apexfi-fraud-detection

ApexFi — Hybrid Fraud Detection Models

Two independent hybrid fraud-detection models — LightGBM (tabular) + GraphSAGE (graph neural network) combined through a learned logistic regression stacking layer — trained on two structurally different real-world proxy datasets, as part of an M.Tech project on cross-channel fraud detection for India's UPI/IMPS digital payment ecosystem.

Framing note: actual large-scale UPI/IMPS transaction data isn't publicly available. These models are trained on real, publicly available proxy datasets (IEEE-CIS, DGraph-Fin) to build and validate the technical architecture for the real target problem — they are not literal UPI/IMPS transaction models, and this is not claimed otherwise.

Full project (web app, data pipeline, source code): https://github.com/KarthickRamAlagar/apexfi-fraud-graph

---

Why two separate models

IEEE-CIS (transaction-level) and DGraph-Fin (account/network-level) have no genuine shared identity or join key between them — combining them into one graph would mean inventing a connection that isn't real. Each dataset is trained and validated independently, using the same hybrid architecture applied to two different real-world structures.

---

Files in this repository

ieee_cis/
├── lightgbm_model.txt              # trained LightGBM booster
├── gnn_model.pt                    # trained GraphSAGE checkpoint
├── stacking_meta.pkl               # logistic regression stacker
└── preprocessing_artifacts.pkl     # frequency tables, categorical
                                     # encoders, neighbor-lookup index —
                                     # required for scoring genuinely new,
                                     # unseen transactions correctly
dgraph_fin/
├── lightgbm_model.txt
├── gnn_model.pt
└── stacking_meta.pkl
predict_example.py                  # minimal, runnable loading/inference example

---

Real, validated results

Both models were validated using a fixed, stratified 70/15/15 train/validation/test split, repeated across 3 random seeds, with mean ± standard deviation reported. (This is not k-fold cross- validation — the split itself is fixed; only the model's own training randomness varies across seeds.)

IEEE-CIS (590,540 transactions, 3.499% real fraud rate)

Learned stacking weight: ~19:1 favoring LightGBM — tabular features dominate on this dataset; the graph contributes a real but small correction.

DGraph-Fin (3,700,550 accounts, 1.265% real fraud rate of the labeled subset)

Learned stacking weight: nearly balanced — unlike IEEE-CIS, the graph and tabular signals are genuinely complementary here.

Research finding worth highlighting: graph information is not universally superior to tabular information — its real, measured value depends on the underlying structure of the specific dataset.

---

Honest limitations — read before citing these numbers

• IEEE-CIS vs. Kaggle competition results: this model's ROC-AUC (0.9736) is higher than the top Kaggle competition solution's best individual model (0.9408, private leaderboard) — but this evaluation used a random/stratified split, while Kaggle's private test set may have used a temporal split (a harder, more realistic evaluation). Not a fully apples-to-apples comparison.
• DGraph-Fin is not comparable to published academic graph-anomaly- detection benchmarks (e.g., GADBench reports ~66.9% ROC-AUC for current specialized methods). Those benchmarks deliberately test a much harder, low-label scenario (as few as 100 labeled examples total, regardless of dataset size). This model is trained under full supervision (857,920 real labeled training examples) — a different, not-comparable task, closer to the realistic scenario where an institution has substantial labeled history.
• These models do not learn from new input. Every prediction uses these same, fixed model files — nothing about a new prediction updates them. This is intentional, production-oriented design (avoiding the real risk of a single bad or adversarial input corrupting future predictions), not a limitation to work around.
• IEEE-CIS's anonymized V1-V339 columns cannot be supplied for a genuinely new transaction (their real-world meaning is undocumented, even by the dataset's own publishers) — predictions for a new transaction whose real risk signal lives mostly in those columns will show an expected, honest gap from what a full-feature retrospective lookup would show.
• IEEE-CIS and DGraph-Fin are real-world proxy datasets, not literal UPI/IMPS data. They were chosen for genuine structural representativeness (transaction-level vs. account/network-level fraud) given that real UPI/IMPS data isn't publicly available at this scale.

---

Intended use

Research and educational demonstration of hybrid tabular + graph fraud detection architecture, and as a genuine, validated reference point for further work on graph-based fraud detection under full supervision. Not intended for direct production deployment on real financial data without independent validation on that data's actual distribution.

License

MIT — see the source datasets' own licenses (IEEE-CIS, DGraph-Fin) for any restrictions on the underlying data itself.