Fraud learns too: continual graph learning under strategic adversarial drift in dynamic networks

CGL-FED: A Continual Graph-Based Learning Framework for Fraudulent Email Detection

Email communication remains the primary vector for sophisticated cyber threats, including phishing and spam, resulting in billions of dollars in annual financial losses. While state-of-the-art deep learning (DL) models have demonstrated high precision in static environments, they frequently suffer from performance degradation when deployed in dynamic, streaming environments—a phenomenon known as concept drift. Furthermore, traditional approaches to model updating lead to catastrophic forgetting, where the model’s weights are overwritten, affecting the ability to identify historical threat patterns. This paper presents a novel continual graph-based learning framework for fraudulent email detection (CGL-FED) that integrates a domain-specific fine-tuned DistilBERT encoder with a graph neural network (GNN) architecture. Unlike traditional instance-based graphs, CGL-FED maps contextual embeddings into a fixed-topology feature graph, ensuring structural stability and computational efficiency. To mitigate the forgetting challenge, the framework employs a rehearsal-based replay memory enhanced by segment-based masking. The extensive evaluation conducted on a large-scale corpus utilizing five benchmark datasets (Trec07p, Enron, SpamAssassin, Ling-Spam, and Nazario), shows that CGL-FED achieves state-of-the-art accuracy, reaching up to 100%. Additionally, it maintains an average cumulative forgetting rate of less than 0.005%. The proposed framework offers a robust, scalable, and industrial-ready solution for maintaining high-fidelity persistent identification of fraudulent messages in real-time cybersecurity operations.

DriftGuard-HCL: Concept-Drift-Aware Continual Heterogeneous Graph Contrastive Learning for Evolving Financial Fraud Detection

Financial fraud detectors are commonly trained as stationary classifiers even though transaction distributions, merchant populations, and attack typologies evolve. This paper presents DriftGuard-HCL, a continual heterogeneous graph-contrastive framework that combines a scalable typed graph-context encoder, semantic-group contrastive regularization, delayed-label replay, and a relation-support-aware drift gate. Each transaction is modeled on a temporal customer–category–merchant graph; causal customer and merchant neighborhood summaries are fused with a typed relation embedding through a bilinear interaction. A multi-signal detector combines Jensen–Shannon divergence over category and amount distributions, latent feature shift, and novel-relation mass. The detector switches a stability–plasticity ensemble from a frozen warm-up anchor toward a replay-regularized current model only after a calibrated shift. We evaluate the method with a strict prequential protocol on the public BankSim benchmark: 30 six-day snapshots, a one-snapshot label delay, five shared random seeds, and no future-label feature construction. In the native chronological stream, DriftGuard-HCL obtains 0.732 PR-AUC and 0.648 F1. In a controlled emergent-typology stress stream, it obtains 0.747 PR-AUC and 0.668 F1, improving over a continually updated heterogeneous contrastive model by 0.169 PR-AUC and 0.306 F1. The drift detector triggers once at typology restoration and never in the native stream. These results are reproducible from the accompanying code and raw result files; they support the value of drift-gated adaptation while not constituting evidence of production-bank performance.

Revisiting the Adversarial Robustness of Graph-Based Traffic Forecasting

This work reframe robustness as a detection problem, introducing a learned physics-informed detector whose output is fed to a hardened forecaster as an input feature and trained against adaptive attacks with the forecaster fixed and improves even on adversarial training hardened against the physics-aware attack itself.

Driftuard -HCL: Concept-Drift-Aware Continual Heterogeneous raph Contrastive Learning for Evolving Financial Fraud Detection

Graph Neural Networks for Financial Fraud and Anomaly Detection

Financial fraud now spreads through coordinated accounts whose risk is visible mainly in how they connect rather than in any single record. Tree based classifiers that score transactions in isolation miss this relational signal. This paper reviews and consolidates how graph neural networks (GNNs) cast fraud and anomaly detection as node and edge classification over transaction graphs, where message passing propagates evidence among accounts, devices, and merchants. We describe the main architectures used in practice, namely graph convolutional networks, GraphSAGE, and graph attention networks, and explain how each aggregates neighbourhood information. Two problems dominate the fraud setting: extreme class imbalance, since genuine fraud is rare, and camouflage, where fraudsters attach to honest neighbours to dilute their signature. We summarise label aware and neighbour selecting designs such as CARE-GNN and PC-GNN that address both. Heterogeneous and temporal graph variants are discussed for settings with several node types and evolving relations, alongside sampling methods that keep training tractable on large graphs. Using illustrative experiments patterned on public benchmarks (Elliptic, Yelp and Amazon review fraud, and IEEE-CIS), we report AUC, AUPRC, F1, and recall at k, and show that imbalance aware GNNs improve minority recall over a gradient boosted baseline. We close with notes on explainability and the engineering needed for production scoring.

A Hybrid Generative Adversarial Network and Random Forest Architecture for Enhanced Fraud Detection in Unified Payments Interface (UPI) Systems

Financial fraud in digital payment systems is a major cybersecurity issue. Global losses exceed $32 billion each year, and fraud-detection methods are constantly improving to keep pace with increasingly complex attack patterns. One significant challenge in fraud analytics is the severe class imbalance. Fraudulent transactions make up a very small fraction of total transaction volume. This study introduces a new detection framework that combines Generative Adversarial Networks (GANs) for synthesising minority classes with Random Forest (RF) ensemble learning for strong classification. The GAN part is based on adversarial training methods introduced earlier, with improved stabilisation techniques from recent studies and tabular data modelling strategies from previous research. The Random Forest classifier uses the ensemble approach first defined in earlier work. In this paper, a synthetic dataset featuring 20,000 transactions and 20 engineered features is presented. This set includes transactional, behavioural, device-based, and contextual information. The GAN uses a 100-dimensional latent-space generator and a binary discriminator, trained for 1,000 epochs with the Adam optimiser. We tuned the hyperparameters of the RF classifier using GridSearchCV with 5-fold cross-validation, resulting in the best parameters: n_estimators=100, max_depth=20, and min_samples_split=5. These experiments show an overall accuracy of 97.09%, with balanced precision and recall metrics at 0.97. This outperforms the baseline RF (96.75%), SMOTE-RF (96.82%), and XGBoost (96.91%). Adding 5,000 GAN-synthesised minority samples, generated using adversarial oversampling techniques, increased validation accuracy to 97.12% (p < 0.05, McNemar’s test). Analysis of feature importance showed that geo-location anomaly flags (24.95%) and previous fraudulent behaviour indicators (20.41%) were the most distinguishing attributes. The proposed hybrid GAN-RF framework effectively addresses class imbalance while maintaining computational efficiency and model interpretability. It shows strong promise for use in real-time fraud detection in Unified Payments Interface (UPI) environments.