Source-linked AI summary
Heterogeneous Graph Neural Networks for Malicious Account Detection
Ziqi Liu, Chaochao Chen, Xinxing Yang, Jun Zhou, Xiaolong Li, Le Song
TL;DR
Malicious-account detection in online and financial services requires high precision and recall despite evolving attacker behavior. GEM learns account embeddings from heterogeneous account-device graphs by combining device and activity aggregation, and its Alipay deployment reports large-scale detection with high precision and broader coverage. The paper also identifies smaller connected subgraphs and daily rather than real-time detection as scope boundaries.
Problem
Malicious accounts harm online and financial systems, while existing methods face difficulty balancing high precision and recall as attack strategies evolve.
Method
GEM learns discriminative account embeddings from heterogeneous account-device graphs by jointly modeling device aggregation and activity aggregation with attention across device types.
Results
Over 98% precision and 10% more account coverage than a former rule-based approach are reported for Alipay’s top-ten-thousand daily risk strategy.
Takeaways & Limitations
GEM is deployed at Alipay, detects tens of thousands of malicious accounts daily, and reports promising results compared with competitive methods.
Takeaways & Limitations
The connected-subgraph approach performs poorly for malicious accounts in smaller subgraphs, and the described system is daily rather than real-time.
Abstract
from arXiv · showhide
We present, GEM, the first heterogeneous graph neural network approach for detecting malicious accounts at Alipay, one of the world's leading mobile cashless payment platform. Our approach, inspired from a connected subgraph approach, adaptively learns discriminative embeddings from heterogeneous account-device graphs based on two fundamental weaknesses of attackers, i.e. device aggregation and activity aggregation. For the heterogeneous graph consists of various types of nodes, we propose an attention mechanism to learn the importance of different types of nodes, while using the sum operator for modeling the aggregation patterns of nodes in each type. Experiments show that our approaches consistently perform promising results compared with competitive methods over time.
1 INTRODUCTION
GEM addresses malicious-account detection in large online and financial services by modeling attackers’ device and activity aggregation in heterogeneous graphs. Deployed at Alipay, it reports daily detection at scale and improved coverage while maintaining high precision.
- Malicious accounts threaten online services through spam, illicit profit, and cash-out activity, making accurate detection important.
- Existing approaches include rule-based, graph-based, and machine-learning methods, but evolving attacks make adaptable detection difficult.
- Attackers tend to concentrate accounts on few devices and compress malicious activity into short campaign periods.
- GEM jointly learns from heterogeneous account-device topology and account activity, using attention across device types and local behavioral context.
- At Alipay, GEM detects tens of thousands of malicious accounts daily and empirically outperforms competitive methods.
2 PRELIMINARIES
The preliminaries describe graph neural networks as neighborhood-aggregation models and node-embedding methods as structure-preserving representations. They situate GEM’s design within these approaches, emphasizing aggregation operators and heterogeneous-node attention.
- Graph neural networks predict graph, edge, or node labels by directly operating on graph structures and neighborhoods.
- GCN learns node representations from features and adjacency structure through normalized neighborhood convolution and nonlinear transformations.
- Iterative neighborhood aggregation methods differ in how they define the receptive fields over which nodes exchange information.
- GEM uses sum aggregation for each node type and attention to reweight the importance of node types in heterogeneous graphs.
- Node-embedding methods learn representations that preserve graph structure, often by modeling relationships among node pairs.
- These embedding methods are commonly unsupervised, with learned node representations later used as graph statistics or classifier inputs.
3 THE PROPOSED APPROACHES
The proposed approach models malicious accounts through device and activity aggregation in heterogeneous account-device graphs, extending connected-subgraph reasoning with learned embeddings and type-aware aggregation.
- Aggregation patterns: Device aggregation flags accounts sharing devices with many other accounts, while activity aggregation flags accounts sharing devices whose behaviors occur in batches.Device aggregation can use connected-component size; activity similarity can use the inner product of account activity vectors.
- Aggregation patterns: Alipay data show normal accounts distributed across devices and time, whereas malicious accounts concentrate on particular devices and burst during short periods.The figures accumulate account-device behavior over seven consecutive days and represent account activity over time.
- Connected Subgraph: The connected-subgraph baseline links accounts sharing devices, removes edges below an activity-similarity threshold θ, and scores accounts by subgraph size.The threshold controls graph sparsity and can be tuned on a validation set.
- Connected Subgraph: Connected-subgraph scoring can detect malicious accounts in the largest components but deteriorates seriously for malicious accounts in smaller components.This limitation motivates a more machine-learning-oriented function that jointly uses graph topology and account features.
- GEM: GEM learns node embeddings from the heterogeneous account-device topology while modeling activity characteristics in local graph structure.The approach is framed as learning a parameterized score function that imitates summed connectivities in an account graph.
- GEM: The heterogeneous graph preserves separate edge structures for each device type, and GEM sums neighborhoods within each type before averaging across types.The type-specific representation retains all vertices and has the same storage complexity as the original graph because only sparse edges are stored.
4 EXPERIMENTS
The experiments evaluate the proposed approaches after deployment as a real system at Alipay.
- Experimental setting: The experiments report results from the proposed approaches deployed as a real system at Alipay.The supplied passage introduces the experimental-results section but does not provide quantitative findings.
4.1 Datasets
The dataset is a one-month Alipay dataset split into four consecutive weekly prediction tasks for newly registered accounts, using heterogeneous account-device graphs and account features.
- Prediction setting: The system targets hundreds of thousands of newly registered accounts daily, while long-used accounts have more profiles available for risk evaluation.Graphs are built daily from active accounts and their associated devices.
- Dataset construction: The one-month preprocessed Alipay dataset is split into four consecutive weeks, with each week producing a heterogeneous graph from accounts, devices, and activities.Partially labeled accounts come from the first six days, and newly registered accounts at each week’s end are predicted.
- Features: Account activity features use 168 hourly slots, supplemented by six device-type features and around 200 demographic features.The resulting feature representation has 374 dimensions.
4.2 Experimental Settings
The evaluation uses hindsight ground-truth labels for suspicious newly registered accounts and reports F-1, AUC, and precision–recall performance. GEM is compared with connected-subgraph and graph-based machine-learning baselines.
- Evaluation: Alipay labels suspicious newly registered accounts after long-term observation, using hindsight to establish evaluation ground truth.
- Evaluation: The reported measures are F-1 score, AUC, and precision–recall curves evaluated on the ground-truth labels.
- Evaluation: Precision–recall curves assess how thresholds balance high-confidence malicious-account detection against disruption to normal users and coverage of malicious accounts.
- Baselines: The comparison includes Connected Subgraph, GBDT+Graph, and GBDT+Node2Vec baselines, alongside the proposed methods.
- Implementation: Node2Vec repeatedly samples 100 paths per node, with each path having length 50.
4.3 Results
GEM and GEM-attention outperform the comparison methods across the reported evaluations, with attention-based aggregation providing the strongest results. The experiments also examine precision–recall behavior, model depth, device-type contributions, and online deployment performance.
- Basic Measures: Connected Subgraph performs poorly because benign accounts are interwoven with malicious accounts, which occur in both large and small connected subgraphs.
- Basic Measures: GCN performs better than GBDT+Graph and GBDT+Node2Vec because it learns label- and activity-informed node embeddings.
- Basic Measures: GEM consistently outperforms GCN by modeling heterogeneous device types and using type-specific aggregators for aggregation patterns.
- Basic Measures: GEM-attention performs best because it learns different importance coefficients for device types rather than treating all device types as equally important.Device data can differ in noise and availability, motivating adaptive weighting.
- Precision-Recall Curves: GEM significantly outperforms comparison methods in the area beneath the precision–recall curve across the reported test weeks.
- Precision-Recall Curves: Connected Subgraph starts with high precision on large components but its precision drops quickly as identified component sizes become smaller.The largest connected subgraph in the experimental dataset contains 1538 accounts.
- Precision-Recall Curves: The proposed methods maintain relatively high precision while detecting more malicious accounts at high recall.
- Model Complexity: With appropriate regularization, varying embedding sizes from 8 to 128 produces no significant F-1-score differences.
5 CONCLUSION
GEM applies heterogeneous graph neural networks to daily malicious-account detection at Alipay, modeling attacker weaknesses through account-device graphs. The paper reports promising precision-recall curves and identifies real-time detection on dynamic graphs as future work.
- 5 CONCLUSION: GEM applies graph neural networks to malicious-account detection using heterogeneous account-device graphs.The approach is based on the attacker weaknesses termed device aggregation and activity aggregation.
- 5 CONCLUSION: The paper summarizes device aggregation and activity aggregation as two fundamental attacker weaknesses underlying its approach.
- 5 CONCLUSION: GEM achieves promising precision-recall curves compared with competitive methods.
- 5 CONCLUSION: Future work targets real-time malicious-account detection using dynamic graphs instead of the proposed daily detection system.