Unsupervised graph anomaly detection - Catching new fraudulent behaviours

Summary

Fraud detection systems relying on historical training data often struggle to detect new fraudulent modus operandi because emerging patterns lack labeled supervision. Grab developed GraphBEAN, an unsupervised autoencoder model designed to detect anomalous patterns across bipartite interaction graphs representing consumers and merchants. The architecture uses graph convolution layers to encode node and edge attributes, then reconstructs features and edge existence through separate feature and structure decoders. High reconstruction errors flag rare, anomalous behaviors at both the node and edge levels. An automated pipeline applies heuristic fraud tags to these scores and routes them to human analysts and automated mitigation systems.

Context

Fraudsters continually innovate their methods, creating new patterns of fraudulent behavior that supervised machine learning models trained on historical data cannot detect due to the absence of labels.

Approach / What changed

Grab built GraphBEAN, an unsupervised bipartite graph autoencoder that encodes consumer and merchant node features alongside order edge features, using dedicated feature and structure decoders to compute reconstruction-based anomaly scores across both nodes and edges.

Takeaways

• GraphBEAN uses an encoder and two distinct decoders—a feature decoder and a structure decoder—to reconstruct node attributes, edge attributes, and graph structure.
• Anomaly scores are calculated from reconstruction error under the assumption that common, normal behaviors reconstruct easily while rare, fraudulent behaviors produce high errors.
• A downstream automated actioning pipeline combines GraphBEAN anomaly scores with heuristic fraud tags (such as promo abuse or collusion) to drive human review and automatic transaction blocks.

Related reading

• Grab · Nov 8, 2023

  Graph modelling guidelines

  Graph modelling uses graph theory to represent real-world entities, relationships, and properties through nodes and edges, unlocking insights across interconnected datasets. The process begins with defining domain concepts, mapping entities and relationships, and assigning relevant descriptive properties to both nodes and edges. Practitioners choose between graph structures such as property graphs or Resource Description Framework models before optionally developing a structural schema. Data is then imported or generated to populate storage systems such as Neo4j, Amazon Neptune, Azure Cosmos DB, or in-memory data structures. Finally, the graph is visualised and analysed using algorithmic methods like shortest path calculation, centrality measurement, and community detection.

  Wenxiang Lu

• Grab · May 15, 2023

  2.3x faster using the Go plugin to replace Lua virtual machine

  Talaria, an open-source distributed time-series database developed at Grab, previously allowed users to run custom data transformation scripts during ingestion using a Lua virtual machine. Launching and executing Lua scripts caused significant performance overhead when processing large volumes of events. To resolve this bottleneck, the team replaced the Lua VM with Go plugins compiled as Linux shared libraries (.so files). Benchmarks revealed that calling Go plugins achieves performance on par with native Go functions, executing roughly 2.3 times faster and consuming 2.3 times less memory than cached Lua VMs. Both execution methods conform to a unified Handler interface to load and run custom transformations.

  Yonghao Hu

• Grab · Oct 25, 2022

  Using mobile sensor data to encourage safer driving

  Dedicated vehicular inertial measurement units are prohibitively expensive to install across large fleets, while customer feedback lacks the coverage required to assess driving safety comprehensively. To monitor driver behavior at scale, Grab processes smartphone sensor data collected via a mobile telematics SDK at high sampling frequencies. A custom orientation algorithm calculates Euler roll and pitch angles from gravity and resolves yaw through principal component analysis to align phone measurements with vehicle axes. The pipeline applies low-pass or Kalman filtering to handle varying noise levels, followed by threshold peak-finding algorithms to detect harsh acceleration, braking, and cornering. Speeding events are identified by comparing GPS speeds against known map limits or aggregated speed profiles derived from free-flowing traffic.

  Laiyi Lin

• Grab · Nov 24, 2022

  Graph for fraud detection

  Rapid expansion across multiple business verticals introduced diverse, evolving fraud patterns at Grab, making traditional rule engines and decision trees inadequate due to their heavy reliance on extensive feature engineering and labeled data. To address cold starts and detect unknown fraud, the engineering team implemented a semi-supervised Relational Graph Convolutional Network (RGCN) across millions of connected ecosystem entities. The model propagates information along neighborhood nodes through graph convolutional layers to produce node embeddings and output fraud probabilities. Trained on graphs where only a small percentage of nodes are labeled, the RGCN achieved an AUROC close to 1 and distinctly separated fraudulent embeddings from genuine ones. The approach also offers high explainability by surfacing dense clusters of shared physical devices and addresses ongoing challenges in real-time prediction and noisy connections.

  Min Chen