Graph-Based Anomaly Scoring for Transaction Networks in Public-Sector Payment Streams

Abstract

The payment streams used in public sector are relational rather than tabular in nature: agencies, budget lines, grantees, bank accounts and the authorizing officer repeat themselves in thousands of payments, while the field of government fraud analytics remains primarily row-oriented. This paper proposes a graph-based method for anomaly scoring of these payment streams aimed at generating a calibrated, ranked and auditable score for every payment. In particular, we formally define the payment stream as a multigraph with labeled and time-stamped edges, specify ego-network and community-relative features which can be updated incrementally, and propose a scoring method which combines the structure deviation score and the attribute risk score into a single additive score where both of its components will be visible. We also propose a constrained capacity-based evaluation protocol for anomaly scoring where we fix the number of investigations and use a simulation of the payment stream with known generation procedures, several schemes of frauds and planted instances of the schemes, labeled and negative samples, an explicit derived relation error model, and temporal discipline. This version does not provide any empirical results since the stream was not yet generated and the protocol has not been applied yet, so the comparisons mentioned below are planned. We argue in the paper that the key problem with the adoption of graph-based anomaly scoring lies in the problem of evidence rather than computation. The structure deviation is a lead and not an evidence and thus each structural score is supplemented with a requirement for corroboration.