Source-linked AI summary
Alleviating the Inconsistency Problem of Applying Graph Neural Network to Fraud Detection
Zhiwei Liu, Yingtong Dou, Philip S. Yu, Yutong Deng, Hao Peng
TL;DR
GNN fraud detectors rely on neighborhood similarity assumptions that are violated by context, feature, and relation inconsistencies. GraphConsis addresses these issues with context embeddings, consistency-based neighbor sampling, and relation attention, and experiments report its effectiveness.
Problem
Existing GNN fraud detectors largely overlook inconsistencies in neighbors' context, features, and relations, despite relying on neighborhood aggregation.
Method
GraphConsis combines context embeddings with node features, filters neighbors using consistency scores and sampling probabilities, and learns relation attention over sampled nodes.
Results
Experiments show GraphConsis is effective, while spam-review detection results report that it outperforms other models with 80% and 60% of training data on both metrics.
Takeaways & Limitations
Inconsistency is crucial in fraud detection and should be considered when applying GNN models to fraud detection tasks.
Abstract
from arXiv · showhide
The graph-based model can help to detect suspicious fraud online. Owing to the development of Graph Neural Networks~(GNNs), prior research work has proposed many GNN-based fraud detection frameworks based on either homogeneous graphs or heterogeneous graphs. These work follow the existing GNN framework by aggregating the neighboring information to learn the node embedding, which lays on the assumption that the neighbors share similar context, features, and relations. However, the inconsistency problem is hardly investigated, i.e., the context inconsistency, feature inconsistency, and relation inconsistency. In this paper, we introduce these inconsistencies and design a new GNN framework, $\mathsf{GraphConsis}$, to tackle the inconsistency problem: (1) for the context inconsistency, we propose to combine the context embeddings with node features, (2) for the feature inconsistency, we design a consistency score to filter the inconsistent neighbors and generate corresponding sampling probability, and (3) for the relation inconsistency, we learn a relation attention weights associated with the sampled nodes. Empirical analysis on four datasets indicates the inconsistency problem is crucial in a fraud detection task. The extensive experiments prove the effectiveness of $\mathsf{GraphConsis}$. We also released a GNN-based fraud detection toolbox with implementations of SOTA models. The code is available at https://github.com/safe-graph/DGFraud.
1 INTRODUCTION
GNN-based fraud detectors aggregate neighborhood information, but fraud graphs violate the assumption that neighbors share similar context, features, and relations. GraphConsis addresses these three inconsistencies with context embeddings, consistency-based neighbor sampling, and relational attention.
- Prior GNN-based fraud detection: Existing fraud detectors use GNNs on homogeneous or heterogeneous graphs to learn node representations through neighborhood aggregation.These frameworks target opinion, financial, and cyber-criminal fraud across several graph types and GNN architectures.
- The inconsistency problem: GNN aggregation assumes neighboring nodes have similar features and labels, an assumption that often breaks in fraud detection.The paper identifies context, feature, and relation inconsistency as three sources of this problem.
- The inconsistency problem: Context inconsistency arises when fraudsters connect to benign entities as camouflage, while feature inconsistency allows same-relation neighbors to have very different features.The toy example illustrates both behaviors around fraudster v1.
- The inconsistency problem: Relation inconsistency arises because different relation types connect neighbors with different degrees of similarity or fraud relevance.For reviews, a common-user relation may indicate greater suspiciousness than a common-product relation.
- GraphConsis: GraphConsis combines context embeddings with node features, filters inconsistent neighbors using consistency scores, and applies relation attention to sampled neighbors.These three techniques are designed to address context, feature, and relation inconsistency simultaneously.
2 PRELIMINARIES
The paper formulates fraud detection as node representation learning on a heterogeneous graph and uses GNNs to learn embeddings and a fraud classifier jointly. Its aggregation process samples neighbors and combines their information with the center node across layers.
- Graph and node representations: A heterogeneous graph represents nodes, node features, and edges grouped by R relation types.The learned node-mapping function preserves graph structure and original node features in a d-dimensional space.
- Graph and node representations: Fraud detection uses learned node representations with a classifier that maps each embedding to benign or fraudster labels.The paper denotes fraudsters by 1 and benign entities by 0.
- GNN framework: A GNN learns node representations and the classifier simultaneously from the graph and node labels.The representation function is trained through iterative neighbor aggregation.
- GNN framework: At each layer, the aggregation function assigns neighbor sampling probabilities, samples Q nodes, averages them, and combines the result with the center node.The L-layer framework aggregates information from the previous layer, with 1 ≤ l ≤ L.
3 PROPOSED MODEL
GraphConsis modifies neighbor aggregation to address feature and relation inconsistency while incorporating trainable context embeddings. It filters neighbors using consistency scores and weights sampled neighbors with relation-aware attention.
- 3 PROPOSED MODEL: The aggregation process combines sampled neighbor information with the center node representation.The framework samples Q neighbors and averages them before combining neighborhood and center-node information.
- 3.1 Context Embedding: GraphConsis introduces trainable context embeddings alongside node features to address context inconsistency.The context embedding is combined with the node representation during aggregation.
- 3.2 Neighbor Sampling: A consistency score measures neighbor compatibility, allowing inconsistent neighbors to be filtered before sampling.The framework applies threshold ϵ to remove distant neighbors.
- 3.2 Neighbor Sampling: Filtered neighbors receive sampling probabilities proportional to their normalized consistency scores at each aggregation layer.The probability is recalculated for each layer’s aggregation function.
- 3.3 Relation Attention: GraphConsis incorporates relation information by learning relation vectors and assigning self-attention weights to sampled neighbors.The relation-aware weights are applied to the sampled nodes during aggregation.
4 EXPERIMENTS
Experiments use YelpChi and benchmark graphs to characterize inconsistency and evaluate GraphConsis for spam-review detection. The results show that graph density and heterogeneous relations create challenges that GraphConsis addresses through feature-aware sampling and relation attention.
- 4.1.1 Dataset and Graph Construction.: The YelpChi graph contains 29,431 users, 182 products, and 45,954 reviews, including 14.5% spam reviews.Products with more than 800 reviews were removed, and reviews were represented using 100-dimensional Word2Vec features.
- 4.1.1 Dataset and Graph Construction.: YelpChi uses three relations: same user, same product with the same rating, and same product and month.These relations are denoted R-U-R, R-S-R, and R-T-R, respectively.
- 4.2 The Inconsistency Problem: YelpChi’s multi-relation graph has average node degree greater than 100, exceeding three widely used benchmark node-classification datasets.The comparison indicates that real-world fraud graphs contain complex relations and many neighbors.
- 4.2 The Inconsistency Problem: Less than 10% of neighboring nodes have similar labels in the R-T-R, R-S-R, and Yelp-ALL graphs.This context characteristic suggests that fraudulent entities may hide among regular entities under some relations.
- 4.2 The Inconsistency Problem: Feature characteristics differ across relations, so neighbors should be sampled using both relation and feature similarity rather than relation alone.The R-U-R graph has higher feature characteristic than the other two relations; different relations also require different attention weights during aggregation.
- 4.3 Performance Evaluation: GraphConsis outperforms the compared models at 80% and 60% training data on both F1-score and AUC.Its advantage over Player2Vec indicates that relation attention alone is insufficient, while its advantage over direct aggregation and equal-probability sampling supports the proposed neighbor-sampling techniques.
5 CONCLUSION AND FUTURE WORKS
The paper investigates three inconsistency problems in applying GNNs to fraud detection and proposes GraphConsis with corresponding modules. Experiments show GraphConsis is effective, while adaptive relation-specific sampling thresholds and evaluation on other fraud datasets remain future work.
- 5 CONCLUSION AND FUTURE WORKS: The paper investigates context, feature, and relation inconsistency in GNN-based fraud detection and proposes GraphConsis with three corresponding modules.The authors identify adaptive sampling thresholds for each relation and studies on other fraud datasets as future directions.