Serge Beucher

Maxima and Minima: A Review

This appendix contains the MAMBA source code for the operators described in this document. The first two operators (maxima and minima) are already contained in the geodesy.

Introduction

The purpose of this note is to clarify the notion of h-maximum (or h-minimum) which is introduced in the course devoted to geodesic transforms as an extension or generalization of maxima (or minima) of a function [START_REF] Beucher | Geodesy and Geodesic Transformations[END_REF]. Indeed, it appears that this concept is misleading. Therefore, it may lead to false interpretations. It is a matter of fact that the result of the h-maximum (or h-minimum) operator is not easy to characterize. Generally, this result is linked to the height of the maxima (or the depth of the minima). However, this notion (height or depth) is ambiguous. Therefore, these operators will be revisited here. Another definition of maxima and minima will be used and extended to h-maxima and h-minima, thus allowing to characterize the result provided by these operators. Then, other operators will be described. These operators allow to sort the different extrema according to a specific measure called dynamics. Finally, the use of these extrema in relation with filtering and segmentation operators will be discussed. These various operators have been implemented with the MAMBA image library [1]. The scripts are available in the appendix. This note can be considered as a complement of the course on geodesic transforms [START_REF] Beucher | Geodesy and Geodesic Transformations[END_REF].

Maxima (minima) of a function

In the sequel, only digital images taking integer values will be considered. Let f be a digital image defined in a digital space E . The graph G of f is made of all the points (x, f(x)), .

x c E For a 2D image, this graph corresponds to the digital topographic surface drawn by the function. Let us start by defining a path ( is the starting point, is the end point) on

C z 0 zn z 0 z n the graph.
is a sequence of points of the graph of f with:

C z 0 zn ( z 0 , ..., z i , ..., z n ) z 0 = ( x 0 , f ( x 0 )) z n = ( x n , f ( x n ))
where is a corresponding sequence of pairwise neighbor points on the ( x 0 , ..., x i , ..., x n ) support E of f. The points and are neighbors on the digital grid defined in E. x i x i+1 draws a path which is the projection on E of the path . We suppose ( x 0 , ..., x i , ..., x n ) c x 0 xn C z 0 zn also that (there is no loop in the path). ≤i, j, x i ! x j A non descending path is a path where:

C z 0 zn ≤x i , x j , i < j, f ( x i ) [ f ( x j
) Such a path starting at is never descending during its course towards .

z 0 z n The height h of a non descending path (NDP) is given by:

C z 0 zn h ( C z 0 zn ) = f ( x n ) -f ( x 0 )
Let us come back to the definition of a maximum as it is given in [START_REF] Beucher | Segmentation d'Images et Morphologie Mathématique[END_REF]. A maximum of f (sometimes called regional maximum) is a summit of the topographic surface G, that is a connected region (but not necessarily reduced to an single point) where it is not possible, starting from any point of this region to reach a higher point (if it exists) of the topographic surface by means of a non descending path (Fig. 1).

Figure 1: Point x belongs to a maximum because, starting from this point, it is impossible to reach a higher point as y by following a non descending Path.

is not a non C xy descending path. On the contrary, z does not belong to a maximum because the path C zt joining z to a higher point t is non descending.

A threshold at level i of a function f defined on E is made of the points of E such that:

X i ( f ) X i ( f ) = x c E : f ( x ) m i
The geodesic reconstruction of a set X by a marker set Y ( ) is made of all the R X ( Y ) Y _ X connected components of X which are marked by Y. The maxima of a function f can be obtained by means of a geodesic reconstruction. Let us consider the various thresholds of f. A maximum of the function at altitude i (if it exists) will be a connected component of the threshold of f containing no connected component of X i ( f ) any threshold where . Indeed, suppose that it is not true. Therefore, there exists a X j ( f ) j > i path connecting any point of the aforementioned connected component of to any point X i ( f ) of the connected component of contained in the previous one (Fig. 2). Let us take X j ( f ) . Then path is the projection of a non descending path on the graph G of f. So, x j = i + 1 c xy cannot belong to a maximum, which proves the proposition. So, a maximum at altitude i corresponds to a connected component of which cannot be X i ( f ) rebuilt by and the set M (f) of all the maxima of f can be defined as:

X i+1 ( f ) M ( f ) = 4 i X i ( f ) \R X i (f) [ X i+1 ( f )]
Let us write this formula differently. We know that:

R X i (f) [ X i+1 ( f )] = R X i (f) [ X i ( f -1 )] = X i [ R f ( f -1 )] where
is the geodesic reconstruction of the function f by (f-1).

R f ( f -1 )
That is:

M ( f ) = 4 i [ X i ( f ) 3 X i c ( R f ( f -1 ))]
This can be written as (see [START_REF] Beucher | About a problem of definition of the geodesic erosion CMM/Mines ParisTech publication[END_REF]):

M ( f ) = X i [ f -R f ( f -1 )
] Maxima of f are made of points of E where is strictly positive [START_REF] Beucher | Segmentation d'Images et Morphologie Mathématique[END_REF]. This function f -R f ( f -1 ) taking only two values 0 or 1 is also the indicator function of the maxima of f. k M ( f ) Minima of f can be obtained in a similar way by simply using the dual reconstruction .

m ( f ) R & We get: k m(f) = R f & ( f + 1 ) -f Figure 2:
The right connected component of is a maximum as it cannot be rebuilt by any X i connected component of (it does not contain such a component). X i+1

Algorithmic definition of a h-maximum

The implementation of this operator in the MAMBA image library is straightforward (see the appendix). Moreover, this implementation has been extended by introducing a parameter h for the constant value which is subtracted from f. When this parameter is set to 1 (its default value), we obtain the classical maxima of f. But when h is greater than 1, the connected components of the set resulting of the operation are called h-maxima. However, characterizing the points which belong to this set is not easy. In fact, this operator is misleading as it does not produce any maximum of height h as its name would suggest.

To better understand this general operator, it is interesting to change the definition of a maximum. This new definition is the following: A point z of the graph of f belongs to a maximum if and only if any non descending path C zz ∏ starting from z has a maximum height equal to 0. The only non descending paths which can be defined on a maximum are horizontal ones. This definition is interesting because, contrary to the previous one, there is no need to look for all the points at a higher altitude to check if they are reachable or not by a non descending path. This definition allows also to simply characterize the points which belong to the set obtained by the h-maximum operator. A point z of the graph of f belongs to a h-maximum if and only if any non descending path starting from z has a maximum height equal to (h-1). C zz ∏ M 2 Z h M 1 h, whilst the height of is lower than h. In both cases, and are at a vertical distance M 2 z 1 z 2 lower than h from these respective maxima.

In other words, the maxima operator in the MAMBA image library provides a set made of Z h all the points x of E for which the corresponding points on the graph G are at a z = ( x, f ( x )) vertical distance less than h to a maximum of f. However, this set does not mark the Z h maxima of f with a height lower than h. On the contrary, as it can be shown in Fig. 3, some detected domes of the graph G of f correspond to maxima of height larger than h, whilst other correspond to maxima of height lower than h. Moreover, when h increases, the set Z h increases too. The operator is extensive:

h < h ∏ u Z h _ Z h ∏ So,
the domes of f tend to merge when h increases. Let us denote by the operator . An interesting property of this operator is its r h ( f ) R f ( fh ) distributivity with respect to addition. Indeed, we can show that:

r h 1 +h 2 ( f ) = r h 2 ( r h 1 ( f )) = r h 2 ( f ) ) r h 1 ( f )
This can be proved by using the thresholds of . Let us consider a threshold at Each c.c. of is marked by a c.c. of . This c.c. is itself marked by a c.c. of

X i ( r h 2 ) r h 1 )
X i+h 2 ( r h 1 ) . Therefore, as this latter c.c. marks a c.c. of , we have:

X i+h 1 +h 2 ( f ) X i ( r h 1 +h 2 ) X i ( r h 2 ) r h 1 ) _ X i ( r h 1 +h 2 ) Each c.c. of
is marked by a c.c. of . But this c.c. marks a c.c. of .

X i ( r h 1 +h 2 )
X i+h 1 +h 2 ( f ) X i+h 2 ( r h 1 ) And this c.c. marks a c.c. of . Therefore, we have:

X i ( r h 2 ) r h 1 ) , Q.E.D. X i ( r h 1 +h 2 ) _ X i ( r h 2 ) r h1 )

Height of a maximum (depth of a minimum)

In the sequel, the notion of altitude will be used for introducing some definitions and algorithms. It is important to not mix up these two concepts: altitude and height. The altitude of a point z(x, f(x)) of the graph of f is simply the value f(x). The height of z (which is supposed to belong to a maximum) is, as it has been shown previously, a more complex notion which will be discussed in this section.

As the operator is unable to provide a satisfactory definition of the height of a maximum, r h other solutions must be explored. The first one could be to define the height of a maximum as the minimal vertical distance one must go down, starting from this maximum to reach another maximum (Fig. 4a). If there exists no other maximum (f has a unique maximum), the height of this maximum is simply equal to the difference between the maximum and minimum values of f.

Figure 4: The height h of the maximum corresponds to the minimal vertical distance M 1 one must go down to reach any other maximum ( in this example) (a). Applied to M 2 minima, this definition corresponds to the depth of the corresponding lower catchment basin, which is far from being satisfactory for minimum (b). m 3 (b) (a)

Applied to minima, this definition of the depth of a minimum corresponds to the height of the lower catchment basin associated to this minimum [START_REF] Beucher Serge | P algorithm, a dramatic enhancement of the waterfall transformation[END_REF]. We know how to obtain these lower catchment basins by means of a geodesic dual reconstruction using the watershed transform. However, this definition is again not satisfactory. Indeed, as it is illustrated in Fig. 4b, this depth is almost the same for all the minima of the drawn structure, which is far from being appropriate for the deepest minimum.

Figure 5: Evolution of the function of the initial function f (a) when h increases and r h ( f ) relationships between its maxima and the maxima of (b). is the dynamics of Z h r h h 1 M 1 (c), the dynamics of (e). Finally, is the dynamics of . It also corresponds to the h

2 M 2 h 3 M 3 dynamics of f (f). (f) (e) (d) (c) (b) (a)
A better definition of the height of a maximum can be obtained by observing the evolution of the function when h increases and especially by observing its maxima. Let us consider the r h function f in Fig. 5a, which shows three maxima, , and . Successive transforms M 1 M 2 M 3 r h can be applied to f with increasing values of h. Let us also extract the maxima of each r h transform. We can see in Fig. 5b that, at the beginning, all the maxima of f are included in maxima of . Then, when h is equal to , the first maximum of f is not included r h h 1 M 1 anymore in a maximum of (Fig. 5c). If we increase h, and continue to be marked r h 1 M 2 M 3 by maxima of . For a higher value of h, is again marked by a maximum of (the same r h M 1 r h maximum also includes , Fig. 5d). M 2 Then, when h is equal to (Fig. 5e), the maximum ceases to be included in a maximum h 2 M 2 of (this is also the case for , although it is not the first time this event occurs). The r h 2 M 1 values and associated to the maxima and respectively (Fig. 5f) are named

h 1 h 2 M 1
M 2 dynamics of these maxima [START_REF] Michel | La Géodésie Numérique en Morphologie Mathématique. Application à la Détection Automatique de Microcalcifications en Mammographie Numérique[END_REF]. It can be shown that the dynamics of a maximum M of a function f is equal to the minimal vertical distance one must go down, starting from this maximum to reach a maximum at a higher altitude than M. When M is the highest maximum, its dynamics is equal to the difference between the maximum and minimum values of f. This value is sometimes defined as the dynamics of the image (it is also called oscillation of the function f ).

So, a small change in the definition (considering a higher maximum instead of any maximum) leads to a much better definition of the height of a maximum as illustrated in Fig. 5f.

Therefore, it is more natural to define the height of a maximum as the value of its dynamics. The same notion can obviously be defined for the minima of an image: the dynamics of a minimum is equal to its depth. The dynamics of a maximum is not a local attribute which can be determined simply by exploring its surroundings as the maximum which determines the value of the dynamics may be far from the first maximum. Therefore, calculating rapidly the dynamics of all the maxima of an image is not simple. There exists, however, an implementation based on hierarchical queues (described in [START_REF] Michel | La Géodésie Numérique en Morphologie Mathématique. Application à la Détection Automatique de Microcalcifications en Mammographie Numérique[END_REF]). Fortunately, in most cases, it is not necessary to calculate the dynamics of all the maxima. We just need to extract those maxima with a height or dynamics higher than or equal to a given value h. Obtaining those maxima with a dynamics larger than (h -1) is very easy. They are produced by a simple threshold at level h of the function . fr h ( f ) We shall not give the proof of this here (it can be found in [START_REF] Michel | La Géodésie Numérique en Morphologie Mathématique. Application à la Détection Automatique de Microcalcifications en Mammographie Numérique[END_REF]), but we can intuitively see why it is true by looking at Fig. 5c. As a matter of fact, when a maximum ceases to be marked, the corresponding part of the function also ceases to increase and its maximal value is fr h ( f ) lower than h. Even if the maximum is marked again later on (Fig. 5d), there is a gap in the increase of which will never be filled in. fr h ( f ) These operators (for maxima and minima) are defined in the appendix (they are named maxDynamics and minDynamics). Note the tiny difference between these operators and the maxima/minima operators (level of the final threshold).

Robustness of the dynamics

The major drawback of the dynamics lies in its great sensitivity to noise and to small variations of grey levels. One particular drawback has been discussed in [START_REF] Michel | La Géodésie Numérique en Morphologie Mathématique. Application à la Détection Automatique de Microcalcifications en Mammographie Numérique[END_REF] and is illustrated in Fig. 6a. When two or more relatively closed maxima are at the same altitude, their dynamics is the same and may be quite high. However, remind that the maxima or minima are widely used to provide markers for the watershed segmentation. Therefore, using extrema of high dynamics to provide these markers may lead to multiple markings of the same salient regions and then to over-segmentations.

(a) (b)

There exists solutions to overcome this problem (see [START_REF] Michel | La Géodésie Numérique en Morphologie Mathématique. Application à la Détection Automatique de Microcalcifications en Mammographie Numérique[END_REF]). Among them, one of the simplest ones consists in using the maxima of the function as markers (or the minima of ). r h ( f ) r h & ( f ) Each maximum contains at least one maximum of the initial function f with a dynamics higher than h. But all the maxima of f which are contained in a single maximum of r h ( f ) correspond to the maxima which were wrongly separated in the previous example (Fig. 6b). Therefore, using the maxima of (or the minima of ) prevents over-segmentations in r h ( f ) r h & ( f ) the watershed transform These operators have also been added to the appendix (highMaxima, deepMinima).

Use of extrema in geodesic reconstructions

To end up this review, let us recall a well-known property of the maxima (or minima) of an image f. If M is the set of all the maxima of f, we can define the valued indicator function of these maxima as the function m equal to:

m ( x ) = max ( f ) if x c M m ( x ) = min ( f ) if x " M and
been respectively the maximal and minimal values taken by f (usely 255 max ( f ) min ( f ) and 0 if f is a 8-bit grey scale image). Then is the function where each maximum belonging to M is valued by its altitude. g = m . f We know that: f = R g ( f ) It is very easy to prove this equality. The same property holds with the minima of f and the dual reconstruction. Now, it is possible to obtain partial reconstructions of f by selecting any subset M' of M. We have:

m ∏ ( x ) = max ( f ) if x c M ∏ m ∏ ( x ) = min ( f ) if x " M ∏ The partial reconstruction operator is equal to: ☞ M ∏ ( f ) ☞ M ∏ ( f ) = R m ∏ .f (
f ) It is also possible to define partial reconstructions by using the dual reconstruction operator and by selecting a specific subset among the minima of the initial image f. These operators can be useful for designing specific filters (Fig. 7), for a better detection of differences between similar images.

(c) (b) (a)

A general implementation of these operators can be found in the appendix. They are named maxPartialBuild and minPartialBuild. They both use a binary set which acts as a mask. Only maxima (or minima) which fall inside the mask are used for reconstructions.

""" This module provides a set of operators dealing with maxima and minima of a function. New operators linked to the notion od dynamics are provided. This module uses Mamba functions available in geodesy.py. it works with imageMb instances as defined in mamba. """ # Contributor: Serge BEUCHER import mamba import mambaComposed as mC def minima(imIn, imOut, h=1, grid=mamba.DEFAULT_GRID):

""" Computes the h-minima of 'imIn' using a dual build operation and puts the result in 'imOut'. When 'h' is equal to 1 (default value), the operator provides """ Performs the partial reconstruction of 'imIn' with its minima which are contained in the binary mask 'imMask'. The result is put in 'imOut'.

'imIn' and 'imOut' must be different and greyscale images. """ imWrk = mamba.imageMb(imIn, 1) mC.minima(imIn, imWrk, 1, grid=grid) mamba.logic(imMask, imWrk, imWrk, "inf") mamba.convertByMask(imWrk, imOut, mamba.computeMaxRange(imIn) [1], 0) mamba.logic(imIn, imOut, imOut, "sup") mC.dualBuild(imIn, imOut)

Figure 3 :

 3 Figure 3: Two maxima and are contained in . But the height of is larger than M 1M 2 Z h M 1 h, whilst the height of is lower than h. In both cases, and are at a vertical distance M 2 z 1 z 2 lower than h from these respective maxima.

Figure 6 :

 6 Figure 6: The two maxima and have the same altitude and their dynamics are also M 1 M 2 equal and higher than h. Selecting these maxima as markers leads to a double marking of the corresponding salient dome (a). Using the maxima of instead produces a single r h ( f ) marker (b).

Figure 7 :

 7 Figure 7: The initial image (a) is rebuilt by taking only those maxima which are outside the marker set (b). The result is shown in (c).

r h ( f ) X i ( r h ( f )) level i of the function . Each connected component (c.c. in brief) of is obtained r h ( f ) X i ( r h ( f )) by a geodesic reconstruction from at least a marker made of a c.c. of . Each c.c. of X i+h ( f ) is also equal to the c.c. of which contains the marker. Let us prove that X i ( r h ( f ))X i ( f ) r h ( f ) can be iterated. For this, we just need to prove that each c.c. of is also a c.c. of X i ( r h 2 ) r h 1 ) then, that each c.c. of is a c.c. of . X i ( r h 1 +h 2 )X i ( r h 1 +h 2 ) X i ( r h 2 ) r h 1 )

py module. The others are gathered in a new module, extrema.py, available at: http://cmm.ensmp.fr/~beucher/Mamba/extrema.py


Marijke Coetzee
email: marijkec@uj.ac.za

Argumentation-based group decision support for collectivist communities

Keywords: Collectivist culture, group decisions, multi-criteria decisionmaking, argumentation

In collectivist communities, decisions are taken by groups of people who prefer to consider the opinions of their in-group. For them it is important to reach group consensus by focusing on the group's preferences and goals. Such decision processes can be supported by multi-criteria decision analysis that identifies sets of objectives, representing subjective values used in decision making, to better generate recommendations. Recently, several attempts have been made to explain and suggest alternatives in decision-making problems by using arguments. Argumentation theory is the process of bringing together arguments so that conclusions can be justified and explained. Each potential decision usually has arguments for or against it, of various strengths. For collectivist communities, the non-monotonicity of argumentation theory is useful as it supports an adaptive decision-making style. The fact that the opinions of group members can be evaluated and replaced, if they are found lacking via a group opinion strategy, fits well with collectivist decision-making. This paper proposes a framework that allows a group of users, belonging to a collectivist and mostly rural community, to share their opinions when making decisions such as buying goods in bulk in order by incorporating their cultural beliefs in the system design.

Introduction

In the developing economies of Africa, South America, India and Asia, very small enterprises (VSEs) find it challenging to conduct business supported by ecommerce [START_REF]Governing development in Africa -the role of the state in economic transactions[END_REF]. VSEs are part of the informal economic sector and have an important role to play in the growth of developing economies. It is therefore vital that these, and other types of VSEs, are supported by technology to enable growth and expansion. To answer this need, recent research projects investigate how to support VSE owners by means of m-commerce applications backed by cloud-based technologies [5] [6] to allow them to conduct their business from a mobile phone. For such applications to be successful, VSE owners should be encouraged to collaborate, and together decided to buy products in bulk from large retail suppliers in order to become more profitable. An analysis of data collected in the U.S. (highly individualistic) and Ghana (highly collectivist) points to the fact that culture affects decision making [START_REF] Lefebvre | Culture Matters: Individualism vs. Collectivism in Conflict Decision-Making[END_REF]. It is thus important for researchers who are designing decision-making tools to be aware of the fact that individualist are inclined to be more rational, and collectivist are inclined to be more dependent when making decisions. Individualistic consumers would rather evaluate the features of a product before they purchase it, in contrast to collectivists in Asia or Africa who consider factors such as status and symbolism [START_REF] Dhar | Brand Management 101-101 Lessons from Real World Marketing[END_REF]. Therefore the role of culture on group decision-making needs to be investigated as currently, no culturally adapted group decision-making tool exists that incorporates collectivist behavior and beliefs.

In order to address this, this research contributes a framework where humans interact with an application on their mobile phone that accumulates the preferences of all members of a collaborative group and addresses cultural factors when decisions are made. The reasoning model is based on an argumentative multi-criteria decision framework [START_REF] Amgoud | An argumentation-based approach to multiple criteria decision[END_REF] to assist members to make decisions. The focus is to determine a collective choice that will satisfy at most of the goals of the group. Arguments provide the pros and cons to support decisions and are not of equal strengths, which makes it possible to compare pairs of arguments. When arguments are compared, it is done using different principles, it is done on the basis of their relevant strengths and whether they are for or against a choice. The process of argumentative decisionmaking is supported by decision-making strategies that meet the needs of collectivists such as a group opinion strategy and a group customisation strategy.

The paper is structured as follows: The next section gives a motivating example that highlights the environment of the collectivist consumer that is considered by this research. The influence of culture on decisions is described by identifying main cultural approaches and the effect of collectivism on decision-making and social position. Group decision methods are discussed and multi-criteria decision analysis is identified as a promising approach for this problem area. To assist a collectivist decision-maker in his decision processes, argumentation theory can be used with multi-criteria decision analysis to provide not only a decision, but also the explanation to the decision. A framework is presented that illustrates how different group decision strategies are implemented with examples. Finally, the paper is concluded.

Motivating example

There is an acute need for culturally-adapted technology to assist VSEs to collaborate more. Today, rural collectivist business owners in Africa, Asia and South America interact in a face-to-face manner with each other in a culturally involved manner to ensure that their businesses will survive in the face of adversity. Figure 1 gives nodes representing VSEs, as well as a large retail supplier of goods. Each of these VSEs operate on their own and buy good from the supplier individually, at more expensive prices. The focus of such a collaboration tool would for example be to assist business owners to group together to buy goods in bulk at a cheaper price from this or any other supplier.

Fig. 1. Very small enterprises collaborating

Due to the size of VSEs and their informal nature, owners tend to run the business and make business decisions based on personal relationships and understandings, where social capital and social ties support and influence all decisions. Their behavior is strongly influenced by their cultural norms and beliefs [START_REF] Hofstede | Cultures and organizations[END_REF]. This is even more relevant when collaborations occur since it involves committing to and trusting in a relationship with another business owner. In order to be able to implement such systems successfully, the collectivist approach to consumer decision-making needs to be understood for such systems to be useful. The aim is to ensure that participants are comfortable with the manner in which the system enables them to collaborate in a group.

3

Culture and decisions

Culture is generally described as the shared symbols, norms, and values in a social group such as an organisation or country [START_REF] Hofstede | Cultures and organizations[END_REF]. Hofstede [START_REF] Hofstede | Cultures and organizations[END_REF] [11] has identified dimensions of national culture of which individualism vs. collectivism is the most prominent. Other dimensions include power distance, uncertainty avoidance, and masculinity vs. femininity. These dimensions are generally applied by other researchers even though Hofstede's model has been criticized as too simplistic and not refined. Yet Hofstede's model has been validated by as many as 140 studies [START_REF] Usunier | International and Cross-Cultural Management Research[END_REF], making it useful in many different situations.

Individualist societies are found mainly in North America and much of Western Europe. For them, ties between members of the community are loose where people make a life for themselves and their direct family members only. The interest of a specific person is more important than the interest of the group. Individualists are more goal-oriented and self-motivated, and use guilt and loss of self-respect as motivators [START_REF] Hofstede | Cultures and organizations[END_REF] [START_REF] Hofstede | Culture's consequences: International differences in work-related values[END_REF]. Individualists perform their duties if they can gain from it, and see themselves independent from any groups.

Collectivist societies are found mainly in much of the Middle East, Asia, Africa, and South America. People are incorporated into strong, cohesive in-groups from birth. In these groups of people there is concern for the wellbeing of others. A person separated from the group experiences anxiety because of this separation. In-groups protect their members in exchange for loyalty to the in-group. Group interests and goals are more important than individual interests, and individuals conduct themselves in a manner to maintain social harmony. Such individuals acquire the skills and qualities necessary to be a good group member and to keep to tradition. Typical motivators are shame and loss of face [START_REF] Hofstede | Cultures and organizations[END_REF]. Collectivists enjoy doing what is right for their in-group, and have self-identities that are strongly linked to the features of their group [START_REF] Isherwood | Towards Trust and Reputation for E-Commerce in Collectivist Rural Africa[END_REF].

Current collaborative group decision tools are designed to suit individualistic communities and may thus be less useful to people in many of the collectivist cultures in the world. For example, expert opinion carries more weight in decision-making [START_REF] Salo | Multicriteria Decision Analysis in Group Decision Processes[END_REF], where collectivists do not necessarily value expert opinion as much as it may be to the detriment of group harmony. Based on a review of collectivists decision-making tendencies that now follows, this research aims to present strategies to be used in the design of decision-making tools for a collectivist audience.

Collectivism and decisions

Studies have investigated the impact of culture on group decision making [START_REF] Yetim | Cultural Aspects of Group Support Systems[END_REF] [14] [START_REF] Güss | Decision making in individualistic and collectivist cultures[END_REF] and has highlighted that the importance of group opinion, maintenance of consensus, and decisions of people with high social positions in the group cannot be underestimated. Collectivists follow an adaptive and more dependent decision-making style to maintain group harmony where the needs of the group outweigh the needs of individuals' opinion of a group leader. Group opinion -Collectivists generally give more weight to the opinions of their in-group than individualists do, and thus these opinions strongly influence their decisions. When collectivists perform an activity in isolation, they feel isolated and are less effective [START_REF] Hofstede | Cultures and organizations[END_REF]. A group opinion strategy to consider may be to provide the user with the opinions of the other in-group members when they make a decision. [START_REF] Khaled | Persuasive interaction for collectivist cultures[END_REF]. This lessens the user's feelings of isolation, and reduces the time taken to seek advice from members of the in-group regarding their opinions. [START_REF] Khaled | Persuasive interaction for collectivist cultures[END_REF].

Consensus change -Collectivists values consensus highly. They have less change in consensus between themselves than individualists [START_REF] Yetim | Cultural Aspects of Group Support Systems[END_REF] and rather strive to maintain consensus.

Group polarization -Polarization is the inclination of individuals in a group setting to hold very different opinions to the group [START_REF] Yetim | Cultural Aspects of Group Support Systems[END_REF]. Polarization is a largely individualistic trait where individuals want to showcase their ideas and influence others to promote self-interest. In contrast, collectivist opinions do not lead to polarization in the group's decision and persuasive arguments.

Persuasive arguments -Collectivists experience lower levels of persuasive content from arguments presented, due to the collective and high power distance of the culture [START_REF] Yetim | Cultural Aspects of Group Support Systems[END_REF]. They may rather support the arguments of powerful people in the group than arguments with more merit.

Adaptive decision-making -Collectivists adapt their decisions as needed as they are part of a group and are more receptive to social consequences of their decisions. Individualists view themselves as independent and responsible for their decisions [START_REF] Güss | Decision making in individualistic and collectivist cultures[END_REF] and keep to the same decision strategies.

Group surveillance -Individualists use guilt as a negative motivational force, whereas collectivists use shame of the in-group as a result of their actions [START_REF] Hofstede | Cultures and organizations[END_REF]. This strategy sets to track the behaviour of an individual or a group of individuals, to either reward or punish them later [START_REF] Khaled | Persuasive interaction for collectivist cultures[END_REF]. Collectivists' identities are strongly tied to that of their in-group and they are want to contribute as team members. An entire group is thus rewarded or punished for the actions of the individual.

Disapproval conditioning -Individualists make use of positive reinforcement as a motivational strategy, but collectivists are use negative reinforcement to be motivated [START_REF] Khaled | Persuasive interaction for collectivist cultures[END_REF].

Deviation monitoring -As collectivists desire to fit in with their in-group, they change their behaviours to adapt to the group and situation to ensure they do not stand out [START_REF] Khaled | Persuasive interaction for collectivist cultures[END_REF]. Collectivist cultures agree on what expected behaviour is deemed to be and they are given severe criticism for small deviations from the norm.

Group customisation -In collectivist cultures it is important to put in-group goals ahead of one's own goals [START_REF] Hofstede | Culture's consequences: International differences in work-related values[END_REF]. This means that in-group preferences may out-weigh individual preferences in different circumstances, particularly where members of the same in-group are together. A group customisation strategy can permit one member of an in-group, or perhaps various members, to modify application settings on behalf of the in-group's needs, preferences, and goals [START_REF] Khaled | Persuasive interaction for collectivist cultures[END_REF].

Previous research indicates that the ignorance of such culture differences cause the failure of systems [START_REF] Bricks | Bunders in International Business[END_REF]. Currently, many group decision-making tools are designed by individualists in the Western world, who do not consciously set out to focus on the individualistic culture. They are not aware of the features they design in this manner, but when such tools are used by different cultural groups, these same features surface to become problematic.

Collectivism and social position

Decisions are not only influenced by culture, but also by the opinions of group leaders. Such leaders are members of a group whose exercises strong influence over the members of the group [START_REF] Yeboah | The Influence Of Culture On Consumer Choice: A Case Of The Fast Moving Consumer Goods In Ghana[END_REF]. In collectivist cultures, members look up to other group members for guidance who have a higher social in the community. Such a leader is trusted by its group members where there is more trust as the social position of the leader increase. Well connected leaders can provide access to a wider range of resources [START_REF] Triandis | Individualism-collectivism and personality[END_REF] and are beneficial to the group. Such leaders form potential collaborations with others outside the group, leading to potential business opportunities.

When groups are formed, new members are generally only invited if they are personal friends or well-know to current members [START_REF] Triandis | Individualism-collectivism and personality[END_REF]. Since current members are held responsible, to a certain degree, for the new member's behaviour, it is crucial that new member should behave according to the norms of the group. Collectivist cultures encourage individuals to relate to those in their in-groups and rely less on others outside the in-group to instill strong loyalty towards the group.

Group decisions

A Group Decision can be defined as "a decision problem that is shared by two or more parties who make a choice for which all parties will bear some responsibility" [START_REF] Kilgour | Chapter 11 -Trends in Multiple Criteria Decision Analysis[END_REF]. Group Decision Support System (GDSS) enables the definition of alternatives, the choice of criteria and their weights, performance and final recommendations [START_REF] Salo | Multicriteria Decision Analysis in Group Decision Processes[END_REF].

In order to obtain a recommendation a complete decision process is supported by formulating and structuring the problem, defining an evaluation model, finding an answer to the problem, and finally constructing a recommendation [START_REF] Ouerdane | Chapter 7 -Argumentation Theory and Decision Aiding[END_REF]. Many GDSS tools have been proposed that support brainstorming to generate ideas, blackboards to share information, argumentation models for decision analysis, and multiple criteria decision models for alternative evaluations. Recent research on GDSS implement consensus models that take into account coincidence among preferences, similarity criteria among the solutions obtained from the experts' preferences, and the agreement between the experts' individual opinions and the group opinion using fuzzy measures [START_REF] Garcıa | A consensus model for group decision making problems with linguistic interval fuzzy preference relations[END_REF] illustrating the trend in these systems to focus only on rational decision-making. Social parameters such as trust or culture are generally ignored by the research community, leaving a gap to be explored.

Of the available set of GDSS decision models, multi-criteria decision analysis shows promise to support collectivist decision-making. It provides a set of techniques and principles to compare and evaluate alternatives according to criteria [START_REF] Kilgour | Chapter 11 -Trends in Multiple Criteria Decision Analysis[END_REF] [START_REF] Ouerdane | Chapter 7 -Argumentation Theory and Decision Aiding[END_REF]. A recommendation is constructed, based on formal preference models defined by users in the decision process, making it possible to explain why a preference is preferred over another. This aspect is relevant to decision-making in collectivist communities, as group members can be given access to the opinions of other group members, to make them more comfortable and effective in their decision-making. A group member can be given a recommendation, and also the reasons that underlie this recommendation by making use of argumentation. Amgoud et al. [START_REF] Amgoud | An argumentation-based approach to multiple criteria decision[END_REF] proposes an approach that explicitly links argumentation to multi-criteria decision making, discussed next.

Argumentation

When considering classical logical reasoning such as propositional or predicate logic it is inferred that a conclusion can be found to be true despite any new additions made to the set of proposition which supported the conclusion. This is defined as monotonicity, where additional information does not cause conclusions to be modified or withdrawn [START_REF] Ouerdane | Chapter 7 -Argumentation Theory and Decision Aiding[END_REF]. For human reasoning this is not natural as people can change their minds when new information is made available. Decisions are based on the available information at a specific moment in time, and can be modified at any time. Nonmonotonic reasoning formalisms have emerged over time of which argumentation theory is considered by this research. Argumentation theory enables reasoning, by constructing and comparing arguments for and against conclusions [START_REF] Ouerdane | Argumentation theory and decision aiding[END_REF].

Non-monotonicity arises as new facts enable the construction of new arguments to support new conclusions, or support stronger counter-arguments against existing conclusions. Those arguments are intended to support, explain, or attack statements that can be decision, opinions, preferences, and values. Argumentation thus fits more naturally with human decision-making as people use arguments to support the claims that contribute to these decisions [START_REF] Chesnevar | Logical Models of Argument[END_REF] [28]. Each potential decision usually has a set of arguments for or against it, of various strengths. The adoption of argumentation to a decision support system has direct benefits as the user can be provided with a choice that is not only well-founded, but is also accompanied by the reasons underlying the decision. Furthermore, as argumentation-based decision making is similar to the manner in which humans mull over options to finally make a decision [START_REF] Amgoud | An argumentation-based approach to multiple criteria decision[END_REF], it is more natural to use.

When one wants to solve a decision problem, a set of X possible choices or decisions needs to be ordered, based on the different consequences of each decision. Here, argumentation can be used to define such an ordering. In order to achieve this arguments are to be constructed in favour of, and against each decision. This enables a comparison of possible decisions on the basis of the arguments and their quality or strengths. An argumentation-based decision process can be decomposed into the following steps:

• Constructing arguments in favour of or against each decision in X.

• Evaluating the strength of each argument.

• Comparing decisions on the basis of their arguments.

•

Defining a pre-ordering on X.

Formally, following [START_REF] Amgoud | An argumentation-based approach to multiple criteria decision[END_REF] an argumentation-based decision framework is defined as follows:

An argumentation-based decision framework is a tuple <X, A, ≥, ∆ Princ > where:

X is a set of all possible decisions. A is a set of arguments. ≥ is a (partial or complete) pre-ordering on A.

∆ Princ a principle for comparing decisions defines a partial or complete pre-ordering on X, defined on the basis of arguments.

Each decision that can be made may have arguments in its favour, and arguments against it. If there are multiple criteria to be considered, an argument in favour of a decision (pro) will be criteria that are positively satisfied. On the other hand, an argument against a decision (con) gives the criteria which are insufficiently satisfied. Arguments may have forces of various strengths [START_REF] Ouerdane | Towards automating decision aiding through argumentation[END_REF] that enable an agent to compare different arguments in order to select the best ones, and consequently to select the best decisions.

Arguments pro/con Let x ∈ X [START_REF] Amgoud | An argumentation-based approach to multiple criteria decision[END_REF] -ArgPro (x) = the set of arguments in A which are in favour of x.

-ArgCon(x) = the set of arguments in A which are against x.

In order to support an argument-based comparison of decisions, a principle is required. A simple principle can be defined by merely counting the arguments in favor of each decision. This principle prefers the decision which has more supporting arguments.

An argument supporting a decision takes the form of an explanation. An argument is a 4-tuple A = <S, x, g, c> where: S is the support of the argument, x is the conclusion of the argument, c is the criterion which is evaluated for x g represents the manner in which c is satisfied by x.

where K represents a knowledge base gathering the available information about the world; X is the set of all possible decision; C is a base containing the different criteria and G is the set of all goals.

To be able to further refine the comparison principle, the strengths of arguments and of the preference relations between arguments are considered. Criteria in C may not have equal importance. The base C is partitioned and stratified into C = (C1 ∪ . . . ∪ Cn) such that all criteria in Ci have the same importance level and are more important than criteria in Cj where j < i. Each criterion can be translated into a set of consequences, which may not be equally satisfactory. For example, consider the criterion "price" for a product on sale. If the price is 10 or less the user may be fully satisfied, but if it is more than 20, the user may be unsatisfied. This leads to the fact that there are sets of goals that are either positive G + or negative G -. A decision to purchase a product is either made or not.

Once it is decided what are considered as pro and con arguments for each possible decision, it is necessary to aggregate them to finally decide what alternative to select. Here, one needs to consider how to manage the potential interactions between arguments that refer to different criteria. Bonnefon and Fargier [START_REF] Bonnefon | Comparing sets of positive and negative arguments: Empirical assessment of seven qualitative rules[END_REF] provide an overview of possible approaches to aggregate sets of pro and cons. These approaches take into account the fact that the arguments are bipolar and qualitative. Amgoud et al. [START_REF] Amgoud | An argumentation-based approach to multiple criteria decision[END_REF] shows that it is possible to make use of classical aggregation operators in their framework. They compare decisions in terms of positive and negative arguments and show that the presented framework can capture different multiple criteria decision rules to select the best decision. The rule for the choice is characterized by the fact that criteria have or do not have the same level of importance.

Framework for collectivist decision support

To illustrate the framework, a mobile eProcurement application, the Virtual Store, is used as example. It solves the challenges of VSEs such as the replenishment of stock using bulk buying. Users are provided with a mobile application to register, login and navigate through a supplier product catalogue. The catalogue contains real-time pricing information and specials that enables VSEs and other retailers to purchase goods in a group. The system allows the formation of collaborative groups where an identified group leader invites group members to be part of the group via the application. Before this can happen, face-to-face agreements are made between group members. A group needs to agree on basic aspects such as the types of products that they will purchase together as well as the threshold amount that they are willing to spend. The goals of the system are to take into account the collectivist nature of the end-user when a decision is make to buy stock in bulk.

The framework is defined next by describing the system architecture, the Virtual Store Agent, and the how collectivist group decision strategies are applied.

System architecture

The architecture of the system is depicted in Figure 2. At the back-end there is a Virtual Store Server agent and on the mobile device of the users there is a User agent.

The Virtual Store Server agent can access the product catalogue of the Virtual Store containing all products that can be purchased. These products are sent to the User agent that displays them to users simultaneously, when a session starts. In addition to the image of the products, the Virtual Store agent supports categories that represent particular aspects of products such as price, type or colour. The User agent is defined by subcomponents found in three layers shown in Figure 3 namely the interaction, reasoning and knowledge layers.

In the knowledge layer the User agent stores information about the environment of the user and profile information of other group members and the profile of the user consisting of preferences and goals. The social system component keeps track of the all group members and their relative social position to include this in the group decision computation Knowledge is accumulated over time, as the user interacts with the system. The reasoning layer forms a bridge between the knowledge and interaction layers and contains two components namely the argumentation component and decision component. The argumentation component is responsible for the generation of arguments when the human makes choices.

Fig. 3. User agent architecture

The decision component processes the opinions of other User agents to provide a group opinion to the user. The interaction layer is responsible for the communication with other User agents and through the GUI with the user. Using the GUI, users express whether they are in favour of purchasing a product or not. Similarly, they provide their preferences for product categories through this interface.

Virtual Store Server Agent

The Virtual Store Server agent stores product records of a large number of products P that can be purchased. For example, a group of VSE owners collaborate to buy prod-ucts such as bread and milk in bulk. As a group, they need to create a shopping cart containing products that has been chosen by a group consensus process. They are provided with sets of products. The set of products is defined by P = p1, .........pk , where k > 2 is the set of available products. Each product is described with a finite set of categories or features. The set C = c1, .........cn contains all the possible categories where n > 2. A category may be associated with more than one product. For example, in Table 1, the following three bread products and their four categories are made available by the Virtual Store for bulk buying. The Virtual Store sends each product and its categories to the User agent, where it is displayed graphically to the user who evaluates it. The application supports strategies for collectivist decision-making, described next.

Collectivist group decision making

The reasoning of the group is now described. A decision protocol is defined to allow the group to reason. To support the collectivist approach to decision-making the decision protocol has two main strategies namely the group customization strategy and group opinion strategy. Then follows a description of the process.

Group customization strategy.

In-group preferences may be more important than individual preferences in scenarios such as the Virtual Store application. A group customisation strategy allows one member or leader, or various respected members, to customise the Virtual Store application configurations with the in-group's needs, preferences, and goals. Other ingroup members can then accept and use the group-level customisation for themselves, thereby saving time and preventing possible uncomfortableness stemming from acting in isolation. It would be possible for group members to set a "personal level" customisation, and they should control which setting will be used in which sitautions. Data can be stored of all in-group preferences, to allow in-group members to stay up to date with group decisions and matters.

Group opinion strategy. The group opinion strategy provides the user with opinions of other in-group members while the user is making a decision. This ensures that the user's is not isolated from the group and reduces the time that he may take to consult each member of the in-group regarding their opinions. The group opinion can be presented in a visual manner by giving a graphical representation of categories that may be sized according to the strength of group preference.

The group decision protocol.

The group decision protocol is shown in Figure 4. The first step is the formation of a group when a group leader invites members to the group. The invited members accept requests. The group leader and respected members customises the goals and preferences of the group to best represent their requirements. The group leader starts a session to select products for bulk buying by the group. The Virtual Store agent send products to the User agent of each user. Members analyse categories and decide their preferences. Each user expresses his opinion about the product categories through the GUI of the User agent. User agents provide their users a report on the aggregated opinion of the group to determine if an agreement was reached. If so, the decision is made to buy the product. If no agreement is reached, the group opinion formation process starts. Users create new opinions as arguments that are exchanged between User agents following an adaptive decision-making style. The decision-module of the User agent determines the modified opinion of the group and whether an agreement was reached. This process continues until an agreement is reached to buy or reject the product. If no agreement can be reached, the group leader makes the final decision.

Fig. 4. Group decision protocol

Group decision-making is now described in more detail using the Virtual Store application.

Group customisation

Using the group customisation strategy, the group leader of the group of retailers configures the Virtual Store with the products and their related categories the group will prefer to buy in bulk where the set of products for the group is defined by PG = p1, .........pk, where k > 2 is the set of available products and PG ∈ P.

Category analysis

When making decisions, the user interacts with the system via the GUI, depicted in Figure 2. Each user expresses an opinion about each category of product sent by the Virtual Store Server agent. To ensure ease of use, the opinion is defined by the use of a slider on the GUI of the application.

Users provide their preferences and rejections for each category. This is done through a value, in the opinion range Op = [0, 100] for each category associated with the product. In this context, the best preferred option is assigned a score of 100, and the least preferred a score of 0. This range can be customised according to the specific scenario. Assigning a value more than 50 to a product means that the product should be bought in bulk by the group.

Category preference

The preferences of a user is defined as follows: Ui = {sij} is the score assigned by user i to category j. This preference represent the user's opinion of a product. For example U1 = {70, 20, 90, 70} gives the opinions of user 1 for each category c1 to c4 of a single product. The user gives a high preference to the baker (c3) Shown in Table 1 that provides the bread. The user may be able to change his opinion, based on what the group decides.

The overall score for each option, Si is given by summing the preference score for option i on criterion j. Si = ∑ ݆݅ݏ ୀଵ /݊ For user 1, S1 = 63, indicating the user is in favour of buying the product. After being provided a report on the ratings of other group members, a user can revise his opinion.

Category aggregation

It is very important for each user to know the opinion of the group as the user may want to revise his opinion to accommodate the preferences of the group.

For example, given are the opinions of a set of 4 users for a product and their total scores: U1 = {70, 20, 90, 70} S1 = 63 U2 = {50, 30, 20, 65} S2 = 42 U3 = {70, 40, 20, 80} S3 = 53 U4 = {50, 30, 30, 70} S4 = 45

The opinion of the group Opi is calculated for each category as follows: opi = ∑ ݆݅ ୀଵ /݊ opi = {60, 30, 40, 72} Si = 50

The opinion of user 1(63) is thus out of bounds with the group (42, 53, 45).

Group opinion

As collectivist consumers prefer an adaptive decision-making style, they should be supported to change their mind when confronted with the opinion of the group. The focus of this research thus to support a group to reach consensus on a joint decision. Each member of the group can give their opinion, and change their mind when needed. This gives these consumers more confidence when making decisions, as they feel that they are complying to the preferences and goals of the group.

For this purpose, arguments pro and con to be used with multi-criteria decision analysis are now defined. The pair (c,o) represents the opinion of a user for a given category of a product. If the opinion is more than 50, the argument is in favour to buy the product, and if the opinion is less or equal to 50, the opinion is in favour to reject the product.

When a user changes his opinion about a given category, the initial argument is removed and replaced by another. For example, if the user decides to give a low preference to the baker, he can decrease the opinion to 30 from 90. The argument ((c3, 90), p) is replaced by ((c3, 30), p). The first argument is thus completely removed from the set of arguments of the user.

User 1 views the opinion of the group provided by his User agent and sees that the group is not in favour of the product. Similarly, user 3 sees that he is also out of the norms of the group. Both users modify their opinion by providing new arguments as follows: U1 = ((c3, 30), p) and U3 = ((c2, 30), p) resulting in the following set of opinions: U1 = {70, 20, 30, 70} S1 = 48 U2 = {50, 30, 20, 65} S2 = 42 U3 = {70, 30, 20, 80} S3 = 50 U4 = {50, 30, 30, 70} S4 = 45

The opinion of the group changes to: opi = {60, 28, 25, 72} Si = 46

The group is now in agreement to reject this product.

Conclusion

This paper proposes a framework for the Virtual Store application to enable a group of users such as VSE owners to create a shared shopping cart containing products that have been agreed to as a group. In the framework, users are provided with products and related criteria over which to define their preferences, which are the strengths of their arguments that they present. A joint group opinion is formed which is reported to all users to assist them to feel part of the group and to ensure that they

Fig. 2 .

 2 Fig. 2. Virtual store system architecture

  pro pg is a pair ((c, o), pg) where c ∈ C and o ∈ O and o > 50. con pg is a pair ((c, o), pg) where c ∈ C and o ∈ O and o ≤ 50.

Table 1 :

 1 Product categories

	Price (c1)	Quantity (c2)	Supplier (c3)	Type (c4)
	100	60	New bakeries	White
	100	80	Smiths	Brown
	80	50	ABC	White

Acknowledgments

The support of the National Research Foundation (NRF) under grant number 81201 toward this research is hereby acknowledged. Opinions expressed and conclusions arrived at are those of the authors and not necessarily to be attributed to the NRF.


Evgenia Novikova
email: novikova@comsec.spb.ru

Igor Kotenko

Visual Analytics for Detecting Anomalous Activity in Mobile Money Transfer Services

Keywords: mobile money transfer services, fraud detection, visual analytics, RadViz visualization

Mobile money transfer services (MMTS) are currently being deployed in many markets across the world and are widely used for domestic and international remittances. However, they can be used for money laundering and other illegal financial operations. The paper considers an interactive multi-view approach that allows describing metaphorically the behavior of MMTS subscribers according to their transaction activities. The suggested visual representation of the MMTS users' behavior based on the RadViz visualization technique helps to identify groups with similar behavior and outliers. We describe several case studies corresponding to the money laundering and behavioral fraud. They are used to assess the efficiency of the proposed approach as well as present and discuss the results of experiments.

Introduction

The field of Mobile Money Transfer service (MMTS) is a growing market segment, particularly in developing countries, where banking systems may not be as dense or available as in developed countries. For example, M-Pesa, which was launched in 2007 in Kenya, displayed in December 2011 about 19 million subscribers, namely 70% of all mobile subscribers in Kenya [29]. Orange Money is deployed in 10 countries and gathers around 14% of the mobile subscribers of these countries [START_REF]Orange Money dépasse les 4 millions de clients et lance ses services en Jordanie et à Maurice[END_REF]. In such services, transactions are made with electronic money, called mMoney. The users can convert cash to mMoney through distributors and use it to purchase goods at merchants, pay bills or transfer it to other users [START_REF] Merrit | Mobile Money Transfer Services: The Next Phase in the Evolution in Personto-Person Payments[END_REF].

The risks inherent to all payment systems are present in the mobile environment. However, the usage of mobile technologies introduces additional risks caused by the large number of non-bank participants, rapidity of transactions and higher level of anonymity compared to traditional banking systems [START_REF] Merrit | Mobile Money Transfer Services: The Next Phase in the Evolution in Personto-Person Payments[END_REF]18]. Therefore, it is required to determine new approaches to detect frauds in mobile money transfer services.

The aim of this paper is to show how visual analytics can provide better insight in the large data sets describing MMTS activity and can assist in fraud detection. Visual data exploration can be considered as a hypothesis generation and verification process which is intuitively clear and does not require explicit application of complex mathematical and statistical methods [START_REF] Keim | Visual Analytics: Definition, Process, and Challenges[END_REF][START_REF] Kotenko | VisSecAnalyzer: a Visual Analytics Tool for Network Security Assessment[END_REF][START_REF] Novikova | Analytical Visualization Techniques for Security Information and Event Management[END_REF]. We suggest an interactive multi-view approach allowing the analyst to get a global overview of the MMTS subscribers' activity and then focus on users of the particular interest drilling down into their transactions. It is based on RadViz-based [START_REF] Ankerst | Similarity Clustering of Dimensions for an Enhanced Visualization of Multidimensional Data[END_REF] visualization of the MMTS users that helps to determine similarity groups and outliers among them and is supported by graph-based and table views assisting in analyzing structural links of the user.

Specifically, our main contribution is the interactive RadViz-based visual representation of MMTS subscribers allowing detection of groups of users with similar behavior. To the best of our knowledge, our work is the first to exploit RadViz visualization technique to visualize MMTS subscribers. To demonstrate and evaluate the usefulness of the proposed approach we investigated several case studies corresponding to the money laundering and behavioral fraud, which take place when the mobile device is used to carry out illegitimate transactions without its owner's consent.

The rest of the paper is structured as follows: Section 2 overviews mobile money transfer service and its structure, and discusses related work in the field of fraud detection techniques in mobile payments as well as visualization techniques used to detect financial frauds. Section 3 describes the approach suggested, including visual models and interactions with them. Section 4 presents the case studies used to demonstrate the proposed approach for financial fraud detection in mobile payments using visual analytics techniques, discusses the results and presents ideas about further developments of the approach. Section 5 sums up our contributions.

Background

Mobile Money Transfer Service

The paper is based on the MMTS use case detailed in [START_REF] Achemlal | Scenario requirements[END_REF][START_REF] Rieke | Security and Reliability Requirements for Advanced Security Event Management[END_REF]. This section outlines the major points to understand the use case. MMTS are systems where electronic money, called mMoney or m, is issued to different roles such as regular users, retailers, merchants, in order to perform various types of transactions which range from merchant payments to transfers between individuals. Fig. 1, which is adapted from [START_REF] Jack | Monetary Theory and Electronic Money: Reflections on the Kenyan Experience[END_REF], shows the economic principle of mMoney and the roles of various actors. As depicted, the Mobile Network Operator (MNO) emits mMoney in partnership with a private bank. The MNO regularly produces compliancy reports, including suspicious activity reports, to the Central Bank, responsible for the country's monetary policy. The emitted mMoney can only be used among the MNO's clients subscribing to the MMT service. The subscribers are end-users, service providers or retailers. They hold a prepaid account stored on a platform and accessible via the MNO's network and an application on their mobile device. Some users, such as retailers or service providers, can use computers to access their account. This account contains mMoney which can be acquired from the retailers. End-users can either transfer money to other end-users or purchase goods.

Fraud Detection Techniques in Mobile Payments

In the Kenyan MMT service M-Pesa, fraud detection is carried out by the Minotaur tool which uses neural networks [START_REF]MinotaurTM Fraud Detection Software -Finance Sector[END_REF][START_REF] Okutyi | Safaricom tightens security on M-Pesa with fraud management system[END_REF]. Apart from this system, there is not much publicly available information about fraud detection in MMT services. However, to our knowledge, the most widely deployed tools are based on rules, linear regression and neural networks.

If we consider other payment systems, several fraud detection techniques have been applied. For example, in the field of credit card fraud detection, Al-Khatib [START_REF] Al-Khatib | Electronic Payment Fraud Detection Techniques[END_REF] identifies several studies which use neural networks, expert systems, case-based reasoning, genetic algorithms, inductive logic programming and regression. Another illustration is the use of graphs proposed by Ron and Shamir [START_REF] Ron | Quantitative Analysis of the Full Bitcoin Transaction Graph[END_REF] to explore the data related to the transactions in the Bitcoin payment system in order to highlight awkward transactions schemes.

Related Work

Due to the complexity of financial data (often with multidimensional attributes), many sophisticated visualization and interaction techniques have been proposed (to analyze the financial market as a whole, or single assets in particular), which support visually decision making [START_REF] Marghescu | Multidimensional Data Visualization Techniques for Financial Performance Data: A Review[END_REF]. Parallel coordinates, scatter-plot matrices, survey plots, special glyphs [START_REF] Schreck | Trajectory-based visual analysis of large financial time series data[END_REF], treemaps [START_REF] Wattenberg | Visualizing the stock market[END_REF], stacked and iconic displays, dense pixel-displays [START_REF] Ziegler | Visual Market Sector Analysis for Financial Time Series Data[END_REF], dendrograms, fish-eye views [START_REF] Lin | The fish-eye visualization of foreign currency exchange data streams[END_REF] are applied to explore financial data. However, the visualization techniques applied in fraud detection systems are rather limited. The most of commercial software products [START_REF]Financial Crime Risk Management solution[END_REF][START_REF]Nice Actimize Integrated Fraud Management[END_REF][START_REF]SAS Fraud detection solutions[END_REF] extensively use trends, pie charts and histograms and gauge-based glyphs to display characteristics of financial flows, number of registered alerts, their type and criticality, etc. The choice of these visual models is explained by their simplicity and ability to communicate the most important information at glance. They can be easily included in the reports of any level and purpose. Apart from the standard visual models, geographical maps are often present in fraud detection systems as they allow detecting regions with high financial risk level as well as determining the limits of organization responsibility. Such kind of metrics is usually encoded by color or specific icon [START_REF]Financial Crime Risk Management solution[END_REF][START_REF]Nice Actimize Integrated Fraud Management[END_REF].

In [START_REF]Financial Crime Risk Management solution[END_REF] the visual representation of statistically calculated behavior of a peer group and deviations from it is used as an advanced technique to reduce alert generation. The behavior of the group is displayed as a set of line charts in which x-axis corresponds to the time and y-axis  to the values of the most important characteristics of the transaction flow such as average transaction amount, number of transactions, etc. The vertical axis is divided into three zones determining deviation level in users' behavior. The normal (average) behavior lies in yellow zone, location of the charts in the red colored zone indicates that behavior deviates significantly from the average one and orange shows the presence of deviation. These deviation levels could be adjusted according to the average characteristics of the peer group thus decreasing alert triggering level.

In order to support alert investigation the most of the fraud detection systems implement flexible querying mechanism that allows the analyst to extract all data associated with a given key value, i.e. account or credit card number [START_REF]Financial Crime Risk Management solution[END_REF][START_REF]SAS Fraud detection solutions[END_REF]. However, identifying hidden relationships, based on data from multiple sources, and tracking the movement of money made between a variety of entities is difficult using tabular methods. For this reason the graph-based representation of users' financial contacts are applied in fraud detection systems [START_REF]Nice Actimize Integrated Fraud Management[END_REF][START_REF]SAS Fraud detection solutions[END_REF] and adopted by different forensic companies [START_REF] Delloite | Visual Analytics: Revealing Corruption, Fraud, Waste, and Abuse. Presentation of the Forensic Center[END_REF][START_REF] Westphal | Patterns for Financial Intelligence Units (FIUs) and Anti-Money Laundering (AML) Operations[END_REF]. Usually graph vertexes represent different entities such as accounts, user IDs, phones, credit cards, addresses, organizations, etc. The edges between them indicate the usage or participation of the corresponding entity in financial operations, and the line thickness displays the frequency of the transactions between entities. The graph-based representation of transaction activity helps to discover connections between customers, to identify suspicious communication patterns, revealing thus organized group of fraudsters.

Korczak et al. [START_REF] Korczak | Visual Exploration of Cash Flow Chains[END_REF] address the problem of graphical representation of sequential financial operations in readable manner. Exploration of transaction chains assists the analyst to detect money laundering operations. However, the major concern when designing a visualization algorithm of sequential operations is the complexity of the resulting graph. In order to solve this problem the authors propose the evolutionary algorithm that minimizes the number of edge intersections.

Chang et al. [START_REF] Chang | WireVis: Visualization of Categorical, Time-Varying Data From Financial Transactions[END_REF] present the WireVis tool for the analysis of financial wire transactions for fraud protection. It is based on transaction keyword analysis and built in collaboration with the Bank of America. All the textual elements contained in transaction data records are seen as keywords. WireVis uses a multi-view approach including a keyword heatmap and a keyword network graph to visualize the relationships among accounts, time and keywords within wire transactions. The keyword heatmap characterizes the usage frequency of the keyword in the users' groups. Authors suggest an interesting modification of the clustering algorithm applied to form groups of similarities. They treat each account as a point in the k-dimensional space (where k is the number of keywords), and group the accounts based on their distances to the average point of all accounts. This approach significantly decreases the complexity of clustering procedure having complexity O(3n). In order to support the visualization of transaction activity over time, authors propose the Strings and Beads view in which the strings refer to the accounts or cluster of accounts over time, and the beads refer to specific transactions on a given day. The x-axis of the view corresponds to the progression of time, and the y-axis shows a transaction attribute selected form the predefined list.

4

Data, Models, and Techniques

Data

The data from existing MMTS are not publicly available and in the most cases confidential. A possible solution of this problem can be usage of artificially generated data. This approach is widely used to train automatic fraud detection techniques based on pattern recognition and machine learning [START_REF] Gaber | Synthetic logs generator for fraud detection in mobile transfer services[END_REF]. In our work we use MMTS log synthetic simulator [START_REF] Gaber | Synthetic logs generator for fraud detection in mobile transfer services[END_REF] to generate test data containing different fraudulent scenarios. The MMTS log synthetic simulator was developed within the FP7 project MASSIF to assess efficiency of the proposed intrusion detection techniques for the mobile money transfer scenario [START_REF] Rieke | Security and Reliability Requirements for Advanced Security Event Management[END_REF]. It models the mobile money transfer platform and the behavior of its legitimate or fraudulent users. These data describe only transaction logs and contain such information as the phone number of the customer (sender/receiver), their account ID and role (customer, retailer, merchant, operator, etc.), transaction ID, its timestamp, type (money transfer between individuals, cash in or cash out of the mobile wallet, etc.), transaction amount, status as well as sender's and receiver's balance before and after transaction.

In order to assess the suggested approach we generated various case studies, including money laundering activities and mobile botnets, using this simulator. In generated scenarios each MMTS subscriber has only one account and role associated with him (her).

Visual Models and Interaction Techniques

When designing main form of the MMTViewer, a tool demonstrating the approach, we followed Shneiderman's information seeking mantra [START_REF] Shneiderman | Dynamic queries for visual information seeking[END_REF] that consists in having the overview first and then focusing on particular areas of interests. Thus, the main window is divided into three subviews: (A) RadViz-based view, (B) graph-based view and (C) table view, designed to inspire the analyst to dive into data, generate hypotheses and verify them (Fig. 2).

The goal of the RadViz-based view (A) is to provide the general overview of the transaction activity in the MMTS. It allows identification of the existence of patterns in subscribers' behavior, while the graph-based view (B) helps to focus on the links of a particular user or a group of users. The table view (C) gives detailed information on the selected MMTS entity (subscriber or transaction). These three views are coordinated together, so selecting a user in view A results in highlighting corresponding user and his/her transactions in view B and refreshing detailed information in view C.

With these three tightly linked views the analyst can interact with users and transactions in order to understand how the data correlate. We suppose such approach is significantly more powerful that using the views separately.

The tool described in the paper is written in Java. All visual models are implemented using Prefuse Toolkit [24], which allows development of highly interactive visualizations. It can be easily integrated into Swing applications or Java applets.

A B C

Fig. 2. The main window of MMTViewer

The RadViz-based View

The main view is a RadViz visualization [START_REF] Ankerst | Similarity Clustering of Dimensions for an Enhanced Visualization of Multidimensional Data[END_REF] of the MMTS users. Its goal is to highlight groups of users with similar "transaction" behavior.

The Radviz is a non-linear multi-dimensional visualization technique that can map n-dimensional data into 2-dimensional space. The analyzed attributes are represented as dimension nodes placed around the perimeter of a circle. Then the objects are displayed as points inside the circle, with their positions determined by a metaphor from physics: each point is connected by n springs to the n respective dimension nodes. The stiffness of each spring is proportional to the value of the corresponding attribute. Thus, the point is located at the position where the spring forces are in equilibrium. Prior to visualization, all used attribute values are normalized. The objects set close to some dimension node have higher values for the corresponding attribute then for the others. For example, analyzing Fig. 3 it is possible to conclude that the merchant payments and individual transfers are prevailing among all other end user's financial operations, furthermore their quantity is comparable. The important feature of the Radviz technique is that it supports visualizing all dimensions of a dataset at once and is very useful when searching for clusters and outliers in multidimensional data. It can be effectively used as clustering tool that is characterized by low complexity O(n).

We suggest using the following attributes of the user as dimension anchors because these properties are commonly used in detecting anomalous activity both in financial systems and scientific research tools [START_REF] Al-Khatib | Electronic Payment Fraud Detection Techniques[END_REF][START_REF] Delloite | Visual Analytics: Revealing Corruption, Fraud, Waste, and Abuse. Presentation of the Forensic Center[END_REF][START_REF]Financial Crime Risk Management solution[END_REF][START_REF]Nice Actimize Integrated Fraud Management[END_REF] and can rather exactly describe the "transaction" behavior of the user:  a number of individual transfers for a given period of time;  a number of cash deposit operations for a given period of time;  a number of cash withdrawal operations for a given period of time;  average amount of individual transfers for a given period of time;  average amount of cash deposit operations for a given period of time;  average amount of cash withdrawal operations for a given period of time;  minimum and maximum amount of individual transfers for a given period of time;  minimum and maximum amount of cash deposit operations for a given period of time;  minimum and maximum amount of cash withdrawal operations for a given period of time.

As the major problem of the RadViz visualization is an appropriate selection of the dimension nodes' layout which determines the quality of the posterior visualization and ability to detect clusters [START_REF] Caro | Analyzing the Role of Dimension Arrangement for Data Visualization in Radviz[END_REF], we use the arrangement of the anchors given in Table 1 as default. However, we implemented a mechanism that enables a user to adjust the layout of dimension nodes by selecting them from the predefined list and setting their order. The MMTS subscribers are displayed as colored points inside the unit circle. The color is used to encode their role in the MMTS. We suppose that users having the same role should merge in clusters, showing thus similar behavior. For example, retailers who are mainly involved in operations of cashing in/out customers mobile wallet should form a cluster. The location of end users is difficult to predict as they can show rather various behavior, nevertheless, we expect them also to be grouped in clusters. We consider that in this case the signs of potential fraud could be as follows:  a user does not belong to any cluster or included in the group of the users having another role;  location of a group of users significantly differs from the rest.

These anomalies in users' layout could be a starting point in the analysis of the transaction activity in the MMTS. The coloring of the nodes based on the users' role simplifies the process of anomaly detection immensely.

The Graph-based View

The graph-based visualization technique is a common way for presenting transactions in financial systems. The main advantage of the graph view is that it emphasizes structural properties of the connectivity between users.

In the tool the graph vertexes represent users, while edges  transactions between them. As mentioned above in our case studies, a user has only one mobile account associated with him, therefore we do not display mobile account as a separate vertex connected with the user. However, if the user has several accounts we suggest to aggregate them into one meta-node preserving all input and output links in order to improve readability of the generated image.

Color is used to encode the role of the user in the MMTS as well as the transaction type. Both color schemes were created using Color-Brewer2 [START_REF][END_REF]. The transaction types that are frequently used in detection of suspicious activity such as cash withdrawal, deposit and individual money transfers are encoded with color-blind safe colors. The shape of the vertex depends on whether the user is only transaction sender (diamond), receiver (ellipse) or both (rectangle). This feature can simplify the detection of subscribers whose accounts are used only for cash withdrawal or deposit operations. If the user is linked with another user by a set of transactions of the same type then they are displayed as one edge, whose thickness is determined by their quantity. The size of the graph vertex could be determined by a sum of received and sent amounts for a given period of time. We consider that this option helps to discover subscribers, who participate in large cash flows.

To support visual exploration of the data, we implemented the following interaction techniques. Flexible filtering mechanism allows specifying different complex logical expressions to filter data. Linking and brushing effect can be applied in order to highlight contacts of the MMTS user. When switched to this mode, it is possible to select the user by clicking on the corresponding node, this will make all input and output links visible while the rest will be hidden. The combination of this technique with filtering mechanism allows focusing on particular user transactions with given characteristics. Apart from tooltip that gives only brief information about the object, i.e. transaction type, its sender and receivers, etc., the user can get detailed information on every element of the graph (node or vertex) shown in table view by clicking on it. This information includes subscriber's id, role, number of transactions, total amount, minimum and maximum transaction amounts, transaction time, etc. This informational display is updated whenever a particular graph node or edge is selected.

We also implemented two graph layouts: radial and based on scatter plot (Fig. 4). In order to construct the latter, we calculate for each subscriber the total quantity of all transactions made by him/her and the number of different transaction types used. These two attributes define the position of the corresponding node on the plane: x-coordinate is determined by the total quantity of all transactions, and y-coordinate is determined by number of different transaction types. This layout helps to reveal the most active users as the heightened activity can be a sign of potential fraud. However, it is clearly seen that these two graphical data presentation cannot be used to visualize a large set of data as generated image is overloaded with lines and labels which are in the most cases are simply unreadable. That is why we suggest using such presentation only when a particular set of users has been already selected. In this case the analyst can take all advantages of graph-based visualization for investigating users' links.

5

Case Studies and Discussion

Money Laundering Misuse Case

Several money laundering schemes exist. In this paper, the emphasis is made on the use of chains of mules. Using mules enables to hide the fraudulent origin of money.

Chains of mules may be composed of several layers. Here, only one layer of several mules is considered. Fraudsters owning a certain amount of money to be laundered divide this amount and send it to several mules. Later on, they withdraw this money from a complicit retailer. In reality, they would then send the cash obtained to another fraudster, but this money stream is not captured by the MMTS. The origin of the amount of money used by the first fraudster is not modeled here. The scenario is composed of 500 legitimate users, 10 mules and 4 retailers and 5317 transactions.

When assessing the efficiency of our tool we conducted almost "blind" experiment as we do not know number of malefactors, number of fraudulent transactions and their amounts, malefactors and mules themselves. We only know that this set of data may contain money laundering activity. The obtained results could be lately verified using special ground proof data field.

When detecting anomalous activity using our tool, we considered the following assumptions: (i) the amount of fraudulent transactions is smaller than the average amount of the users; (ii) the mules also perform legitimate transactions and (iii) a sudden change in transferred mMoney amounts corresponds to an anomaly.

Thus, we can expect that a fraudster is described by (i) greater number of individual money transfers and withdrawal operations and (ii) smaller average amount of these transactions.

These assumptions are made on base of analysis of existing money laundering scenarios described in [17,18]. That is why we selected the following attributes as anchors: quantities of individual transfers, mMoney withdrawals and deposits, and their average amounts, respectively. The result of MMTS users' visualization using RadViz technique is shown in Fig. 5.

It is clearly seen that two subscribers are located apart from the others. This fact can be explained by that these users are mainly involved in the individual money transfers.

Additionally, from the graph-based view we see that one of them only sends money and another -only receives money. Further analysis of their contacts shows that these two subscribers (PN_FR1 and PN_FR2) are connected with each other via a set of users (Fig. 6). According to this, we can conclude that PN_FR1 and PN_FR2 could be potential fraudsters and the subscribers connected with them are the mules.

Behavioral Fraud Case Study

Behavioral frauds occur when the behavior of the fraudster is superimposed on the legitimate user's one. Both actors use the mobile device to carry out transactions in the same window of time. In this paper, we consider two types of such fraud. The first one corresponds to a botnet which is deployed on several mobile devices. The malicious program carries out several transfers towards mules who withdraw the money within 72 hours after its reception. This scheme is rather similar to the money laun-dering scheme except that the amounts involved are not the same, there is no complicit retailer, and the mules are used here to hide the destination of the stolen money and not its origin. Moreover, the fraudulent transactions are initiated by the malicious programs. The second case corresponds to a theft. The mobile device is stolen and the fraudster then tries to withdraw money several times during a short range of time before the phone's theft is reported and the phone is deactivated. The generated scenario is made of 2 merchants, 6 retailers and 4010 users, 4 of which are mules, and 54222 transactions. There are 3 thieves and 39 infected mobile devices. As in previous use case we do not know the detailed information on simulated frauds: number of thieves, structure of the botnet and average amount of fraudulent transactions. When detecting the mobile botnet, we considered the following assumptions: (i) the amount of fraudulent transactions is slightly inferior than the average amount of the regular users transactions, (ii) the time elapsed between two fraudulent transactions is similar to the average interval between two legitimate transactions and (iii) the legitimate and fraudulent behavior occur during the same window of time. Like in the money laundering scenario, the infected subscribers as well as mules are characterized by increased transaction quantity. However, the amount of fraudulent transactions does not differ significantly from a normal one. That is why we use only attributes describing subscriber's transaction activity as anchors. The RadViz visualization of the MMTS users based on their transaction activity reveals four groups of users exposing similarities in behavior -Retailers, Merchants, End users 1, End users 2 (Fig. 7). Groups Retailers and Merchants consist of retailers who are involved only in withdrawal and deposit operations, and merchants, respectively; group End users 1, the most numerous, consists of the subscribers who mostly uniformly make transactions of different types. Users belonging to the fourth group End users 2 have individual money transfers significantly prevailing over transactions of other types. The link analysis of the users shows that apart from individual transfers they make numerous withdrawal operations (Fig. 8a). These two facts allow us to conclude that these users are mules whose accounts are used to cash out mMoney from the mWallets. In order to detect a set of subscribers with infected mobile devices we filtered out all transactions that are not sent to the mules and this enabled us to detect the botnet. Its structure is presented in Fig. 8b. However, we failed to detect the theft of mobile devices. The detailed analysis of the raw data showed that the values of attributes selected as RadViz anchors of the compromised users are comparable to the ones of the subscribers using the MMTS comparatively rare during the selected period of time. And as the result their behavior is similar to the behavior of legal end users and they are in the group End users 1. Meanwhile it changes dramatically if observing his/her behavior in dynamics as legal activity fully stops.

Discussion

When choosing visualization technique for representation of the MMTS users and their transactions we aimed to produce a rather compact generalized view on users and their behavior, to divide them into relatively small groups uniting according to the similarities in their behavior and, thus, to decrease the amount of data to be investigated. We assumed that MMTS users could have similar behavior described in terms of average transaction amount, number of transactions and their types for a given period of time. Uniting them into groups allows focusing on these characteristics and determining subgroups or users in the group exposing anomalous behavior. Therefore, analysis of such groups could be a starting point in the investigation of the financial frauds of any type. The RadViz technique could be considered as a clustering tool that may be effectively used to solve this task. Its advantages such as low computational complexity (O(n)) and obvious representation of results of clustering procedure overweight its disadvantages which could be partly eliminated by providing a security officer a flexible mechanism for axis setup and layout.

Our experiments showed that the approach for analysis of the MMTS user behavior based on RadViz visualization used in conjunction with graph-based presentation of their transactions can be used effectively for money laundering scheme and botnet detection. These financial frauds are characterized by usage of mules, whose behavior usually significantly differs from ordinary users. Their accounts are used only as receivers of individual transfers and withdrawal operations, that means that corresponding points of the RadViz view lie apart from other users. These outliers can easily attract the attention of the analyst and cause additional investigation of their transactions. The analysis of the mules' transaction using graph-based visualization is able to reveal the botnet structure or the money-laundry scheme. Thus, we can assume that our approach can be effective in detection of financial frauds that have structural peculiarities involving usage of mules.

We failed to detect behavior frauds such as the theft of mobile devices using our approach. This failure is explained by the fact that we used statistical characteristics such as average transaction amount, number of transactions calculated for a given period of time to describe the user behavior. These statistical profiles of the users, whose mobile devices were stolen, were similar to rather large number of profiles of other users, making thus almost impossible to reveal them. In order to detect behavior frauds it is necessary to trace changes in users' behavior in time providing the analyst a possibility to compare selected attributes for different periods of time. Visualization techniques with time axes such as timelines or heat map with time axes enables historical analysis of data and could be used to monitor dynamics in users' behavior. However, the graphical representation of sufficiently large number of the MMTS users on one screen can cause certain difficulties in the analysis of their behavior due to illegible details of the generated image. Application of clustering techniques based on analysis of users' attributes and used to reduce data dimension can face the same difficulties as our approach. The possible solution of the problem within our approach is the usage of animated graphical data representation. Animation of user's location on RadViz visualization of the users and highlighting its trace if the changes in his/her behavior are significant can assist the analyst to spot a strange behavior.

Conclusions

The analysis of the state-of-art in fraud detection techniques in the mobile money transfer services showed that link analysis of subscribers' transactions using interactive graph-based data presentation is the most widely used visualization technique. It allows the analyst implementing link analysis of the user's contacts visually as well as applying graph-theoretic algorithms in order to discover structural peculiarities such as bridges and cliques. We proposed to form metaphoric presentation of the MMTS subscriber behavior according to his/her transaction activity. The user's activity is assessed using average amount of transactions, their quantity and usage of transactions of different type. This approach allows determining clusters of users exhibiting similar behavior and outliers. The latter is considered as a starting point of transaction analysis supported by traditional graph-based presentation of subscribers' transactions. However, the experiments implemented using the special synthetic simulator showed that our approach is able to detect fraud schemes that cause long term chang-es in the average behavior of the MMTS subscribers or characterized by the specific behavior of the fraud scheme participants. In order to improve the efficiency of the proposed approach we defined future directions of the research concerning with exploration of the appropriate selection and arrangement of the dimension nodes in RadViz visualization and elaboration of the dynamic data presentation.

Fig. 1 .

 1 Fig. 1. Economic environment of Mobile Money Transfer services[START_REF] Jack | Monetary Theory and Electronic Money: Reflections on the Kenyan Experience[END_REF]

Fig. 3 .

 3 Fig. 3. Schema of the RadViz-based visualization of user transaction-based behavior

Fig. 4 .

 4 Fig. 4. Graph-based representation of the financial contacts of the MMTS user using radial layout (a) and scatter plot-based layout (b)

Fig. 5 .Fig. 6 .

 56 Fig. 5. RadViz visualization of MMTS users in money laundering scenario

Fig. 7 .

 7 Fig. 7. RadViz visualization of MMTS users in the behavior fraud scenario

Fig. 8 .

 8 Fig. 8. Detection of mobile botnet: contacts of the mule (a) and botnet structure (b)

Table 1 .

 1 Default order of dimension nodes in RadViz-based view

	Order	Dimension node
	0	a number of individual transfers for a given period of time
	1	a number of deposit operations for a given period of time
	2	a number of withdrawal operations for a given period of time

Acknowledgements. This research is being supported by grants of the Russian Foundation of Basic Research (projects 13-01-00843, 13-07-13159, 14-07-00697, 14-07-00417), the Program of fundamental research of the Department for Nanotechnologies and Informational Technologies of the Russian Academy of Sciences (2.2), by Government of the Russian Federation, Grant 074-U01, the State contract #14.ВВВ.21.0097, and the project ENGENSEC of the TEMPUS program.