PageRank

PageRank computes a node's importance not just by counting incoming edges, but by weighing the influence of the source nodes. A transaction from a high-risk entity passes more 'rank' than one from a benign entity.

• Damping Factor: A probability (typically 0.85) that the random walk continues, preventing rank sinks
• Convergence: The algorithm iterates until node scores stabilize, revealing the steady-state influence distribution
• Example: A shell company receiving funds from multiple known fraud accounts will accumulate a disproportionately high PageRank score, flagging it as a central laundering hub

In financial networks, the standard web-link model is inverted to analyze money flow direction. Edges represent monetary transfers, and PageRank identifies entities that are significant recipients of funds.

• Weighted Edges: Transaction amounts serve as edge weights, ensuring that high-value transfers contribute more to the recipient's score
• Directed Graphs: The algorithm respects the asymmetry of payments, distinguishing between a payer and a payee
• Example: A merchant account receiving thousands of small, rapid payments from distinct accounts across a short window will exhibit an anomalously high PageRank, indicative of a potential money mule aggregation point

Instead of a global importance score, Personalized PageRank biases the random walk to restart at a known set of seed nodes, such as confirmed fraud accounts. This computes a contextual similarity score relative to the seeds.

• Seed Vector: A predefined set of high-confidence fraudulent entities initializes the teleportation probability
• Proximity Scoring: Nodes that are structurally close to the seed set receive higher scores, effectively performing a guided search for collusion
• Example: Starting from a list of 50 confirmed mule accounts, Personalized PageRank can sweep the transaction graph to rank all other accounts by their likelihood of being part of the same money laundering ring

Standard PageRank treats all edges as equally relevant regardless of time. For fraud detection, the algorithm is often modified with a temporal decay factor to prioritize recent transactional activity over stale historical data.

• Time-Weighted Edges: Edge weights are scaled by an exponential decay function based on transaction recency
• Dynamic Re-computation: Scores are recalculated on sliding windows to capture evolving fraud campaigns
• Example: An account that was highly active six months ago but dormant since will see its influence score decay, preventing it from masking a currently active fraud ring that has shifted to new accounts

PageRank scores are compared against expected baselines derived from benign network behavior. Entities whose actual PageRank significantly exceeds their predicted score based on legitimate activity patterns are flagged as anomalies.

• Expected vs. Observed: A regression model predicts a node's expected PageRank based on its degree and local clustering coefficient
• Residual Score: The difference between the computed PageRank and the expected value serves as the anomaly signal
• Example: A newly created account with few connections but an abnormally high PageRank—because its few connections are to highly central fraudulent nodes—will produce a large positive residual, triggering an alert despite its low degree

PageRank is rarely used as a standalone classifier. Instead, the computed centrality score is injected as a structural feature into a downstream supervised model like XGBoost or a Graph Neural Network.

• Feature Vector Enrichment: Each node's feature set is augmented with its PageRank score, HITS hub/authority scores, and betweenness centrality
• Multi-Modal Fusion: Structural features are concatenated with behavioral features (e.g., average transaction velocity) for a holistic risk assessment
• Example: A gradient-boosted tree model trained to predict account takeover receives the account's PageRank as an input feature, learning that accounts with sudden spikes in network influence are at elevated risk of being compromised and used for fraudulent outbound transfers

The unsupervised partitioning of a graph into clusters of densely connected nodes. While PageRank identifies high-influence individual entities, community detection identifies tightly-knit groups or functional modules.

• Modularity Maximization: Optimizes the density of edges inside communities vs. outside.
• Fraud Ring Detection: Isolates suspiciously isolated or densely connected subgraphs.
• Complement to PageRank: A high-PageRank node bridging two dense communities is a critical structural bottleneck.

A spatial-based graph neural network that introduces a self-attention mechanism to dynamically weigh the importance of neighboring nodes during aggregation.

• Dynamic Weighting: Unlike PageRank's static link-based scoring, GAT learns to assign varying importance to different transaction edges.
• Multi-Head Attention: Stabilizes learning by running multiple attention mechanisms in parallel.
• Fraud Context: A fraudulent node may pay disproportionate attention to specific laundering conduits, revealing collusion.

A stochastic process that generates node sequences by randomly traversing graph edges. PageRank is fundamentally a stationary distribution of a specific random walk with a teleportation factor.

• DeepWalk & Node2Vec: Use biased random walks to learn structural node embeddings.
• Teleportation Factor (damping factor): In PageRank, this prevents the walker from getting trapped in dead-end nodes.
• Temporal Walks: Extensions on dynamic graphs respect chronological transaction ordering.

A neural architecture designed for dynamic graphs where interactions occur chronologically. It maintains a compressed memory state for each node, updated continuously.

• Beyond Static PageRank: Standard PageRank operates on a static snapshot. TGN captures evolving influence as new transactions occur.
• Memory Module: Compresses a node's interaction history into a vector, updated via an RNN or attention mechanism.
• Application: Detecting when a previously dormant account suddenly becomes a high-influence hub in a money laundering layering phase.

A matrix representation derived from the degree and adjacency matrices of a graph. Its spectral properties form the mathematical basis for spectral clustering and spectral GNNs.

• Connection to PageRank: The personalized PageRank vector can be expressed as a solution to a linear system involving the graph Laplacian.
• Spectral Clustering: Uses eigenvectors of the Laplacian to partition the graph, identifying structural communities.
• Smoothness Prior: In GNNs, the Laplacian enforces that connected nodes should have similar representations.

A technique that jointly optimizes the graph topology and the GNN parameters during training. It is used to denoise a noisy or adversarially manipulated transaction graph.

• Robustness to Evasion: Fraudsters may create spurious transactions to artificially inflate PageRank scores. Graph structure learning can prune these adversarial edges.
• Latent Graph Inference: Learns a hidden, cleaner adjacency matrix from noisy observed data.
• Iterative Refinement: Alternates between updating the graph structure and training the downstream fraud classifier.