Graph Neural Network for False Positive Reduction

GNNs ingest alerts from legacy rule-based systems and re-score them by aggregating features from neighboring nodes. An account triggering a velocity rule might be downgraded if its transaction graph neighborhood consists of known payroll processors or verified corporate entities. This moves detection logic from isolated attribute checking to relational plausibility assessment, dramatically reducing investigator time wasted on false leads.

A core mechanism for false positive suppression is evaluating local structural consistency. The GNN learns a typical profile of how legitimate nodes connect. An alert is suppressed if the flagged node's ego-network—its immediate neighbors and their interconnections—matches benign patterns. For example, a sudden large transfer is deemed plausible if the recipient sits within a tightly clustered corporate supply chain subgraph.

Unsupervised Graph Autoencoders (GAEs) learn to reconstruct the adjacency matrix and node features of normal transaction graphs. During inference, the reconstruction error for each node or edge serves as a refined anomaly score. Alerts with low reconstruction error—meaning the GNN finds the pattern structurally normal—are suppressed. This catches sophisticated mule accounts that pass rule checks but form anomalous topological structures.

GNNs enrich alert features with aggregated neighborhood statistics before final classification. Instead of relying solely on the transaction amount and time, the model incorporates:

• Mean neighbor risk score
• Community density of the transacting cluster
• Heterogeneous path patterns (e.g., Account → Device → IP → Account) This relational context provides a holistic view that linear rules cannot capture.

False positives often arise from stale relationships. Temporal Graph Networks (TGNs) assign time-aware attention weights to edges, decaying the influence of old transactions. A historical connection to a now-defunct fraudulent entity won't permanently poison an account's reputation. The model learns that recency and frequency of benign interactions are stronger indicators of legitimacy than a single past misstep.

Tools like GNNExplainer identify the specific subgraph and features that led to a suppression decision. For an alert downgraded from high to low risk, the explainer might highlight: 'Node classified as benign due to strong clustering with 15 known corporate payroll accounts and absence of structural holes.' This auditable rationale is critical for regulatory compliance and investigator trust in automated suppression.

An unsupervised architecture that uses a GNN encoder to produce latent node embeddings and a decoder to reconstruct the original graph adjacency matrix. In anomaly detection, a transaction that is flagged by rules but has a low reconstruction error in the GAE is likely a false positive—its structural pattern is normal within the graph context, even if it appears suspicious in isolation.