[Paper Review] Anomaly Detection in Networks with Application to Financial Transaction Networks

Andrew Elliott, Mihai Cucuringu+3 more|arXiv (Cornell University)|Jan 2, 2019

Network Security and Intrusion Detection55 references17 citations

TL;DR

This paper proposes a novel anomaly detection method for financial transaction networks by combining network comparison and spectral analysis to extract 140 features, which are then used with a feature sum or random forest classifier to identify unknown anomalies. The method outperforms existing approaches like Oddball, flagging over 90% of planted anomalies in the top 2% of ranked nodes across synthetic datasets.

ABSTRACT

This paper is motivated by the task of detecting anomalies in networks of financial transactions, with accounts as nodes and a directed weighted edge between two nodes denoting a money transfer. The weight of the edge is the transaction amount. Examples of anomalies in networks include long paths of large transaction amounts, rings of large payments, and cliques of accounts. There are many methods available which detect such specific structures in networks. Here we introduce a method which is able to detect previously unspecified anomalies in networks. The method is based on a combination of features from network comparison and spectral analysis as well as local statistics, yielding 140 main features. We then use a simple feature sum method, as well as a random forest method, in order to classify nodes as normal or anomalous. We test the method first on synthetic networks which we generated, and second on a set of synthetic networks which were generated without the methods team having access to the ground truth. The first set of synthetic networks was split in a training set of 70 percent of the networks, and a test set of 30 percent of the networks. The resulting classifier was then applied to the second set of synthetic networks. We compare our method with Oddball, a widely used method for anomaly detection in networks, as well as to random classification. While Oddball outperforms random classification, both our feature sum method and our random forest method outperform Oddball. On the test set, the random forest outperforms feature sum, whereas on the second synthetic data set, initially feature sum tends to pick up more anomalies than random forest, with this behaviour reversing for lower-scoring anomalies. In all cases, the top 2 percent of flagged anomalies contained on average over 90 percent of the planted anomalies.

Motivation & Objective

• To detect previously unspecified anomalies in financial transaction networks that are not captured by existing rule-based or pattern-specific methods.
• To develop a general-purpose anomaly detection framework applicable to diverse network structures without prior knowledge of anomaly patterns.
• To improve detection performance over state-of-the-art methods like Oddball by integrating multiple network features and machine learning classification.
• To evaluate the method on synthetic networks with known planted anomalies to ensure robustness and reliability.
• To analyze false positives by examining nodes flagged as anomalous but not part of any planted anomaly structure.

Proposed method

• The method generates 140 features by combining network comparison metrics (e.g., graph distance, edge-wise differences) and spectral analysis (e.g., eigenvector localization, modularity matrix properties).
• It uses the ℓ₁ norm z-score of eigenvectors to detect spectral localization, a sign of anomalous node concentration in network structures.
• Features are aggregated using a simple sum (Feature sum) and a random forest classifier to rank and classify nodes as normal or anomalous.
• The approach is validated on two synthetic datasets: one used for training (70%) and another independent test set (30%) with unknown generation mechanisms during development.
• The method includes a 2-hop snowball sampling procedure to explore local network neighborhoods of flagged nodes, enabling visual and statistical analysis of non-embedded anomalies.
• Performance is evaluated using standard metrics: recall, precision, and average precision, with error bars indicating standard error across 100 test networks.

Experimental results

Research questions

• RQ1 Can a hybrid method combining network comparison and spectral analysis detect unknown anomaly patterns in financial transaction networks more effectively than existing methods?
• RQ2 How does the performance of the Feature sum compare to the random forest classifier in detecting anomalies across varying synthetic network configurations?
• RQ3 To what extent can the method identify true anomalies while minimizing false positives, especially in cases where anomalies are not explicitly planted?
• RQ4 How do the top-ranked nodes from the classifier compare to the actual planted anomalies in terms of recall and precision across different parameter regimes?
• RQ5 What structural characteristics do nodes flagged as anomalous but not part of planted anomalies exhibit in their local network neighborhoods?

Key findings

• The random forest classifier outperformed the Feature sum method in terms of precision and F1-score on the independent test set of synthetic networks.
• On the second synthetic dataset, the Feature sum initially detected more anomalies than the random forest, but this trend reversed for lower-scoring anomalies, indicating a trade-off in sensitivity.
• In all test scenarios, the top 2% of ranked nodes contained, on average, over 90% of the planted anomalies, demonstrating high detection efficiency.
• The method significantly outperformed both random classification and the widely used Oddball method in terms of recall and precision across all parameter regimes.
• Nodes flagged as anomalous but not part of any planted anomaly showed no clear structural patterns in their 2-hop neighborhoods, suggesting the method detects subtle, non-obvious anomalies.
• The use of spectral features, particularly eigenvector localization via ℓ₁ norm z-scores, contributed significantly to identifying anomalous nodes not detectable by standard network statistics.