Fraud Detection with Graph Analytics
By: Lina Faik
Tags: Network, Data Science, Fraud, Clustering, Editors Pick

Fraud Detection with Graph Analytics

Cracking a data science problem might seem today as easy as child’s play with all the powerful machine learning algorithms that are available today. When correctly adjusted and trained, these algorithms are able to efficiently extract key features from the data, learn common patterns, and eventually provide accurate predictions.

But what happens when the problem is less about the number and more about the network?

Typically in banking, detecting shell companies that hide fraudulent financial transactions is difficult to achieve when relying only on transaction amounts or other characteristics. However, the transaction path is crucial information that the model could leverage to boost its performance. Similarly, in healthcare, detecting fraud is difficult as it involves peers of providers, physicians, beneficiaries acting together to provide fake claims.

In this situation, what are the options left?

Faced with this type of problem, one is generally torn between two imperatives: performance and interpretability.

Performance: Using Graph Neural Networks (GNNs) models or their variants such as Graph Convolutional Networks (GCN), Graph Attention Network (GAT), graphs can yield outstanding results. Why? The main reason is their ability to represent graph nodes, edges, or subgraphs by vectors and learn from them . [1] However, they can lead to overly complex and poorly interpretable models.

Using models or their variants such as Graph Convolutional Networks (GCN), Graph Attention Network (GAT), graphs can yield outstanding results. Why? The main reason is their . [1] However, they can lead to overly complex and poorly interpretable models. Interpretability: Obtaining interpretable models can be achieved by choosing among a set of Machine Learning algorithms but sometimes at the expense of performance.

Fortunately, there is another alternative: combining Machine Learning and Graph Analytics.

The approach consists of representing the problem in its graphical form, computing the network features, and using this information to enrich the dataset from which the ML algorithm learns. Hence, this approach has the potential to boost the model performance without compromising the imperative of interpretability.

The goal of this article is to explain and illustrate this approach through a concrete use case: fraud detection in the healthcare sector.

After reading this article, you will learn:

How to visualize your data graphically and compute graph key features How to perform graph clustering on your data? How to leverage these features to boost your model performance?

1. Dataset Enrichment

1.1. About the Dataset

What does the data consist of?

The dataset comes from Medicare and consists of claims filed by the providers as well as information about the beneficiary for every claim.

More specifically, it contains information:

about the claim: start and end dates, status, physicians involved (provider, attending physician, operating physician), diagnosis, etc.

about the patient: age, gender, location, health conditions, etc.

More information about the dataset is available here [2].

The goal is to predict whether a claim is fraudulent or not.

What fraud cases are we hoping to detect?

They are mainly 4 fraud use cases that are usually predominant in the healthcare sector:

Billing a service not actually provided Duplicating a claim for the same service Misrepresenting the service provide Charging a more expensive service than actually provided

These use cases, and more especially the 3 first ones, are difficult to detect when using only the available information on the claim, the diagnosis, or the patient.

However, the place of the provider in the network of physicians brings valuable information. For instance:

a practitioner who charges for services not actually provided will tend to have a higher number of claims, hence representing a central node strongly linked to the other nodes.

a physician who duplicates claims will tend to have a significant number of claims with the same operating and attending physicians, hence representing a node strongly linked to the same nodes, etc.

1.2. How to Go From a Table to a Graph?

The first step is to explore data by representing it graphically and visualizing it.

But first, what is a graph composed of? A graph essentially consists of:

Nodes (or vertex): they represent entities in the data. In our case, they can represent physicians or patients for instance. Edges: they symbolize a link between entities, and can be weighted according to a certain criterion.

Fig 1 — Graph components, illustration by the author

In the rest of the article, the graph will consist of nodes representing the physicians, and edges representing claims.

Transforming the dataset into a graph can be easily achieved using the library Networkx [3], as described in the example below.

The visualization of the graph can be done using the library Plotly [4]. An example of the code can be found here.

Fig 2— Graph exploration, image by the author

1.3. What Useful Information can be Extracted from the Graph?

Once the dataset has been transformed into a graph, what information can we get from it? There is a wide range of metrics that can be computed for each node representing physicians. Given our use case, we will focus only on 4: degree of the node, closeness centrality coefficient, eigenvector centrality, and PageRank. They mainly capture how central and influential a node is in the graph.

Degree

It represents the number of edges that are incident to the vertex

Closeness Centrality

As its name suggests, closeness centrality measures how close and central a node is to other nodes. For a given node u, it represents the reciprocal of the sum of the shortest path distances from u to all n-1 other nodes, as described in the formula below:

where d(u,v) is the shortest-path distance between v and u and n is the number of nodes in the graph.

To illustrate the concept behind this metric, let’s take a simple example:

Fig 3— Closeness centrality, illustration by the author

Eigenvector Centrality

The eigenvector centrality captures the centrality for a node based on the centrality of its neighbors. This means that a node with a high score is a node that is connected to other influential nodes with high scores as well.

What does it consist of? Mathematically, it is computed as follows. For a given graph G(V,E) with |V| vertices A be the adjacency matrix, i.e. a ᵤᵥ =1 if vertex u is linked to vertex v, 0 otherwise.

The relative centrality x for the vertex v can be defined as:

which can be rewritten in vector notation as the eigenvector equation: Ax = λx. The vth component of x gives the relative centrality score of the vertex v in the network.

More information about the score and its computation can be found here [6].

PageRank

Concerning the PageRank score, it relies on the normalized eigenvector centrality or normalized prestige p.

What does it consist of? It is computed using the normalized adjacency matrix N which is defined as:

where od(u) is the out-degree of node u.

The normalized eigenvector prestige score p(v) of a node v is computed by resolving the following equation:

More information can be found here [6].

How does the PageRank compare to the eigenvector centrality? As both metrics measure the centrality of the node using the centrality of their neighbors, let’s explore the results on 2 concrete examples.