Detecting new fraudulent behaviors through unsupervised graph anomaly detection

**GraphBEAN: Anomaly Detection Model for Fraud Detection in Graph Networks**

Graph networks have become increasingly important in fraud detection, providing valuable insights into fraudulent behavior patterns. However, one of the challenges in fraud detection is that fraudsters constantly innovate their methods to evade detection. Machine learning models trained on historical data may not be able to pick up on these new patterns. To address this, Grab developed an in-house machine learning model called GraphBEAN, which detects anomalous patterns in graphs without the need for label supervision. This article explores the architecture and application of GraphBEAN within Grab’s fraud detection system.

**Graph Construction: Modeling Interactions**

Grab modeled interactions between consumers and merchants in their GrabFood and GrabMart platforms as bipartite graphs. The first group of nodes represents consumers, the second group represents merchants, and the edges connect them to indicate orders placed by consumers. The graph is enriched with transactional information in the form of node and edge features. This bipartite graph construction provides the foundation for detecting anomalous behaviors.

**Model Architecture: Autoencoder for Anomaly Detection**

GraphBEAN is designed as an autoencoder with an encoder and two decoders: a feature decoder and a structure decoder. Unlike previous works, GraphBEAN accepts bipartite graphs with both node and edge attributes as input, allowing for a more comprehensive analysis of suspicious behaviors. The encoder processes the graph through graph convolution layers to produce latent representations for both node groups. The feature decoder reconstructs the original graph, while the structure decoder predicts the existence of edges to learn the graph structure. A reconstruction loss function compares the reconstructed graph to the original input graph.

**Anomaly Score Computation: Reconstruction-based Scores**

GraphBEAN computes anomaly scores based on reconstruction error. Normal behaviors are common and easily reconstructed, resulting in low errors. Anomalous behaviors, on the other hand, are rare and difficult to reconstruct, leading to high errors. The model produces both edge-level and node-level anomaly scores. Edge-level scores are derived from edge reconstruction error, while node-level scores combine node reconstruction error and aggregations of edge scores connected to the node.

**Actioning System: Detecting Anomalies and Taking Action**

Grab’s implementation of GraphBEAN includes a fully-automated pipeline for anomaly detection and actioning. The system constructs a bipartite graph from GrabFood and GrabMart transactions, trains the GraphBEAN model, and computes anomaly scores for consumers, merchants, and their interactions. These scores are then passed to an actioning system, which consists of a human expert actioning system and an automatic actioning system. Fraud experts analyze the anomalies and take appropriate action, while the automatic actioning system uses the anomaly scores, fraud type tags, and external signals to automatically respond to detected anomalies.

**Future Development: Advancements and Expansion**

The GraphBEAN model has proved effective in detecting fraudulent behavior and enabling swift action against it within Grab’s platforms. Grab is currently working on extending the model to more generic heterogeneous graphs and implementing it in other use cases within the company. By continuously improving their fraud detection capabilities, Grab aims to enhance their defense against fraudulent activity and ensure the safety of their users.

**Citation Information**

If you use the GraphBEAN model for academic purposes, please cite the following publication:

R. Fathony, J. Ng and J. Chen, “Interaction-Focused Anomaly Detection on Bipartite Node-and-Edge-Attributed Graphs,” 2023 International Joint Conference on Neural Networks (IJCNN), Gold Coast, Australia, 2023, pp. 1-10, doi: 10.1109/IJCNN54540.2023.10191331.

(Note: This citation information is provided as per the original article’s request)

Wrap-up:

GraphBEAN is a powerful unsupervised learning model developed by Grab to detect new types of fraudulent behavior in graph networks. By leveraging bipartite graph construction and a unique autoencoder architecture, GraphBEAN enables the detection of anomalies without label supervision. Grab’s implementation includes an actioning system that combines expert analysis with automated processes to swiftly respond to detected anomalies. With plans for future advancements and expansion, Grab aims to enhance their fraud detection capabilities and ensure the safety of their users.