ApexFi — Hybrid Fraud Detection Models
Two independent hybrid fraud-detection models — LightGBM (tabular) + GraphSAGE (graph neural network) combined through a learned logistic regression stacking layer — trained on two structurally different real-world proxy datasets, as part of an M.Tech project on cross-channel fraud detection for India's UPI/IMPS digital payment ecosystem.
Framing note: actual large-scale UPI/IMPS transaction data isn't publicly available. These models are trained on real, publicly available proxy datasets (IEEE-CIS, DGraph-Fin) to build and validate the technical architecture for the real target problem — they are not literal UPI/IMPS transaction models, and this is not claimed otherwise.
Full project (web app, data pipeline, source code): https://github.com/KarthickRamAlagar/apexfi-fraud-graph
Why two separate models
IEEE-CIS (transaction-level) and DGraph-Fin (account/network-level) have no genuine shared identity or join key between them — combining them into one graph would mean inventing a connection that isn't real. Each dataset is trained and validated independently, using the same hybrid architecture applied to two different real-world structures.
Files in this repository
ieee_cis/
├── lightgbm_model.txt # trained LightGBM booster
├── gnn_model.pt # trained GraphSAGE checkpoint
├── stacking_meta.pkl # logistic regression stacker
└── preprocessing_artifacts.pkl # frequency tables, categorical
# encoders, neighbor-lookup index —
# required for scoring genuinely new,
# unseen transactions correctly
dgraph_fin/
├── lightgbm_model.txt
├── gnn_model.pt
└── stacking_meta.pkl
predict_example.py # minimal, runnable loading/inference example
Real, validated results
Both models were validated using a fixed, stratified 70/15/15 train/validation/test split, repeated across 3 random seeds, with mean ± standard deviation reported. (This is not k-fold cross- validation — the split itself is fixed; only the model's own training randomness varies across seeds.)
IEEE-CIS (590,540 transactions, 3.499% real fraud rate)
| Model | Precision | Recall | F1 | ROC-AUC |
|---|---|---|---|---|
| LightGBM alone | 0.825 ± 0.005 | 0.768 ± 0.001 | 0.796 ± 0.002 | 0.973 ± 0.000 |
| GraphSAGE alone | 0.466 | 0.522 | 0.492 | 0.892 |
| Stacked (best) | 0.878 ± 0.002 | 0.731 ± 0.001 | 0.798 ± 0.001 | 0.974 ± 0.000 |
Learned stacking weight: ~19:1 favoring LightGBM — tabular features dominate on this dataset; the graph contributes a real but small correction.
DGraph-Fin (3,700,550 accounts, 1.265% real fraud rate of the labeled subset)
| Model | Precision | Recall | F1 | ROC-AUC |
|---|---|---|---|---|
| LightGBM alone | 0.992 ± 0.009 | 0.524 ± 0.000 | 0.686 ± 0.002 | 0.938 ± 0.000 |
| GraphSAGE alone | 1.000 | 0.524 | 0.688 | 0.916 |
| Stacked (best) | 0.995 ± 0.005 | 0.524 ± 0.000 | 0.687 ± 0.001 | 0.938 ± 0.001 |
Learned stacking weight: nearly balanced — unlike IEEE-CIS, the graph and tabular signals are genuinely complementary here.
Research finding worth highlighting: graph information is not universally superior to tabular information — its real, measured value depends on the underlying structure of the specific dataset.
Honest limitations — read before citing these numbers
- IEEE-CIS vs. Kaggle competition results: this model's ROC-AUC (0.9736) is higher than the top Kaggle competition solution's best individual model (0.9408, private leaderboard) — but this evaluation used a random/stratified split, while Kaggle's private test set may have used a temporal split (a harder, more realistic evaluation). Not a fully apples-to-apples comparison.
- DGraph-Fin is not comparable to published academic graph-anomaly- detection benchmarks (e.g., GADBench reports ~66.9% ROC-AUC for current specialized methods). Those benchmarks deliberately test a much harder, low-label scenario (as few as 100 labeled examples total, regardless of dataset size). This model is trained under full supervision (857,920 real labeled training examples) — a different, not-comparable task, closer to the realistic scenario where an institution has substantial labeled history.
- These models do not learn from new input. Every prediction uses these same, fixed model files — nothing about a new prediction updates them. This is intentional, production-oriented design (avoiding the real risk of a single bad or adversarial input corrupting future predictions), not a limitation to work around.
- IEEE-CIS's anonymized
V1-V339columns cannot be supplied for a genuinely new transaction (their real-world meaning is undocumented, even by the dataset's own publishers) — predictions for a new transaction whose real risk signal lives mostly in those columns will show an expected, honest gap from what a full-feature retrospective lookup would show. - IEEE-CIS and DGraph-Fin are real-world proxy datasets, not literal UPI/IMPS data. They were chosen for genuine structural representativeness (transaction-level vs. account/network-level fraud) given that real UPI/IMPS data isn't publicly available at this scale.
Intended use
Research and educational demonstration of hybrid tabular + graph fraud detection architecture, and as a genuine, validated reference point for further work on graph-based fraud detection under full supervision. Not intended for direct production deployment on real financial data without independent validation on that data's actual distribution.
License
MIT — see the source datasets' own licenses (IEEE-CIS, DGraph-Fin) for any restrictions on the underlying data itself.