This document discusses using TigerGraph and machine learning to detect money laundering. It describes money laundering techniques like layering and layering loops. It then outlines an AML workflow with TigerGraph, and goes into depth on how TigerGraph can detect layering loops through a bi-directional graph search approach in multiple phases. It provides pseudocode and examples to illustrate the loop detection approach. Finally, it discusses implementing loop detection as a GSQL query in TigerGraph.

1. Detecting Fraud and Money
Laundering in Real-Time with a
Graph Database Part 2
Gaurav Deshpande and Dan Hu
September 26, 2018
Graph Gurus Episode 4

2. © 2018 TigerGraph. All Rights Reserved
Welcome
● Attendees are muted but you can talk to us via Chat in Zoom
● We will have 10 min for Q&A at the end
● Send questions at any time using the Q&A tab in the Zoom menu
● The webinar will be recorded
● A link to the presentation and reproducible steps will be emailed
2
Developer Edition Download https://www.tigergraph.com/developer/

3. © 2018 TigerGraph. All Rights Reserved
Today’s Moderator
● Built out and positioned IBM’s Big
Data and Analytics portfolio, driving
45 percent year-over-year growth.
● Led 2 startups through explosive
growth - i2 Technologies (IPO) & Trigo
Technologies (largest MDM
acquisition by IBM)
● Big Data Analytics Veteran, 14 patents
in supply chain management and big
data analytics
3
Gaurav Deshpande, VP of Marketing

4. © 2018 TigerGraph. All Rights Reserved
Today’s Guru
● BS & MS in Physics from University of
Science and Technology of China (USTC)
● PhD in Quantum Computation from
University of California, Merced
● 3-Year TigerGraph Veteran
● Solution Architect, Graph Query
Language Designer, Database Core
Engineer
4
Dr. Dan Hu, Distinguished AI Research Scientist

5. © 2018 TigerGraph. All Rights
Reserved
What is Money Laundering?
The process of transforming proceeds of illegal activities to
legitimate money
www.unodc.org/unodc/en/money-laundering/laundrycycle.html
5

6. © 2018 TigerGraph. All Rights
Reserved
Money Laundering Techniques - Layering
1. Funds to be laundered starts at one
source
2. Layering: Split and transferred in less
suspicious amounts to various accounts.
Split and transfer again...
3. Integration: transfer and consolidate…
4. Funds arrive in the account of a related
party
Perfect fit for graph analytics
6

7. © 2018 TigerGraph. All Rights
Reserved
Money Laundering Techniques - Layering Loop
● Layering requires many transactions
○ Smaller, less suspicious amounts
○ Complex pattern which is hard to notice
● But criminals still want to keep their money!
● Solution: Pass the funds around in a loop
7

8. © 2018 TigerGraph. All Rights
Reserved
AML Workflow with TigerGraph and Machine
Learning
8

9. Anti Money Laundering with TigerGraph In
Depth
Layering Loop Detection

10. © 2018 TigerGraph. All Rights
Reserved
Anti Money Laundering
• An effective anti money launder system should have the
following two features, i.e.
• Detect All Suspicious Behavior Quickly: system should find all
suspicious patterns of wrongdoing at all time.
• Be Easy to Use and Change: all patterns can be easily applied and
user could easily modify the pattern to adapt new rules.
10

11. © 2018 TigerGraph. All Rights
Reserved
Detect Suspicious Behavior with TigerGraph
• TigerGraph is a native graph database with multiple built-in
graph analytical tools.
• With its powerful graph query language (GSQL), TigerGraph
can do graph traversal & aggregation in a real time fashion.
• Detection of suspicious behavior can be easily converted into
a graph pattern matching problem.
11

12. © 2018 TigerGraph. All Rights
Reserved
Examples of detection of Suspicious
Behavior
• Detection of 1-level frequent money sender/receiver
• Detection of 2-level frequent money sender/receiver
• Detection of accounts with loop money transactions
• Controllable search depth (Up to 20 hops)
• Search transactions within a given time window
• Amount lower Limit
• Drain Ratio: (max - min) / max
• All transactions in the loop must be in a forward time series
12

13. © 2018 TigerGraph. All Rights
Reserved
Graph Schema Design
13

14. © 2018 TigerGraph. All Rights
Reserved
Loop Detection Pseudocode
a1
t4
t2
t1
send
send
a2
t3
a3
t5
send
send
send
send send
send
send
send
Algorithm: Start with one
account and collect paths
while traversal.
Disadvantages:
● memory cost: collect too
many invalid paths
● computation cost: can not
stop until arriving at the end
of traversal.
14

15. © 2018 TigerGraph. All Rights
Reserved
Bi-directional Loop Detection Pseudocode
a1
t4
t2
t1
rev_send
send
a2
t3
a3
t5
send
send
send
rev_send rev_send
send
send
send
Phase1: use bidirectional search
to mark the subgraph with loops.
Phase2: Traverse the subgraph
graph to collect loop paths.
Phase3: Apply path related filters
(drain ratio) on obtained paths
Note: The start account could be multiple related
accounts (such as linked by the same ID)
15

16. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
t5
send
send
send
rev_send rev_send
send
send
send
Algorithm
● Traverse the first half hops from the starting
account. Label vertices with the forward and
backward reachable flags.
● Limit the other half traversal among the
vertices with reachable flags, i.e.
○ Forward reachable vertex can only
reach backward reachable vertices.
○ Backward reachable vertex can only
reach forward reachable vertices.
● The potential loop candidates are the
vertices with both forward and backward
reach flags
16

17. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
Search Depth = 6, k = 1
a4 t5
a5
send send
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
17

18. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
Search Depth = 6, k = 2
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
18

19. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
Search Depth = 6, k = 3
● Traverse the first half hops (3
hops) from the starting account.
● Label vertices with the forward
(green) and backward (blue)
reachable flags.
19

20. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 4
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
20

21. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 5
rev_send
send
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
21

22. © 2018 TigerGraph. All Rights
Reserved
Phase 1: Bidirectional Search
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Forward reachable vertex
can only reach backward
reachable vertices.
● Backward reachable vertex
can only reach forward
reachable vertices.
22

23. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
23

24. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 1
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
24

25. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 2
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
25

26. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 3
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
26

27. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 4
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
27

28. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 5
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
28

29. © 2018 TigerGraph. All Rights
Reserved
Phase 2: SubGraph Traversal
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Build Paths for each loop
● Apply filter on transactions
with forward timestamps
29

30. © 2018 TigerGraph. All Rights
Reserved
Phase 3: Apply Path Filters
a1
t4
t2
t1
rev_send
send
a2
t3
a3
send
send
send
rev_send rev_send
send
a4 t5
a5
send send
send
rev_send
Search Depth = 6, k = 6
rev_send
send
rev_send
send
● Drain Ratio Check
30

31. © 2018 TigerGraph. All Rights
Reserved
GSQL Query: Suspicious account with loop
transactions
Graph Data
http://192.168.0.118:14240/#/loading-executor
GSQL implementation on loop transactions
http://192.168.0.118:14240/#/query-editor
For GSQL Starter
https://info.tigergraph.com/en/gsql-webinar-1
31

32. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
• To search for all possible accounts with loop transactions,
one need to do loop detection query for all candidates.
• One solution would be expand the single account loop
detection algorithm to multiple accounts, which may
greatly complicate the query and may actually reduce the
performance.
• GSQL Query provide an easy alternative way to speed up
batch processing using Query Calling Query Feature.
32

33. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
Query Calling Query in parallel with GSQL
• Use Vertex Block to parallelization
• Start a Vertex Block with all candidate vertices
• Call the loop detection subquery in ACCUM block
• Use Edge Block to parallelization
• Start a Edge Block with all candidate vertices as target vertex
• Call the loop detection subquery in POST-ACCUM block
33

34. © 2018 TigerGraph. All Rights
Reserved
GSQL Query Batch Processing
GSQL loop transactions in batch
http://192.168.0.118:14240/#/query-editor
34

35. © 2018 TigerGraph. All Rights
Reserved
GSQL Query: Suspicious account with loop
transactions
35

36. Q&A
Please send your questions via the Q&A menu in Zoom
36

37. © 2018 TigerGraph. All Rights Reserved
Thank You!
37
Compare the Developer Edition and Enterprise Free Trial
https://www.tigergraph.com/download/
Guru Scripts
https://github.com/tigergraph/ecosys/tree/master/guru_scripts
Join our Developer Forum
https://groups.google.com/a/opengsql.org/forum/#!forum/gsql-users
Download our Ebook
https://info.tigergraph.com/ebook
@TigerGraphDB youtube.com/tigergraph facebook.com/TigerGraphDB linkedin.com/company/TigerGraph

38. User Defined Function
38