Graph service platform

Summary

Grab's GrabDefence team required a dedicated graph infrastructure to proactively identify mobile fraud patterns, such as multiple accounts operating on shared physical devices and suspicious financial loops. To address this, the team built a four-layer Platform as a Service that encapsulates graph database operations behind uniform RESTful APIs for OLTP search and OLAP analysis. The architecture utilizes Amazon S3 for raw data files, Amazon Neptune for graph storage, DynamoDB for schema and metadata configurations, and Kafka for streaming ingestion. When users trigger data loading tasks, the service validates entity attributes against schemas stored in DynamoDB before importing records into Neptune. This infrastructure allows investigators to traverse adjacent account IDs and visualize complex entity relationships without managing underlying database runtimes.

Context

Grab's fraud detection team needed to discover complex data linkages in consumer data to proactively identify malicious behavior, such as shared physical devices across accounts, transaction loops, and money laundering.

Approach / What changed

Grab built a graph service platform (PaaS) layered over Amazon Neptune, Amazon S3, and DynamoDB, using Kafka for stream ingestion and exposing RESTful APIs for graph management, OLTP search, and OLAP analysis.

Takeaways

• The graph service synchronizes and validates entity and attribute data against DynamoDB schemas before importing S3 CSV files into Amazon Neptune.
• Using Kafka as a streaming write engine provides primary user authentication while mitigating write pressure on the Neptune database cluster.
• The platform exposes separate RESTful API interfaces for real-time stream search (OLTP) and batch processing graph analysis (OLAP).

Related reading

• Grab · Oct 28, 2019

  Griffin, an Anti-fraud Risk Rule Engine Making Billions of Predictions Daily

  Grab's Trust/Identity/Safety team built Griffin, an in-house anti-fraud risk rule engine designed to process billions of daily predictions across multiple business verticals. Initially, Grab managed fraud rules directly within backend service code, but escalating rule complexity, tight rule interdependencies, and translation gaps between data scientists and developers caused deployment delays and misfiring errors. To overcome the limitations and steep learning curves of third-party engines like Drools, the team separated the workflow into data orchestration and rule-based prediction. Griffin enables analysts and data scientists to author Python-based rules directly via a web portal and reload updated logic into memory without manual developer intervention. By eliminating I/O during rule evaluation and leveraging Gunicorn multi-processing, the engine handles over 100,000 queries per second at peak on six EC2 instances with single-prediction latencies under six milliseconds.

  Muqi Li

• Grab · Oct 21, 2019

  Using Grab’s Trust Counter Service to Detect Fraud Successfully

  Grab's Trust Platform team built the Counter service to detect fraud across business verticals like transportation, food, and payments. The platform replaces manual, multi-week engineering cycles with a self-service UI where data analysts can define and experiment with counters independently. Operating on an asynchronous ingestion and synchronous transaction model, the architecture evaluates incoming stream data, enriches it via internal services, and persists aggregated signals to ScyllaDB through Grab-Stats. A multi-bucket strategy partitions queries into fifteen-minute, hourly, and daily granularities to maintain low-latency query aggregations across wide time ranges under strict SLAs.

  Chao Wang

• Grab · Apr 28, 2022

  Graph Networks - Striking fraud syndicates in the dark

  Grab's Integrity team faced escalating threats from organized fraud syndicates operating device farms and GPS spoofing tools that mimic normal user behavior. To overcome the limitations of traditional rule-based systems, Grab built a Graph-based Prediction Platform that links entities across shared attributes to expose hidden network structures. The architecture includes a scalable graph database platform holding over one billion nodes, powering real-time graph visualization for analysts alongside a configurable network feature extraction system. In addition, the team deployed Graph Neural Networks to capture structural correlations across transaction networks. These systems collectively help detect coordinated promo abuse, payment fraud, and complex money laundering schemes.

  Muqi Li

• Grab · Jun 30, 2022

  Graph Networks - 10X investigation with Graph Visualisations

  Fraud detection traditionally required investigators to manually combine large datasets from disparate anti-fraud systems using statistical methods, which proved slow and inefficient. Grab built an interactive Graph Visualisation platform to transform raw records into connected visual maps without requiring manual queries or switching tools. The platform manages over three billion nodes and edges, allowing investigators to selectively expand data points and replay chronological events using temporal filters. Visual relationship mapping helps teams verify account appeals, uncover device-sharing rings, and spot anti-money laundering behavior through transaction density patterns.

  Fujiao Liu