Applying explainable AI for real-time fraud detection using Machine Learning for IBM z/OS — a step-by-step example
Machine Learning for IBM z/OS (MLz) is the flagship AI platform utilized by organizations to integrate machine learning and deep learning models into their mission-critical z/OS applications, providing real-time business insights at scale. With the recent maintenance update to MLz v3.1 in Q4 2023, the product’s capabilities have been further strengthened with the introduction of advanced Trustworthy AI functionalities. This enhancement empowers users to seamlessly incorporate AI into their business-critical z/OS applications, ensuring the highest level of trust, confidence, and performance, all at a minimal cost.
In our commitment to delivering enhanced Trustworthy AI capabilities, we are taking an iterative approach. With the initial release in Q4, we are introducing the highly anticipated model explainability capability. This feature provides valuable insights into the influential factors that drive outcomes in both machine learning and deep learning models. Throughout 2024, we will continue to expand the Trustworthy AI scope by incorporating additional functionalities such as drift detection, robustness, and fairness.
The Trustworthy AI component of MLz is a lightweight docker container that runs under z/OS container extensions. This architecture diagram illustrates the efficient and straightforward configuration of the Trustworthy AI component, and its seamless integration with the existing model lifecycle management and operationalization flow of MLz.
Let’s now explore an example to understand how the model explainability function of the MLz Trustworthy AI component can shed light on the decision-making process of an AI model in a credit card fraud detection scenario. The key flow of this use case is illustrated in the following architecture diagram:
- Model Training and Deployment:
- A credit card fraud detection model is trained on a distributed platform using relevant historical transaction data.
- The trained model is deployed to the MLz scoring service, which enables real-time predictions for incoming credit card transactions running on z/OS.
2. Model Monitoring and Subscription Creation:
- The deployed model is subscribed and continuously monitored by the MLz built-in trustworthy AI component.
- As the credit card transactions are scored by the model in real-time, the trustworthy AI component captures and stores the transaction records along with the prediction results.
3. Explanation of Flagged Transactions:
- At any given time, when the need arises to understand why a specific transaction has been flagged as fraudulent by the AI model, the MLz Trustworthy AI component provides the capability to explain the decision.
- By leveraging the explainability function, analysts and investigators can delve into the captured transaction data and gain insights into the factors that contributed to the model’s decision.
Step 1: Deploying an AI Model for Real-Time Fraud Detection
Here the model list page of MLz shows a model named FraudDetectionModel. It is a machine learning model built by the XGBoost algorithm, saved into PMML format, and imported to MLz.
The model is deployed to the MLz scoring server so that to be consumed by z/OS online transactions to detect fraud in real-time. The model takes various input features into account to predict whether a transaction is fraudulent or not. These features typically include the merchant category code, transaction type, transaction time, transaction amount, and potentially other relevant factors. The model is designed as a binary classifier, meaning it classifies transactions into one of two categories: fraud (1) or non-fraud (0). The prediction output consists of the probabilities associated with each class. For example, the model might assign a higher probability to the fraud class if it determines that a transaction is more likely to be fraudulent based on the input features.
Step 2: Establishing a Subscription for Deployment Monitoring
After deploying the model, you can enable the explain function for the deployment by clicking the Explain button.
This action will navigate you to the MLz Trustworthy AI user interface, where you need to configure the subscription settings.
On the Create Subscription page, the scoring endpoint of the deployment is automatically populated. Keep it as is and provide a few additional configurations as guided by the UI, which include the subscription name, some sample training data for building the explainer, and the algorithms to be used by the explainer. MLz supports the most popular algorithms LIME and SHAP for model explanation. Typically, you would want to enable both so that you can cross compare the explain results given by the two algorithms.
Additionally, you can enable transaction data collection by checking the Store transactions checkbox. This feature allows the system to capture and store transaction data for further analysis and explanation.
To ensure efficient data storage and focus on pertinent transactions, a filtering criteria can be set. In the example here, the output feature “probability(1)” with a value greater than 0.5 is chosen as the filtering criteria. This means that only transactions classified as fraudulent (where the probability of being fraudulent exceeds 0.5) will be captured and stored by the Trustworthy AI service. By selectively storing fraudulent transactions, the system optimizes storage resources and targets the data that will likely require explanation or further investigation at a later stage.
Once the information is filled in, click the Create button to create the subscription. You can then generate explain report for suspicious transaction(s) by clicking the View Transactions button.
Step 3: Identifying Fraudulent Transaction(s) to Explain
The Explained transactions page displays all the transactions that have been explained. When you access the page for the first time, you need to add transactions to enable them for explanation, by clicking the Add transactions button.
You can use various search and filter parameters to narrow down and locate specific transactions that require explanation. For instance, if you are aware of a potentially fraudulent transaction reported between 2023/12/11 and 2023/12/12, involving a merchant with MCC 5958, you can set the following search and filter criteria:
All transactions that meet your search parameters will be presented in the Searched and Filtered Transactions table.
Additionally, you can access the transaction details by clicking on the corresponding transaction ID within the transactions table. In the example here, you can see the transaction was scored as fraudulent with a probability greater than 0.92.
Now with the matching transactions listed, you can choose which one(s) to explain by checking the corresponding checkbox and clicking the Create explanations button.
The explain action normally takes a few minutes to complete. You can check the status of the explanations in the Explained Transactions table. Once the explanations are completed, the View Results button will become available.
Alternatively, if you want to test the water before enabling transaction data collection, you can also very easily generate ad hoc explanations by using the Input via Record method provided by the Search transactions feature.
Step 4: Understanding the AI Model’s Decision through the Explain Report
Clicking the View results button on the Explained transactions page will navigate you to the visualized explanation reports. The explanation report serves as a comprehensive resource for interpreting the decision made by the AI model. When viewing the explanation report for a specific transaction flagged as fraudulent, the bar charts provide a clear summary of the most important features that positively or negatively influenced the model’s classification. In the example here, the merchant category code (MCC), transaction_hour_of_day, and transaction_amount_last_day were identified as the top three influential features for the given transaction.
By hovering over the bar chart, additional information such as the specific values of each feature can be displayed. This level of detail helps you and stakeholders understand the role and impact of each feature in the model’s decision-making process. You can also export the reports in csv or image format, to share the reports to other stakeholders for fraud detection process optimization.
Step 5: Meeting Auditing Requirements with Subscription History
AI models typically evolve over the time. The MLz Trustworthy AI service provides the subscription history feature which enables you to go back to any previous model version and check the explanation results at any time when required.
In the example here, you can see all the historical versions of the subscription along with the explained transactions are maintained by the product, available for revisiting whenever needed.
OK! Now it concludes the use case example of enabling explainable AI using the new Trustworthy AI capabilities of Machine Learning for IBM z/OS. For more detailed instructions and information regarding the Trustworthy AI functionality, check out the product online document here: https://www.ibm.com/docs/en/wml-for-zos/enterprise/3.1.0?topic=trustworthy-ai
Co-author:
Meng Wan — Development lead, Machine Learning for IBM z/OS
