Dynamic Graph

Unlike static graphs, dynamic graphs represent transactions as timestamped edge events that occur at specific moments. Each interaction—such as a wire transfer or card payment—carries a temporal coordinate that defines when the relationship was established. This chronological ordering is critical for detecting fraud patterns like velocity spikes, where an account suddenly initiates an abnormal volume of transactions within a compressed time window. The edge may also carry a duration or decay factor, allowing the model to distinguish between a long-standing merchant relationship and a fleeting, suspicious connection.

In dynamic graph architectures like Temporal Graph Networks (TGNs), each node maintains a compressed memory vector that updates as new interactions occur. This memory functions as a running summary of the node's historical behavior, mutating with each incoming transaction. When a node engages in a new edge event, the model reads its current memory state, computes an embedding for the interaction, and then writes an updated memory back. This mechanism allows the model to capture behavioral drift—a legitimate account that gradually changes spending patterns versus one that abruptly shifts due to account takeover.

Dynamic graphs operate in continuous time rather than discrete time steps, using neural ordinary differential equations or temporal point processes to model the irregular intervals between transactions. This approach naturally handles the non-uniform cadence of financial activity—some accounts transact daily, others monthly. The model learns that a 30-day gap between transactions is normal for a mortgage payment but highly anomalous for a daily-use checking account. Hawkes processes are often integrated to capture self-exciting behavior, where one fraudulent transaction increases the probability of subsequent fraudulent events in a cascading scheme.

Beyond node and edge additions, dynamic graphs capture structural mutations in the network topology. Nodes can be deleted when accounts are closed, edge weights can shift as transaction volumes change, and entire subgraphs can merge when fraud rings consolidate resources. Graph edit distance metrics quantify how much the network structure has changed between two time points. A sudden topological shift—such as a previously isolated cluster of accounts suddenly forming dense interconnections with a known fraud ring—serves as a powerful anomaly signal that static graph analysis would miss entirely.

Production dynamic graph systems require streaming data pipelines that ingest transaction events in real time and update graph state without batch recomputation. Technologies like Apache Kafka or Amazon Kinesis feed event streams into a graph database optimized for temporal queries. The system must handle out-of-order events gracefully—a transaction with an earlier timestamp may arrive after a later one due to network latency. Watermarking strategies define how long the system waits for late-arriving data before advancing its internal clock, balancing latency against completeness in the fraud scoring decision.

Training on dynamic graphs requires specialized temporal neighborhood sampling that respects causality. When computing an embedding for a node at time t, the sampler can only access edges with timestamps strictly less than t to prevent information leakage from the future. This constraint ensures the model learns genuine predictive patterns rather than exploiting hindsight. Temporal random walks traverse edges in chronologically increasing order, generating sequences that capture the natural flow of money through the network. These walks often reveal layering patterns where funds move through multiple intermediary accounts in rapid succession to obscure their origin.

The primary neural architecture designed for continuous-time dynamic graphs. TGN maintains a compressed memory state for each node, updated via a message function whenever a new chronological interaction occurs. This allows the model to capture evolving transactional behavior without reprocessing the entire history. Core components include a memory module, message function, memory aggregator, and embedding decoder.

The fundamental computational paradigm where nodes exchange vectorized information along temporally-aware edges. Unlike static message passing, dynamic variants must account for edge creation timestamps and sequence order. Techniques include:

• Time-encoding functions to map continuous timestamps to vectors
• Temporal attention mechanisms that weight recent interactions more heavily
• Causal masking to prevent information leakage from future events

The engineering process of transforming a live feed of transaction logs into an incrementally updated graph structure. This requires low-latency ingestion pipelines that handle:

• Node and edge upserts as new entities and transactions arrive
• Feature mutation tracking for attributes like account balances or risk scores
• Windowed subgraph extraction for real-time inference on recent activity
• Stateful graph databases such as Neo4j or TigerGraph with temporal extensions

The process of mapping discrete financial entities to a continuously updating low-dimensional vector space. As new transactions occur, node embeddings drift to reflect changing behavioral roles. Key approaches include:

• Online learning with stochastic gradient updates on new edges
• Recurrent neural network (RNN) decoders that project memory states into embedding space
• Exponential decay factors that diminish the influence of stale interactions
• Concept drift detection to identify when an entity's behavior fundamentally shifts

A forecasting task that predicts the likelihood and timing of future edges in a dynamic graph. Applied to financial networks, this anticipates hidden relationships or upcoming collusive transactions. Methods include:

• Hawkes processes to model self-exciting temporal event sequences
• Temporal point processes parameterized by GNN-derived node representations
• Time-decay scoring functions that evaluate edge probability as a function of recency
• Negative sampling over time windows to train discriminative models

The task of identifying nodes or edges whose temporal evolution deviates from expected patterns. Unlike static anomaly detection, this captures bursts of activity, sudden structural role changes, or anomalous velocity. Techniques include:

• Residual analysis between predicted and observed temporal embeddings
• LSTM-based autoencoders that reconstruct temporal node trajectories
• Contrastive learning on temporal subgraph views to isolate suspicious deviations
• Real-time alerting when reconstruction error exceeds adaptive thresholds