# Unsupervised graph anomaly detection - Catching new fraudulent behaviours

[Grab](https://yomu.fyi/company/grab) · Rizal Fathony · Aug 2, 2023

**Type:** Problem & solution

## Summary

Fraud detection systems relying on historical training data often struggle to detect new fraudulent modus operandi because emerging patterns lack labeled supervision. Grab developed GraphBEAN, an unsupervised autoencoder model designed to detect anomalous patterns across bipartite interaction graphs representing consumers and merchants. The architecture uses graph convolution layers to encode node and edge attributes, then reconstructs features and edge existence through separate feature and structure decoders. High reconstruction errors flag rare, anomalous behaviors at both the node and edge levels. An automated pipeline applies heuristic fraud tags to these scores and routes them to human analysts and automated mitigation systems.

## Context

Fraudsters continually innovate their methods, creating new patterns of fraudulent behavior that supervised machine learning models trained on historical data cannot detect due to the absence of labels.

## Approach / What changed

Grab built GraphBEAN, an unsupervised bipartite graph autoencoder that encodes consumer and merchant node features alongside order edge features, using dedicated feature and structure decoders to compute reconstruction-based anomaly scores across both nodes and edges.

## Takeaways

- GraphBEAN uses an encoder and two distinct decoders—a feature decoder and a structure decoder—to reconstruct node attributes, edge attributes, and graph structure.
- Anomaly scores are calculated from reconstruction error under the assumption that common, normal behaviors reconstruct easily while rare, fraudulent behaviors produce high errors.
- A downstream automated actioning pipeline combines GraphBEAN anomaly scores with heuristic fraud tags (such as promo abuse or collusion) to drive human review and automatic transaction blocks.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Data Pipelines](https://yomu.fyi/topic/data-pipelines), [Machine Learning](https://yomu.fyi/topic/machine-learning)

[Read original post](https://engineering.grab.com/graph-anomaly-model)