Graph Anomaly Detection

The process of mapping discrete graph nodes to low-dimensional continuous vectors that preserve structural and feature-based similarities. In fraud detection, node embeddings transform accounts, merchants, and devices into dense representations where proximity in vector space correlates with functional similarity.

• Transductive methods (Node2Vec, DeepWalk) learn embeddings for fixed graphs using random walk sampling
• Inductive methods (GraphSAGE) generate embeddings for unseen nodes, critical for dynamic transaction networks
• Embeddings serve as feature inputs for downstream anomaly classifiers like isolation forests or autoencoders
• Reconstruction error from graph autoencoders directly quantifies how anomalous a node's embedding is relative to the norm

Unsupervised partitioning of graphs into clusters of densely connected nodes, revealing functional modules or suspiciously isolated groups within transaction networks. Fraud rings often manifest as tightly-knit communities with abnormal internal density.

• Louvain algorithm optimizes modularity to identify hierarchical community structures at scale
• Label propagation detects communities through iterative neighbor agreement, efficient for billion-edge graphs
• Suspicious patterns include communities with unusually high transaction velocity, cyclic money flows, or complete isolation from the main graph component
• Community-level anomaly scores aggregate individual node deviations to flag entire collusive groups rather than isolated actors

An unsupervised architecture using a GNN encoder to compress node features and graph structure into latent embeddings, paired with a decoder that reconstructs the adjacency matrix. Anomalies are identified through high reconstruction error.

• Encoder: Typically a 2-3 layer GCN that aggregates neighborhood information into latent vectors
• Decoder: Computes the dot product between latent vectors to predict edge probabilities
• Nodes with high reconstruction error deviate structurally from the learned norm, flagging potential fraud
• DOMINANT extends this by jointly reconstructing both node attributes and graph structure, ranking anomalies by combined error
• Particularly effective for detecting synthetic identities that form unusual connection patterns

A self-supervised paradigm that trains graph encoders to maximize mutual information between augmented views of the same graph, learning robust representations without labeled fraud data. Critical when ground-truth labels are scarce or unreliable.

• GraphCL applies stochastic augmentations like node dropping, edge perturbation, and attribute masking
• Positive pairs are different views of the same node or subgraph; negative pairs are views of different entities
• The learned representations are inherently sensitive to structural anomalies that resist augmentation invariance
• BGRL (Bootstrapped Graph Latents) eliminates the need for negative pairs, improving scalability on large transaction graphs
• Pre-trained encoders transfer to downstream anomaly detection tasks with minimal fine-tuning

A technique that jointly optimizes graph topology and GNN parameters during training, denoising adversarially manipulated or naturally noisy transaction graphs. Fraudsters often inject spurious edges to evade detection; structure learning counters this.

• Pro-GNN learns a clean adjacency matrix by enforcing sparsity, low-rank, and feature smoothness constraints
• IDGL iteratively refines the graph structure based on current node embeddings, converging on an optimal topology
• Denoised graphs improve the robustness of downstream anomaly classifiers against adversarial camouflage attacks
• Structure learning can reveal hidden relationships suppressed by fraudsters while pruning deceptive connections
• Joint optimization ensures the learned structure is optimal for the specific anomaly detection objective

A neural architecture for dynamic graphs that maintains a compressed memory state for each node, updated continuously as new chronological transactions occur. Essential for capturing evolving behavioral patterns in real-time fraud detection.

• Memory module: Stores a vector summary of each node's interaction history, updated via RNNs or attention
• Message function: Computes messages between interacting nodes at each timestamp
• Embedding module: Generates temporal node embeddings by combining memory state with neighborhood aggregation
• Detects anomalies where a node's behavior suddenly deviates from its historical pattern, even if the current structure appears normal
• Enables streaming anomaly detection on live transaction feeds without full graph retraining