Detecting Fraud and Money Laudering in Real-Time Part 2

1. Detecting Fraud and Money
Laundering in Real-Time with a
Graph Database Part 2
Gaurav Deshpande and Dan Hu
September 26, 2018
Graph Gurus Episode 4

2. © 2018 TigerGraph. All Rights Reserved
Welcome
● Attendees are muted but you can talk to us via Chat in Zoom
● We will have 10 min for Q&A at the end
● Send questions at any time using the Q&A tab in the Zoom menu
● The webinar will be recorded
● A link to the presentation and reproducible steps will be emailed
2
Developer Edition Download https://www.tigergraph.com/developer/

3. © 2018 TigerGraph. All Rights Reserved
Today’s Moderator
● Built out and positioned IBM’s Big
Data and Analytics portfolio, driving
45 percent year-over-year growth.
● Led 2 startups through explosive
growth - i2 Technologies (IPO) & Trigo
Technologies (largest MDM
acquisition by IBM)
● Big Data Analytics Veteran, 14 patents
in supply chain management and big
data analytics
3
Gaurav Deshpande, VP of Marketing

4. © 2018 TigerGraph. All Rights Reserved
Today’s Guru
● BS & MS in Physics from University of
Science and Technology of China (USTC)
● PhD in Quantum Computation from
University of California, Merced
● 3-Year TigerGraph Veteran
● Solution Architect, Graph Query
Language Designer, Database Core
Engineer
4
Dr. Dan Hu, Distinguished AI Research Scientist

5. © 2018 TigerGraph. All Rights
Reserved
What is Money Laundering?
The process of transforming proceeds of illegal activities to
legitimate money
www.unodc.org/unodc/en/money-laundering/laundrycycle.html
5

6. © 2018 TigerGraph. All Rights
Reserved
Money Laundering Techniques - Layering
1. Funds to be laundered starts at one
source
2. Layering: Split and transferred in less
suspicious amounts to various accounts.
Split and transfer again...
3. Integration: transfer and consolidate…
4. Funds arrive in the account of a related
party
Perfect fit for graph analytics
6

7. © 2018 TigerGraph. All Rights
Reserved
Money Laundering Techniques - Layering Loop
● Layering requires many transactions
○ Smaller, less suspicious amounts
○ Complex pattern which is hard to notice
● But criminals still want to keep their money!
● Solution: Pass the funds around in a loop
7

8. © 2018 TigerGraph. All Rights
Reserved
AML Workflow with TigerGraph and Machine
Learning
8

9. Anti Money Laundering with TigerGraph In
Depth
Layering Loop Detection

10. © 2018 TigerGraph. All Rights
Reserved
Anti Money Laundering
• An effective anti money launder system should have the
following two features, i.e.
• Detect All Suspicious Behavior Quickly: system should find all
suspicious patterns of wrongdoing at all time.
• Be Easy to Use and Change: all patterns can be easily applied and
user could easily modify the pattern to adapt new rules.
10

11. © 2018 TigerGraph. All Rights
Reserved
Detect Suspicious Behavior with TigerGraph
• TigerGraph is a native graph database with multiple built-in
graph analytical tools.
• With its powerful graph query language (GSQL), TigerGraph
can do graph traversal & aggregation in a real time fashion.
• Detection of suspicious behavior can be easily converted into
a graph pattern matching problem.
11

12. © 2018 TigerGraph. All Rights
Reserved
Examples of detection of Suspicious
Behavior
• Detection of 1-level frequent money sender/receiver
• Detection of 2-level frequent money sender/receiver
• Detection of accounts with loop money transactions
• Controllable search depth (Up to 20 hops)
• Search transactions within a given time window
• Amount lower Limit
• Drain Ratio: (max - min) / max
• All transactions in the loop must be in a forward time series
12

13. © 2018 TigerGraph. All Rights
Reserved
Graph Schema Design
13

14. © 2018 TigerGraph. All Rights
Reserved
Loop Detection Pseudocode
a1
t4
t2
t1
send
send
a2
t3
a3
t5
send
send
send
send send
send
send
send
Algorithm: Start with one
account and collect paths
while traversal.
Disadvantages:
● memory cost: collect too
many invalid paths
● computation cost: can not
stop until arriving at the end
of traversal.
14

15. © 2018 TigerGraph. All Rights
Reserved
Bi-directional Loop Detection Pseudocode
a1
t4
t2
t1
rev_send
send
a2
t3
a3
t5
send
send
send
rev_send rev_send
send
send
send
Phase1: use bidirectional search
to mark the subgraph with loops.
Phase2: Traverse the subgraph
graph to collect loop paths.
Phase3: Apply path related filters
(drain ratio) on obtained paths
Note: The start account could be multiple related
accounts (such as linked by the same ID)
15

16. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
t5
send
send
send
rev_send rev_send
send
send
send
Algorithm
● Traverse the first half hops from the starting
account. Label vertices with the forward and
backward reachable flags.
● Limit the other half traversal among the
vertices with reachable flags, i.e.
○ Forward reachable vertex can only
reach backward reachable vertices.
○ Backward reachable vertex can only
reach forward reachable vertices.
● The potential loop candidates are the
vertices with both forward and backward
reach flags
16

17. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
Search Depth = 6, k = 1
a4 t5
a5
send send
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
17

18. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
Search Depth = 6, k = 2
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
18

19. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
Search Depth = 6, k = 3
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
19

20. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 4
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
20

21. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 5
rev_send
send
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
21

22. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
22

23. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
23

24. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 1
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
24

25. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 2
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
25

26. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 3
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
26

27. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 4
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
27

28. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 5
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
28

29. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
29

30. © 2018 TigerGraph. All Rights
Reserved
Phase 3: Apply Path Filters
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Drain Ratio Check
30

31. © 2018 TigerGraph. All Rights
Reserved
GSQL Query: Suspicious account with loop
transactions
Graph Data
http://192.168.0.118:14240/#/loading-executor
GSQL implementation on loop transactions
http://192.168.0.118:14240/#/query-editor
For GSQL Starter
https://info.tigergraph.com/en/gsql-webinar-1
31

32. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
• To search for all possible accounts with loop transactions,
one need to do loop detection query for all candidates.
• One solution would be expand the single account loop
detection algorithm to multiple accounts, which may
greatly complicate the query and may actually reduce the
performance.
• GSQL Query provide an easy alternative way to speed up
batch processing using Query Calling Query Feature.
32

33. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
Query Calling Query in parallel with GSQL
• Use Vertex Block to parallelization
• Start a Vertex Block with all candidate vertices
• Call the loop detection subquery in ACCUM block
• Use Edge Block to parallelization
• Start a Edge Block with all candidate vertices as target vertex
• Call the loop detection subquery in POST-ACCUM block
33

34. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
GSQL loop transactions in batch
http://192.168.0.118:14240/#/query-editor
34

35. © 2018 TigerGraph. All Rights
Reserved
GSQL Query: Suspicious account with loop
transactions
35

36. Q&A
Please send your questions via the Q&A menu in Zoom
36

37. © 2018 TigerGraph. All Rights Reserved
Thank You!
37
Compare the Developer Edition and Enterprise Free Trial
https://www.tigergraph.com/download/
Guru Scripts
https://github.com/tigergraph/ecosys/tree/master/guru_scripts
Join our Developer Forum
https://groups.google.com/a/opengsql.org/forum/#!forum/gsql-users
Download our Ebook
https://info.tigergraph.com/ebook
@TigerGraphDB youtube.com/tigergraph facebook.com/TigerGraphDB linkedin.com/company/TigerGraph

38. User Defined Function
38