[Paper Review] Quick survey of graph-based fraud detection methods

Paul Irofti, Andrei Pătraşcu+1 more|arXiv (Cornell University)|Oct 24, 2019

Network Security and Intrusion Detection78 references4 citations

TL;DR

This paper surveys graph-based fraud detection methods that integrate topological structure and node/edge attributes to identify anomalies in financial and social networks. It proposes hybrid techniques using graph clustering, autoencoders, and information-theoretic principles like MDL to detect fraudulent nodes, edges, or subgraphs, achieving up to 7.93% higher recall and 4.63% higher F-score than baseline methods on real-world data.

ABSTRACT

In general, anomaly detection is the problem of distinguishing between normal data samples with well defined patterns or signatures and those that do not conform to the expected profiles. Financial transactions, customer reviews, social media posts are all characterized by relational information. In these networks, fraudulent behaviour may appear as a distinctive graph edge, such as spam message, a node or a larger subgraph structure, such as when a group of clients engage in money laundering schemes. Most commonly, these networks are represented as attributed graphs, with numerical features complementing relational information. We present a survey on anomaly detection techniques used for fraud detection that exploit both the graph structure underlying the data and the contextual information contained in the attributes.

Motivation & Objective

• To identify and classify fraudulent entities—nodes, edges, or subgraphs—by leveraging both relational structure and attribute information in attributed graphs.
• To address the limitations of treating transactions as independent data points by modeling them as dynamic, relational networks with temporal and topological features.
• To develop unsupervised and semi-supervised methods that detect anomalies without relying on extensive labeled fraud data, crucial for real-world deployment.
• To integrate temporal dynamics into graph models, enabling detection of high-frequency or patterned fraudulent behaviors such as spam or money laundering.
• To evaluate and compare existing methods across domains like finance, social networks, and e-commerce, focusing on scalability and interpretability.

Proposed method

• Uses attributed graphs where nodes and edges carry numerical features, and applies graph structure analysis to detect deviations from normal patterns.
• Employs Minimum Description Length (MDL) principles to jointly model network topology and attribute distributions, minimizing encoding cost for normal substructures.
• Applies nonnegative matrix factorization (NMF) to simultaneously cluster nodes based on connectivity and feature similarity, enabling joint optimization of structure and attributes.
• Utilizes deep autoencoders to learn low-dimensional, reconstructive embeddings of nodes or edges from network walks, preserving local distances and enabling anomaly scoring.
• Integrates Laplacian regularization and CUR decomposition to identify representative instances and measure normality via residual analysis in high-dimensional attribute space.
• Applies dynamic clustering and reservoir sampling to maintain efficient, updatable representations in evolving networks, supporting real-time fraud detection.

Experimental results

Research questions

• RQ1 How can graph structure and attribute information be jointly leveraged to improve fraud detection beyond traditional vector-based models?
• RQ2 What role do topological features such as cliques, dense subgraphs, or high-degree nodes play in identifying fraudulent behavior in financial and social networks?
• RQ3 To what extent do unsupervised and semi-supervised methods outperform supervised baselines when labeled fraud data is scarce?
• RQ4 How can temporal patterns—such as high-frequency transactions—be effectively modeled within a graph framework to detect time-sensitive fraud?
• RQ5 Can information-theoretic principles like MDL provide a principled way to detect rare or anomalous subgraph patterns in large-scale attributed networks?

Key findings

• The HitFraud algorithm, which uses meta-paths and label aggregation on attributed graphs, achieved a 7.93% improvement in recall and 4.63% in F-score over SVM and Random Forest baselines on the EA dataset.
• MDL-based clustering methods effectively identify normative substructures by minimizing encoding cost, with anomalous subgraphs emerging as those with least frequent or least compressible patterns.
• Hybrid models combining autoencoders with graph walks produce faithful node and edge representations that preserve local structure and enable accurate anomaly detection through reconstruction error.
• Dynamic representation learning with reservoir sampling allows efficient updates to embeddings in response to network changes, supporting real-time fraud detection in streaming environments.
• Models using CUR decomposition and residual analysis successfully detect abnormal instances by identifying those poorly represented by a sparse set of normal prototypes.
• The integration of network entropy regularizers in mixture models enables better assignment of nodes to components based on both attribute similarity and topological context.