Embed Size (px)
DESCRIPTION
Effective risk management in large, user-facing systems (like platforms) requires strategic and effective use of data. Typically we discuss data in the context of behavioral analysis within the systems, where it is used to better profile threats and vulnerabilities. In this talk we will discuss how data-driven controls are incorporated into the systems themselves, and typical areas where risk managers will need to focus their attention and algorithms in the future: defenses, dev/ops, & devices. We will explore what this means for risk control designers working on closed systems versus open systems, and also review proper care and feeding of algorithms.
Citation preview
#SIRACon14
When Algorithms Are Our Co-Pilots
Allison MillerPresident, SIRA
#SIRACon14 @selenakyle
Outline
❖ What are algorithms?
❖ OMG, I LOVE Algorithms!
❖ Algorithms as the foundation of information risk control systems
❖ Algorithms VS (Adversity + Adversaries)
❖ Control vs Complexity
#SIRACon14 @selenakyle
#TBT
#SIRACon14 @selenakyle
Namshub
❖Tie Your Shoes
❖Common core
❖$15.51
1,000,000,000,000
-1
Are you a good algorithm or a bad algorithm?
#SIRACon14 @selenakyle
ed
#SIRACon14 @selenakyle
Namshub
❖Tie Your Shoes
❖Common core❖$15.51
#SIRACon14 @selenakyle
#InQuantsWeTrust
#SIRACon14 @selenakyle
w(e) <3 Math❖ Gauss: What’s Normal Anyway
❖ Bernoulli: Making Heads or Tails of things
❖ Plenty of Poisson in the Sea
❖ Euler: Graph theory, topology
❖ All about that Bayes
❖ Groves of Decision Trees, Nets of Neurons, Totally Random Forests
#SIRACon14 @selenakyle
#WWAD?
#SIRACon14 @selenakyle
What Algorithms Do
❖Simplify❖Match❖Price❖Automate❖Predict❖Compete
#SIRACon14 @selenakyle
#FTW
#SIRACon14 @selenakyle
The Player is the Game
❖ Tic Tac Toe❖ Chess❖ Trivia❖ Poker❖ Tit for Tat
Kasparov vs X3D Fritz
#SIRACon14 @selenakyle
Discussing Games
Mechanics of decision trees
UP
DOWN
CIRCLE
RED
BLUE
MARIO
LUIGI
KIRBY
GIZMO
10, 3
2, 10
10
2, 5
-3, 3A
B
B
A
A
A
#SIRACon14 @selenakyle
#WTF(What, Thou Failest?)
* Es tu, Bot — eh?
#SIRACon14 @selenakyle
Algorithms Gone Wild
❖Bidding/auctions❖Targeting❖Too Many Likes
Why?
#SIRACon14 @selenakyle
Speaking of $$$
❖Black Scholes❖Automation of trading
❖HFT: Faster than the speed of light
#SIRACon14 @selenakyle
#YMMV
#SIRACon14 @selenakyle
Managing DecisionsRisk Management = Decision Management Algorithms are useful for “outsourcing” decisions to our
systems
Systems enforce risk strategies
Defenders and operators design control systems that make decisions Where risks/issues manifest in observable behavior
They can make moves/counter-moves depending on the context and understanding of an actor’s identity or intent
Where system or individual costs/payoffs depend on the outcome of an actor’s actions
Decision strategies can be optimized

UP
DOWN
CIRCLE
RED
BLUE
MARIO
LUIGI
KIRBY
GIZMO
10, 3
2, 10
2, 5
-3, 3A
B
B
A
A
A
Payoffs!
Optimization!
% of populationC
ost
Number of Defects Produced
Cost of Control
Cost of Defects
CV
Total CostCV
Operations
Risk/Loss
#SIRACon14 @selenakyle
Algorithms Rule
❖Defenses❖DevOps❖Devices
#SIRACon14 @selenakyle
Operating a Learning System
Disposition&
Time
EmailCC#ItemsTotal
Submit
Maybe
No!
Yes!! SuOutcomeSuAttempt
Black & Whitelists
Machine Learning
Velocity & Spend caps
Geo & IP Logic
Linking
Data
• Reporting• Metrics• Analysis• Modeling
GoodBadIndeterminate
#SIRACon14 @selenakyle
The Better Mousetrap
Automates defensive action x-platform
- Fast
- Accurate
- Cheap
In Real TimeIn Time to Minimize
LossReasonable False PositivesAs good as a human specialist
Reduces Reduction > Cost CreatedCheaper than Manual
intervention
#SIRACon14 @selenakyle
TheJoyof… #If/Then
#SIRACon14 @selenakyle
The first rule of any technology
used in a business is that automation
applied to an efficient operation
will magnify the efficiency.
The second is that automation
applied to an inefficient
operation will magnify the inefficiency.–Bill Gates
#SIRACon14 @selenakyle
Managing Social Systems
“…all policy systems…pose incentives that are reacted to by groups of agents acting in their own interest, and often those reactions are unexpected
and act counter to the policy’s intentions…”
— Brian Arthur, All Systems will be Gamed: Exploitive Behavior in Economic and Social Systems
#SIRACon14 @selenakyle
Send in the Bots
❖ Convenience vs dependence
❖ Transparency vs obfuscation
❖ Simplicity vs complexity
#SIRACon14 @selenakyle
#TheInterdependenceOf(AllThe)Things
#SIRACon14 @selenakyleAsimov’s 3 Laws of Robotics
1. A robot may not injure a human being or, through inaction, allow a human being to come to harm.
2. A robot must obey the orders given to it by human beings, except where such orders would conflict with the First Law.
3. A robot must protect its own existence as long as such protection does not conflict with the First or Second Law.
#SIRACon14 @selenakyle
SIRAtonin 3 Bot Guidelines
1.Bots are thoughtless but purposeful
2.Bots compete but will also collude
3.The behavior of a network of bots is more complex than the behavior of a single bot
#SIRACon14 @selenakyle
The Complexity Dimension
Embedded system controls are part of the system
Instrument your instrumentation
Learning systems are hungry
Intelligent agents are dumb
Fatal feedback is fatal
Risk hides in complexity
https://www.youtube.com/watch?v=G1t4M2XnIhI#action=share
Photo: Michael Rubenstein/Harvard University
Allison Miller
@selenakyle
