Graphs Analytics for Fraud Detection
By: Saurav Chakravorty
Tags: Fraud Detection, Artificial Intelligence, Graph

Photo by Ariel Besagar on Unsplash

A Fraud Detection System (FDS) based on supervised learning techniques will not be able to track novel fraudsters. A solution consisting of an ensemble of both supervised and unsupervised techniques will ensure that the FDS is capable of preventing both common fraud patterns and novel ones.

Unsupervised techniques in fraud detection are typically a variant of Anomaly Detection. A Graph-Based approach is very promising in its ability to detect anomalies by connected data analysis.

Graphs are a useful abstraction of the financial domain. The nodes represent entities whereas the edges encode relationships including transactions. Graphs provide a natural way to understand links between entities. Graphs have significant advantages over other techniques for anomaly detection due to the following reasons [1].

Entities of interest are related and dependent. Encoding that relation is important for FDS application. Graphs naturally represent relations between nodes as edges and that allows for a richer representation of information.

Inter-relation of anomalies themselves. For example, an individual who was perpetuated an opportunistic fraud is likely to tell her friends (related entities on a graph) about it and they are likely to do the same.

Graphs are more robust to adversarial attacks. Graphs represent long term correlations that are tougher to mimic even by advanced fraudsters.

An example of such a graph is shown below.

Image Credit PGQL

There any multiple approaches for anomaly detection on Graphs. A few commonly used are Structure-based methods (egonet [2]), community-based methods (Autopart [3]), and relationship learning-based methods (relational dependency networks [4]).

Though promising the above approached does not scale on large graphs due to the problem of sparsity. For example, a graph of all entities in a realistic financial system will have millions of sparsely connected nodes. Even with modern graph databases, the time complexity of these methods is too high for a real-time fraud detection system.

To overcome the challenge of sparsity, and yet retain the advantages of a graph representation new approaches such as Network Representation Learning (NRL) are gaining popularity [7]. In this approach, a graph embedding is used to learn a latent representation of the vertices on a large-scale network. These representations are then used in downstream anomaly detection or classification task. Node2vec [5] is one such approach that allows “mapping of nodes to a low-dimensional space of features that maximizes the likelihood of preserving network neighborhoods of nodes.”

Consider the following image. The diagram of the left represents a graph of interconnected accounts and transactions. The image on the left denotes a mapping of this graph on a 2-dimensional space. The transformation attempts to preserve the most important advantages of the graph and yet make the graph accessible to ML algorithms. NRL are unsupervised algorithms and thus have major advantages in practical financial networks by removing the need for human supervision.

Image Credit DeepWalk [6]

Graph Neural Networks for Anomaly detection

GraphSAGE, an opensource project from Stanford, is a deep neural network-based NRL toolkit. This toolkit is implemented in Tensorflow making this the ideal platform to develop an anomaly detection system for FDS.

GraphSAGE can be used to develop an embedding for each node in the entity transaction graph. This is equivalent to the Node2Vec approach as described above. Once this embedding is available these new features are used to predict anomalies using standard anomaly detection techniques such as an Isolation Forest [8].

[1]: https://www.andrew.cmu.edu/user/lakoglu/pubs/14-dami-graphanomalysurvey.pdf

[2]: https://www.cs.cmu.edu/~abeutel/ccs2015_tutorial/slides/010Subgraph.pdf

[3]: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.130.841&rep=rep1&type=pdf

[4]: https://arxiv.org/abs/1410.7835

[5]: https://cs.stanford.edu/~jure/pubs/node2vec-kdd16.pdf

[6]: https://arxiv.org/pdf/1403.6652.pdf

[7]: http://snap.stanford.edu/proj/embeddings-www/

[8]: https://towardsdatascience.com/outlier-detection-with-isolation-forest-3d190448d45e