# Fraud detection with graph machine learning

Imagine a world where transactions, accounts, and customers are connected to a vast web of data. This is the world that fraudsters operate in, using a variety of techniques to stay one step ahead of detection. But imagine if businesses could see the same web of data, connecting the dots between seemingly unrelated transactions and customers to uncover fraudulent activity.

Enter graph machine learning, where it’s possible to map out the complex web of relationships between users, accounts, and transactions, making it easier to spot patterns of fraudulent activity. With this, we’ll catch the fraud in near real-time and stop it before damage happens.

The worldwide fraud detection market is rapidly expanding and is projected to reach[ USD 129.17 billion](https://www.fortunebusinessinsights.com/industry-reports/fraud-detection-and-prevention-market-100231) by 2029, as compared to USD 30.65 billion in 2022. This highlights a great potential for growth and, with the large scale and intricate data involved, graph-based fraud detection is going to play a huge role.

This post explores the concept of Graph Machine Learning and its potential to revolutionize[ fraud detection](https://www.nebula-graph.io/posts/fraud-detection-using-knowledge-and-graph-database).

## **What is graph machine learning?**

Graph Machine Learning is a type of ML that specializes in building algorithms and models to process and analyze graph-structured data in a[ graph database](https://nebula-graph.io). Graphs are made of nodes (or vertices) and edges, with the edges connecting the nodes and representing relationships between them.

The goal of graph ML is to make predictions or get insights from the graph structure by training models to do tasks such as node classification, link prediction or community detection. These tasks can be accomplished through different techniques such as graph convolutional networks, graph attention networks and random walk-based methods. These models can be trained on large, complex graphs using either semi-supervised or unsupervised representation learning techniques.

## **Using graph machine learning for fraud detection**

Graph machine learning is used for fraud detection by analyzing the connections and relationships between entities in a network. It can be applied to a wide range of datasets, such as financial transactions, communication logs, and social media interactions, to uncover patterns and anomalies that indicate fraudulent activity.

One common approach is to construct a graph based on the relationships between entities, such as financial accounts, individuals, or IP addresses. This graph can then be analyzed to identify groups of entities that exhibit suspicious behavior, such as abnormal patterns of communication or financial transactions.

The typical process of getting to prepare a graph ML model for use in fraud detection can be divided into several phases. Here is a visual presentation of how the process generally looks like:

Let’s discuss the process of creating a fraud detection solution with graph machine learning.

## **Stage 1. Understanding the data**

It all starts by understanding the kind of data you are dealing with. Below are some of the common types of data types you’re likely to encounter in a typical organization that is concerned with fraud (both private and government)

**Transaction data:** This type of data includes details relating to individual transactions, like the date, time, price, and vendor. We can use this data to identify suspicious activity, like strange spending habits or purchases that don't match up with a customer's usual behavior.

**Customer data:** Encompasses details about a customer, like their name, address, phone number, and email address. This info can be leveraged to recognize fraud linked to an individual customer, like out of the blue changes to their contact info.

**Network data**: Information about networks and devices used for transactions like IP addresses and device fingerprints. This type of data can help detect fraudulent activities that are associated with a particular network or device - for example, a group of transactions that all come from the same IP address.

**Demographic data:** Includes information about the customer, such as age, gender, income, and job position. Through such data, we can recognize patterns of fraud that are characteristic of particular demographics.

**Behavioral data**: Contains info on how customers utilize a system/service, e.g. logins, time spent in sessions, clicks and navigation. This data can help detect fraud patterns related to a customer’s behavior, like an account being accessed by numerous IPs and devices, or an account originating from an abnormal or suspicious location.

**External data:** Consists of information sourced from external sources like social media and public records.This kind of info can supplement the other forms of data above, help confirm customer identity, and detect fraudulent activity, like recognizing bogus or stolen identities.

It is essential to train the model with a labeled dataset that includes fraudulent and non-fraudulent activities. The data's accuracy, relevance, and variety are key factors that determine how well the model will perform.

### **How to preprocess the data and get it ready for analysis**

The specific steps and techniques for preprocessing our data will depend on the nature of the data, the goals of the analysis, and the type of model.

These are the common steps in pre-processing:

1. **Data cleaning:** This step involves identifying and rectifying errors or inconsistencies in the data. For instance, this could include deleting duplicate entries, updating incorrect values, or inputting missing information..
2. **Feature engineering:** Entails developing fresh features or variables from the current data. For instance, you could devise a new feature that represents the average transaction amount of a customer or shows if a customer has ever committed a fraudulent transaction.
3. **Data scaling:** The process of transforming data from a given range to a new range, in order to bring all the features to the same level of magnitude so that no feature dominates others.
4. **Data splitting:** Involves dividing a dataset into two or more subsets,e.g a training set, a validation set and a test set, in order to train models and evaluate their performance. The training set is used to train the model, the validation set is used to evaluate the model performance and optimize the parameters, and the test set is used to evaluate the final performance of the model.
5. **Outlier detection and treatment:** This is all about identifying and eliminating any data points that are drastically different from the rest. It’s important for a fraud detection system since as much as outliers may suggest suspicious activity, they can also affect the model's overall accuracy in performance if not taken care of.
6. **Data transformation:** Involves applying mathematical functions to the data to change its distribution and make it more suitable for the models. For example, logarithmic transformation can be applied to decrease the skewness of the data and to make it more homoscedastic, or power transformation can be applied to make the data more normal.

## **Stage 2: Building the graph model**

Several approaches can be used for fraud detection with graph machine learning, such as community detection, link prediction, and anomaly detection.

Community detection machine learning algorithms can be used to identify clusters or groups of individuals or entities that are likely to be involved in fraudulent activities.

Link prediction algorithms can identify potential connections or relationships between individuals or entities that may indicate fraud.

Anomaly detection algorithms can identify patterns or behaviors that deviate from normal patterns and may indicate fraud.

To build a simple model, let's say you are using a graph database like Nebula Graph and want to build a graph model to detect fraudulent transactions. You can start by importing your transaction data into your Nebula Graph database and create nodes for the entities involved in the transactions, such as individuals, accounts, and merchants. You will then create relationships between the nodes to represent the transactions and add properties to the nodes and relationships to store additional information such as amounts, dates, and locations.

Once you have your data imported and modeled in the graph, you can use[ nGQL](https://docs.nebula-graph.io/1.2.0/manual-EN/1.overview/1.concepts/2.nGQL-overview/), Nebula Graph's query language, to run community detection algorithms like Louvain or info map to identify communities of related nodes that may indicate fraudulent activities. You can also use nGQL to link prediction algorithms to find potential relationships between nodes that you may want to investigate further.

## **Stage 3: Evaluating the model**

Evaluation is crucial to ensure that our graph model can accurately detect fraud. Some common metrics you can use to evaluate the performance of a graph model include precision, recall, and F1 score.

Precision measures the proportion of true positives (correctly identified fraud) to all positive predictions (both true and false positives). Recall measures the proportion of true positives to all actual fraud cases. The F1 score is the harmonic mean of precision and recall that measures the model's overall accuracy.

To assess the model's effectiveness, it is essential to separate the data into training and testing sets so that the model can be trained on the training set and then evaluated on the testing set. This will accurately represent the model's performance on unseen data. Unseen data in this case refers to any data that the model has not been trained on. The idea here is that the model has been trained on a portion of the data (the training set), and then its performance is evaluated on a separate portion of the data (the test set) that it has not seen before. In other words we are essentially using the test set as a proxy for new, unseen data that the model will eventually encounter when it is deployed in the real world.

You can fine-tune the model to improve its performance by adjusting its parameters and algorithms or incorporating new data into the model. You can achieve this by running several tests to identify the parameters and algorithms that yield the best performance. One way to fine-tune the model is to use hyperparameter tuning, which involves adjusting the model's parameters to find the best combination that yields the best performance. To achieve this, we can deploy techniques like grid search, random search, or Bayesian optimization.

Another way to improve the model's performance is by incorporating new data, such as additional fraud cases or new feature data, into the model. This can increase the model's accuracy and make it more robust.

## **Stage 4: Deploying the model**

Just like a typical software or app, we can deploy our model on premise or in the cloud. Both options have advantages and disadvantages, and the best choice will certainly depend on the project's specific preferences.

* **Deploying on-premise:** Here we’ll deploy the model within the organization's infrastructure. This allows for more control over the deployment and security of the model, as well as the ability to customize the environment to the model's specific needs. However, this option requires more resources and maintenance from the organization’s IT team.
* **Deploying in the cloud:** The most popular options for this option include cloud platforms like AWS, Azure, or Google Cloud. This allows for easier scalability and reduces the need for infrastructure maintenance by the organization.

### **Example: How to deploy the model using Docker**

With Docker, you can containerize your fraud detection graph ML model and deploy it to your favorite cloud platform. Follow these steps:

1. **Create a Docker container:** The first step is to create a Docker container that includes all the necessary dependencies and software for the model. This includes the graph mode itself, necessary libraries, and configurations.
2. **Deploy the container:** Once the container is set up, you can deploy it either on-site or in the cloud. With tools like Docker Compose, you can easily launch multiple containers at the same time.
3. **Test the deployment:** Before deploying the model to production, it is essential to test it and be sure it’s going to function properly once deployed. You can do this by running a series of tests against the model and evaluating the results.
4. **Monitor and maintain the model:** So far so good? Well, things can go wrong at any time. So it's important that we constantly monitor our model's accuracy. Promptly add dependencies as the need arises, as well as new data to ensure the model's performance is always at peak.

Docker allows for easy deployment in different environments. It also makes it easy to maintain the model and update its dependencies.

**Also Read:**[ Graph-based intrusion detection](https://www.nebula-graph.io/posts/intrusion-detection-with-graph-technology)

## **Which types of fraud can graph machine learning detect?**

Some common types of fraud that can be detected using graph machine learning systems include:

* **Money laundering:** This is a type of financial fraud involving the movement of illegally obtained money through a series of transactions in order to conceal its origin..
* **Insider trading:** Involves the use of non-public information for financial gain. Graph machine learning can be used to identify connections and patterns of communication between individuals that may indicate the sharing of insider information.
* **Ponzi schemes:** The use of new investors' funds to pay returns to earlier investors.
* **Identity theft:** The unauthorized use of another person's personal information for financial gain.
* **Social engineering:** The manipulation of people into divulging sensitive information or performing actions that can be used for financial gain..
* **Credit card fraud:** Credit card fraud typically involves someone obtaining credit card information and using it to buy goods and services without authorization. This type of fraud can cause a financial loss for the victim, as well as damage their credit score.
* **Insurance fraud:** When false information is given to an insurer in order to obtain a payment that would otherwise not be granted. This fraudulent activity can range from making false claims about injuries or damage, to exaggerating medical problems in order to obtain higher payments.

**Also Read:**[ Detecting insurance fraud with graph technology](https://www.nebula-graph.io/posts/insurance-fraud-detection-with-graph)

## **Conclusion**

Traditionally, organizations have used rule-based systems and linear models to detect fraud. But as fraudsters become more sophisticated, these methods are becoming increasingly ineffective.

The sophistication of fraud means that we should stop approaching detection as a guessing game. It’s high time we started to uncover hidden connections and patterns within data, and detect even the most complex and well-concealed fraud schemes.

As we have seen, this is possible with graph machine learning. Graph models can reveal the subtle connections and relationships that exist within data, allowing us to see the bigger picture and gain a deeper understanding of data. With this capability, we can detect a developing fraudulent activity and stop it even before it’s actualized. It's not just a fraud detection software, it's a game-changer.

Think of it this way, with graph machine learning, fraud detection is no longer a reactive measure. It's a proactive approach that can keep your organization one step ahead of the fraudsters.

## **FAQ Section**

### **Why is graph machine learning used for fraud detection?**

Graph machine learning is used for fraud detection because it can accurately identify complex and hidden patterns plus connections that are not easily detectable by traditional methods. Graphs can represent the relationships and interactions between entities in a more intuitive way, and graph-based models can be used to analyze the structure of these relationships to detect patterns or anomalies that may indicate fraudulent activity.

### **How does graph machine learning work in fraud detection?**

Graph machine learning fraud detection works by creating a graph that represents the relationships and interactions between entities, and then creating fraud detection algorithms to analyze the graph for patterns or anomalies that may indicate fraudulent activity.

### **What are the challenges of using graph machine learning in fraud detection?**

Some of the common challenges associated with using graph machine learning for fraud detection include the high computational cost of analyzing large and complex graphs, the need for high-quality data to effectively train the model, and the need for high level experts to interpret the results.

### **How can graph machine learning prevent fraud in addition to detection?**

Graph machine learning can be used to prevent fraud by identifying at-risk individuals or transactions and taking proactive measures to prevent such activities. Graph machine learning can also be used to monitor known fraudulent actors to prevent further fraudulent activities.