Weitere ähnliche Inhalte
Ähnlich wie Graph Gurus Episode 4: Detecting Fraud and Money Laudering in Real-Time Part 2 (20)
Kürzlich hochgeladen (20)
Graph Gurus Episode 4: Detecting Fraud and Money Laudering in Real-Time Part 2
- 1. Detecting Fraud and Money
Laundering in Real-Time with a
Graph Database Part 2
Gaurav Deshpande and Dan Hu
September 26, 2018
Graph Gurus Episode 4
- 2. © 2018 TigerGraph. All Rights Reserved
Welcome
● Attendees are muted but you can talk to us via Chat in Zoom
● We will have 10 min for Q&A at the end
● Send questions at any time using the Q&A tab in the Zoom menu
● The webinar will be recorded
● A link to the presentation and reproducible steps will be emailed
2
Developer Edition Download https://www.tigergraph.com/developer/
- 3. © 2018 TigerGraph. All Rights Reserved
Today’s Moderator
● Built out and positioned IBM’s Big
Data and Analytics portfolio, driving
45 percent year-over-year growth.
● Led 2 startups through explosive
growth - i2 Technologies (IPO) & Trigo
Technologies (largest MDM
acquisition by IBM)
● Big Data Analytics Veteran, 14 patents
in supply chain management and big
data analytics
3
Gaurav Deshpande, VP of Marketing
- 4. © 2018 TigerGraph. All Rights Reserved
Today’s Guru
● BS & MS in Physics from University of
Science and Technology of China (USTC)
● PhD in Quantum Computation from
University of California, Merced
● 3-Year TigerGraph Veteran
● Solution Architect, Graph Query
Language Designer, Database Core
Engineer
4
Dr. Dan Hu, Distinguished AI Research Scientist
- 5. © 2018 TigerGraph. All Rights
Reserved
What is Money Laundering?
The process of transforming proceeds of illegal activities to
legitimate money
www.unodc.org/unodc/en/money-laundering/laundrycycle.html
5
- 6. © 2018 TigerGraph. All Rights
Reserved
Money Laundering Techniques - Layering
1. Funds to be laundered starts at one
source
2. Layering: Split and transferred in less
suspicious amounts to various accounts.
Split and transfer again...
3. Integration: transfer and consolidate…
4. Funds arrive in the account of a related
party
Perfect fit for graph analytics
6
- 7. © 2018 TigerGraph. All Rights
Reserved
Money Laundering Techniques - Layering Loop
● Layering requires many transactions
○ Smaller, less suspicious amounts
○ Complex pattern which is hard to notice
● But criminals still want to keep their money!
● Solution: Pass the funds around in a loop
7
- 8. © 2018 TigerGraph. All Rights
Reserved
AML Workflow with TigerGraph and Machine
Learning
8
- 10. © 2018 TigerGraph. All Rights
Reserved
Anti Money Laundering
• An effective anti money launder system should have the
following two features, i.e.
• Detect All Suspicious Behavior Quickly: system should find all
suspicious patterns of wrongdoing at all time.
• Be Easy to Use and Change: all patterns can be easily applied and
user could easily modify the pattern to adapt new rules.
10
- 11. © 2018 TigerGraph. All Rights
Reserved
Detect Suspicious Behavior with TigerGraph
• TigerGraph is a native graph database with multiple built-in
graph analytical tools.
• With its powerful graph query language (GSQL), TigerGraph
can do graph traversal & aggregation in a real time fashion.
• Detection of suspicious behavior can be easily converted into
a graph pattern matching problem.
11
- 12. © 2018 TigerGraph. All Rights
Reserved
Examples of detection of Suspicious
Behavior
• Detection of 1-level frequent money sender/receiver
• Detection of 2-level frequent money sender/receiver
• Detection of accounts with loop money transactions
• Controllable search depth (Up to 20 hops)
• Search transactions within a given time window
• Amount lower Limit
• Drain Ratio: (max - min) / max
• All transactions in the loop must be in a forward time series
12
- 14. © 2018 TigerGraph. All Rights
Reserved
Loop Detection Pseudocode
a1
t4
t2
t1
send
send
a2
t3
a3
t5
send
send
send
send send
send
send
send
Algorithm: Start with one
account and collect paths
while traversal.
Disadvantages:
● memory cost: collect too
many invalid paths
● computation cost: can not
stop until arriving at the end
of traversal.
14
- 15. © 2018 TigerGraph. All Rights
Reserved
Bi-directional Loop Detection Pseudocode
a1
t4
t2
t1
rev_send
send
a2
t3
a3
t5
send
send
send
rev_send rev_send
send
send
send
Phase1: use bidirectional search
to mark the subgraph with loops.
Phase2: Traverse the subgraph
graph to collect loop paths.
Phase3: Apply path related filters
(drain ratio) on obtained paths
Note: The start account could be multiple related
accounts (such as linked by the same ID)
15
- 16. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
t5
send
send
send
rev_send rev_send
send
send
send
Algorithm
● Traverse the first half hops from the starting
account. Label vertices with the forward and
backward reachable flags.
● Limit the other half traversal among the
vertices with reachable flags, i.e.
○ Forward reachable vertex can only
reach backward reachable vertices.
○ Backward reachable vertex can only
reach forward reachable vertices.
● The potential loop candidates are the
vertices with both forward and backward
reach flags
16
- 17. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
Search Depth = 6, k = 1
a4 t5
a5
send send
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
17
- 18. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
Search Depth = 6, k = 2
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
18
- 19. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
Search Depth = 6, k = 3
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
19
- 20. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 4
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
20
- 21. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 5
rev_send
send
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
21
- 22. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
22
- 23. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
23
- 24. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 1
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
24
- 25. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 2
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
25
- 26. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 3
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
26
- 27. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 4
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
27
- 28. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 5
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
28
- 29. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
29
- 30. © 2018 TigerGraph. All Rights
Reserved
Phase 3: Apply Path Filters
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Drain Ratio Check
30
- 31. © 2018 TigerGraph. All Rights
Reserved
GSQL Query: Suspicious account with loop
transactions
Graph Data
http://192.168.0.118:14240/#/loading-executor
GSQL implementation on loop transactions
http://192.168.0.118:14240/#/query-editor
For GSQL Starter
https://info.tigergraph.com/en/gsql-webinar-1
31
- 32. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
• To search for all possible accounts with loop transactions,
one need to do loop detection query for all candidates.
• One solution would be expand the single account loop
detection algorithm to multiple accounts, which may
greatly complicate the query and may actually reduce the
performance.
• GSQL Query provide an easy alternative way to speed up
batch processing using Query Calling Query Feature.
32
- 33. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
Query Calling Query in parallel with GSQL
• Use Vertex Block to parallelization
• Start a Vertex Block with all candidate vertices
• Call the loop detection subquery in ACCUM block
• Use Edge Block to parallelization
• Start a Edge Block with all candidate vertices as target vertex
• Call the loop detection subquery in POST-ACCUM block
33
- 34. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
GSQL loop transactions in batch
http://192.168.0.118:14240/#/query-editor
34
- 35. © 2018 TigerGraph. All Rights
Reserved
GSQL Query: Suspicious account with loop
transactions
35
- 37. © 2018 TigerGraph. All Rights Reserved
Thank You!
37
Compare the Developer Edition and Enterprise Free Trial
https://www.tigergraph.com/download/
Guru Scripts
https://github.com/tigergraph/ecosys/tree/master/guru_scripts
Join our Developer Forum
https://groups.google.com/a/opengsql.org/forum/#!forum/gsql-users
Download our Ebook
https://info.tigergraph.com/ebook
@TigerGraphDB youtube.com/tigergraph facebook.com/TigerGraphDB linkedin.com/company/TigerGraph