Association-Focused Path Aggregation for Graph Fraud Detection
Authors: Tian Qiu
Wenda Li
Zunlei Feng
Jie Lei
Tao Wang
Yi Gao
Mingli Song
Yang Gao
Venue: NeurIPS 2025 poster ()
Keywords: graph fraud detection
graph anomaly detection
graph neural networks
gnn
path-level
path aggregation
long-range dependency
graph data mining
node classification
attention
interpretability
explainability
Primary area: deep_learning

Abstract: Fraudulent activities have caused substantial negative social impacts and are exhibiting emerging characteristics such as intelligence and industrialization, posing challenges of high-order interactions, intricate dependencies, and the sparse yet concealed nature of fraudulent entities. Existing graph fraud detectors are limited by their narrow "receptive fields", as they focus only on the relations between an entity and its neighbors while neglecting longer-range structural associations hidden between entities. To address this issue, we propose a novel fraud detector based on Graph Path Aggregation (GPA). It operates through variable-length path sampling, semantic-associated path encoding, path interaction and aggregation, and aggregation-enhanced fraud detection. To further facilitate interpretable association analysis, we synthesize G-Internet, the first benchmark dataset in the field of internet fraud detection. Extensive experiments across datasets in multiple fraud scenarios demonstrate that the proposed GPA outperforms mainstream fraud detectors by up to +15% in Average Precision (AP). Additionally, GPA exhibits enhanced robustness to noisy labels and provides excellent interpretability by uncovering implicit fraudulent patterns across broader contexts. Code is available at https://github.com/horrible-dong/GPA.

Association-Focused Path Aggregation for Graph Fraud Detection
Tian Qiu 1.2
Wenda Li 1,2
Jie Lei Mingli Song 1,2 Yang Gao 1,2*
Zunlei Feng 1.2
Tao Wang" 4+
Yi Gao
State Key Laboratory of Blockchain and Data Security, Zhejiang University 2 Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security
3 College of Computer Science, Zhejiang University of Technology Department of Planning, Ministry of Emergency Management Big Data Center
{tqiu, 1wdup, wwwleiiennneg
cn
jasonlei@zjut edu. hbliu@qdu. edu. on
Abstract
Fraudulent activities have caused substantial negative social impacts and hibiting emerging characteristics such as intelligence and industrialization posing challenges of high-order interactions, intricate dependencies, and the sparse yet concealed nature of fraudulent entities. Existing graph fraud detectors are limited by their narrow "receptive fields", as they focus only on the relations between an entity and its neighbors while neglecting longer-range structural associations hidden between entities. To address this issue, we propose novel fraud detector based on Graph Path Aggregation (GPA). It operates through variable-length path sampling, semantic-associatee path encoding, path interaction and aggregation, and aggregation-enhancee fraud detection. To further facilitate interpretable as- sociation analysis, we synthesize G-Internet, the first benchmark dataset the field of internet fraud detection. Extensive experiments across datasets in multiple fraud scenarios demonstrate that the proposed GPA outperforms mainstream fraud detectors by up to +15% in Average Precision (AP). Additionally, GPA exhibits enhanced robustness to noisy labels and provides excellent interpretability by un- covering implicit fraudulent patterns across broader contexts. Code is available at https: thub. cow htt.//orrbbbb bbll- blw-dong/eeeeeeeeeeeeeeooeee /GAg
Introduction
With the evolution of information technology, there a pronounced spillover of risks from cyberspace into human society and the physical world. The sharp rise in fraudulent activities has made fraud detection [1-4] increasingly prominent research area. Fraud encompasses various domains such as the internet, finance, social networks, and online reviews, bringing severe negative social impacts including economic losses, trust damage, disruption of fair competition, and infringement of consumer rights. Therefore, combating fraud and safeguarding public interests are of utmost importance.
As fraudulent activities become increasingly intelligent and industrialized, the main challenges in fraud detection include: (1) high-order interactions often exist between fraudulent entities, (2) dependencies among fraudulent entities intricate, and (3) fraudulent entities are sparse and highly concealed. Given the complex dependencies and topological structures among fraud entities, researchers have employed Graph Neural Networks (GNNs) [5-7] for fraud detection. However,
*Conesponding authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

#A
HE
#A
AR
HR
ftand relased
MLP
aC
Predictor
MB
#0
probabiliy
Mining A
#C
Atlention
Average
benign/frudhie froshient pantem
Path Sampling
Path Encading
Interaction & Aggregation
Fraud Detection
User (Any / Benign/ Anomalous)
Website
Padding
No. of Visits
Behavior Feat.
Event
An illustration of the proposed fraud detector based Graph Path Aggregation (GPA) under the internet fraud scenario, which operates through variable-lengle path sampling, semantic- associated path encoding, path interaction and aggregation, and aggregation -ehaannnneeeeeeedddeeeeeeeeeeede fraud detection. Note that the proposed method is generally applicable to other fraud detection scenarios.
Figure I:
standard GNNs such GCN [8] and GAT [9] are local-aware, unable to process graph structures with long-range dependencies as they primarily focus on knowledge from one-hop neighbors with limited utilization of global contexts. Graph Transformers [10-12] can capture global contexts. However, they include all nodes for self-attention, facing computational challenges in large-scale fraud detection graphs while overlooking the inherent structural associations among fraudulent entities.
In recent years, significant advancements have been made in graph-based fraud detection techniques, which can be broadly categorized into spectral methods and spatial methods. Spectral methods emphasize leveraging different frequency components of graph signals to enhance the ability to capture and process fraudulent clues on graphs through strategies such as spectral energy distribution analysis [13], label-aware edge indicators [14], and multi-frequency signal combinations [15, 16]. Spatial methods focus on spatial relations among nodes, employing techniques like context and relation fusion [17], class balance and sampling optimization [18), reinforced relation-awar neighbor selection [191, homogeneous and heterogeneous connection management [20], anomalous feature recognition and constraint [21], implicit fairing-inspired layer-wise propagation rule [22], and low- variance relation generating [23] to improve GNNs' ability to detect and identify fraudulent activities. Although these methods demonstrate excellent performance, their "receptive fields" remain limited, they primarily rely information from low-hop neighbors. For more concealed and complex fraud that involves long-range structural associations, they often struggle to respond effectively.
To address the aforementioned challenges in graph fraud detection, it is imperative to develop global- -oare technique that can effectively capture long-range structural dependencies in graphs to unveil hidden fraudulent patterns within massive data. Toward this goal, we propose novel fraud detector based on Graph Path Aggregation (GPA), as illustrated Figure GPA integrates variable-length path sampling, comantic-associate path encoding, path interaction and aggregation, fraud detection to effectively deal with the high-order interactions, intricate
and aggregation-enhanne dependencies, and the sparse yet concealed nature of fraudulent entities. This approach overcomes the limitation of mainstream fraud detectors in handling graph structures with long-range associations.
Due to privacy restrictions, existing fraud datasets have been anonymized, making it impossible to discern the specific meanings of entities, thereby hindering the analysis of model interpretability. To further facilitate this line of research, we focus on the currently prevalent yet underexplored field of internet fraud detection. Based on established fraud rules, we synthesize the first internet fraud dataset, G- Interrent, to support research on interpretable association analysis. Extensive experiments across datasets multiple fraud scenarios encompassing the internet, finance, social networks, and online reviews demonstrate that the proposed GPA outperforms various mainstream fraud detectors in Area Under the Curve (AUC) and Average Precision (AP). Meanwhile, GPA exhibits stronger robustness to noisy labels. It also provides excellent interpretability that can uncover common patterns

---

within fraud-related paths through global pattern interaction and similarity computation, showcasing a more comprehensive view of the associations among diverse fraudulent entities.
The main contribution of this paper is the proposal of a novel fraud detector based on Graph Path Aggregation (GPA), which goes beyond the local view of neighbors and explores hidden and complex fraud associations at the path level. To enrich research on interpretable associations, we synthesize the first internet fraud dataset named G-Internet. Experimental results demonstrate that GPA exhibits superior performance compared to mainstream fraud detectors across various fraud scenarios. Fur- thermore. GPA presents enhanced robustness to noisy labels and excellent interpretability, providing new insights for unveiling global association patterns in fraudulent activities.
2 Related Work
2.1 Graph Neural Networks
Given the topological structures and intricate dependencies among entities, researchers introduced Graph Neural Networks (GNNs) [5-7] as a powerful tool for processing unstructured data. Built upon message-passing GNNs have been widely employed for various downstream tasks [24-26].
GCN [8] is among the earliest classical GNNs, which updates node representations by aggregating in- formation from neighbor nodes through graph convolution. GAT [9] introduces attention mechanisms [27] to learn interaction weights between neighbor nodes. Their common drawback is that they only utilize knowledge from one-hop neighbors, making them inadequate for handling graph structures with long-range dependencies. Graph Transformers [10-12] are designed to capture global context. However, they perform self-attention across all nodes, which is not only computationally infeasible for large-scale graphs in fraud detection but also neglects the structural associations inherent among fraudulent entities. While some general approaches like PathNet [28] and RAW-GNN [29] claim to incorporate path-level structures, their core design is in fact to address heterophily issues. Not specifically resolving long-rang dependency challenges, they employ short path lengths (2-7 hops) that essentially maintain local-aware framework. Additionally, these methods suffer from slow encoding, lack path interaction, and are unable to uncover implicit fraud patterns.
2.2 Graph Fraud Detectors
Traditional graph fraud detectors [30-32] primarily rely on structural information to assess the node's contribution, commonly utilizing metries such as centrality, PageRank [33], and HITS [34]. These methods are effective in identifying behaviors similar to known fraudulent patterns, but exhibit limitations in detecting unknown types of fraud. To address this issue, graph representation learning like Walk [35], LINE [36], and node2vec [37] has emerged as a promising solution.
In recent years, advanced graph fraud detectors have been mainly categorized into spectral meth- ods and spatial methods. Regarding spectral methods, AMNet [15] adaptively combines multiple frequency signals to capture anomalies across different bands. BWGN [13] employs Beta graph wavelets for band-pass filtering in spectral and spatial domains. GHRN [14] addresses over-smoothing [38] by calculating similarities with label-aware edge indicator and pruning heterogeneous edges based on this. AHFAN [16] builds a semantic fusion module based on Chebyshev polynomial filtering capture high- and fow-frequency components of graph signals. CARE-GNN [39] leverages context embeddings, neighborhood metrics, and relation attention to mitigate fraud inconsistencies. PC- GNN [18) employs label-balanced sampler and neighborhood sampler to resolve feature dilution from class imbalance. RioGNN [19] combines reinforced relation-aware neighbor selection with label-aware similarity measures for more effective representation learning. HF-Feetcctor [20] tackles fraudsters hiding in graphs by incorporating both homophilic and heterophilic connections, along with novel aggregation strategy guided by prototype priors to propagate similar and distinct signals. GDN [21] identifies key anomalous features to mitigate the influence of heterogeneous neighbors and uses prototype vectors manage the distribution of anomalous features. GFCN [22] introduces a layer-wise propagation rule motivated by the concept of implicit fairing in geometry processing. HedGe [23] emphasizes reducing the high homophily variance between categories by generating new low-variance relations rather than modifying the original ones. Due to reliance on low-hop neighbors, these methods are also local-aware. Therefore, there remains an absence of methods that are both global-awan and capable of effectively uncovering long-range structural fraudulent patterns.
3

---

3 Methodology
To address the challenges posed by high-order interactions, intricate dependencies, and the sparse yet concealed nature of fraudulent entities, along with the limitations of BaNN-based anti-fraud methods in dealing with long-range dependencies in graph structures, we propose novel fraud detector based on Graph Path Aggregation (GPA), as illustrated in Figure 1. GPA works through variable-length path sampling, semantie-associated path encoding, path interaction and aggregation, and finally the aggregation-enhancee fraud detection. To facilitate an intuitive understanding, the methodology is presented in the context of internet fraud detection. Note that the proposed method is generally applicable to other fraud detection scenarios.
3.1 Problem Definition
Let G = (V,E) be a graph in the context an internet fraud scenario. Let V {vi, U2, uN ) E {e1, C2, .... eM ), X {Xe, Xyy..... Xux }. and T {te, tez: fe., t..,,,es denote the set of nodes, edges, node features, and edge weights. The nodes include two types: users and websites. U, E N is the node index, among which Vuser {U,, U2,, ..., VU is the set of user nodes and yueb (UV+1, "U+,, UN) is the set of website nodes. Xx, E I is the feature of node Un, where D is the dimension. Cm N is the edge index, which includes two types of bidirectional relations: "user visits website" and "user to user". te... E N+ represents the number of visits within the edge em- yusee = (Vey Vug: ..... Vve } is the set of labels for the user nodes. The essence of graph-based internet fraud detection is a binary classification task for user nodes, Vu,,vv EV E {0, 1}, signifying the user node U, is benign anomalous. Additionally, in alignment with realistic settings, the types and labels of website nodes are treated as unknown, leaving the model to mine them.
3.2
Variable-Length Path Sampling
For given user node, starting from itself, sample paths R N through random walk. Each path R. E N' starts from this user node and contains J nodes (of any type) connected in sequence. To further enrich the diversity of path lengths, the sampled paths are randomly masked. Define binary matrix M E 1JxJ M = U - I, where U E 1 is an upper triangular matrix filled with ones, and I Jxx is an identity matrix. Randomly and repeatably sample I rows from M and get
M e 11x], Then, obtain variable-length paths R Rx as follows:
Righ
if M.j =
R
if M., =1
To enhance the quality of the sampled paths, additional selection is sometimes necessary. The importance of each path is evaluated by summing the degree centrality of its nodes. From the randomly sampled I paths, the top-K most valuable paths R. E RxX are selected as follows:
R R KXJ <- T-Top- ddegre (R E R(()).
(2)
3.3 Semantic-Associated Path Encoding
In order to facilitate subsequent path interaction, the sampled variable-length paths are uniformly encoded into fixed-length embeddings based on atomic events. Additionally, a vector of behavior feature is designed based on the global behavior of the node and integrated into the path encoding to enrich the feature representation.
For the k-th path Ru, the set of node features it contains is {x 1/=1- The variable-length paths sampled in $3.2 are padded at the tail with nodes indexed as -1, and the feature x corresponding to the "-1" node is filled with zeros. Each link in the dataset can be viewed as an event. Taking the link "user visits website" as an example, this event consists of three elements: user (node), website (node), and the number of visits (edge weight). To produce the representation for this event, operate by adding the user feature with the product of the website feature and the number of visits, For all events in the path, the same operation is applied successively, and then get the path feature hig PJ:
h Ufxtn + fi - Xiu J==1
(3)
4

---

where U denotes the multi-element "concatenate" operation, REy + Rk is the edge between nodes RR,, and R and X is padding feature filled with zeros. The length of the path feature after concatenating is D. For other datasets with the meaning of relations/events unknown, just simply concatenate the node features along the path and get hę U(xR,,, | 1 After that, linear projection is applied to the path feature to obtain the path embedding hę RC:
h h& W + b,
where W E DJxC and b RC are learnable weight and bias respectively.
For further enhanced path feature, the behavior feature x-ehuv for each node introduced. For user nodes, the behavior feature includes the number of visited websites, the total number of website visits, and the number of connected users. For website nodes, no behavior feature set, and instead, zero vector with the same length as the user behavior feature is used. The variable-length paths sampled in $3.2 are padded at the tail with nodes indexed as 11, and the behavior feature bbeaav corresponding to the "-1" node is filled with zeros. The behavior features of all nodes are denoted as (x ) Ra. J==1+
where x behav R and S is the length of the feature. Then, normalize the behavior features. Next, R
string together the behavior features for all nodes within a path as follows and get hhehav E IR2S)
h behav
U behaa RE.
U behav
RE
where Undd V denote two-element and multi-element "concatenate" operations respectively, and behav is a padding behavior feature filled with zeros. The length of the behavior feature after x Re,
concatenating is 2S J. For different scenarios, unique behavior feature can be designed on a case-by-case basis. After that, a linear projection is applied to the concatenated behavior feature to obtain the behavior embedding h
behav E RRC:
hchav libehav Whbchav hg
b behav
(6)
where Whehhuv E XC25JxC and b heeaa E RC are learnable weight and bias respectively.
Finally, integrate the behavior embedding into the original path embedding and get z E IRC
Z hg
h bebav
3.4 Path Interaction and Aggregation
Interaction will be conducted between the paths of a user node to uncover common fraudulent patterns. For given user node, stack all the path embeddings starting from this node and get Z E R xx
=
|
Z2; zx]-
(8)
Then, self eelf-attention between paths is employed to produce the updated embeddings Ż R
Q Z Wquery K Z Whey V = Z Wvaaue
Ż softmax (Q KT). V,
(10)
where Wiquery, koy, value) E RCC are learnable weights. softmax(Q KT) can yield the attention scores of each path to itself and to other paths. With increasing training data, the model can identify fraudulent and benign path patterns more clearly. Additionally, compared to local-aware models such
as GCN and GAT, the "receptive field" of path interaction is much larger, making it more suitable for detecting fraudulent associations that are concealed through all sorts of means.
After path interaction, path aggregation is performed. Unlike traditional GNNs that aggregate features from neighbor nodes, the proposed GPA aggregates features from high-order paths. Specifically, aggregate the embeddings Ż E TR TgKx of all paths as follows to produce à RCC
(11)
where n denotes the multi-element "aggregate" operation. this paper, the average aggregation adopted, and the aggregated embedding 2 serves as the updated embedding of the central user node.
5

---

3.5 Enoigaattoo-Enbannee Fraud Detection
The updated user embedding å from path aggregation is fed into a Multi-Layer Perceptron (MLP) and subsequently sigmoid predictor to yield prediction E [0, 1]:
p
sigmoid(
(12)
representing the probability that the central user node predicted be anomalous, Then, together with the label computes the binary cross- eoss-py loss L:
C = y logp (1 - y) -oogll p).
(13)
Finally, optimize the model through standard backward propagation and gradient descent.
4 Dataset Construction
Existing fraud datasets are typically anonymized, which obscures the specific meanings of entities and consequently hinders interpretability analysis. Moreover, emerging internet fraud is rapidly evolving and widespread with concealed tactics, and research on internet fraud detection remains limited. Considering these gaps, we construct G-Internet, the first benchmark dataset for internet fraud detection, featuring a transparent structure. Due privacy restrictions, weal-world data is not available. Therefore, we synthesize the dataset through simulation. The anomaly rate in G-Internet only 2.96%, the lowest among existing fraud datasets. This section provides overview of the construction process for G-Internet, with more detailed descriptions available in Appendix $A.1.
Fraud rules. Types of internet fraud are varied, and the user behaviors regarding website visits exhibit specific patterns within each type. To more accurately simulate anomalous activities, we have designed 12 common rules shown in Table 5 & 6, which are based real cases and account for the diversity and complexity of user behaviors.
User nodes. A total of attributes have been generated for users. Based on existing references, we determine the attribute distribution for each user category and sample the attribute accordingly. Since our primary focus is to detect fraud based on the behavior of users visiting websites rather than on the users' inherent characteristics, we intentionally minimize the distinction between benign and anomalous users when constructing user attributes.
Website nodes. In total, we have included 11 types of fraud-related websites and 27 types of normal websites in the dataset. We employ large language models to generate keywords for each website, then derive the corresponding website description from these keywords, and finally encode the description into the website feature.
"User visits website" relation. For anomalous user, randomly select of the designed fraud rules and generate connections between the user and websites that meet the rule. Anomalous users may also visit large number of normal websites while visiting the websites involved in the fraud rules. These connections are also taken into account and randomly generated. For benign users, they visit more normal websites, but they may also visit fraud-related websites long they do not meet any of the fraud rules.
"User to user" relation. There may be relations between users, such phone calls or other interactions. Since our primary focus to detect fraud based on the behavior of users visiting websites rather than on the connections between users, we set both benign users and anomalous users to maintain a closer connection with benign users, so as to minimize the difference in communication behaviors between these two types of users.
In summary, the constructed G-Internet aligns with practical situations and has a clear and transparent structure. This interpretable dataset facilitates the demonstration of the interpretable GPA method ($3), which in turn enables the interpretable association analysis of fraud-related entities ($5.4).
Experimental Study
Datasets. We adopt our released G-Internet dataset for internet fraud detection. Additionally, adopt the well-known Elliptic [40] and T-Finance [13] datasets for finance fraud detection, T-Social [13] dataset for social networks fraud detection, YelpChi [41] and Amazon [42] datasets for online

---

reviews fraud detection. Table 1 provides a brief overview of the datasets' statistics. For datasets except Elliptic, the split ratio for training, val- idation, and testing is 4:2:4. Detailed dataset descriptions are provided in Appendix $..2.
Table 1: A brief overview of dataset statistics.
Scenario]
Dataset
#Nodes
#Edges
#Feats.
Anomaly
Internet
[G-nntemet]
160655
1972292
106
2.96%
Elliptic
46564
73248
93
9.76%
Finance
T-Finance
39357
42445086
4.58%
Compared methods. The proposed GPA is compared with a range of methods including Non- GNNs: MLP [43] and KNN [44], Standard Non-GNNs:
Social
T-Social
J5781065
146211016
3.01%
YelpChi
45954
7693958
32
14.53%
Reviews
Amazon
11944
8796784
25
6.87%
GNNs: GCN [8], GraphSAGE [45], and GAT
19], Spectral GNNs: BernNet [46], AMNet [15],
BWGNN [13], GHRN [14], and AHFAN [16]. and Spatial GNNs: GAS [47], DCI [48]. CARE-GIN
[39], PC-GNN [18), RioGNN (19), HD-FDetector [20], GDN [21], GFCN [22], and HedGe [23].
Experimental settings. The experiments for the proposed GPA are conducted using the Adam optimizer with an initial learning rate of le-4 1e-3 and a weight decay of 5c-4, It adopts minibatch sampling of user nodes per iteration, training for a maximum of 200 epochs from scratch. The baseline models use the officially recommended settings. All numerical results are the averages across 10 different random seeds. Detailed GPA model settings can be found in Appendix $A.3.
Evaluation metrics. Due the significant positive-negative imbalance in fraud datasets, evaluation metrics should take both Precision and Recall into account. In this paper, Area Under the Curve (AUC, %) and Average Precision (AP, %) are adopted to assess the model performance. For more details on the metrics, please refer to Appendix $A.4.
5.1 Performance Comparison
The proposed GPA is comprehensively compared with non- standard, spectral, and spatial GNNs in the internet, finance, social networks, and online reviews fraud detection scenarios. As shown in Table 2, the proposed GPA performs excellently and is the most stable across all datasets, achieving significant AP improvements of +15.7%, +3.4%, and +9.2% on the challenging G-Internet, Elliptic, and T-Social datasets. Other methods exhibit high instability and often perform poorly on several of these datasets. Standard GNNs, while able to capture some graph structural features, struggle when handling higher-order interactions. Spectral and spatial methods, designed specifically for fraud detection, perform better but still only consider low-hop neighbors, resulting in a limited "receptive field". Moreover, these methods generally perform poorly on G-Internet. The possible reason is that the inherent features of benign and anomalous users in G-Internet are not distinguishable. Without deeper mining of associations within user behaviors, the detection effect will be severely weakened. In comparison, GPA has broader perceptions and excels identifying more complex and hidden fraudulent patterns, thus outperforming existing techniques.
5.2 Robustness to Noisy Labels
Mislabeled data has detrimental impact model performance [49, 50). In real-world scenarios, due to the hidden nature of anomalies, it is often challenging to label anomalous nodes accurately, resulting in the widespread presence of noisy labels, particularly anomalous labels that are incorrectly marked as benign labels. Table 3 presents the impact of noisy labels on model performance. GAT, which also employs that GAT focuses only on neighbor nodes and therefore lacks a global view of fraudulent patterns, making it more prone to noise. In contrast, under both asymmetric and symmetric label noise, the proposed GPA shows stronger robustness compared to other methods. This may be attributed to the implicit associations in paths, which capture long-range interactions among nodes, allowing the extraction of rich benign and fraudulent patterns even from a limited set of accurately labeled data. This global view enables the model to more comprehensively understand the underlying logic behind node behaviors, thereby mitigating the interference caused by noisy labels to some extent.
attention mechanism, struggles to resist label noise. The explanation is
5.3 Ablation Study
This section conducts ablation study of the proposed GPA. As presented in Table 4, each component of GPA can contribute to enhancing the model, and any combination the components involved can further enhance performance, with the optimal achieved when all components are used.
7

---

Table 2: Model performance comparison in various fraud scenarios. "/" denotes "out of memory".
Scenario
Internet
Finance
Social
Reviews
Method
Datasel
G-Intemett
Ellipiic
T-Finance
T-Social
YelpChi
Amazon
Metrie
AUC
AUC
AUC.
AUC.
AUC
AP
AUC
AP
MLP
61.0
4.7
88.3
43.8
92.2
74.2
73.1
9.7
81.6
47.7
96.9
87.3
Non-GNN
KNN
51.7
3.0
88.0
61.0
92.7
75.0
77.6
36.3
84.6
54.4
94.9
84.4
GCN
98.5
81.9
81.7
78.2
76.4
58.6
20.9
85.2
45.7
Standard
GraphSAGE
98.6
78.9
87.6
57.8
95.6
84.7
95.7
75.3
82,9
46.6
90.9
82.5
GAT
94.2
57.9
86.3
27.5
95.8
82.7
90.3
32.1
79.1
43.6
97.1
87.9
BemNNet
91.5
57.6
87.5
38.3
96.7
89.2
93.7
44.3
83.5
$1.9
95.8
84.9
AMNet
90.8
36.0
88.9
69.5
96.4
88.9
92.5
37.7
81.9
46.9
96.9
88.4
Spectral
BWGNN
95.8
72.7
89.6
48.4
96.9
89.4
96.9
78.9
87.1
61.5
98.3
91.5
GHRN
66.
84.6
55.4
98.3
89.5
AHIFAN
87.6
72.8
87.5
72.7
86.8
73.3
87.1
73.5
86.8
72.7
98.2
88.2
GAS
96.7
72.9
86.7
29.8
96.5
86.0
95.0
62.4
76.4
35.1
92.7
81.4
DCI
82.4
23.6
85.7
27.4
87.9
63.7
84.0
13.0
78.4
39.9
95.4
85.2
CARE-GNN
70.2
87.8
37.2
78.3
84.0
53.0
85.6
PC-GNN
79.6
22.4
86.5
42.7
94.0
83.3
96.9
80.3
80.8
44,5
98.0
89.3
Spatial
RioGNN
72.8
86,4
29.1
91.3
62.6
81.7
17.6
96.9
87.6
Hº .F-FDetcctor
83.7
GDN
90.7
45.7
88.7
65.2
95.8
85.7
88.4
52.3
90.4
67.4
97.3
86.8
GFCN
85.9
43.4
85.8
45.5
92.6
82.1
86.1
47.4
87.6
68.4
95.5
83.8
HedGe
91.2
49.7
88.9
64.5
96.5
89.0
96.8
83.7
91.3
70.7
98.3
92.3
Path
GPA
99.8
97.6
91.3
76.1
97.3
89.6
99.6
96.0
91.8
73.7
98.1
92.5
Table 3: Impact of noisy labels on model performance. The dataset used for evaluation is G-Internet. "a bb" denotes the proportion of anomalous labels that are incorrectly marked as benign labels, and "b-ta" represents the proportion of benign labels that are incorrectly marked as anomalous labels.
a-
0%
10%
20%
40%
80%
0%
0%
0%
0%
10%
20%
40%
80%
0%
0%
0%
0%
0%
10%
20%
40%
80%
10%
20%
40%
80%
AUC
94.2
94.0
92.5
89.9
86.1
84.3
81.0
73.0
63.6
83.1
76.5
56.1
51.3
GAT
AP
57.9
56.6
54.4
44.4
23.7
33.9
27.4
14.4
5.5
32.8
19.5
3,6
3.1
AUC
95.8
95.0
94.7
93.3
88.0
91.8
86.3
82.8
73.6
90.2
86.9
70.1
42.3
BWGNN
72.7
71.8
67.2
64.1
42.9
58.7
42.9
24.7
10.3
53.3
31.0
8.4
2.5
AUC
99.8
99.7
99.6
99.3
98.3
98.4
97.
96.8
79.4
98.7
97.3
78.0
52.6
GPA
97.6
96.5
95.2
92.9
83.8
93.8
89.3
82.2
12.6
93.3
82.6
10.8
3.2
Table 4: Ablation study of the proposed GPA on G-Internet.
Variable-Lengle Paths Path Selection
x
v
v
v
X
X
Y
Bchavior Encoding
X
V
x
X
X
X
Path Interaction
AUC
99.83
79,79
99.75
99. 99.26
86.63
99. 89.84
99.
98, 66
86.48
AP
97.62
97.17
97.06
90.41
34.15
88.81
96.94
88.17
34,59
5.4 Interpretability
Firstly, we use the constructed G-Intennet dataset explore the associations between users falling victim to internet fraud and their website-visiting behaviors, as well as their internet environments. The paths starting from a user interact, and the attention scores between paths are computed through Equation 10. The attention maps are shown in Figure 2.
(I) Whether the path length is set short long, the proposed GPA maintains clear interpretability, As shown in Figure 2(a)c), when the central user exhibits anomalous status, some paths consistently attract attention during interactions. These paths typically pass through fraud-related websites visited by the user, whereas paths through normal websites receive little to no attention. This indicates that the attention mechanism can highlight the contribution of visited websites the fraud incident. Besides, in Figure (d), when the central user is benign, paths through normal websites receive more attention, which sharply contrasts with the results in Figure ((a)(c) and aligns with the expected interpretability. Moreover, since the construction of Intereeeet does not impose strong regularity on user connections (see $4), the proposed GPA, as expected, pays more attention to users' website- visiting behaviors rather than the connections between users, which is also interpretable.

---

Ancenalous path lengehh:
Beniign length:
length:
Benign puth lengthe
pots index (qua0y) )
polls indes Linn
pub indes (Camm))
pals mnkes (ambb
index (key)
path (key)
index (key)
path (key)
paih gous through fraud- raudt-rllated visited
puil gous ilnoughh
visited by
This path through one of the anomalous connected the This path goes through the benign connected by the
Figure 2: Attention map between all paths starting from user G-Internet during path interaction.
The brighter the area, the higher the attention score.
(2) In Figure 2(c), some paths through fraud- related websites visited by the user also receive less attention. This is because, in longer paths, the model evaluates the contribution of user- visited websites the fraud incident within broader context, allowing it to filter out less rel- evant related websites and uncover other implicit patterns at higher levels. Consequently, Figure (d) exhibit improved detection per- formance compared to Figure 2(a)(b).
Patl Pontea
2- x
Sample<11
Samplex
Samplox
Samplex
40
Samples 10
50
Remgr
10
20
Next, as shown in Figure 3, to investigate the potential associations between path patterns, we use the T-Social dataset and select five types of path patterns. Ten paths are sampled from each pattern, totaling 50 paths. After encoding, these paths interact, and the attention scores between paths are computed through Equation 10. It can be observed from the attention map that there is a close association between all paths in the same path pattern, and there may be common associations between similar path patterns. In the following discussions, "B" denotes "Benign node" and "A" denotes "Anomalous node".
Figure 3: Attention map between paths from five patterns in T-Social during path interaction. The brighter the area, the higher the attention score.
(1) "A-A" and "A-A-H BB-> A" are highly correlated, probably because both involve continuous anomalous nodes, indicating that some frauds tend to be clustered continuous.
(2) "A-B-+" and "A-B-AA AB-AAB-A'" are highly correlated, probably because both show the strategy of fraud spreading or hiding through benign nodes. "A-*B*>" indicates that anomalous nodes may spread fraud with the help benign nodes to increase concealment. "A-BBAA-B reveals that more covert fraudulent patterns may be produced by bridging multiple benign nodes.
(3) "A-B"" is highly correlated with "A-B-AA and "A-B-AA- probably because "A-+B" represents the initial of fraud and is the basis of more complex patterns. When analyzing more complex patterns, attention will paid whether they are developed from "A-B".
(4) "A-B->' and "A-BB-y MAA-B-AA are almost irrelevant to "A-+B", probably because they contain context that has gone beyond the scope of "A-B"", focusing more on their own complexity.
Conclusion
This paper presents novel fraud detector based on Graph Path Aggregation (GPA). By incorporating path sampling, encoding, interaction, and aggregation, GPA tackles the challenges of high-order interactions, intricate dependencies, and the sparse yet concealed nature of fraudulent entities, overcoming limitations of existing methods in handling graph structures with long-range associations. Furthermore, we construct G-Internet, the first benchmark dataset for internet fraud detection, to support the research. Experiments demonstrate GPA's superior performance over mainstream methods, robustness to label noise, and interpretability by unveiling implicit fraudulent patterns.

---

Acknowledgments and Disclosure of Funding
This work is funded by the National Key Research and Development Project (No. 2022YFB2703100; the Hangzhou Joint Fund of the Zhejiang Provincial Natural Science Foundation of China (No. LHZSD24F020001), the Fundamental Research Funds for the Central Universities (No. 226-2025- 00067), and ZJU-China Unicom Digital Security Joint Laboratory.
References
[1] Leman Akoglu, Hanghang Tong, and Danai Koutra. Graph based anomaly detection and description: A survey, Data mining and knowledge discovery, 29:626-688, 2015.
[2] Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang. Chuan Zhou, Quan Z Sheng, Hui Xiong, and Leman Akoglu. comprehensive survey on graph anomaly detection with deep learning. IEEE transactions on knowledge and data engineering, 35(12):12012-1225) 2021.
[3] Jing Ren, Feng Xia, Ivan Lee, Azadeh Noori Hoshyar, and Charu Aggarwal. Graph learning for anomaly analytics: Algorithms, applications, and challenges. ACM transactions on intelligent systems and technology, 14(2):1-29) 2023.
[4] Jianheng Tang, Fengrui Hua, Ziqi Gao, Peilin Zhao, and Jia Li. Gadbench: Revisiting and benchmarking supervised graph anomaly detection. Advances in neural information processing systems, 36:29628 29653,99633322 2023.
[5] Jie Zhou, Ganqu Cui, Shengding Hu, Zhengyan Zhang, Cheng Yang, Zhiyuan Liu, Lifeng Wang, Changcheng Li, and Maosong Sun. Graph neural networks: A review of methods and applications. Al open, 1:57-81, 2020.
[6] Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengqi Zhang, and Yu Philip. comprehensive survey on graph neural networks. IEEE transactions on neural networks and learning systems, 32(1 3:4-24, 2020.
[7] Yu Zhou, Haixia Zheng, Xin Huang, Shufeng Hao. Dengao Li, and Jumin Zhao. Graph neural networks: Taxonomy, advances, and trends. ACM transactions on intelligent systems and technology, 13(1):1-54, 2022.
[8] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. arXiv preprint arXivv1609.02907, 2016.
[9] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua 2017.
Bengio. Graph attention networks. arXiv preprint
[10] Chengxuan Ying, Tianle Cai, Shengjie Luo, Shuxin Zheng, Guolin Ke, Di He, Yanming Shen, and Yan Liu. Do transformers really perform badly for graph representation? Advances in neural information processing systems, 34:28877-28888. 2021.
(11) Qitian Wu, Wentao Zhao, Zenan Li, David P Wipf, and Junchi Yan. Nodeformer: A scalable graph structure learning transformer for node classification. Advances in Neural Information Processing Systems, 35:27387-27401, 2022.
[12] Qitian Wu, Wentao Zhao, Chenxiao Yang, Hengrui Zhang, Fan Nie, Haitian Jiang, Yatao Bian, and Junchi Yan. Sgformer: Simplifying and empowering transformers for large-graph representations. Advances in Neural Information Processing Systems, 36:64753-64773, 2023.
[13] Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li. Rethinking graph neural networks for anomaly detection. In International conference on machine learning, pages 21076-21089, PMLR, 2022.
[14] Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang, Addressing heterophily in graph anomaly detection: A perspective graph spectrum. In Proceedings of the ACM web conference, pages 1528-1538, 1538, 2023.
[15] Ziwei Chai, Siqi You, Yang Yang, Shiliang Pu, Jiarong Xu, Haoyang Cai, and Weihao Jiang. Can abnormality detected by graph neural networks? In International joint conference on artificial intelligence, pages 1945-1951, 2022.
10

---

[16] Xiang Wang, Hao Dou, Dibo Dong, and Zhengyu Meng. Graph anomaly detection based on hybrid node representation learning. Neural networks, page 107169, 2025.
[17] Zhiwei Liu, Yingtong Dou, Philip S Yu, Yutong Deng, and Hao Peng. Alleviating the incon- sistency problem of applying graph neural network fraud detection. In Proceedings of the international ACM SIGIR conference on research and development in information retrieval, pages 1569-1572, 2020.
[18] Yang Liu, Xiang Ao, Zidi Qin, Jianfeng Chi, Jinghua Feng, Hao Yang, and Qing He. Pick and choose: a gnn- aun-based imbalanced learning approach for fraud detection. In Proceedings of the web conference, pages 3168-3177, 2021.
[19] Hao Peng, Ruitong Zhang, Yingtong Dou, Renyu Yang, Jingyi Zhang, and Philip S Yu. Rein- forced neighborhood selection guided multi-relational graph neural networks. ACM transactions on information systems, 40(4): 2021.
[20] Fengzhao Shi, Yanan Cao, Yanmin Shang, Yuchen Zhou, Chuan Zhou, and Jia Wu. H2-fdetector: A gnn-based fraud detector with homophilic and heterophilic connections. In Proceedings of the ACM web conference, pages 1486-1494, 2022.
[21] Yuan Gao, Xiang Wang, Xiangnan He, Zhenguang Liu, Huamin Feng, and Yongdong Zhang. Alleviating structural distribution shift in graph anomaly detection. In Proceedings of the ACM international conference on web search and data mining, pages 357-365, 2023.
[22] Mahsa Mesgaran and A Ben Hamza. Graph fairing convolutional networks for anomaly detection. Pattern recognition, 145:109960, 2024.
[23] Rui Zhang, Dawei Cheng, Xin Liu, Jie Yang, Yi Ouyang, Xian Wu, and Yefeng Zheng. Generation is better than modification: Combating high class homophily variance in graph anomaly detection. arXiv preprint arXiv:2403.10:: 2024.
[24] Shunxin Xiao, Shiping Wang, Yuanfei Dai, and Wenzhong Guo. Graph neural networks in node classification: Survey and evaluation. Machine vision and applications, 33(1):4, 2022.
[25] Ajay Kumar, Shashank Sheshar Singh, Kuldeep Singh, and Bhaskar Biswas. Link prediction techniques, applications, and performance: A survey. Physica A: Statistical mechanics and its applications, 553: 124289, 2020.
[26] Zhaohui Wang, Huawei Shen, Qi Cao, and Xueqi Cheng. Survey graph classification. Journal of software, 33(1):171, 01 2022.
[27] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, tukasz Kaiser, and Illia Polosukhin. Attention all you need. Advances in neural information processing systems, 30, 2017.
(28) Yifei Sun, Haoran Deng, Yang Yang, Chunping Wang, Jiarong Xu, Renhong Huang, Linfeng Cao, Yang Wang, and Lei Chen. Beyond homophily: Structure-aware path aggregation graph neural network. In IJCAI, pages 2233-2240, 2022.
[29] Di Jin, Rui Wang, Meng Ge, Dongxiao He, Xiang Li, Wei Lin, and Weixiong Zhang. Raw-gnn: Random walk aggregation based graph neural network. arXiv preprint arXiv:2206.1388 13953, 2022.
[30] Rafal Drežewski, Jan Sepiclak, and Wojeiech Filipkowski. The application of social network analysis algorithms in a system supporting money laundering detection. Information sciences, 295:18-32, 2015,
[31] Kai Wang and Danwei Chen. Graph structure based anomaly behavior detection. In International conference on computer engineering, information science application technology, pages 331-538. Atlantis press, 2016.
[32] Yuan Wang, Liming Wang. and Jing Yang. Egonet based anomaly detection in e-bank transaction networks. In TOP conference series: Materials science and engineering, volume 715, page 012038. IOP publishing, 2020.
11

---

[33] Lawrence Page. The pagerank citation ranking: Bringing order to the web. Technical report, 1999.
[34] Jon M Kleinberg. Authoritative sources in a hyperlinked environment. Journal of the ACM, 46 (5)66046632, 1999.
[35] Bryan Perozzi, Rami Al-Rfou, and Steven Skiena. Deepwalk: Online learning of social representations. In Proceedings of the ACM SIGKDD international conference on knowledge discovery and data mining, pages 701-710, 2014.
[36] Jian Tang, Meng Qu, Mingzhe Wang, Ming Zhang, Jun Yan, and Qiaozhu Mei. Line: Large- scale information network embedding. In Proceedings of the international conference on world wide web, pages 1067-1077, 2015.
[37] Aditya Grover and Jure Leskovec. node2vec: Scalable feature learning for networks. In Proceedings of the ACM SIGKDD international conference on knowledge discovery and data mining, pages 855-864, 2016.
[38] Konstantin Rusch, Michael M Bronstein, and Siddhartha Mishra. survey on oversmoothing in graph neural networks. arXiv preprint arXiv: 10993, 2023.
[39] Yingtong Dou, Zhiwei Liu, Li Sun, Yutong Deng, Hao Peng, and Philip S Yu. Enhancing graph neural network-based fraud detectors against camouflaged fraudsters. In Proceedings of the ACM international conference on information & knowledge management, pages 315-324, 2020.
[40] Mark Weber, Giacomo Domeniconi, Jie Chen, Daniel Karl Weidele, Claudio Bellei, Tom Robinson, and Charles E Leiserson. Anti-money laundering in bitcoin: Experimenting with graph convolutional networks for financial forensics. arXiv preprint arXiv: 190500990, 2019.
[41] Shebuti Rayana and Leman Akoglu. Collective opinion spam detection: Bridging review networks and metadata. In Proceedings of the ACM SIGKDD international conference on knowledge discovery and data mining, pages 985-994, 2015.
[42] Julian John McAuley and Jure Leskovec. From amateurs to connoisseurs: modeling the evolu- tion of user expertise through online reviews. In Proceedings of the international conference on world wide web, pages 897-908, 2013.
[43] Frank Rosenblatt. The perceptron: A probabilistic model for information storage and organiza- tion in the brain. Psychological review, 65(6):386, 1958.
[44] Thomas Cover and Peter Hart. Nearest neighbor pattern classification. IEEE transactions on information theory, 13(1):21-27, 1967.
[45] Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. Advances in neural information processing systems, 30, 2017.
[46] Mingguo He, Zhewei Wei, Hongteng Xu, et al. Bernnet: Learning arbitrary graph spectral filters via bernstein approximation. Advances in neural information processing systems, 34: 14239-14251, 2021.
[47] Ao Li, Zhou Qin, Runshi Liu, Yiqun Yang, and Dong Li. Spam review detection with graph convolutional networks. In Proceedings of the ACM international conference information and knowledge management, pages 2703-2711, 2019.
[48] Yanling Wang, Jing Zhang, Shasha Guo, Hongzhi Yin, Cuiping Li, and Hong Chen. Decoupling representation learning and classification for gan-based anomaly detection. In Proceedings of the internationnal ACM SIGIR conference on research and development information retrieval, pages 1239-122400 1248, 2021.
[49] Enyan Dai, Charu Aggarwal, and Suhang Wang. Nrgnn: Learning a label noise resistant graph neural network sparsely and noisily labeled graphs. In Proceedings of the ACM SIGKDD conference on knowledge discovery & data mining, pages 227-236, 2021.
[50] Jingyang Yuan, Xiao Luo, Yifang Qin, Yusheng Zhao, Wei Ju, and Ming Zhang. Learning on graphs under label noise. In IEEE international conference on acoustics, speech and signal processing, pages 1-5, 2023.
12

---

A Appendix
A.1 Detailed Dataset Construction
Existing fraud datasets are typically anonymized, which obscures the specific meanings of entities and consequently hinders interpretability analysis. Moreover, emerging internet fraud is rapidly evolving and widespread with concealed tactics, and research on internet fraud detection remains limited. Considering these gaps, we construct G-Internet, the first benchmark dataset for internet fraud detection, featuring a transparent structure. Due to privacy restrictions, real-world data is not available. Therefore, we synthesize the dataset through simulation. We meticulously consider a range of key factors, including fraud rules, the physical meanings. construction, and diversity of user and website node features, the behavioral differences between anomalous and benign users in terms of website visits, and the interconnections among users. In overview, G-Internet contains 5 51268 user nodes, 109387 website nodes, 1572836 edges of the "user visits website" (or equivalently, "website visited by user") relation, and 399456 edges of the "user to user" relation.
Fraud rules. Types of internet fraud are varied, and the user behaviors regarding website visits exhibit specific patterns within each type. To more accurately simulate anomalous activities, we have designed 12 common rules as shown in Table 5 & 6, which are based on real cases and account for the diversity and complexity of user behaviors. Using the "pig-butchering scam" as an example, we establish the following rule: within a specified time frame, a user who downloads APKs more than twice, accesses blacklisted IPs and domains more than once each, and visits banking websites more than three times can be identified as having fallen into the trap of ipig-butchering scam".
Table Types of fraud and their rules.
Type of fraud
Rule
Pig-butchering seam
8>2 && (>1 & 1 && 7>3
Brushing scam
(a>2 || B>2) & 7>2
Phishing seam
((>1 [-11|7>11 c>5) 7>2
Credit repair scam
A>1 && (a>1 x>|) y
Loan scam
0>5 &&
&& <>2
Investment scarn
(1 (5>3 K>3) && 7>2
Game trading scam
<>3 52 (a>2 | 8>2)
Hookup seam
(e> 1 (25 & 853 7>2
Honeytrap scam
(<>5 & 8>3 && y>2
Online gambling scam
<> 1 && (>5 & 1/5 && 7>2
Escort scam
6>3 & (> && 7> & 7>1
Nude chat scam
1 && R> && 5>5
Table 6: Mcanings of each code in fraud rules.
Code
Meaning
Number of times user visits zoom-like like (online meeting) websites in fixed time period
Number of times user visits like (customer service) websites in fixed time period Number of times user visits banking wehsites in fixed time period
6
Number of times user downloads APKs in fixed time period
Number of times user visits gambling websites in a fixed time period
C
Number of times user visits blacklisted IPs a fixed time period Number of times user visits blacklisted domains in a fixed time period
7
0
Number of times user visits loan websites in fixed time period Number of times user visits gaming websites fixed time period Number of times user visits niche chat websites fixed time period Number of times user visits credit repair websites in fixed time period
X
User nodes. A total of attributes have been generated for users, including age, gender, city, level. number of login times within fixed time period, average login time, device, operating system, and active time periods. For instance, the age distribution often differs between benign and anomalous users. Based on existing references, we determine the age distribution for each user category and sample the age accordingly when constructing the attribute. Similar procedures are applied to the other attributes. Since our primary focus is to detect fraud based on the behavior of users visiting websites rather than on the users' inherent characteristics, we intentionally minimize the distinction between benign and anomalous users when constructing user attributes. Then, the user feature is
13

---

obtained through binary (0/1) encoding applied to each attribute. The dimension after binary encoding 106. Additionally, we randomly mask some user attributes to increase the challenge.
Website nodes. The types of websites are diverse. In total, we have included 11 types of fraud-related websites and 27 types of normal websites in the dataset. The 11 types of fraud-related websites include zoom-like (online meeting), meiqia-like (customer service), banking, APKs, gambling, blacklisted IPs, blacklisted domains, loan, gaming, niche chat, and credit repair. The 27 types of normal websites include news, information, wikipedia, e-commerce, social media, blogs & personal, enterprise, education, forums& & community, entertainment, government & non-profit, travel & food, image sharing, video, content sharing, art & design, technology & product review, travel guide, charity, community service platform, university official website, job search, real estate agency, real estate information platform, sports & fitness, flight & hotel booking, and financial management. Collecting and annotating a vast number of websites requires long-term investment. Due to the simulation nature of the dataset, we simplify the process by employing large language models (LLMs) to generate keywords for each website (except for websites on sensitive topics like gambling, pornography, etc., for which we collect keywords manually), then generate the website description based on the selected keywords, and finally use the BERT model to encode the description as the website feature, whose dimension is 768. To make the dimension match those of the user feature and to increase the difficulty, we only take the first 106 elements of the original website feature. Additionally, we randomly mask some elements in the website feature to increase the challenge.
"User visits website" relation. For an anomalous user, randomly select one of the designed fraud rules and generate connections between the user and websites that meet the rule. Anomalous users may also visit a large number of normal websites while visiting the websites involved the fraud rules. These connections are also taken into account and randomly generated. For benign users, they visit more normal websites, but they may also visit fraud-related websites as long as they do not meet any of the fraud rules.
"User to user" relation. There may be relations between users, such as phone calls or other interactions. Since our primary focus is to detect fraud based on the behavior of users visiting websites rather than on the connections between users, we both benign users and anomalous users to maintain a closer connection with benign users, so as to minimize the difference in communication behaviors between these two types of users.
In summary, the constructed G-Internet aligns with practical situations and has a clear and transparent structure. This interpretable dataset facilitates the demonstration of the interpretable GPA method ($3), which in turn enables the interpretable association analysis of fraud-related entities ($5.4).
A.2 Detailed Dataset Descriptions
In addition to the constructed internet fraud dataset, G-Internet, this paper adopts another five commonly used datasets from three typical fraud scenarios ceenaris-ffinnce, social networks, and online reviews-to evaluate the proposed method. These datasets include Elliptic [40]. T-Finance [13],
T-Social [13], YelpChi [41], and Amazon [42].
G-Internet has been thoroughly detailed in $A.1. The dataset is partitioned into training, validation, and testing sets with proportions of 40.00%, 20.00%, and 40.00%, respectively.
Elliptic [40] is derived from real-world Bitcoin transaction network. It is graph-structured dataset where nodes represent Bitcoin transactions and edges denote transaction flows. Transactions are categorized as legal, illegal, or unknown, encompassing entities such as exchanges, miners, and activitics. Each node is associated with 93 features. Elliptic is particularly valuable for blockchain security and financial fraud detection, enabling the identification of illegal activities like money laundering. The dataset is split into training, validation, and testing sets with proportions of 45.86%, 18.34%, and 35,80% respectively, based on transaction timestamps as per official recommendations.
T-Finance [13] focuses on detecting anomalous accounts in financial transaction networks. Nodes represent anonymous accounts characterized by 10-dimensional features related to registration dura- tion, logging activities, and interaction frequencies. the graph, edges signify account transactions, while anomalous nodes (e.g., money laundering, online gambling, etc.) are labeled by experts. The dataset partitioned into training, validation, and testing sets with proportions of 40.00% 20.00%. and 40.00%, respectively.
14

---

T-Social [13] is tailored for identifying anomalous accounts in social networks. It shares the same feature annotations as T-Finance. Two nodes are connected if they maintain a friendship for over three months. T-Social is characterized by its impressive scale, comprising 5.78 million nodes and 1.5 billion edges. This sheer volume of data poses significant computational challenge. The dataset is partitioned into training, validation, and testing sets with proportions of 40.00% 20.00% and 40.00%, respectively.
YelpChi [41] is a behavioral graph dataset built from Yelp (a major U.S. review platform, which boasts a substantial customer base and significant social influence). It incorporates individual and graph-structured features stored in sparse matrix form, encompassing businesses, reviews, and user information. YelpChi widely used in financial risk management and anti-money laundering research. The dataset is partitioned into training, validation, and testing sets with proportions of 40.00%, 20.00% and 40.00% respectively.
Amazon [42] is large-scale e-commerce dataset provided by Amazon. Much like YelpChi, encompasses vast array of product metadata along with user-generated reviews. The dataset includes product reviews under the Musical Instruments category. with users and reviews as nodes. Amazon frequently used for fraud detection validation. The dataset partitioned into training, validation, and testing sets with proportions of 40.00%, 20.00%, and 40.00% respectively.
A.3 Model Settings
The model settings for each dataset are shown Table 7. n_path (/) denotes the number initially sampled paths, k_path (K) denotes the number of selected top-K paths, Lpath (J) denotes the maximum length of the path, d_path (C) denotes the dimension path encoding, and __attn and head denote the number of attention layers and attention heads, respectively.
Table 7:
Model settings for each dataset.
Dataset
p_path (T)
k_path (K)
Lpath (J)
d_path (C)
n_altn
n_head
Interrnet
200
128
2
Elliptic
100
100
256
2
T-Finance
200
150
128
2
T-Social
200
100
30
64
2
8
YelpChi
200
200
20
256
2
8
Amuzon
60
20
64
2
1
A.4 Evaluation Metries
Considering the significant class imbalance between positíve and negative samples in fraud datasets, it is essential to use evaluation metrics that account for both Precision and Recall. This study employs Area Under the Curve (AUC) and Average Precision (AP) as key performance metrics.
AUC (%) generally refers to AUC-ROC (Area Under the Receiver Operating Characteristic Curve). The ROC curve illustrates the trade-off between the true positive rate and the false positive rate across different classification thresholds.
AP (%) is derived from the Precision- Recall (P-R) curve, which plots Precision against Recall as the classification threshold varies. AP reflects the area under the P-R curve, representing the model's average precision over all thresholds.
Fraud datasets are often highly imbalanced, with anomalous (positive) samples being significantly fewer than benign (negative) samples. As result, models tend to achieve high recall for benign samples, potentially leading to an overly optimistic AUC score. The P-R curve, the other hand, better reflects the model's ability to identify anomalous samples, as false negatives significantly impact the AP score. Therefore, AP offers more reliable metric for assessing model performance in identifying rare but critical anomalous samples within imbalanced datasets.
Additionally, we provide two extra metrics: Recall@K K (%) and F1-Score (%). Recall K [4] is determined by the recall of true positives (anomalous samples) within the top-K highest-confidence predictions from the model, where the value of K is set as the number of anomalous samples in the test dataset. F1 -core represents the harmonic mean of Precision and Recall, offering a balanced assessment. Model performance comparison on these two metrics is shown in Table 8.
15

---

Table 8: Model performance comparison on Recall K (%) and Fl FI-Score (%) metrics.
Dutaset
G-Intemett
Elliptic
T-Finance
T-Social
YelpChi
Amazon
Metric
R@K
R@ K
F1
R@K
F1
R@ K
F1
R@K
F1
R@K
F1
GAT
58.6
77.6
37.9
79.8
64.9
42.1
63.4
44.2
57.1
70.5
BWGNN
64.1
77.7
42.5
59.2
84.2
89.1
75.8
85.3
56.7
76.6
85.9
91.5
PC-GNN
26.3
56.4
43.8
62.9
79.1
58.2
73.5
48.6
43.8
63.7
85.3
89.9
GPA
93.4
96.5
69.9
81.7
84,5
92.2
90.3
95.4
68.2
79.0
86.1
92.3
A.5
Hyperparameter Impact Analysis
This section explores the impact of various hyperparameters on the proposed GPA model, including the number of sampled paths and average path length in variable-length path sampling, the dimension of path embedding and number of behavior features in semantic- associated path encoding, and the number of attention layers and attention heads in path interaction and aggregation. Figure illustrates the impact of these hyperparameters on G-Internet.
Experimental results indicate that, in variable-length path sampling, increasing the number of sampled paths allows the model interact with more paths, helping detect a broader range of fraudulent patterns, thus improving common pattern mining. However, this also raises computational costs. As the average path length increases, the model performance rises first and then drops. This may be because shorter paths can only achieve low-order pattern interactions and fail to capture more complex associations, while too-long paths may lead to information redundancy, and the longer the path, the more severe the information loss after path encoding. In semantic-associater path encoding, increasing both the dimension of path embedding and the number of behavior features enhances the model's knowledge base, leading to improved performance. Regarding path interaction and aggregation, the model performance improves as the number attention layers increases. Unlike traditional GNNs such GCN and GAT, increasing the number of attention layers in the proposed GPA will not cause "over-smoothing" that has negative effects. Additionally, as the number of attention heads increases, the model performance improves and gradually reaches saturation, and an excessive number of attention heads will impose computational burden.
100
100
100
200
100
250
30
30
32
256
1.0
391
98
413
96
94
92
92
90
Number sampled paths
Avenge path length
Dimension of path embedding
100
100
100
92
96
AUC
AP
AUC
AP
ALCC
AP
Number of behavior features
Number of oftettctionn layers
Number of attention heads
Figure Impact of the hyperparameters of the proposed GPA on G-Internet.
16

---

A.6 Necessity of Mining Long-Range Associations
Fraudulent activities often form implicit patterns through long-rann Long-range associations. For example:
User A visits website X, but determining whether X is anomalous requires further analysis of whether other users visiting X (such user B) exhibit anomalous behavior, and user B's anomalous behavior may be reflected in the website Y he visits, thus forming a multi-hop association chain. Although the "user visits website" relation in the dataset appears one-to-one relationship, the long-range association "A "A-X->B ---- can better help accurately determine whether user is anomalous.
From the graph in Figure I, we can observe the following rules through long-range analysis:
(I) Fraud-related websites are mainly visited by anomalous users. (2) Websites frequently visited by anomalous users are not necessarily related to fraud, as they are also frequently visited by benign users.
Therefore, mining long-range associations is of great necessity for interpretable fraud detection.
A.7 Computational Costs
We measure the model's running time. For training, we record the average time taken by the model to process batch of data (including forward pass, backward pass, and gradient descent). For inference, we record the average time taken by the model to process a batch of data (forward pass only). The dataset used is G-Intennet The model settings used for measuring running time are kept the same as those in the main paper. All experiments use batch size of 1024 and are conducted on a single 10.
NVIDIA GeForce RTX 3090 GPU. The results are presented in Table
The proposed method is faster in both training and inference than many mainstream fraud detectors. Due to pytorch's low-level optimizations, the time required for path interaction does not increase significantly even if the number of paths grows a lot. The main computational overhead of the proposed method actually stems from path encoding, followed by path sampling and path interaction.
Table 9: Computational costs comparison.
Method
CARE-GNN
GDN
GPA
Training time / batch
821.5ms 688.3ms
340.3ms
95.4ms
Inference time batch
119.3ms
25.4ms
Table 10:
Computational costs for each component of the proposed GPA.
GPA
Path Sampling
Path Encoding
Path Interaction
Path Aggregation
Fraud Detection
Total
Inference time / batch
8.73
14.025ms
2.502ms
0.034ms
0.1 10ms
25.402ms
A.8 Limitation and Discussion
The limitation of our work lies in the simulated nature of the constructed G-Internet dataset. This is in fact constrained by data privacy policies. Initially, to establish this benchmark dataset, we consulted our collaborating institutions. Due to privacy restrictions, they were unable to provide real-world data directly. However, they did share several empirical fraud rules (as presented in Table 5 & 6). based on which we constructed the "user visits website" relation. Additionally, "user to user" connections (such phone calls) are also actively utilized evidence in rule- base-baeddde fraud detection by our collaborating authorities. Therefore, we integrated these two relation types into the fraud detection system, with their distributions being freely adjustable accommodate various world fraud scenarios. Anyway, based on existing fraud rules, we have made every effort to construct a dataset that is both close to reality and adjustable different fraud scenarios, fully leveraging its advantages. Moving forward, we remain committed to continuous improvement and refinement.
A.9 Societal Impacts
This study strengthens the prevention and governance of various fraudulent activities across scenarios including the internet, finance, social networks, online reviews, etc., helping safeguard public welfare, promote social harmony and stability, and foster the healthy development of the digital economy.
17

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: "Abstract" & $1 "Introduction"
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: $A.8 - "Limitation and Discussion"
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "L "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
18

---

Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: $3 "Methodology" $5 "Experimental Study" $A.3 "Model Settings" & The source code provided & The constructed dataset provided
Guidelines:
The answer NA means that the paper does include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
19

---

reproducible, they Answer: [Yes]
Justification:
The source code has been provided.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please the NeurlPS code and data submission guidelines (ttps://nips.ccppubiieguu
dess/CodeSubmmissiooolliie for more details.
While encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g.. for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines httppubbe/gguidee/ooeeuuuuiiiiee
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: $5 "Exxerimental Study Experimental settings" & $5 "Experrrimental Study Datasets" & $A.2 "Detailed Dataset Descriptions" & $A.3 "Model Settings" $A.5
"Hyperparameter Impact Analysis" & $A.7 "Computational Costs"
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer:
[NA]
Justification:
The numerical results are the average under 10 different random seeds.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
20

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: $A.7 - "Compuutaataio Costs"
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http:///wwppp..ooooolllc/ttcccns
Answer: [Yes]
Justification: The research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
$A.9 "Societal Impacts"
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
21

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The source code provided & The citations in the paper
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use the package should be provided. For popular datasets, paperswitheode, httpssiithcddcccomttttteee has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
22

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
The source code provided
Guidelines:
The answer NA means that the paper does not release new assets,
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
23

---

16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Answer: [Yes]
Justification: $A.1 - "Detailed Dataset Construction Website nodes"
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy https///eeuris.cccccmmmeeeeeeess for what should or should not be described.
24


Reviews:
[{"review_id": "3qg2p1dngh", "reviewer": "Reviewer_AGHk", "summary": "This paper proposes a novel method called Graph Path Aggregation (GPA) to overcome the “receptive field” limitations commonly observed in existing GNN-based fraud detection models. GPA samples variable-length paths from each user node, encodes these paths by incorporating behavioral features, and leverages self-attention mechanisms to model interactions among paths, thereby capturing long-range structural associations. The aggregated path-level information is then used to predict whether a user is fraudulent or benign. Additionally, the authors introduce G-Internet, a new benchmark dataset specifically designed for internet fraud detection. Through extensive experiments across multiple domains—including finance, online reviews, and social networks—the proposed method demonstrates up to 15% improvement in Average Precision (AP) compared to existing approaches.", "questions": "1.\tThe G-Internet dataset is simulation-based and may not fully capture the dynamic and evolving patterns of real-world fraud. Do the authors have any plans to validate the model on real datasets or to collaborate with external partners for real-world evaluation?\n\t2.\tFor datasets where the maximum path length is limited to 5 (e.g., Elliptic or T-Finance), it is unclear whether GPA captures fundamentally different information compared to standard GNNs like GCN or GraphSAGE. Do the authors have plans to provide more experimental evidence to support the distinctiveness of GPA under such settings?\n\t3.\tGiven the computational complexity of GPA—including path sampling, behavior encoding, and attention-based interactions—it would be helpful to include an analysis of time and space complexity. Can the authors provide further discussion on the scalability of GPA to large-scale graphs (e.g., with tens of millions of nodes)?\n\t4.\tIn fraud detection tasks, Recall is often more critical than Precision. Beyond Average Precision (AP), could the authors also report metrics such as Recall@K or F1-score to more comprehensively demonstrate the effectiveness of GPA?", "limitations": "The authors have not adequately addressed the limitations or potential negative societal impacts of their work. The paper lacks discussion on key limitations such as the limited realism of the simulation-based G-Internet dataset, risks of overfitting to predefined fraud patterns, computational scalability, and the narrow scope of evaluation metrics. Moreover, it does not consider potential societal consequences, including deployment risks in high-stakes settings, the possibility of reinforcing biases through behavior-based features, and the dangers of premature adoption due to overclaimed performance.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\t•\tNovel path-based approach: Unlike conventional GNNs that primarily rely on 1-hop neighbor information, the proposed GPA method captures long-range structural dependencies by aggregating path-level information combined with behavioral features. This represents a significant modeling innovation.\n\t•\tStrong performance and robustness: GPA consistently outperforms existing methods across multiple domains. Notably, it maintains a high AP of 83.8% even under 80% label noise, demonstrating strong robustness to noisy annotations.\n\t•\tInterpretability contribution: The analysis of attention maps (Figures 2 and 3) reveals that the model assigns higher attention weights to fraud-related paths, offering a visually intuitive explanation that aligns well with domain knowledge and enhances interpretability.\n\t•\tContribution of the G-Internet dataset: Existing fraud detection datasets are often anonymized, making interpretability difficult. G-Internet, constructed based on well-defined fraud rules, provides a transparent, interpretable benchmark that facilitates the evaluation of association-focused detection methods.\n\nWeaknesses:\n\t•\tLimitations of G-Internet as a simulation-based dataset: Since G-Internet is synthetically generated based on 12 predefined rules rather than real-world data, there is a risk that the model may overfit to these handcrafted patterns. As such, it may fail to generalize to the complexity and evolving nature of actual fraud behavior.\n\t•\tLimited path lengths in certain datasets: Although the paper emphasizes capturing long-range dependencies, the maximum path length is only 5 in some datasets (e.g., Elliptic, T-Finance). This narrow scope may weaken the claim of capturing truly long-range associations and reduce the distinctiveness compared to traditional GNNs.\n\t•\tLack of computational complexity and scalability analysis: The GPA framework involves intensive operations such as path sampling, behavior feature construction, and attention-based interaction. However, the paper does not provide an analysis of computational complexity (e.g., O-notation) or discuss the scalability of the approach to large-scale graphs.\n\t•\tDisparity in baseline performance: In Table 2, many baseline models perform extremely poorly on G-Internet, while GPA achieves substantially higher scores. This raises concerns that the dataset might be tailored to favor the proposed method.\n\t•\tLimited evaluation metrics: In fraud detection, Recall is often more critical than Precision. However, the paper evaluates performance using only AUC and Average Precision (AP). Including metrics like Recall or F1-score would provide a more comprehensive and practically relevant evaluation.", "was_revised": true, "final_justification": "The authors have provided satisfactory responses to my questions overall. In particular, I appreciate the inclusion of Recall and F1-score metrics, which are important in fraud detection tasks and show strong results in this case. I believe this addition strengthens the paper. I had previously assigned a positive rating, and based on the rebuttal, I do not find any compelling reasons to either raise or lower it. Therefore, I will maintain my current rating.", "rebuttal": "> **W1: (a)** Limitations of G-Internet as a simulation-based dataset: Since G-Internet is synthetically generated based on 12 predefined rules rather than real-world data, there is a risk that the model may overfit to these handcrafted patterns. As such, it may fail to generalize to the complexity and evolving nature of actual fraud behavior.\n>\n> **Q1: (b)** The G-Internet dataset is simulation-based and may not fully capture the dynamic and evolving patterns of real-world fraud. **(c)** Do the authors have any plans to validate the model on real datasets or to collaborate with external partners for real-world evaluation?\n\nWe appreciate the reviewer for raising these points.\n\n**(a)** In fact, the 12 empirical fraud rules used to construct the G-Internet dataset were not predefined based on our imagination but **were patterns already extracted by our collaborating institutions from real-world data**. As we mentioned in the \"Limitation and Discussion\" section, due to privacy restrictions, our collaborating institutions were unable to provide real-world data **directly**, so they gave us these 12 empirical fraud rules, and we reversely constructed the actual data based on these rules. In other words, we adopted an **indirect** approach to obtain real-world data, which was a helpless way to **circumvent privacy restrictions**. During the process of reverse-engineering the dataset through real-world rules, we have added substantial details and tried our very best to restore the real world.\n\n**(b)** The dataset can support the dynamic expansion of fraud rules and custom noise injection to simulate the evolution characteristics of fraudulent activities. Since existing public graph fraud datasets are all static, to maintain consistency in the research, the experimental analysis in this paper is conducted under static data scenarios as well.\n\nGPA consistently outperforms baselines on the five other real-world datasets (Elliptic, T-Finance, T-Social, Yelpchi, and Amazon), particularly achieving a +9.2% improvement in AP on the T-Social dataset, which has demonstrated its transferability to real-world patterns.\n\n**(c)** Yes, in the near future, I will be doing an internship at a collaborating institution, where I will have access to real-world data and can conduct validation. I am very much looking forward to it.\n\n&nbsp;\n\n> **Q2/W2:** For datasets where the maximum path length is limited to 5 (e.g., Elliptic or T-Finance), it is unclear whether GPA captures fundamentally different information compared to standard GNNs like GCN or GraphSAGE. Do the authors have plans to provide more experimental evidence to support the distinctiveness of GPA under such settings?\n\nWe appreciate your insightful comment. The selection of path length should be tailored to the specific fraud scenario, as certain fraud patterns may be more effectively captured through shorter paths. Using path interaction and aggregation can effectively preserve the original structural information, whereas the aggregation mechanisms of standard GNNs (such as GCN or GraphSAGE) are to fuse node information, potentially leading to the loss of structural fraud information (i.e., the over-smoothing).\n\nFurthermore, the core differences between our method and standard GNNs are as follows: First, standard GNNs only aggregate information from one-hop neighbors, which differs from our higher-order path-based approach. Second, standard GNNs' aggregation process lacks interaction between neighboring nodes, with weight allocation based solely on the nodes' own features. In contrast, our GPA method, through path interaction, can produce interpretable clustering-like effects (please refer to the visual results in Fig. 2, Sec. 5.4). In future work, we will further validate this through additional visualization analysis.\n\n&nbsp;\n\n> **Q3/W3:** Computational complexity and scalability to large-scale graphs.\n\nYour constructive feedback is much appreciated. These suggestions present important opportunities for us to refine and strengthen our work.\n\n###  ***Computational complexity***\n\nTheoretically, the time complexity and space complexity of path sampling, path encoding, and path interaction are as follows:\n\n||Path Sampling|Path Encoding|Path Interaction|\n|-|-|-|-|\n|Time Complexity|$O(n)$|$O(n)$|$O(n^2d)$|\n|Space Complexity|$O(n)$|$O(n)$|$O(n^2+nd)$|\n\nwhere $n$ denotes the number of nodes/paths and $d$ denotes the dimension of path embedding.\n\nIn practice, **due to pytorch's low-level optimizations, the time required for path interaction does not increase significantly even if the number of paths grows a lot.** The average inference time taken by the model to process a batch of data from G-Internet is as follows:\n\n|GPA|Path Sampling|Path Encoding|Path Interaction|Path Aggregation|Fraud Detection|Total|\n|-|-|-|-|-|-|-|\n|Inference time per batch|8.731ms|14.025ms|2.502ms|0.034ms|0.110ms|25.402ms|\n\nWe have also measured the model's running time. For training, we record the average time taken by the model to process a batch of data (including forward pass, backward pass, and gradient descent). For inference, we record the average time taken by the model to process a batch of data (forward pass only). The dataset used is G-Internet. The model settings used for measuring running time are kept the same as those in the main paper. All experiments use a batch size of 1024 and are conducted on a single NVIDIA GeForce RTX 3090 GPU. The results are as follows:\n\n|G-Internet|CARE-GNN|GDN|GPA|\n|-|-|-|-|\n|Training time per batch|821.5ms|340.3ms|95.4ms|\n|Inference time per batch|688.3ms|119.3ms|25.4ms|\n\n###  ***Scalability to large-scale graphs***\n\nThe proposed GPA can easily handle large-scale graphs. In each iteration, a subset of nodes is first sampled, and then several paths are sampled with these nodes as centers. This means that each iteration does not require the entire graph as input and instead only a small portion of the graph is extracted for processing, similar to the concept of **minibatch** or **subgraph sampling**, resulting in low GPU memory usage. The processes of path sampling, encoding, interaction, and aggregation are fast. We tested the model's running time on the large-scale graph fraud dataset T-Social (containing 5.78 million nodes and 146 million edges) using the same configuration as the aforementioned test on the G-Internet dataset, and obtained the following results, which further demonstrate the scalability of GPA to large-scale graphs.\n\n|T-Social|CARE-GNN|GDN|GPA|\n|-|-|-|-|\n|Training time per batch|601.4ms|164.2ms|50.8ms|\n|Inference time per batch|189.6ms|30.5ms|8.2ms|\n\n&nbsp;\n> **Q4/W5:** Additional metrics (Recall@K and F1-Score).\n\nThank you for your constructive suggestion. Here, we report the Recall@K and F1-Score metrics across all datasets. The results indicate that our proposed GPA achieves excellent performance on these metrics compared to baseline models.\n\n|Dataset|G-Internet||Elliptic||T-Finance||T-Social||YelpChi||Amazon||\n|-|-|-|-|-|-|-|-|-|-|-|-|-|\n|Metric|Recall@K|F1-Score|Recall@K|F1-Score|Recall@K|F1-Score|Recall@K|F1-Score|Recall@K|F1-Score|Recall@K|F1-Score|\n|GAT|58.6|77.6|37.9|57.3|79.8|64.9|42.1|63.4|44.2|57.1|82.6|70.5|\n|BWGNN|64.1|77.7|42.5|59.2|84.2|89.1|75.8|85.3|56.7|76.6|85.9|91.5|\n|PC-GNN|26.3|56.4|43.8|62.9|79.1|58.2|73.5|48.6|43.8|63.7|85.3|89.9|\n|GPA|**93.4**|**96.5**|**69.9**|**81.7**|**84.5**|**92.2**|**90.3**|**95.4**|**68.2**|**79.0**|**86.1**|**92.3**|\n\n&nbsp;\n> **W4:** Disparity in baseline performance: In Table 2, many baseline models perform extremely poorly on G-Internet, while GPA achieves substantially higher scores. This raises concerns that the dataset might be tailored to favor the proposed method.\n\nWe sincerely regret any confusion caused. The issue is that existing benchmarks such as T-Social, T-Finance, and Elliptic are mostly homogeneous graphs with simple types of nodes and edges/relations, but in the real world, fraud graph structures are highly heterogeneous, with complex types of nodes and edges/relations. **Thus, our newly constructed G-Internet is not tailored to favor the proposed method, but to favor the real world.**\n\nConsequently, existing baselines performing extremely poorly on our constructed G-Internet dataset is because G-Internet exhibits high heterogeneity (diverse node types and edge types), whose challenge far exceeds that of other datasets. In contrast, datasets such as T-Social, T-Finance, and Elliptic are all structurally homogeneous graphs, thus they are simpler and easier to be trained by other baseline models.\n\nWe hope our explanation can address your concerns.\n\n&nbsp;\n> **L1:** The authors have not adequately addressed the limitations or potential negative societal impacts of their work. The paper lacks discussion on key limitations such as the limited realism of the simulation-based G-Internet dataset, risks of overfitting to predefined fraud patterns, computational scalability, and the narrow scope of evaluation metrics. Moreover, it does not consider potential societal consequences, including deployment risks in high-stakes settings, the possibility of reinforcing biases through behavior-based features, and the dangers of premature adoption due to overclaimed performance.\n\nMany thanks for these helpful suggestions. Regarding the first few points you mentioned, we have touched upon them in our responses to the previous questions, which you can refer to. Regarding your final point about potential societal consequences, we have strengthened our discussion on this issue:\n\nWhile GPA enhances fraud detection across high-stakes domains, we acknowledge deployment risks and emphasize that real-world implementation requires rigorous safeguards (such as combining manual review to avoid fully automated decision-making) against potential biases. In addition, our performance claims are grounded in multi-scenario benchmarks, and we will provide more rigorous performance claims in the revised version."}, {"review_id": "UqGRcN0h1U", "reviewer": "Reviewer_nY14", "summary": "The paper presents a graph-based path sampling and aggregation algorithm to detect fraudulent entities online. The authors argue that path sampling is necessary to capture long-range structural dependencies between entities and unveil fraud patterns. A new dataset is also proposed to simulate the online fraud pattern. Experiments on various datasets demonstrate that the proposed method is better than baselines.", "questions": "- What is the longest path that the GPA is encoded in the G-Internet dataset?\n- Does GPA distinguish between behavior feature and node feature in datasets other than G-Internet?\n- According to Table 4, the behavior feature plays a very critical role in boosting fraud detection performance. I am wondering if other baselines also use the behavior feature as part of the node feature?", "limitations": "- The Sec. 3 should be generalizable to all graph fraud datasets instead of G-Internet only\n- The dataset introduction in Sec. 4 is confusing; I need to read the Appendix to fully understand the dataset construction process\n- I appreciate the author's effort in building a new fraud dataset simulating real-world fraud patterns, but the near-perfect performance makes the dataset almost useless", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n\n- Path sampling and aggregation is a legitimate solution for graph-based fraud detection, and it is more flexible than GNNs\n- The dataset and baseline selection are comprehensive\n- Interpretability analysis demonstrates the advantage of the proposed GPA method\n\nWeaknesses\n\n- The newly curated dataset is poorly described. GPA's AUC already hitting 99.8% leaves no improvement space for follow-up work\n- The definitions and equations in Sec. 3 are introduced based on the proposed Internet Fraud dataset, while GPA has been tested on five other datasets as well. It's unclear how GPA generalizes to those graph datasets that do not have the same node/edge types and features", "was_revised": true, "final_justification": "The authors' rebuttal and final remark explain most of my concerns.\n\nIn terms of the contribution of the curated datasets, the authors explain how the dataset facilitates the validation of the proposed method, which makes sense to me. I persist that the new dataset may not be used as a benchmark for fraud detection since its performance is saturated, but the way the authors built the graphs and the subsequent analysis have their merit.\n\nConsidering all the factors above, I've updated my rating to borderline accept to reflect changes.", "rebuttal": "> **W1: (a)** The newly curated dataset is poorly described. **(b)** GPA's AUC already hitting 99.8% leaves no improvement space for follow-up work.\n\nWe sincerely apologize for any confusion caused.\n\n**(a)** The most essential details have been provided in Appendix A.1 \"Detailed Dataset Construction\". Since the dataset construction process is intricate, it is not possible to show all of them in the paper. We appreciate your understanding. All original materials and source code used for dataset construction are preserved by us and will be made public after the paper is published.\n\n**(b)** It is important to emphasize that the core purpose of the constructed G-Internet dataset is to **facilitate interpretable association analysis (as highlighted in the paper's Line 10-11, 54-56, 67-68, etc.)**, whose value is far beyond the detection accuracy. Existing fraud datasets are anonymized, obscuring entity semantics and hindering the analysis of model interpretability. Therefore, we constructed G-Internet as a transparent benchmark, whose nodes (users/websites) and edges (user visits websites / user to user) carry clear real-world semantics, enabling path-level analysis of fraudulent patterns. For example, attention maps in Fig. 2 exposing path-level reasoning explains how the proposed method flags fraud.\n\nIt is also worth noting that **the difficulty of the constructed dataset can be adjusted** by modifying the noise ratio (see Table 3, the dataset's performance can be arbitrarily adjusted by the noise ratio), positive/negative ratio, etc. The results presented in this work are based on one specific configuration. Upon paper's publication, we will release all construction materials and source code, **enabling follow-up studies to freely modify these settings for different experimental scenarios.**\n\nMoreover, the high performance (AUC 99.8, AP 97.6) of our GPA method is achieved under circumstances where the baseline models perform poorly. The poor performance of baseline models indicates the challenges of our constructed dataset, yet our method excels in addressing these challenges. Our method also achieves near-perfect results on larger public benchmarks like T-Social (AUC 99.6, AP 96.0), highlighting its robustness and generalizability.\n\nWe sincerely hope these explanations will help you better assess the contribution of our work.\n\n&nbsp;\n\n> **W2:** The definitions and equations in Sec. 3 are introduced based on the proposed Internet Fraud dataset, while GPA has been tested on five other datasets as well. It's unclear how GPA generalizes to those graph datasets that do not have the same node/edge types and features.\n\nWe are sincerely sorry for the confusion. The proposed GPA method is generally applicable to all graph fraud datasets in the paper.\n\nSince other datasets are anonymized with node/edge/relation types unknown, we could not introduce our path-based method from an interpretable view. For this purpose, we specifically constructed the G-Internet dataset with transparent data and structure as a demonstration carrier for our method. This design aims to help readers more intuitively understand the methodology (as we explained in Line 121-123). **But actually, the method pipeline in Sec. 3 is designed for general graph structures, which means it is also applicable to those graph datasets that do not have the same node/edge types and features.** Our approach, to some extent, \"homogenizes\" heterogeneous graphs, adopting a unified processing paradigm for different node/edge types and features. Additionally, it is worth noting that under the overall framework of path interaction and aggregation, the specific implementations of each module can be flexible since the diversity of graph data necessitates case-by-case analysis.\n\n**_Below, we elaborate on how the proposed GPA adapts to all graph fraud datasets:_**\n\n**Path Sampling:** When sampling paths via random walk, only the ID sequences of the nodes and connected edges need to be recorded. These nodes and edges can be of any type and have nothing to do with specific semantic information.\n\n**Path Encoding:** Essentially, this involves combining the features of nodes and edges (if any) along the path. For datasets with known node/edge meanings, they can be processed similarly to G-Internet. If there are other special physical meanings in nodes/edges, custom processing can be applied. Since the other five anonymized datasets cannot provide sufficient node/edge meanings, we took an approximate alternative approach, as we explained in the paper:\n\n>> Line 159-160: For other datasets with the meaning of relations/events unknown, just simply concatenate the node features along the path ...\n\nFor behavior feature design, different datasets may adopt different approaches according to their own conditions. There is no fixed standard, as we explained in the paper:\n\n>> Line 173-174: For different scenarios, unique behavior feature can be designed on a case-by-case basis.\n\nFor the other five anonymized datasets with unclear node/edge meanings, we designed specific behavior features for them. For details, please refer to our response to **Q2** below.\n\n**Path Interaction and Aggregation & Fraud Detection:** All paths are uniformly encoded into fixed-length vectors, so the processing flow is identical across datasets.\n\nWe hope our explanations can adequately address your concerns.\n\n&nbsp;\n\n> **Q1:** What is the longest path that the GPA is encoded in the G-Internet dataset?\n\nThank you for your comment. Theoretically, GPA can encode paths of unlimited length (Eq. (3)(4)). However, too-long paths may lead to information redundancy and information loss after path encoding.\n\n&nbsp;\n\n> **Q2:** Does GPA distinguish between behavior feature and node feature in datasets other than G-Internet?\n\nWe are glad to clarify this aspect of work. Yes, GPA also distinguishes between behavior feature and node feature in datasets other than G-Internet. The behavior feature is a highly customizable part, as we explained in the paper:\n\n>> Line 173-174: For different scenarios, unique behavior feature can be designed on a case-by-case basis.\n\nHowever, the other five datasets used in the paper are anonymized, making it impossible to discern the specific meanings of entities. Therefore, we could only assume all nodes were of the same type and adopted a unified approach: introducing decision tree binning encoding, which used decision trees to split attribute values into exclusive bins, using the bin index as discretized features. It then derived relative relations between a node's attribute and its neighbors to characterize behavior features.\n\nExperiments on T-Social confirm that the behavior feature designed for anonymized datasets remains effective.\n\n|T-Social|AUC|AP|\n|-|-|-|\n|w/o behav. feat.|99.0|91.1|\n|w/ behav. feat.|**99.6**|**96.0**|\n\n&nbsp;\n\n> **Q3:** According to Table 4, the behavior feature plays a very critical role in boosting fraud detection performance. I am wondering if other baselines also use the behavior feature as part of the node feature?\n\nThank you for your insightful comment. No, the baseline models do not incorporate behavior feature as part of their node feature. The design and integration of behavior feature constitute a **novel contribution** of our method.\n\nExisting baselines primarily focus on refining the aggregation mechanisms for neighbor nodes, while our designed behavior features capture environmental properties of nodes, which are different to the nodes' inherent attributes. This environmental context remains unexplored in prior works.\n\nWe also validate the applicability of the designed behavior feature on other fraud detectors as follows, which shows that on G-Internet and T-Social, behavior features provide modest performance gains but are far from dominant. Furthermore, ablation study (Table 4 in the paper) confirms that GPA's performance primarily comes from its path-level interaction for fraudulent pattern uncovering, while behavior features only serve as auxiliary enhancements.\n\n|G-Internet||CARE-GNN|PC-GNN|GDN|GPA|\n|-|-|-|-|-|-|\n|w/o behav. feat.|AUC|70.2|79.6|90.7|**99.3**|\n||AP|15.5|22.4|45.7|**90.4**|\n|w/ behav. feat.|AUC|72.4|83.4|92.9|**99.8**|\n||AP|18.6|36.9|54.8|**97.6**|\n\n|T-Social||CARE-GNN|PC-GNN|GDN|GPA|\n|-|-|-|-|-|-|\n|w/o behav. feat.|AUC|78.3|96.9|88.4|**99.0**|\n||AP|41.2|80.3|52.3|**91.1**|\n|w/ behav. feat.|AUC|78.9|97.1|89.5|**99.6**|\n||AP|43.8|81.5|55.6|**96.0**|\n\n&nbsp;\n\n> **L1:** The Sec. 3 should be generalizable to all graph fraud datasets instead of G-Internet only.\n\nWe apologize again for the confusion. Sec. 3 is generally applicable to all graph fraud datasets in the paper.\n\nPlease refer to our response to **W2** above.\n\n&nbsp;\n\n> **L2:** The dataset introduction in Sec. 4 is confusing; I need to read the Appendix to fully understand the dataset construction process.\n\nWe sincerely apologize for the confusion. Due to space constraints, we had to provide only an overview of the dataset construction process in the main text (Sec. 4) and place the detailed construction process in Appendix A.1. As the dataset construction involves an extensive amount of detail, we deeply appreciate your time in reviewing the Appendix and regret any inconvenience caused by this structural limitation.\n\n&nbsp;\n> **L3:** I appreciate the author's effort in building a new fraud dataset simulating real-world fraud patterns, but the near-perfect performance makes the dataset almost useless.\n\nWe apologize again for the confusion. The core purpose of the constructed G-Internet dataset is to **facilitate interpretable association analysis (as highlighted in the paper's Line 10-11, 54-56, 67-68, etc.)**, whose value is far beyond the detection accuracy.\n\nPlease refer to our response to **W1 (b)** above.\n\n&nbsp;\n\nFinally, thank you once again for your meticulous review. If you have any other unclear parts, we welcome your corrections and look forward to more discussions with you!"}, {"review_id": "jR0dk7FLiI", "reviewer": "Reviewer_Q88F", "summary": "This paper introduces a novel fraud detection method called Graph Path Aggregation (GPA), which addresses the limitations of existing graph-based fraud detectors by capturing long-range structural associations between entities. The authors propose a framework that includes variable-length path sampling, behavior-associated path encoding, path interaction, and aggregation-enhanced fraud detection. Additionally, they synthesize G-Internet, the first benchmark dataset for internet fraud detection, to facilitate interpretable association analysis. Experiments across multiple fraud scenarios demonstrate that GPA outperforms mainstream methods by up to +15% in Average Precision (AP) and exhibits robustness to noisy labels.", "questions": "1)\tG-Internet is synthetic. How do you plan to validate GPA on real-world data, given privacy constraints? Could you simulate noise/artifacts to better mimic real data?\n2)\tPath sampling/interaction seems expensive, especially for large graphs like T-Social. How does GPA scale compared to baselines (e.g., training time per batch)?\n3)\tThe paper notes that very long paths hurt performance due to \"information redundancy\" What is the optimal range, and how is it determined? Is there a theoretical justification?\n4)\tHow does GPA fundamentally differ from PathNet or RAW-GNN, which also use paths?", "limitations": "Yes, the authors discuss limitations (e.g., synthetic data, privacy constraints) in Appendix A.9.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1)\tThe methodology is well-designed, with clear steps from path sampling to fraud detection. The ablation study and robustness tests (e.g., noisy labels) are thorough.\n2)\tThe paper is well-structured, with detailed descriptions of each component (e.g., path encoding, interaction). Figures and tables effectively support the narrative.\n3)\tFraud detection is a critical problem, and the proposed method addresses key challenges (e.g., long-range dependencies, interpretability).\n4)\tThe focus on path-level associations and the integration of behavior features are novel. The approach diverges from traditional GNNs by emphasizing global patterns.\n\nWeaknesses:\n1)\tThe G-Internet dataset is synthetic, which may limit the generalizability of results. Real-world validation is missing.\n2)\tWhile GPA performs well, the computational cost of path sampling/interaction is not deeply analyzed. Scalability for very large graphs (e.g., T-Social) is unclear.\n3)\tThe paper could better differentiate GPA from prior path-based GNNs (e.g., PathNet) and justify the need for variable-length paths.", "was_revised": true, "final_justification": "Based on the authors' rebuttal and discussion, I keep the previous score unchanged.", "rebuttal": "> **W1: (a)** The G-Internet dataset is synthetic, which may limit the generalizability of results. Real-world validation is missing.\n>\n> **Q1:** G-Internet is synthetic. **(b)** How do you plan to validate GPA on real-world data, given privacy constraints? **(c)** Could you simulate noise/artifacts to better mimic real data?\n\nThank you for your valuable comments. These are important considerations for our work.\n\n**(a)** The other five datasets used in the paper (Elliptic, T-Finance, T-Social, Yelpchi, and Amazon) are real-world datasets, on which GPA consistently outperforms baselines, particularly achieving a +9.2% improvement in AP for T-Social, which has demonstrated its transferability to real-world patterns.\n\n**(b)** In the near future, I will be doing an internship at a collaborating institution, where I will have access to real-world data and can conduct validation. I am very much looking forward to it.\n\n**(c)** Yes. In fact, we have added substantial details that simulate noise/artifacts to better mimic real data, including but not limited to:\n\n- We randomly mask some user attributes to increase the challenge.\n\n- We randomly mask some elements in the website feature to increase the challenge.\n\n- Anomalous users may also visit a large number of normal websites while visiting the websites involved in the fraud rules. \n\n- For benign users, they visit more normal websites, but they may also visit fraud-related websites.\n\n- A large number of benign users satisfy the majority of the conditions in at least one fraud rule.\n\nWe have also made a very detailed division of the distribution of user attributes. All original materials and source code used for dataset construction are preserved by us and will be made public after the paper is published.\n\n&nbsp;\n\n> **W2:** While GPA performs well, the computational cost of path sampling/interaction is not deeply analyzed. Scalability for very large graphs (e.g., T-Social) is unclear.\n>\n> **Q2:** Path sampling/interaction seems expensive, especially for large graphs like T-Social. How does GPA scale compared to baselines (e.g., training time per batch)?\n\nWe sincerely appreciate your insightful feedback.\n\n###  ***Computational costs***\n\nTheoretically, the time complexity and space complexity of path sampling, path encoding, and path interaction are as follows:\n\n||Path Sampling|Path Encoding|Path Interaction|\n|-|-|-|-|\n|Time Complexity|$O(n)$|$O(n)$|$O(n^2d)$|\n|Space Complexity|$O(n)$|$O(n)$|$O(n^2+nd)$|\n\nwhere $n$ denotes the number of nodes/paths and $d$ denotes the dimension of path embedding.\n\nIn practice, **due to pytorch's low-level optimizations, the time required for path interaction does not increase significantly even if the number of paths grows a lot.** The average inference time taken by the model to process a batch of data from G-Internet and T-Social is as follows:\n\n|GPA||Path Sampling|Path Encoding|Path Interaction|Path Aggregation|Fraud Detection|Total|\n|-|-|-|-|-|-|-|-|\n|G-Internet|Inference time per batch|8.731ms|14.025ms|2.502ms|0.034ms|0.110ms|25.402ms|\n|T-Social|Inference time per batch|4.345ms|1.974ms|1.745ms|0.019ms|0.079ms|8.162ms|\n\nFor G-Internet, the main computational overhead of the proposed method stems from path encoding, followed by path sampling and path interaction. For T-Social, the main computational overhead of the proposed method stems from path sampling, followed by path encoding and path interaction. This difference is primarily due to the different approaches to path encoding. G-Internet encodes path based on atomic events (Eq. (5)), whereas the other five anonymous datasets adopt a simpler alternative approach (Lines 159-160) due to the lack of node and edge information, resulting in lower time consumption during the path encoding phase. Overall, both path sampling and path encoding are fast, while path interaction and path aggregation are even faster.\n\nThe overall efficiency of the proposed GPA can also be demonstrated through comparisons with other baselines. We have also measured the model's running time. For training, we record the average time taken by the model to process a batch of data (including forward pass, backward pass, and gradient descent). For inference, we record the average time taken by the model to process a batch of data (forward pass only). The dataset used is G-Internet. The model settings used for measuring running time are kept the same as those in the main paper. All experiments use a batch size of 1024 and are conducted on a single NVIDIA GeForce RTX 3090 GPU. The results are as follows:\n\n|G-Internet|CARE-GNN|GDN|GPA|\n|-|-|-|-|\n|Training time per batch|821.5ms|340.3ms|95.4ms|\n|Inference time per batch|688.3ms|119.3ms|25.4ms|\n\n###  ***Scalability for very large graphs (e.g., T-Social)***\n\nThe proposed GPA can easily handle large-scale graphs. In each iteration, a subset of nodes is first sampled, and then several paths are sampled with these nodes as centers. This means that each iteration does not require the entire graph as input and instead only a small portion of the graph is extracted for processing, similar to the concept of **minibatch** or **subgraph sampling**, resulting in low GPU memory usage. The processes of path sampling, encoding, interaction, and aggregation are fast. We tested the model's running time on the large-scale graph fraud dataset T-Social (containing 5.78 million nodes and 146 million edges) using the same configuration as the aforementioned test on the G-Internet dataset, and obtained the following results, which further demonstrate the scalability of GPA to large-scale graphs.\n\n|T-Social|CARE-GNN|GDN|GPA|\n|-|-|-|-|\n|Training time per batch|601.4ms|164.2ms|50.8ms|\n|Inference time per batch|189.6ms|30.5ms|8.2ms|\n\n&nbsp;\n\n> **Q3:** The paper notes that very long paths hurt performance due to \"information redundancy\" What is the optimal range, and how is it determined? Is there a theoretical justification?\n\nThank you for your insightful comment. The optimal range of path length depends on specific fraud scenarios. For complex fraud scenarios, longer paths would help extract more comprehensive fraudulent patterns, while for simpler fraud cases, shorter paths would be more advantageous. Currently, as the complex nature of fraud graphs makes theoretical derivation challenging, we approach the determination of optimal path length as a hyperparameter optimization problem. However, we consistently observe that excessively long paths inevitably have negative effects, so we hypothesize that this is due to information redundancy. The longer the path, the more severe the information loss after path encoding.\n\n&nbsp;\n\n> **W3:** The paper could better differentiate GPA from prior path-based GNNs (e.g., PathNet) and justify the need for variable-length paths.\n>\n> **Q4:** How does GPA fundamentally differ from PathNet or RAW-GNN, which also use paths?\n\nThank you for your constructive suggestion. Although PathNet and RAW-GNN also use paths in their frameworks, their primary objective is to address the heterophily issue in graphs, where traditional GNNs' neighbor aggregation mechanisms may inappropriately mix information between heterogeneous nodes—unlike our GPA method, which is designed to address the long-range dependency issue of fraudulent entities in graphs. Thus, our proposed GPA fundamentally differs from PathNet or RAW-GNN from the very starting point. Moreover, PathNet and RAW-GNN typically only utilize short paths of 2–7 hops and do not involve path interactions, indicating that they still operate within the framework of \"models with local perception\".\n\nOur GPA method leverages paths to address the long-range dependency issue of fraudulent entities in graphs, where traditional GNNs with only \"local perception\" lack a global perspective on high-order, complex, sparse, yet concealed fraudulent patterns. Besides, our approach can also unveil hidden fraudulent patterns across a broader scope.\n\nOn the need for variable-length paths: Variable-length paths are essential because real-world fraud patterns exhibit diverse structural spans. Fixed-length paths either truncate critical long-range associations or introduce noise from irrelevant nodes in shorter fraud scenarios. Our variable-length sampling adapts to this heterogeneity by dynamically capturing paths of contextually relevant lengths. As demonstrated by the ablation study in Section 5.3, variable-length paths can yield performance improvements, highlighting their critical value."}, {"review_id": "GHZ1CxjUxt", "reviewer": "Reviewer_AdLw", "summary": "This paper addresses the challenges of high-order interactions, intricate dependencies, and the sparsity of fraudulent entities in graph-based fraud detection. The authors point out that existing mainstream fraud detectors suffer from narrow receptive fields, focusing mainly on local neighborhoods and neglecting long-range structural associations. To address these limitations, the paper proposes a novel Graph Path Aggregation (GPA) method that leverages variable-length path sampling, behavior-associated path encoding, path interaction, and aggregation for enhanced fraud detection. Experimental results demonstrate that GPA significantly outperforms mainstream methods, shows superior robustness to noisy labels, and offers stronger interpretability. Additionally, the authors introduce G-Internet, a new synthetic benchmark dataset designed to facilitate research on interpretable fraud detection.", "questions": "1. I am concerned about the dataset construction. While defining anomalous behavior via fixed rules is understandable, it is unclear how the simulated anomalies compare to real-world fraudulent activities. The authors should clarify the representativeness and limitations of the synthetic behaviors.\n2. The paper mentions using an LLM to generate keywords for each website, which essentially acts as pseudo-labeling. The reliability of LLM-generated pseudo-labels should be discussed, and their potential impact on downstream performance should be evaluated.\n3. More details about the dataset are necessary. For example, the distribution of user attributes, typical behavioral examples for individual users, and more case studies of both normal and anomalous instances would greatly help the community assess the dataset quality and method effectiveness.\n4. The reported metrics (especially AP) are sensitive to class imbalance, yet only mean values are presented. The paper lacks standard deviations, confidence intervals, or statistical significance analysis.", "limitations": "The paper does not analyze the boundary conditions under which the proposed method works or fails. I recommend that the authors explicitly discuss the assumptions, potential failure cases, and the method’s robustness to violations of key assumptions.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths：\n1.  The proposed approach utilizes variable-length path sampling, behavior-associated path encoding, path interaction, and aggregation-enhanced fraud detection, resulting in a much larger receptive field compared to conventional methods.\n2. The method demonstrates stronger robustness to noisy labels, as evidenced by experiments.\n3. The model provides excellent interpretability, allowing for a better understanding of the detected fraudulent patterns.\n4. The introduction of the G-Internet synthetic dataset is a valuable contribution to the community, enabling further research and benchmarking in interpretable fraud detection.\n\nWeakness：\n1. The construction of the synthetic dataset is not sufficiently justified. It remains unclear how well the fixed-rule simulated anomalies reflect real-world fraudulent behaviors, raising concerns about the real-world applicability and generalizability of the results.\n2. The reliance on LLM-generated pseudo-labels for website attributes introduces potential noise and bias. The paper does not assess the reliability of these pseudo-labels or their possible effects on model performance.\n3. The dataset lacks transparency: key details such as user attribute distributions, representative behavioral patterns, and concrete case studies (for both normal and anomalous users) are missing, limiting the ability of the community to fully evaluate the data quality and the scope of the results.\n4.  The evaluation lacks statistical rigor. Given the class imbalance, reporting only mean values (e.g., AP) without standard deviations, confidence intervals, or significance testing makes it difficult to judge the robustness and reproducibility of the reported gains.\n5. The manuscript does not provide an analysis of the boundary conditions for the proposed method.", "was_revised": true, "final_justification": "The authors have provided satisfactory responses to my questions, particularly regarding the motivation behind dataset construction and the discussion on boundary conditions. As I have already given positive feedback in the previous discussion, I choose to maintain my original score.", "rebuttal": "> **W1:** The construction of the synthetic dataset is not sufficiently justified. It remains unclear how well the fixed-rule simulated anomalies reflect real-world fraudulent behaviors, raising concerns about the real-world applicability and generalizability of the results.\n>\n> **Q1:** I am concerned about the dataset construction. While defining anomalous behavior via fixed rules is understandable, it is unclear how the simulated anomalies compare to real-world fraudulent activities. The authors should clarify the representativeness and limitations of the synthetic behaviors.\n\nWe sincerely appreciate your valuable feedback.\n\nIn fact, the 12 empirical fraud rules used to construct the G-Internet dataset were not from our imagination but **were patterns already extracted by our collaborating institutions from real-world data**. As we mentioned in the \"Limitation and Discussion\" section, due to privacy restrictions, our collaborating institutions were unable to provide real-world data **directly**, so they gave us these 12 empirical fraud rules, and we reversely constructed the actual data based on these rules. In other words, we adopted an **indirect** approach to obtain real-world data, which was a helpless way to **circumvent privacy restrictions**. During the process of reverse-engineering the dataset through real-world rules, we have added substantial details and tried our very best to restore the real world.\n\nBesides, the proposed GPA consistently outperforms baselines on the five other real-world datasets (Elliptic, T-Finance, T-Social, YelpChi, and Amazon), particularly achieving a +9.2% improvement in AP on the T-Social dataset, which has demonstrated its transferability to real-world patterns.\n\nWe hope our explanation can address any doubts or concerns you may have. If necessary, we are more than willing to provide further elaboration.\n\n&nbsp;\n\n> **W2:** The reliance on LLM-generated pseudo-labels for website attributes introduces potential noise and bias. The paper does not assess the reliability of these pseudo-labels or their possible effects on model performance.\n>\n> **Q2:** The paper mentions using an LLM to generate keywords for each website, which essentially acts as pseudo-labeling. **(a)** The reliability of LLM-generated pseudo-labels should be discussed, **(b)** and their potential impact on downstream performance should be evaluated.\n\nYour constructive feedback is much appreciated.\n\n**(a)** Regarding the reliability of LLM-generated pseudo-labels: \n\nIn constructing the G-Internet dataset, website keywords generated by LLMs are primarily used to simulate annotation information that is difficult to obtain in real-world scenarios. Their reliability depends on the strong representational capability of LLMs in capturing semantic associations. Although LLM-generated content carries some degree of uncertainty, we mitigate potential risks through the following measures:\n\n- **Manual rule constraints:** Keyword generation is strictly limited to predefined website categories like banking, gambling, etc., to avoid semantic drift caused by open-domain generation.\n\n- **Posterior verification:** Manually sampling and reviewing generated keywords to ensure consistency with the website category. For example, when sampling from the keyword library of the \"APK download\" website, strongly associated words such as \"installation package\" and \"cracked version\" are deemed reliable words. This design essentially follows common practices in simulation-based datasets, where the goal is not to pursue perfect annotations but to construct a structured benchmark that can be flexibly adjusted.\n\n**(b)** Regarding the pseudo-labels' potential impact on downstream performance: \n\nFirstly, it is worth noting that we allow for the presence of noise (i.e., some unreliable or mislabelled keywords), as it is also inevitable in real-world data. \n\nFurthermore, we conducted an in-depth analysis of how noise in LLM-generated features affects downstream performance:\n\n- **Noise sensitivity test on website labels:** Randomly alter some website labels to simulate noise from incorrect website keywords. The impact of noisy website labels on model performance under different noise ratios is as follows. It can be observed that, under the current dataset conditions, adding noise to website labels has a greater effect on downstream performance as the noise ratio increases. This indirectly indicates that the constructed dataset contains relatively low levels of noise. The marginal effect of the noise magnitude in website labels on downstream performance also suggests that the method possesses a certain degree of noise resistance.\n\n|Noise Ratio||Current|Current+20%|Current+40%|Current+80%|\n|-|-|-|-|-|-|\n|GAT|AUC|94.2|87.2|88.6|84.7|\n||AP|57.9|36.7|33.0|30.7|\n|BWGNN|AUC|95.8|92.3|92.4|92.1|\n||AP|72.7|57.2|47.7|45.6|\n|GPA|AUC|99.8|98.0|95.2|94.8|\n||AP|97.6|82.2|65.3|61.3|\n\n- **Noise sensitivity test on user labels:** As evidenced in Table 3 of the paper, we have specifically validated GPA's robustness against user label noise, where it significantly outperforms baseline methods under both asymmetric and symmetric noise conditions.\n- **Cross-dataset generalization validation:** As shown in Table 2, GPA outperforms significantly across multiple real-world datasets (Elliptic, T-Finance, T-Social, Yelpchi, and Amazon), demonstrating that the model's core capabilities are independent of the specific characteristics of G-Internet.\n\nThe combination of rigorous experimental validation and targeted bias mitigation strategies helps ensure that LLM-generated attributes do not compromise GPA's reliability or performance. We appreciate the reviewer for highlighting this important discussion and will further clarify these points in the revised version.\n\n&nbsp;\n\n> **W3:** The dataset lacks transparency: key details such as user attribute distributions, representative behavioral patterns, and concrete case studies (for both normal and anomalous users) are missing, limiting the ability of the community to fully evaluate the data quality and the scope of the results.\n>\n> **Q3:** More details about the dataset are necessary. For example, the distribution of user attributes, typical behavioral examples for individual users, and more case studies of both normal and anomalous instances would greatly help the community assess the dataset quality and method effectiveness.\n\nWe sincerely appreciate your valuable feedback. The most essential details have been provided in Appendix A.1 \"Detailed Dataset Construction\". Since the details in the dataset construction process are numerous and intricate, it is not possible to show all of them in the paper. We appreciate your understanding.\n\nAll original materials and source code used for dataset construction are preserved by us and will be made public after the paper is published.\n\n&nbsp;\n\n> **W4:** The evaluation lacks statistical rigor. Given the class imbalance, reporting only mean values (e.g., AP) without standard deviations, confidence intervals, or significance testing makes it difficult to judge the robustness and reproducibility of the reported gains.\n>\n> **Q4:** The reported metrics (especially AP) are sensitive to class imbalance, yet only mean values are presented. The paper lacks standard deviations, confidence intervals, or statistical significance analysis.\n\nThank you for your constructive suggestion. Here, we report the numerical results (mean ± std) for GPA across all datasets, demonstrating its robust numerical stability.\n\n|Dataset|G-Internet||Elliptic||T-Finance||T-Social||YelpChi||Amazon||\n|-|-|-|-|-|-|-|-|-|-|-|-|-|\n|Metric|AUC|AP|AUC|AP|AUC|AP|AUC|AP|AUC|AP|AUC|AP|\n|GPA|99.8±0.04|97.6±0.26|91.1±0.54|75.5±0.59|97.2±0.07|89.6±0.13|99.6±0.02|96.0±0.15|91.9±0.18|73.6±0.47|98.1±0.06|92.4±0.12|\n\nWe will include the numerical results with standard deviations in the revised version.\n\n&nbsp;\n\n> **W5:** The manuscript does not provide an analysis of the boundary conditions for the proposed method.\n>\n> **L1:** The paper does not analyze the boundary conditions under which the proposed method works or fails. I recommend that the authors explicitly discuss the assumptions, potential failure cases, and the method’s robustness to violations of key assumptions.\n\nWe greatly value these constructive suggestions. Your perspective highlights several critical considerations that we should address in our ongoing work.\n\nThe proposed GPA method is designed to detect fraud by leveraging long-range structural associations, and its effectiveness relies on the assumption that fraudulent patterns can be captured through path-based interactions. Potential failure cases may arise when fraudulent behaviors lack discernible path-level patterns or when the graph structure is overly noisy, obscuring meaningful associations. Additionally, the method assumes that the sampled paths are representative of the underlying fraud mechanisms. If this condition is violated, such as due to insufficient path diversity or biased sampling, performance may degrade. To enhance robustness, future work could explore adaptive sampling strategies and incorporate mechanisms to handle highly noisy or sparse graphs.\n\nOn further analysis of boundary conditions, we will include a dedicated discussion in the revised manuscript to address these points. This will include an examination of scenarios where the method might underperform, such as when fraudulent entities exhibit minimal connectivity or when the graph lacks sufficient labeled data for training. We believe this addition will provide readers with a clearer understanding of the method’s limitations and practical applicability. \n\nThank you once again for your insightful suggestion!"}]

Author rebuttal:

Meta-review: The proposed Graph Path Aggregation (GPA) model exploits variable-length path sampling, behavior-associated path encoding, path interaction and aggregation, and aggregation-enhanced fraud detection for overcoming the limitation of narrow receptive fields in existing fraud detection methods. Additionally, the G-Internet dataset was constructed to support interpretable analysis of fraudulent behaviors in the field of internet fraud detection. Reviewers gave positive scores on this work in their final reviews and acknowledged its model design, novel ideas, and performance. During the rebuttal and discussion, the authors provided additional clarifications/explanations and additional experiments, which should be incorporated into the final version of the manuscript (e.g., motivation of the new dataset, additional metrics, computational complexity/costs, noise sensitivity tests, etc.).
Decision: Accept (poster)