕͋Δ ○ ྫ: ಛ௃ྔA͕aҎ্ ͔ͭ ಛ௃ྔB͕bҎԼ ͔ͭ...

Slide 24

Slide 24 text

Copyright Kanmu, Inc. All right reserved. ܾఆ໦Λ༻͍Δ ● େྔͷ࢖͑ͦ͏ͳಛ௃ྔΛܾఆ໦ʹೖྗɺڭࢣσʔλ͸ 1(ෆਖ਼) / 0(notෆਖ਼) ͷೋ஋෼ྨ ● ෆਖ਼͕ͨ͘͞Μؚ·ΕΔ͔ͭר͖ࠐΈ͕গͳ͍ऴ୺ϊʔυ͕͋Ε͹ͦͷϊ ʔυʹͨͲΓண͘·ͰͷϧʔϧΛͦͷ··ϧʔϧϕʔεʹ͢ΔΞϓϩʔν ● ֤ϊʔυ͕ͦΕͧΕఏҊ͞Εͨϧʔϧͱߟ͑Δ͜ͱ͕Ͱ͖Δ featA > a ? featB > b ? featC > c ? not ෆਖ਼ ෆਖ਼ yes no ѱ͍ϧʔϧ ྑ͍ϧʔϧ ϧʔϧʹ͢Δͱ ● featA <= a ͔ͭ featC <= c Λෆਖ਼ͱ͢Δ

Slide 25

Slide 25 text

Copyright Kanmu, Inc. All right reserved. ϧʔϧͷܾఆ ● ӡ༻໘΍ղऍͷ͠΍͢͞ͳͲ͔ΒϧʔϧΛܾఆ ● ࠷ޙ͸ᮢ஋ͳͲΛաڈͷσʔλͰݟͳ͕ΒϩόετੑͳͲ΋ ߟྀ͠ඍௐ੔ ● ͜Ε΋νʔϜ(ෆਖ਼؂ࢹઐ໳ϝϯόʔͳͲ)Ͱ૬ஊܾͯ͠ఆ featA > a ? featB > b ? featC > c ? not ෆਖ਼ ෆਖ਼ yes no ྑ͍ϧʔϧ ϧʔϧʹ͢Δͱ ● featA <= a ͔ͭ featC <= c Λෆਖ਼ͱ͢Δ

Slide 26

Slide 26 text

Copyright Kanmu, Inc. All right reserved. ܾఆ໦ͷ஫ҙ఺ ● ໦͕ਂ͘ͳΔͱϧʔϧ͕ෳࡶʹͳΓ͗͢Δ ● ໦͕ਂ͍ͱɺͦͷϊʔυͷෆ७౓͕Լ͕Δ͕ɺऴ୺ϊʔυʹؚ· ΕΔσʔλ਺͕গͳ͍ͷͰෆਖ਼Λଟ͘औΓಀ͕͢͜ͱʹ ○ ܾఆ໦ͷਂ͞͸ɺ਺ύλʔϯࢼͤ͹͋ͨΓ͸͙͢ʹ෇͚ΒΕͨ ● ӡ༻໘ɺղऍੑɺਫ਼౓ͳͲటष͘σʔλΛݟͳ͕ΒܾΊ͍ͯ͘ඞ ཁ͕͋Δ featA > a ? featZ > z ? not ෆਖ਼ ෆਖ਼ yes no ෆ७౓͸খ͍͕͞ɺ ଟ͘ͷෆਖ਼Λಀͯ͠ ͍Δྫ . . .

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Copyright Kanmu, Inc. All right reserved. ·ͱΊ ● σʔλυϦϒϯͳ૊৫ ○ ೔ʑͷҙࢥܾఆʹ͸جຊతʹσʔλ͋Γ͖ɻࢿྉʹ͸SQLͷΫ ΤϦ΋Ұॹʹ෇͍ͯ͘Δɻ(ඇΤϯδχΞͰ΋) ○ ͜Ε͕పఈ͞Ε͍ͯΔͷͰɺଟํ໘͔Β࢖͑ͦ͏ͳσʔλ͕ू ·Δɻ ● ෆਖ਼ݕ஌ͱ͍ͬͯ΋ɺͲ͏͍͏໰୊Λղ͖͍͔ͨʹΑͬͯΞϓϩ ʔν͕ҟͳΔ ○ ղ͍ͯخ͍͠໰୊Λৗʹߟ͑Δ ○ ਫ਼౓ͷߴ͍MLϞσϧ࡞ͬͯ΋࢖Θͳ͚Ε͹ҙຯ͕ͳ͍ ● ϧʔϧϕʔεͷܾఆͷ͓ख఻͍ͱͯ͠MLϞσϧ(ܾఆ໦)Λ࢖༻ͨ͠