Graph Construction

The critical preprocessing step of mapping raw identifiers to canonical node entities. This involves resolving multiple representations of the same real-world actor (e.g., a user with multiple email addresses or device IDs) into a single, unique node. Without rigorous deduplication, the graph becomes sparse and fragmented, diluting the neighborhood aggregation signal. Techniques include fuzzy string matching, probabilistic record linkage, and deterministic rule-based matching on personally identifiable information (PII) hashes.

Defining a rich ontology of node types (e.g., AccountHolder, Merchant, Device, IP_Address) and edge types (e.g., TRANSFERS_TO, LOGS_IN_FROM, OWNS). A heterogeneous schema preserves the semantic meaning of different relationships, enabling Relational Graph Convolutional Networks (R-GCNs) to apply distinct learnable weight matrices per edge type. This prevents the model from conflating a TRANSFERS_TO relationship with a SHARES_DEVICE_WITH relationship.

Assigning time-decayed weights to edges based on transaction recency. A transaction from yesterday should exert more influence on a node's current state than one from five years ago. This is implemented by applying an exponential decay function to edge features or by creating time-weighted adjacency matrices. This technique is essential for constructing dynamic graphs where the relevance of historical behavior diminishes, preventing stale data from masking emerging fraud patterns.

Populating nodes and edges with dense, numerical attribute vectors. Node features include account age, average transaction velocity, and risk scores. Edge features capture transaction amount, currency type, authorization response code, and time delta since the last interaction. These features serve as the initial input signals for the GNN's message-passing layers. Categorical features must be properly encoded (e.g., one-hot or learned embeddings) to avoid imposing false ordinal relationships.

The strategy for extracting manageable subgraphs from a massive, billion-edge transaction network for mini-batch training. Techniques like GraphSAINT and Cluster-GCN partition the full graph into smaller, densely connected clusters that preserve local structure. This overcomes the memory bottleneck of loading the entire adjacency matrix onto a GPU. Effective sampling ensures that each training batch is a statistically representative microcosm of the global fraud patterns.

The methodology for partitioning a graph dataset without introducing data leakage. Unlike random row-wise splitting in tabular data, graph splitting must account for message-passing dependencies. A naive split allows a test node's features to influence a training node's embedding through shared edges. The correct approach uses temporal splitting (training on past edges, testing on future edges) or inductive node splitting that masks test nodes and their incident edges entirely during training.

The process of defining entity types and their feature vectors that will serve as vertices in the graph. In financial networks, nodes typically represent account holders, merchants, devices, or IP addresses. A robust schema must define the primary key for each node type and the static or dynamic attributes (e.g., account age, average transaction velocity) that form the initial feature matrix X.

The logic for transforming raw event logs into directed or undirected connections. This involves defining edge types (e.g., TRANSFERRED_TO, LOGGED_IN_FROM) and computing edge weights based on aggregation functions:

• Monetary aggregation: Sum of transaction amounts over a time window.
• Frequency aggregation: Count of interactions between two entities.
• Temporal decay: Weighting recent interactions higher than older ones to capture concept drift.

Building a graph with multiple node and edge types to preserve semantic richness. Unlike homogeneous graphs, a financial heterogeneous graph distinguishes between Account and Merchant nodes, and between Transaction and Ownership edges. This requires defining a metagraph schema that specifies valid source and target node types for each relation, enabling Relational GCNs to apply distinct transformation matrices per edge type.

The strategy for partitioning a continuous stream of transactions into discrete snapshots or time-windowed subgraphs. Techniques include:

• Sliding windows: Overlapping intervals that capture smooth behavioral transitions.
• Tumbling windows: Non-overlapping fixed intervals for batch training.
• Session-based windows: Dynamic intervals based on user activity bursts. This temporal discretization is critical for feeding dynamic graphs into Temporal Graph Networks (TGNs).

The computation of node-level and edge-level features that serve as input signals for GNN layers. Node features may include degree centrality, PageRank scores, or transaction velocity. Edge features often encode transaction amount, currency type, or time elapsed since last interaction. Proper feature scaling and normalization prevent numerical instability during message passing.

Techniques for constructing mini-batches from massive transaction graphs that exceed GPU memory. Methods include neighbor sampling (GraphSAGE-style) which randomly selects a fixed number of neighbors per node, and cluster-GCN which partitions the graph into dense subgraphs. This step is essential for scaling GNN training to production-scale financial networks with billions of edges.