-
Notifications
You must be signed in to change notification settings - Fork 13
Memgraph in fraud detection #1367
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
Josipmrden
wants to merge
71
commits into
main
Choose a base branch
from
memgraph-in-fraud-detection
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
71 commits
Select commit
Hold shift + click to select a range
5e5b886
init
katarinasupe 55ff98c
Merge branch 'main' into memgraph-3-2
katarinasupe 17384d2
Merge branch 'main' into memgraph-3-2
katarinasupe 46cfb1f
Add hardware sizing
Josipmrden ee9a7bb
Add vm.max_map_count explanation
Josipmrden de342fb
Add deployment options
Josipmrden 0b741e8
Add flag set suggestions
Josipmrden e8353d3
Indentation
Josipmrden b63517e
Remove unnecessary comment
Josipmrden cf434bb
Add enterprise, queries and import sections
Josipmrden bfc44eb
Finish general suggestions guide
Josipmrden d3c71fe
Make under construction notes
Josipmrden 1a5097f
Add todo
Josipmrden 5de8cac
Update property sizes
Josipmrden d63d9d1
Add backup considerations
Josipmrden fd35d83
Added overview page
Josipmrden 0042907
Add hardware sizing
Josipmrden 6de5e65
Add vm.max_map_count explanation
Josipmrden 60f1f25
Add deployment options
Josipmrden 01f350e
Add flag set suggestions
Josipmrden 74715a8
Indentation
Josipmrden a97f41a
Remove unnecessary comment
Josipmrden e8753c1
Add enterprise, queries and import sections
Josipmrden bcf7a0c
Finish general suggestions guide
Josipmrden 89ce823
Make under construction notes
Josipmrden 6c5e47f
Add todo
Josipmrden 84f4d0c
Update property sizes
Josipmrden 51f07a4
Add backup considerations
Josipmrden 2d481aa
Added overview page
Josipmrden 0126e49
Merge branch 'memgraph-in-production' of github.com:memgraph/document…
Josipmrden 81d7788
Main
Josipmrden 72f6649
Main
Josipmrden c27b99d
Newline
Josipmrden 6d1c3c3
Merge branch 'main' into memgraph-in-production
Josipmrden c58d7c5
Add section for query timeout
Josipmrden 6742f61
Set up lab features
Josipmrden 5cedea6
Sentence case
Josipmrden 2a3aa4e
Remove empty construction pages
Josipmrden 313e61b
Add callout
Josipmrden 1b5c5f3
Update GraphRAG use case
Josipmrden 05e8b71
Finish memgraph in production for graphrag
Josipmrden 2c7e98f
Merge branch 'main' into memgraph-in-production
Josipmrden 52485ac
Update initial page
Josipmrden 7f2fcb2
Add graphrag link
Josipmrden 44518e5
Merge branch 'memgraph-in-production' into evaluating-memgraph
Josipmrden f3b0c5c
Add page for evaluating memgraph -> mgbench
Josipmrden 53e1526
Address PR comments
Josipmrden 4a4c77a
Merge branch 'memgraph-in-production' into evaluating-memgraph
Josipmrden f2f4ff7
Add title for evaluating memgraph
Josipmrden 5a828ad
Address PR comments
Josipmrden ae10ec9
Add contents before the deep-dive
Josipmrden b07865d
Edit titles
Josipmrden be53774
Add guidelines for updating the page
Josipmrden e9ce4ce
Finish guide for high throughput workloads
Josipmrden 7c5fc5a
Omit constructed guide
Josipmrden bdc9514
Add initial mission critical page
Josipmrden c43bcd0
Omit guide being constructed
Josipmrden f6150f7
Dash
Josipmrden 99a1ab2
Merge branch 'main' into memgraph-in-high-throughput-workloads
Josipmrden 9d92156
Merge branch 'main' into memgraph-in-high-throughput-workloads
matea16 0ef77f4
Address PR commnets
Josipmrden fc5fbbc
Push memgraph up
Josipmrden 17d25a8
Fix link for benchmarking Memgraph
Josipmrden 4f0d144
Merge branch 'memgraph-in-high-throughput-workloads' into memgraph-in…
Josipmrden 3b710e6
Merge branch 'main' into memgraph-in-mission-critical-workloads
Josipmrden 070291a
Add guide for mission critical workloads
Josipmrden 6b68ac7
Link backup and restore
Josipmrden 94c3646
Add memgraph in supply chain workload
Josipmrden a30b09c
Add fraud detection blueprint example
Josipmrden a716856
Refactor guide
Josipmrden 274fed2
Apply suggestions from code review
matea16 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
150 changes: 150 additions & 0 deletions
150
pages/deployment/workloads/memgraph-in-fraud-detection.mdx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,150 @@ | ||
| --- | ||
| title: Memgraph in fraud detection | ||
| description: Suggestions on how to bring your Memgraph to production in fraud detection and anti-abuse use cases. | ||
| --- | ||
|
|
||
| import { Callout } from 'nextra/components' | ||
| import { CommunityLinks } from '/components/social-card/CommunityLinks' | ||
|
|
||
| # Memgraph in fraud detection | ||
|
|
||
| <Callout type="info"> | ||
| Before diving into this guide, we recommend starting with the [Deployment best practices](/deployment/best-practices) | ||
| page. It provides foundational, use-case-agnostic advice for deploying Memgraph in production. | ||
|
|
||
| This guide builds on that foundation, offering additional recommendations tailored to fraud detection and anti-abuse workloads. | ||
| In cases where guidance overlaps, consider the information here as complementary or overriding, depending on the | ||
| unique needs of your use case. | ||
| </Callout> | ||
|
|
||
| ## Is this guide for you? | ||
|
|
||
| This guide is for you if you're building real-time **fraud detection**, **anti-money laundering (AML)**, or **account abuse** systems. | ||
| You'll benefit from this content if: | ||
|
|
||
| - You need to **detect anomalies in real time** across transactions, devices, identities, and merchants. | ||
| - You want to uncover **multi-hop fraud rings** (e.g., money mules, collusion networks, synthetic identities) and **account takeover cascades**. | ||
| - You plan to run **what‑if tests** to evaluate new rules, thresholds, and investigation workflows before rollout. | ||
| - You ingest high-velocity events from **payments/auth logs/identity services** and require consistent read performance while updates stream in. | ||
| - You need to correlate evidence across systems for **investigation and case management**. | ||
|
|
||
| ## Why choose Memgraph for fraud detection? | ||
|
|
||
| - **In-memory architecture**: Consistent, predictable response times for scoring, alerting, and investigator tooling. | ||
| - **Graph algorithms (MAGE)**: Use community detection, node similarity, centralities, and more to **infer hidden structure and risk signals** (e.g., collusion clusters, mule networks, synthetic identities). Explore the [available algorithms](/advanced-algorithms/available-algorithms). | ||
| - **Streaming/dynamic algorithms**: Keep results fresh on **high‑velocity data** with online/dynamic algorithms that update incrementally (e.g., online centralities). See [dynamic graph algorithms](/advanced-algorithms/available-algorithms#dynamic-graph-algorithms-enterprise). | ||
| - **GNNs and ML on graph topology**: Leverage graph-native topology for **GNNs** (e.g., node classification, link prediction) and combine **embeddings** with graph algorithms to improve fraud detection accuracy over tabular‑only baselines. | ||
|
|
||
|
|
||
| ## What is covered? | ||
|
|
||
| The suggestions for fraud detection workloads complement several key sections in the | ||
| [general suggestions guide](/deployment/best-practices). These sections offer important context and | ||
| additional best practices tailored for performance, stability, and scalability in production: | ||
|
|
||
| - [Choosing the right Memgraph flag set](/deployment/best-practices#choosing-the-right-memgraph-flag-set) | ||
| Configure flags for schema access. | ||
|
|
||
| - [Choosing the right Memgraph storage mode](/deployment/best-practices#choosing-the-right-memgraph-storage-mode) | ||
| Select between transactional durability and multithreaded ingestion for your workload. | ||
|
|
||
| - [Optimizing fraud detection](#optimizing-fraud-detection) | ||
| Use deep path traversals, map properties, and nested indices. | ||
|
|
||
| - [Enterprise features you might require](#enterprise-features-you-might-require) | ||
| Secure multi-user environments and ensure governance. | ||
|
|
||
| ## Choosing the right Memgraph flag set | ||
|
|
||
| If you plan to power natural-language interfaces for investigators (see GraphRAG below), enable constant-time schema retrieval: | ||
|
|
||
| ```bash | ||
| --schema-info-enabled=true | ||
| ``` | ||
|
|
||
| This drastically reduces time to provide schema to an LLM, improving responsiveness. | ||
|
|
||
| ## Choosing the right Memgraph storage mode | ||
|
|
||
| Most finance and fraud workloads are inherently **transactional** (safety-critical decisions, auditability, recoverability). As a default, | ||
| we recommend running in `IN_MEMORY_TRANSACTIONAL` mode to ensure **ACID guarantees**, support for **replication/HA**, and **WAL/snapshot** durability. | ||
|
|
||
| Consider `IN_MEMORY_ANALYTICAL` only for specialized pipelines focused on **bulk/multithreaded ingestion** and **read-only analytics/simulations** where transactional rollback isn’t required. | ||
| Another suitable flow for using analytical is during import, after which the user will switch to `IN_MEMORY_TRANASCTIONAL` mode for ensuring data consistency during the batch update process day-to-day. | ||
|
|
||
| Learn more about storage modes in the [Storage memory usage](/fundamentals/storage-memory-usage#storage-modes) documentation. | ||
|
|
||
| ## Enterprise features you might require | ||
|
|
||
| - [Role-based and label-based access control (RBAC/LBAC)](/database-management/authentication-and-authorization/role-based-access-control) | ||
| Ensure least-privilege access across analysts, SOC teams, and external partners. | ||
|
|
||
| - [Replication](/clustering/replication) and [high availability](/clustering/high-availability) | ||
| Keep scoring and investigations online with leader–replica setups and automatic failover. | ||
|
|
||
| - [Multi-tenancy](/database-management/multi-tenancy) | ||
| Isolate per product, region, or use case. | ||
|
|
||
| - [Single sign-on (SSO) for Memgraph Lab](/memgraph-lab/features/single-sign-on) | ||
| Streamline secure access for your fraud investigators and stakeholders. | ||
|
|
||
| - [Audit logs](/database-management/enabling-memgraph-enterprise#audit-log) | ||
| Track access and changes for compliance and investigations. | ||
|
|
||
| - [Query sharing](/database-management/enabling-memgraph-enterprise#sharing-features) for collaboration | ||
| Enable investigators to share queries and findings seamlessly. | ||
|
|
||
| ## Working with fraud detection | ||
|
|
||
| There are three complementary ways to build fraud detection on Memgraph: | ||
| 1. [Basic pattern matching in Cypher](#basic-pattern-matching-in-cypher) | ||
| 2. [Graph algorithms (MAGE library)](#graph-algorithms-mage) | ||
| 3. [Machine learning on graphs](#machine-learning-on-graphs) | ||
|
|
||
| ### Basic pattern matching in Cypher | ||
| Use Cypher to encode rules and patterns directly over the graph: | ||
| - Variable‑length paths for multi‑hop patterns (e.g., mule chains, shared devices) | ||
| - Property/time filters for velocity and windowing | ||
| - Negative patterns (absence of expected relationships) | ||
|
|
||
| ```cypher | ||
| // Example: shared device across multiple accounts in a short window | ||
| MATCH (d:Device)<-[:USED_DEVICE]-(a:Account)-[:PERFORMED]->(tx:Txn) | ||
| WHERE tx.ts >= $from AND tx.ts < $to | ||
| WITH d, collect(DISTINCT a) AS accounts | ||
| WHERE size(accounts) >= $minAccounts | ||
| RETURN d, accounts; | ||
| ``` | ||
|
|
||
| ### Graph algorithms (MAGE) | ||
| Compute risk signals by scoring topology. Commonly useful algorithms include: | ||
| - [Katz centrality](/advanced-algorithms/available-algorithms/katz_centrality) | ||
| - [Degree centrality](/advanced-algorithms/available-algorithms/degree_centrality) | ||
| - [Community detection](/advanced-algorithms/available-algorithms/community_detection) | ||
| - [PageRank](/advanced-algorithms/available-algorithms/pagerank) | ||
| - [Betweenness centrality](/advanced-algorithms/available-algorithms/betweenness_centrality) | ||
| - [Node similarity](/advanced-algorithms/available-algorithms/node_similarity) | ||
|
|
||
| Browse more in [Available algorithms](/advanced-algorithms/available-algorithms). Many also have online/dynamic variants (e.g., [pagerank_online](/advanced-algorithms/available-algorithms/pagerank_online), [katz_centrality_online](/advanced-algorithms/available-algorithms/katz_centrality_online)) for high‑velocity data. | ||
|
|
||
| ### Machine learning on graphs | ||
| Leverage graph structure and embeddings to train models: | ||
| - Supervised GNNs: [GNN node classification](/advanced-algorithms/available-algorithms/gnn_node_classification), [GNN link prediction](/advanced-algorithms/available-algorithms/gnn_link_prediction) | ||
| - Unsupervised embeddings: [node2vec](/advanced-algorithms/available-algorithms/node2vec), [node2vec_online](/advanced-algorithms/available-algorithms/node2vec_online) | ||
|
|
||
| Combine ML features (embeddings, graph algorithm scores, rule outputs) into your fraud scoring pipeline to maximize precision/recall. | ||
|
|
||
|
|
||
| ## Interact with your fraud graph using GraphRAG | ||
|
|
||
| Enable natural-language interaction for triage and investigations with GraphRAG and GraphChat in Memgraph Lab. | ||
| This helps non-technical stakeholders quickly ask: “Is user X linked to known fraud rings?” or “Show connections between these accounts in the last 30 days.” | ||
|
|
||
| - See: [Memgraph in GraphRAG use cases](/deployment/workloads/memgraph-in-graphrag) | ||
| - Include constant-time schema retrieval in your pipeline: | ||
|
|
||
| ```cypher | ||
| SHOW SCHEMA INFO; | ||
| ``` | ||
|
|
||
| <CommunityLinks/> | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This section doesn't correspond to the content of the page, resolve content and links