Source-linked AI summary
DGraph: A Large-Scale Financial Dataset for Graph Anomaly Detection
Xuanwen Huang, Yang Yang, Yang Wang, Chunping Wang, Zhisheng Zhang, Jiarong Xu, Lei Chen, Michalis Vazirgiannis
TL;DR
Graph anomaly detection needs more varied, realistic datasets because anomalies are rare and existing graph datasets with ground truth are limited. The paper introduces DGraph, a large-scale dynamic financial graph with labeled fraudsters, background nodes, preserved missing values, and extensive observations and experiments. DGraph reveals distinct anomaly-related graph and temporal patterns, highlights background nodes, and exposes limited generalization of current methods.
Problem
Graph anomaly detection lacks varied real-world datasets combining graph structure and anomaly ground truth, despite the importance of application-oriented evaluation.
Method
The paper constructs DGraph, a real-world dynamic financial graph from user profiles, emergency-contact relationships, borrowing behavior, and preserved missing values.
Results
DGraph contains over 3M nodes, 4M dynamic edges, and over 1M ground-truth nodes; experiments reveal distinct anomaly characteristics and limited generalization of current methods.
Takeaways & Limitations
DGraph supports deeper exploration of anomalous and background nodes and provides a challenging benchmark for advancing graph anomaly-detection methods.
Abstract
from arXiv · showhide
Graph Anomaly Detection (GAD) has recently become a hot research spot due to its practicability and theoretical value. Since GAD emphasizes the application and the rarity of anomalous samples, enriching the varieties of its datasets is fundamental work. Thus, this paper present DGraph, a real-world dynamic graph in the finance domain. DGraph overcomes many limitations of current GAD datasets. It contains about 3M nodes, 4M dynamic edges, and 1M ground-truth nodes. We provide a comprehensive observation of DGraph, revealing that anomalous nodes and normal nodes generally have different structures, neighbor distribution, and temporal dynamics. Moreover, it suggests that unlabeled nodes are also essential for detecting fraudsters. Furthermore, we conduct extensive experiments on DGraph. Observation and experiments demonstrate that DGraph is propulsive to advance GAD research and enable in-depth exploration of anomalous nodes.
1 Introduction
DGraph addresses the scarcity and limitations of realistic graph anomaly-detection datasets by introducing a large-scale financial dynamic graph. Observations and experiments show distinctive anomaly characteristics, the importance of background nodes, and limited generalization of current methods.
- Only a small number of public datasets combine graph structure with anomaly ground truth, motivating broader coverage of representative application domains such as financial fraud detection.
- DGraph contains over 3M nodes and 4M edges, over 1M ground-truth nodes, and more than 2M background nodes from a real-world financial social network.Nodes represent Finvolution users, while directed edges represent emergency-contact relationships.
- Anomalous and normal users differ in network structure, neighbor-feature distributions, and temporal dynamics, making comprehensive modeling of DGraph challenging.
- Background nodes are vital for fraudster detection and support deeper study of unlabeled users in graph anomaly detection.
- Experiments with 9 supervised and 7 unsupervised methods reveal limited generalization of current graph anomaly-detection methods on DGraph.
2 Related datasets
Graph anomaly detection research has expanded across practical domains, but datasets with anomaly ground truth and graph structure remain scarce and often too small for node-level evaluation.
- Existing graph anomaly-detection applications include financial fraud, Bitcoin anti-money laundering, and fake-news filtering on social media.
- Only a limited set of datasets provide both anomaly ground truth and graph structure, including Enron, Twitter Sybil, Disney, Amazon, Elliptic, and YelpChi.
- More than half of these datasets are unsuitable for node-level graph anomaly detection because their network structures are small.Enron, for example, contains about 150 users.
3 Proposed Dataset: DGraph
DGraph is a privacy-preserving, real-world financial dynamic graph built from user profiles, emergency-contact records, and borrowing behavior. Its construction preserves missing values and distinguishes fraudsters, normal borrowers, and non-borrowing background users.
- DGraph links a real-world finance scenario to fraudster detection through a dynamic graph derived from Finvolution data.
- Raw data are privacy-protected through masking, and an online leaderboard supports tracking and evaluation of new DGraph methods.
- The dataset construction creates directed time-dependent emergency-contact edges by matching contact telephone numbers to Finvolution user identities.
- DGraph represents each user with a 17-dimensional profile feature vector, preserving optional missing attributes as “-”.
- Borrowing behavior labels 15,509 users as fraudsters and 1,210,092 as normal, while 2,474,949 non-borrowing users are designated background nodes rather than detection targets.
4 Observation on DGraph
DGraph exhibits distinct fraudster–normal differences in structure, neighbor features, missing values, and temporal dynamics, while background nodes are difficult to distinguish yet important for connectivity and fraud detection.
- Anomalous vs. normal: 2.33×: normal users’ average out-degree is 1.73 versus 0.75 for fraudsters, indicating graph structure differentiates the groups.Their average in-degrees are similar, but out-degrees differ significantly.
- Anomalous vs. normal: 0.242 versus 0.324: fraudsters have lower average out-edge neighbor similarity than normal users, making neighbor features informative for detection.
- Anomalous vs. normal: 41.8% versus 19.0%: normal users more often have no missing values than fraudsters, while edge timing also differs at matched out-degrees.Fraudsters have lower average time intervals between out-edges than normal users with the same out-degree.
- Overall: DGraph combines differences in structure, neighbor feature distribution, missing values, and temporal dynamics with connectivity-critical background nodes, providing multiple axes for evaluating graph models.
- Background node: 92% of sampled background nodes are inseparable from other nodes by features, yet removing them produces 605,194 weakly connected components, including 380,490 single-node components.Background nodes therefore contribute substantially to DGraph’s connectivity despite being difficult to identify from features.
- Background node: 46.0% of anomalous nodes’ in-neighbors are background nodes, compared with 31.1% of their out-neighbors, and two-hop background-mediated links have higher homophily.These patterns indicate that background nodes contain semantic information relevant to fraudster detection.
5 Experiments on DGraph
Experiments on DGraph evaluate supervised and unsupervised methods, missing-value handling, and background-node processing. Results show that graph structure, node features, temporal information, missing-value treatment, and background nodes materially affect fraud detection.
- 5.1 Performance of current models (Q1): TGAT achieves the state-of-art performance among supervised methods by combining dynamic information, node features, and graph information.
- 5.1 Performance of current models (Q1): Most GAD methods do not outperform general GNNs on DGraph, contrasting with results on Amazon and YelpChi.MLPs and DevNet underperform methods using graph information and node features, while Node2Vec underperforms methods using both.
- 5.1 Performance of current models (Q1): MLPAE and OCGNN achieve the best unsupervised AUC and AP values of 0.625 and 0.019, respectively, while other methods may exceed memory or time limits.
- 5.2 Missing values in DGraph (Q2): Handling missing values improves GCNs by an average of 0.39% AUC and MLPs by 0.11% AUC, with Trick B best among GCN settings.The results indicate that missing-value handling is more consequential for GCNs, while the generally suitable replacement value remains task-specific.
- 5.3 Background nodes in DGraph (Q3): Removing background nodes lowers average GCN test AUC from 0.76 to 0.72, while reducing time cost from 20 to 12.This exposes a trade-off between compressing background nodes for speed and preserving their contribution to performance.
- 5.3 Background nodes in DGraph (Q3): Adding background labels improves GCN by 2.26%, whereas RGCN improves over GCN by 4.39% under a matched parameter count.These results support investigating background nodes as a source of semantic information for GAD.
6 Conclusion
The paper presents DGraph as a real-world dynamic financial graph designed to broaden GAD datasets and address limitations of existing benchmarks. Its observations show differences between anomalous and normal nodes across multiple graph-related characteristics.
- 6 Conclusion: DGraph is a real-world dynamic financial graph that preserves missing node-feature values and identifies no-borrowing users as background nodes.The paper reports that anomalous and normal nodes differ across various graph-related characteristics.
Checklist
The checklist records affirmative responses for claims, reproducibility details, asset attribution, and ethics-related documentation. It records negative responses for describing limitations, potential negative societal impacts, and including new assets.
- Checklist: The paper reports that its main claims accurately reflect its contributions and scope.
- Checklist: The checklist reports that the paper does not discuss limitations or potential negative societal impacts.
- Checklist: The paper reports providing code, data, reproduction instructions, training details, error bars, and compute information for experiments.
- Checklist: The paper reports citing existing assets and describing their licenses, while reporting no new assets in supplemental material or via URL.
- Checklist: The checklist marks participant-related instructions, risks, compensation, and institutional review documentation as not applicable.
A.1 About DGraph
DGraph’s data collection and release are framed around user approval, data minimization, anonymization, and legal compliance. The paper describes deleting personal identifiers, randomizing user order, and restricting access through a license.
- A.1 About DGraph: The collected behavior data and data type were approved by users, and the paper states that the data are necessary for the platform’s anti-fraud algorithm.
- A.1 About DGraph: The underlying user service collects identity and emergency-contact information for real-name verification and credit evaluation.
- A.1 About DGraph: DGraph follows stated Chinese personal-information law and GDPR requirements, with disclosed data protected by encryption and anonymization.
- A.1 About DGraph: Users are anonymized by deleting personal identifiers and randomizing user order; non-unique features are also cited as preventing identification through the dataset.
- A.1 About DGraph: Access requires a name, email address, and confirmation of agreement with a user license intended to restrict non-commercial, unethical, unfair, or socially harmful use.
A.2 Explanations of the observation
Fraudsters’ observed differences are explained by how their financial goals shape emergency-contact behavior, profile completion, and timing. The paper also cautions that background nodes are only preliminarily explored.
- Fraudsters tend to fill fewer emergency contacts because additional contacts do not help them defraud money.
- Fraudsters’ emergency contacts show lower feature similarity because some may provide false contacts lacking genuine social connections.
- Fraudsters often leave optional profile fields incomplete, producing a larger proportion of missing node-feature values.
- Some fraudsters add multiple emergency contacts within a short period, consistent with seeking loans quickly rather than carefully completing profiles.
- Background nodes are unique to DGraph and receive only preliminary exploration of their properties in this paper.
A.3.1 Data splitting
The evaluation uses fixed random data splits and compares feature-only, static, dynamic, supervised, and unsupervised graph-anomaly methods. An ablation tests whether the emergency-contact structure matters for performance.
- Data splitting: DGraph nodes are randomly split into training, validation, and test sets using a fixed 70/15/15 partition.
- Methods: The evaluation includes Node2Vec, GCN, SAGE, and dynamic TGAT, using structure, node features, or temporal edges according to each model’s design.
- Methods: Supervised anomaly methods include DevNet, CARE-GNN, PC-GNN, and AMNet, with components designed for extreme sample imbalance.
- Methods: Unsupervised evaluation covers SCAN, MLPAE, GCNAE, Radar, DOMINANT, GUIDE, and OCGNN.
- Ablation Studies: The ablation compares self-loop, random, and feature-similarity-based K-nearest-neighbor network structures while matching the original edge count where specified.
- Ablation Studies: GCN achieves the best performance on the original emergency-contact network compared with alternative network structures.