Unsupervised Graph Anomaly Detection for Fraud

6 posts · Apr 2022 – Nov 2023

What this trail covers

Grab has evolved its fraud detection capabilities by developing and implementing an in-house unsupervised machine learning model called GraphBEAN for detecting anomalous patterns in bipartite graphs. This model, which accepts node and edge attributes, can identify both node-level and edge-level anomalies without requiring labeled data. The system constructs bipartite graphs from consumer-merchant interactions in GrabFood and GrabMart, trains the GraphBEAN model, and then uses anomaly scores and network-based features to identify fraudulent syndicates. Future work includes diving deeper into graph infrastructure and database development using AWS Neptune.

All Grab trails

Nov 2023Graph modelling guidelinesThis post provides guidelines on graph modelling, detailing the process from defining the domain to implementing and analyzing the graph. It covers identifying entities, relationships, and properties, choosing between property graphs and RDF models, developing a schema, importing data, and implementing the graph using a graph database. It also touches upon analyzing and visualizing the graph. While it mentions fraud detection as an application, it does not introduce a new system or significant technical advancement to the existing GraphBEAN system.
Aug 2023Unsupervised graph anomaly detection - Catching new fraudulent behavioursThis post details the development and application of GraphBEAN, an in-house unsupervised machine learning model for detecting anomalous patterns in bipartite graphs. It describes the graph construction process for consumer-merchant interactions in GrabFood and GrabMart, the GraphBEAN model architecture (an autoencoder with feature and structure decoders), and the computation of edge-level and node-level anomaly scores based on reconstruction error. The post also outlines the full pipeline for anomaly detection and actioning, including a fraud type tagger and subsystems for human expert and automatic actioning.
Jan 2023Graph service platformThis post elaborates on the need for a graph service platform and its architecture. It details a system that uses Amazon S3 for data storage, Neptune for graph data, and DynamoDB for metadata. The platform provides universal graph operation APIs and service management, supporting ETL for data loading and real-time stream injection via Kafka. A key use case in fraud detection is highlighted, showing how the platform can identify shared devices among multiple accounts. The architecture includes a storage backend, drivers, service layer, and RESTful APIs for OLTP and OLAP.
Nov 2022Graph for fraud detectionThis post details the application of Relational Graph Convolutional Networks (RGCN) for fraud detection in Grab's ecosystem. It explains why graph-based models are superior to rule engines and decision trees for unknown fraud detection due to their ability to utilize structural correlations and require less feature engineering. The post presents the RGCN architecture, its semi-supervised learning approach, and performance metrics (ROC curve, AUROC). It also provides practical tips for using RGCN, such as limiting convolutional layers and utilizing rich node features. Furthermore, it discusses graph explainability through visualization and highlights ongoing challenges and future work, including feature initialization, real-time prediction, and handling noisy connections.
Jun 2022Graph Networks - 10X investigation with Graph VisualisationsThis post introduces Grab's Graph Visualisation Platform, an investigation tool that transforms raw records into interactive maps to reveal hidden connections and patterns for fraud detection. It highlights features like expanding data points and timeline tracking/history replay. The post provides examples of how the platform facilitates fraud investigations, including appeal confirmation, passenger device sharing detection, and anti-money laundering (AML) pattern discovery. It emphasizes the platform's ability to make fraud investigations easier and more effective by allowing investigators to directly interact with data points and visualize relationships without manual queries or data science expertise.
Advertisement
Apr 2022Graph Networks - Striking fraud syndicates in the darkThis post introduces Grab's advancements in fraud detection using graph network technologies. It details the development of a Graph Database Platform for visualization and network-based feature engineering, and Graph-based Machine Learning models, specifically Graph Neural Networks (GNNs), for scenarios like anti-money laundering and fraud detection. The post highlights the identification of fraudulent syndicates by analyzing relationships between entities (users, IPs, devices) and discusses the use of AWS Neptune for future infrastructure development.