The mixed integer program developed is designed to detect suspicious transactions in an electronic wallet (e-Wallet). The Fitness function aims to maximize the detection of suspicious transactions while minimizing false positives. Variables and constraints are defined to capture transactional characteristics such as amount, geographical location, device type and IP address.

The MIP is composed of two types of variables:

Continuous variables, binary integer variables

$x_i=\{\begin{array}{l}1\text{if a transaction is classified as suspect}\\ 0\text{otherwise}\end{array}$

$y_{ij}\in \left\{0,1\right\}$: Binary variable representing an anomaly detected for characteristic $j$ in the transaction $i$

if $j=1$: characteristic relates to amount of the transaction

if $j=2$: characteristic relates to geographical location

if $j=3$: characteristic relates to type of Peripheral

if $j=3$: feature relates to IP address

$S_i\ge 0$: Transaction suspicion score $i$

$C_i\in {ℝ}^{+}$: Transaction cost $i$

The MIP objective function is a linear combination of successful detections and penalties for errors, weighted by suspicion scores and adjusted by priority coefficients.

These components are:

Suspicion score ( $S_i$): score attribué à chaque transaction $i$

$\left(w\cdot S_i\cdot x_i\right)$: This term values suspicious transactions correctly detected by the model

$\left(\omega \cdot \left(1-x_i\right)\cdot F_i\right)$: This term penalizes misclassified transactions

with:

$w$: Weight that adjusts the importance of suspicious transactions in the objective function

$\omega$: weight adjusting penalty for false negatives

$F_i$: False negatives: Suspicious transactions not detected ( $x_i=0$)

$S_i$: Transaction suspicion score $i$

$x_i$: Binary variable indicating transaction suspicion $i$

$\text{Maximize}Z=\underset{i=1}{\overset{n}{{\displaystyle \sum }}}\left(w\cdot S_i\cdot x_i-\omega \cdot \left(1-x_i\right)\cdot F_i\right)$

Note:

The weights $w$ and $\omega$ control the balance between maximizing the detection of suspicious transactions and minimizing classification errors.

If $w$ is high, the model will focus on anomaly detection.

If $\omega$ is high, the model will minimize false negatives.

This allows the objective function: ( $Z$) ensure efficient and optimized detection as part of e-wallet security.

Constraints

Transaction amount constraint (for $j=1\Rightarrow y_{i1}$)

A transaction is considered suspicious if its cost $C_i$ deviates significantly from the historical average of transactions for a given user.

$y_{i1}=\{\begin{array}{l}1\text{if}\left|C_i-\mu C\right|>{\kappa }_1\cdot \sigma C\\ 0\text{otherwise}\end{array}$

With

$\mu C$: Average transaction cost per user

$\sigma C$: Standard deviation of transaction values

${\kappa }_1$: Adjustable threshold factor.

Constraints on geographical location (for $j=2\Rightarrow y_{i2}$)

$y_{i2}=\{\begin{array}{l}1\text{if}D\left(\left(L_i,l_i\right),\left({\mu }_L,{\mu }_l\right)\right)>\xi \\ 0\text{otherwise}\end{array}$

with:

$L_i,l_i$: Transaction latitude and longitude $i$

${\mu }_L,{\mu }_l$: Average latitude and longitude of usual transactions

$D(.)$: Geographical distance.

$\xi$: Distance threshold $D(.)$

Device type constraints (for $j=3\Rightarrow y_{i3}$)

$y_{i3}=\{\begin{array}{l}1\text{si}{p}_i\notin P_{\text{approved}}\\ 0\text{otherwise}\end{array}$

with:

$p_i$: Peripheral

$P_{\text{approved}}$: All devices authorized for the user.

IP address constraints (for $j=4\Rightarrow y_{i4}$)

A transaction is considered suspicious if the $A_i$ IP address does not correspond to an IP range authorized for the user

$y_{i4}=\{\begin{array}{l}1\text{si}{A}_i\notin A_{\text{authorized}}\\ 0\text{otherwise}\end{array}$

$A_i$: IP address used for the transaction

$A_{\text{authorized}}$: All authorized IP ranges.

Suspicion score

The suspicion score for a transaction i is a weighted combination of the anomalies detected.

$S_i={\beta }_j\cdot y_{ij};\text{where}j=\left\{1,2,3,4\right\}$

For a transaction $i$, the suspicion score is:

$S_i={\beta }_1\cdot y_{i1}+{\beta }_2\cdot y_{i2}+{\beta }_3\cdot y_{i3}+{\beta }_4\cdot y_{i4}$

${\beta }_j$: Weight assigned to each $j$ characteristic

Suspicious transaction classification constraint

Let $\theta$: the predefined suspicion score threshold

$x_i=\{\begin{array}{l}1\text{if}{S}_i\ge \theta \text{then the transaction is classified as suspicious}\\ 0\text{si}\text{non}\end{array}$

Non-negativity constraints

$x_i\in \left\{0,1\right\}$

$y_{ij}\in \left\{0,1\right\}$

$C_i\in {ℝ}^{+}$

$S_i\in {ℝ}^{+}$

$\theta \in {ℝ}^{+}$

The Mixed Integer Program is:

$\max Z=\underset{i=1}{\overset{n}{{\displaystyle \sum }}}\left(w\cdot S_i\cdot x_i-\varphi \cdot \left(1-x_i\right)\cdot F_i\right)$ (1)

s.c

$S_i={\beta }_j\cdot y_{ij};\text{with}j=\left\{1,2,3,4\right\}$ (2)

$x_i=\{\begin{array}{l}1\text{if}{S}_i\ge \theta \text{the transaction is classified as suspicious}\\ 0\text{otherwise}\end{array}$ (3)

$x_i\in \left\{0,1\right\}$ (4)

$y_{ij}\in \left\{0,1\right\}$ (5)

$C_i\in {ℝ}^{+}$ (6)

$S_i\in {ℝ}^{+}$ (7)

$\theta \in {ℝ}^{+}$ (8)

with

$y_{i1}=\{\begin{array}{l}1\text{if}\left|C_i-\mu C\right|>{\kappa }_1\cdot \sigma C\\ 0\text{otherwise}\end{array}$ (9)

$y_{i2}=\{\begin{array}{l}1\text{if}D\left(\left(L_i,l_i\right),\left({\mu }_L,{\mu }_l\right)\right)>\xi \\ 0\text{otherwise}\end{array}$ (10)

$y_{i3}=\{\begin{array}{l}1\text{if}{p}_i\notin P_{\text{otherwise}}\\ 0\text{otherwise}\end{array}$ (11)

$y_{i4}=\{\begin{array}{l}1\text{if}{A}_i\notin A_{\text{authorized}}\\ 0\text{otherwise}\end{array}$ (12)

This mathematical program enables accurate classification of suspicious transactions, optimizing resources and reducing false positives, while maintaining high detection capacity.

(1) is the fitness function whose main objective is to optimize anomaly detection by assigning a suspicion score $S_i$ to each transaction i, while minimizing false positives and false negatives in the classification of transactions as suspicious ( $x_i=1$) or normal ( $x_i=0$). is the suspicion score assigned to each transaction $i$ obtained by a weighted combination of the various anomalies detected (amount, location, device, IP). (3) and (4) are binary variables respectively indicating whether a transaction is classified as suspicious or not. (5) Binary variable representing an anomaly detected for characteristic $j$ in transaction $i$. (6): continuous variable representing the cost of a transaction; (7): continuous variable representing the value of the suspicion score assigned to each transaction $i$; continuous variable defining the threshold value of the predefined suspicion score used to define the type of transaction $i$. (9), (10), (11) et (12): are binary variables indicating anomalies detected for amount, location, device and IP address respectively.

The mathematical program developed combines two main objectives:

Efficient anomaly detection: By maximizing suspicion scores for suspicious transactions. Reduce classification errors: By minimizing false positives and false negatives through penalties integrated into the objective function.

This combination of objectives is rarely seen in literature, where models often focus solely on detection. The aim is to provide a balanced solution, suitable for financial systems where minimizing disruption to legitimate users is essential.

Study of the complexity of the Mixed Integer Program

The mathematical model proposed in section 3.1 is based on a Mixed Integer Program (MIP) to detect suspicious transactions in an e-Wallet system. This type of program combines continuous variables (transaction amounts) and discrete variables (binary indicators of suspicion) in an objective function optimized under several constraints. To study its complexity is to analyze the computational difficulty of finding an optimal solution.

MIP belongs to the NP-hard complexity class. This is due to the presence of continuous and discrete variables in the model, whereas in general cases, integer linear optimization problems require an exhaustive search in the space of discrete solutions. In addition, multiple non-trivial constraints such as transaction cost, location, type of device used for the transaction and IP addressing increase the dimensionality of the problem and make the solution space more complex.

In addition, certain key variables influence complexity: considering $n$: Total number of transactions (variables to be optimized), $m$: Number of constraints in the model, $k$: Number of discrete (binary) variables. The exhaustive search for possible solutions for $k$ discrete variables in a MIP has an exponential complexity in $k$, i.e. $O\left(2^k\right)$.

Solving sub-problems for continuous variables with linear relaxation is feasible in polynomial time with simplex algorithms or the interior point algorithm. Thus, its total complexity is combined is $O\left(2^k\cdot P\left(n,m\right)\right)$ where $P\left(n,m\right)$ represents the solving complexity of a relaxed linear program. An exact resolution is feasible for moderate-sized data sets, but quickly becomes impractical on a large scale without recourse to heuristics or relaxation.

Simulation data are presented in Table 1 .

Datasets: the dataset is a CSV file of 10,000 records with the following information: Transaction_ID, Value, Latitude, Longitude, Device_Type, adress_IP and suspicion score thresholds for the first 20 lines of the dataset are shown in Table 2 .

The results of the various experiments are presented below.

The histogram of transaction amounts in Figure 1 reveals a significant concentration around a mean of 513.99 monetary units, with a standard deviation of $\sigma =118.45$ indicating that most transactions fall within a reasonable range around this average. The shape of the histogram seems close to a slightly asymmetric

normal distribution. The concentration around the means suggests stable and predictable transaction behavior for most users. On the other hand, analysis of the extreme minimum and maximum values: [165.28, 936.79] could signal activity in unexpected regions. Indeed, the presence of high amounts (close to the maximum) may signal atypical transactions or merit specific attention in a security context. This could indicate risks, such as unusual transfers or malicious activities like ceiling attacks. However, concentration around the mean suggests stable and predictable transactional behavior for most users.

The visualization of geographical distribution in Figure 2 shows two distinct categories: Normal transactions are distributed (blue color) over a well-defined set of geographical areas, probably corresponding to regions of regular activity for users, these geographical clusters could correspond to urban areas or densely populated regions. Suspicious transactions (red color) are located outside the normal clusters, indicating transactions initiated from unusual geographical locations in relation to the user’s historical behavior, or locations manipulated to mask the true origin of the transaction (use of proxies or VPNs). In addition, the concentration of transaction anomalies in a single region may indicate a coordinated fraud attempt.

Normal transactions follow a logical, dense distribution, aligned with expected activity zones, while suspicious transactions appear more scattered or concentrated in isolated areas:

Figure 3 ’s analysis of device types shows a dominance of transactions carried out via mobile devices among normal transactions, followed by desktop and a significant percentage of unidentified devices (Unknown). This reflects modern usage patterns where smartphones dominate digital payments. A notable proportion remain classified as “unknown” and are associated with transactions classified as suspicious in the majority; however, some may result from misconfiguration of legitimate devices due to missing metadata. Anomalies show no use of mobile devices, suggesting that attacks are targeting fewer common devices or exploiting less monitored environments from proxies or VPNs to mask their identity? The non-involvement of mobile devices in the anomalies suggests that mobile transaction security systems are more robust, or that attackers are avoiding these devices.

Figure 4 shows a uniform distribution of anomalies across multiple IP addresses, where each address appears only once in the suspect data. This raises interesting questions about the nature and scope of suspicious transactions:

The typology of suspect IP addresses appears to belong to local ranges (192.168.0.145), while others belong to public ranges (203.0.113.x). This may indicate either a false positive for the IP address (192.168.0.145) or an attempt to mask the origin of the type of device used to carry out the transaction via shared public IP addresses, hence the lack of knowledge of the devices used.

A false positive refers to a transaction or activity that is wrongly considered suspicious or malicious, even though it is legitimate. When it comes to IP addresses, several factors can contribute to these errors, affecting both the user experience and the effectiveness of security systems among other things: if users connecting via VPNs or shared proxies may have IP addresses associated with fraudulent behavior in which case no legitimate transaction may be falsely reported if the IP address is listed as suspicious or if ISPs frequently reassign dynamic IP addresses, which can link suspicious past activities to innocent current users, this can lead to new transactions being classified as suspicious. The consequence of false positives is a degraded user experience: transactions are blocked or delayed, leading to a loss of confidence in the service. One solution to combat false positives will be to use reliable IP address databases and update them regularly to avoid errors due to obsolete information, or implement systems capable of detecting anomalies dynamically, considering changes in IP usage.

The Mixed Integer Program (MIP) accurately identifies suspicious transactions by integrating multiple criteria. It offers better prioritization of resources by reducing unnecessary expenditure on false positives. In addition, the mathematical program can be adjusted to meet the specific needs of an e-Wallet system. However, in terms of computational complexity, MIP can be resource-intensive for large-scale systems, and the robustness of the model will depend on the quality and completeness of the data used, since attackers are constantly modifying their strategies, which will entail regular revision of MIP. By exploiting its modeling and optimization capabilities, it is possible to create an efficient and sustainable mathematical security program, while maintaining smooth and frictionless user experience.