Multi-Layer Graph Anomaly Detection for Network Fraud
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anomaly detection methods rely on a single layer of information, which is insufficient for real-world applications where multiple inputs are necessary to determine anomalies, leading to inaccurate identification of anomalous network activity and inefficient resource allocation.
Innovation Solution
A computer-implemented method and system for user network activity anomaly detection using multi-layer graph analysis, where network resource data is processed to generate multiple layers of a graph, merged into a single layer graph with weighted adjacency matrices, and anomaly scores are calculated based on node attributes and peer node attributes to identify anomalous users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional single-layer anomaly detection is used, then the system is simple to implement, but the detection accuracy is insufficient
Solution Approach 1:
The patent divides the anomaly detection system into multiple layers, where each layer processes different types of information or relationships. This segmentation allows the system to capture complex patterns from multiple perspectives while maintaining manageable complexity through modular processing of each layer independently.
Solution Approach 2:
The patent transitions from single-layer detection to multi-layer graph representation, adding dimensional complexity to capture diverse relationships and attributes. By representing data across multiple layers with different relationship types, the system achieves higher detection accuracy without proportionally increasing overall system complexity.
2Measurement precision
If multi-layer graph analysis is implemented, then detection accuracy improves, but computational resources increase
Solution Approach 1:
The patent merges multiple layers into a unified multi-layer graph structure, allowing shared computation across layers. By integrating information from different layers through a cohesive framework with centralized anomaly scoring, the system achieves high detection accuracy while optimizing resource utilization through shared processing infrastructure.
Solution Approach 2:
The patent employs parameter optimization techniques to adjust the configuration of multi-layer graphs, such as selecting relevant layers and tuning graph construction parameters. This allows the system to achieve high detection accuracy while minimizing computational overhead by processing only the most informative layers and relationships.
3Measurement precision
If multiple inputs and peer comparison are used, then anomaly detection accuracy increases, but data processing time increases
Solution Approach 1:
The patent performs preliminary processing of network resource data to construct the multi-layer graph structure in advance. By pre-processing and organizing data into the multi-layer framework before anomaly detection, the system reduces real-time processing requirements while maintaining high detection accuracy through pre-computed relationships and attributes.
Solution Approach 2:
The system uses each user's peer group members to provide contextual reference data for anomaly scoring. By leveraging the inherent relational structure in the multi-layer graph where peers serve as natural comparison points, the system achieves accurate detection without requiring external reference data or additional processing overhead.
Data Source
AI summary
Disclosed are a system, method, and computer program product for user network activity anomaly detection. The method includes generating a multilayer graph from network resource data, and generating an adjacency matrix associated with each layer of the multilayer graph to produce a plurality of adjacency matrices. The method further includes assigning a weight to each adjacency matrix to produce a plurality of weights, and generating a merged single layer graph by merging the plurality of layers based on a weighted sum of the plurality of adjacency matrices using the plurality of weights. The method further includes generating a set of anomaly scores by generating, for each node in the merged single layer graph, an anomaly score. The method further includes determining a set of anomalous users based on the set of anomaly scores, detecting fraudulent network activity based on the set of anomalous users, and executing a fraud mitigation process.