From Detection to Investigation: Calibrated Synthetic Graphs for Reliable AML using Graph Neural Net

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

From Detection to Investigation: Calibrated Synthetic Graphs for Reliable AML using Graph Neural Network

Mohammed Yasar1 , B. Swathi2

1Student, Dept. of CSE(AI&ML), Andhra Loyola Institute of Engineering & Technology, India -12

2Assistant Professor, Dept. of CSE(AI&ML), Andhra Loyola Institute of Engineering & Technology, India -12

Abstract - Anti-Money Laundering (AML) systems increasingly rely on graph-based learning to detect complex financial crime patterns. However, existing research often evaluates models on synthetic datasets that contain strong structuralbiases,leadingtounrealisticallyhighperformance. This paper presents a calibrated AML pipeline that combines synthetic data generation, Graph Neural Network (GNN) detection, and a post-hoc investigation layer. We introduce a systematicmethodologyforreducingstructural determinism insynthetictransactiongraphsthroughdegreestratification, structuralnoiseinjection,cross-contamination,andembedded path construction. These techniques progressively transform the dataset from trivial to realistic, reducing inflated AUC scores from 0.99 to 0.95 while restoring meaningful classification performance (F1 = 0.55). A 2-layer Graph AttentionNetwork(GAT)istrainedonstructuralfeaturesand evaluated against a statistical baseline, achieving significant improvements in detection performance. Additionally, an investigationlayerconvertsalertsintostructuredcasereports using motif detection, temporal analysis, and similarity retrieval. The results demonstrate that proper dataset calibration isessentialforreliableevaluationof graph-based AML systems and that integrating detection with explainability produces actionable intelligence for analysts.

Keywords: Anti-Money Laundering, Graph Neural Networks, Synthetic Data, Graph Attention Network, Fraud Detection, Explainable AI, Financial Networks

1. INTRODUCTION

Modern financial systems are increasingly supported by advanced digital infrastructure, including large-scale transaction processing platforms, real-time monitoring systems,andbigdataanalyticsframeworks.Amongthese, transactionnetworksformthebackboneofglobalfinancial operations. However, one of the most critical challenges facedbythesesystemsisthedetectionoffinancialcrimes suchasmoneylaundering.Thischallengearisesduetothe complex,multi-hopnatureoftransactionsandtheabilityof maliciousactorstodisguiseillicitflowswithinlargevolumes oflegitimateactivity.Therefore,thereisagrowingneedfor intelligentAnti-MoneyLaundering(AML)solutions,which can be effectively addressed using graph-based machine learning techniques that capture relational and structural dependencies.

Statistics indicate that a significant proportion of illicit financial activity goes undetected due to limitations in traditional monitoring systems. Existing approaches primarilyrelyon rule-based detectionor tabularmachine learning models, which fail to capture the interconnected nature of financial transactions. Currently, most systems operateonisolatedtransactionrecordswithoutleveraging thefulltransactiongraph,leadingtohighfalsepositiverates andmisseddetectionofcoordinatedlaunderingpatterns.To addresstheselimitations,thereisaneedforascalableand intelligentAMLframeworkthatutilisesadvancedtechniques suchasGraphNeuralNetworks(GNNs)tomodeltransaction flows [1][2]. The proposed system focuses on identifying suspicious accounts by learning structural and temporal patterns within transaction graphs. It leverages a Graph Attention Network (GAT) architecture, which enhances representationlearningbyassigningimportanceweightsto neighbouringnodes,allowingthesystemtocapturesubtle relationalsignalsindicativeoflaunderingbehaviour

2. LITERATURE SURVEY

[1]Theobjectiveofthepaper“Semi-SupervisedClassification withGraphConvolutionalNetworks”byKipfandWellingwas to introduce Graph Convolutional Networks (GCNs) for learning on graph-structured data. The study proposed a spectral-based convolutional approach that aggregates feature information from neighbouring nodes to perform nodeclassification.TheresultsdemonstratedthatGCNscan effectivelycapturestructuralrelationshipsingraphdataand achieve strong performance on benchmark datasets. However, the model assigns equal importance to all neighbouring nodes during aggregation, which limits its ability to distinguish between relevant and irrelevant connectionsincomplexfinancialnetworks.

[2] The aim of the paper “Graph Attention Networks” by Veličković et al. was to improve graph representation learningbyincorporatingattentionmechanismsintograph neural networks. The proposed model computes attention coefficients to assign different weights to neighbouring nodes,allowing the network to focus on more informative connections.Theresultsshowedimprovedperformanceover traditional GCNs, particularly in heterogeneous graph environments.However,alimitationofthisapproachisthe increased computational complexity due to multi-head attentionmechanisms,whichcanimpactscalabilityinlarge transactionnetworks.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

[3] The objective of the paper “Anti-Money Laundering in Bitcoin:ExperimentingwithGraphConvolutionalNetworks forFinancialForensics”byWeberetal.wastoapplygraphbased learning techniques to detect illicit transactions in cryptocurrency networks. The study utilised transaction graphs andapplied graph convolutional models toclassify suspicious entities. The results demonstrated that graphbased approaches significantly outperform traditional methods in capturing laundering behaviour. However, the datasetusedinthestudyexhibitedstructuralbiases,which may lead to overestimation of model performance in realworldscenarios.

[4]Theobjectiveofthepaper“TemporalGraphNetworksfor Deep Learning on Dynamic Graphs” by Rossi et al. was to extendgraphneuralnetworkstohandletemporaldynamics in evolving networks. The proposed model incorporates time-aware embeddings to capture changes in node interactions over time. The results showed improved performance in dynamic environments such as communicationandfinancialnetworks.However,themodel introduces additional complexity in training and requires careful handling of temporal dependencies, which can be challenginginlarge-scaleAMLsystems.

3. PROPOSED WORK

The proposed AML system is designed as a multi-stage pipeline that integrates data generation, detection, and investigationintoa unifiedframework.Eachcomponentis carefullydesignedtoaddressspecificlimitationsobservedin existingapproaches.

3.1 Synthetic Data Generation and Calibration

The system begins with the generation of a synthetic transactionnetworkintendedtosimulaterealisticfinancial activity. Constructing realistic graph datasets requires careful structural calibration and sampling strategies [9]. Unlikenaivesyntheticdatasetsthatexhibitoverlycleanor isolated structures, the proposed approach introduces severalcalibrationmechanismstoimproverealism.

These include degree-stratified sampling to prevent hub dominance, controlled transaction density to avoid unrealistic clustering, and the embedding of laundering paths within normal transaction flows. Additionally, communitystructuresareadjustedtoensurethatlaundering entitiesarenottriviallyseparablefromnormalaccounts.

As a result of these calibration steps, the final dataset achieves a balanced structural composition, with over 397,000transactionsandapproximately39,500nodes.The test graph alone contains more than 31,000 nodes and 37,000edges,providingasufficientlycomplexenvironment forevaluatingdetectionperformance.

3.2 GNN-Based Detection Layer

The detection component utilises a Graph Attention Network (GAT) architecture [2], chosen for its ability to dynamically weigh the importance of neighbouring nodes duringfeatureaggregation.Themodelconsistsoftwolayers, with multiple attention heads in the first layer to capture diverse structural patterns. Learning structural representations in graphs has been widely explored using embedding techniques such as DeepWalk and struc2vec [7][8].

Eachnodeinthegraphisrepresentedusingasetoften structural features that capture both connectivity and transactionalbehaviour.Thesefeaturesincludedegree-based metrics, centrality measures such as PageRank and betweenness centrality, clustering coefficients, and transactionvolumecharacteristics.

The model is trained using a weighted binary crossentropylossfunction,whichiscommonlyusedinimbalanced classification tasks [10]. to address class imbalance, as launderingaccountstypicallyrepresentasmallfractionofthe overall dataset. OptimisationisperformedusingtheAdam optimiser,withearlystoppingappliedtopreventoverfitting.

The choice of Graph Attention Network (GAT) is motivated by the heterogeneous nature of financial transaction graphs, where not all neighbouring nodes contribute equally to the behaviour of an account. In laundering scenarios, certain connections such as intermediary accounts in layering patterns carry significantlymoreimportancethanothers.

Unlike Graph Convolutional Networks (GCNs), which assign uniform importance to all neighbours, GAT dynamicallylearnsattentionweights,enablingthemodelto prioritisestructurallyandbehaviorallyrelevantconnections. ThisisparticularlyimportantinAML,whereillicitpatterns are often embedded within noisy and highly connected networks.

3.3 Investigation Layer

Akeycontributionofthisworkistheintroductionofan investigation layer that operates on top of the detection outputs.Insteadoftreatingmodelpredictionsasstandalone alerts,thislayertransformsthemintostructuredcasereports thatprovidecontextualandinterpretableinsights.

For each flagged account, a local subgraph is extracted using a breadth-first search strategy, with a strict upper bound on the number of nodes to ensure computational efficiency. This subgraph represents the immediate transactionalneighbourhoodoftheaccountandservesasthe basisforfurtheranalysis.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

Motif detection techniques are then applied to identify commonlaunderingpatternssuchascircularmoneyflows, whichalignwithgraph-basedanomalydetectionframeworks [6]. Layering structures involving multi-hop paths, and smurfing behaviour characterised by aggregation of small transactions.Inparallel,temporalanalysisisperformedto detectanomalies[10].Suchasburstsofactivitywithinshort time windows and rapid transaction chains with minimal delaysbetweensuccessivetransfers.

The findings from these analyses are used to generate deterministic explanations, ensuring that each case report clearlyreflectstheunderlyingsignalsdetectedbythesystem. Additionally,asimilarityretrievalmechanismisimplemented usingvectorrepresentationsofcases,allowingthesystemto identifyandpresentpreviouslyobservedcaseswithsimilar characteristics.

This investigation layer significantly enhances the practicalusabilityofthesystembybridgingthegapbetween detectionandhumananalysis

4. RESEARCH &

The researchmethodology adoptedin this work followsa systematic and iterative approach that combines data

engineering,graph-basedlearning,andpost-hocanalytical validation. The objective is not only to build a highperforming detection model but also to ensure that the learnedpatternsaremeaningful,unbiased,andapplicableto realistic Anti-Money Laundering (AML) scenarios. The methodology is structured into three key phases: dataset construction and calibration, model development and evaluation,andinvestigation-drivenvalidation.

4.1 Dataset Construction and Experimental Setup

The foundation of this research lies in the creation of a synthetic transaction dataset designed to stimulate realworldfinancialnetworks,asrealisticgraphconstructionisa key challenge in anomaly detection systems [9], while avoidingthecommonpitfallsofoverlysimplifiedorbiased data.Thedatasetisgeneratedthroughacontrolledpipeline thatincorporatesmultiplelaunderingtypologies,including smurfing, layering, and circular transactions, alongside a dominantproportionoflegitimateactivity.

To ensure robustness, the dataset is partitioned into training,validation,andtestsplits.Thisseparationisstrictly enforcedthroughoutthepipeline,particularlyduringgraph construction,topreventinformationleakagebetweenstages. The final dataset consists of approximately 397,580 transactions,distributedacross 39,500 nodes,withthetest graph containing over 31,700 nodes and 37,500 edges. This scale enables meaningful evaluation of graph-based models under conditions that resemble real financial systems.

A critical aspect of the methodology is the calibration of structuralpropertieswithinthedataset.Multipleiterations are performed to eliminate trivial signals that could artificially inflate model performance. These include controllingnodedegreedistributions,regulatingtransaction density, and embedding laundering behaviour within legitimateactivity.Theeffectivenessofthesecalibrationsis assessed using a Community Ambiguity Report, which measures metrics such as internal edge ratios, external neighbourrates,andtransactiondensityratios.Thisensures that the dataset presents a challenging yet realistic classificationtask.

4.2 Model Development and Training Strategy

ThedetectionmodelisdevelopedusingaGraphAttention Network (GAT) architecture, which extends graph convolutional approaches by incorporating attention mechanisms [2]. Implemented in PyTorch Geometric. The choiceofGATismotivatedbyitsabilitytoassignadaptive importance to neighbouring nodes, allowing the model to focusonrelevanttransactionpatternswithincomplexgraph structures.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

The model operates at the node level, where each node represents an account and edges represent transactions. Inputfeaturesarederivedfromstructuralandtransactional propertiesofthegraph,includingcentralitymeasuresand flow-basedattributes.Thesefeaturesarenormalisedandfed intothenetworktoensurestabletraining.

Trainingisconductedusingaweightedbinarycross-entropy lossfunctiontoaddressclassimbalance,aslaunderingnodes constitute a small fraction of the dataset. A positive class weight is introduced to penalise misclassification of laundering nodes more heavily than legitimate ones. The optimisation process uses the Adam optimiser with a learning rate of 0.005, and training is performed for a maximum of 150 epochs with early stopping based on validationloss.

To ensure reproducibility and stability, multiple training runs are conducted, and performance is evaluated using standardmetrics,includingprecision,recall,F1-score,and Area Under the ROC Curve (AUC). A baseline statistical modelisalsoimplementedtoprovideapointofcomparison, enablingaclearassessmentofthebenefitsintroducedbythe GNN-basedapproach.

Toestablishameaningfulcomparison,astatisticalbaseline modelisimplementedusinglogisticregressiontrainedon the same node-level feature set used by the GNN. The featuresincludedegree-basedmetrics,centralitymeasures, andtransactionflowattributes.

Thebaselinemodeloperatesindependentlyonnodefeatures without leveraging graph connectivity or neighbourhood information. This setup ensures that performance improvementsobservedintheGNNmodelcanbeattributed toitsabilitytocapturerelationaldependenciesratherthan differencesinfeaturerepresentation.

4.3 Iterative Calibration and Bias Mitigation

A key methodological contribution of this work is the iterativerefinementprocessappliedtoboththedatasetand themodel.Ratherthanrelyingonasinglestaticdataset,the systemundergoesmultiplecalibrationphases,eachdesigned toidentifyandeliminatesourcesofbiasthatcouldleadto misleadingperformance.

In early iterations, the model exhibited near-perfect performance due to the presence of easily identifiable structural patterns, such as highly cohesive laundering communitiesandhub-dominatedactivity.Toaddressthis, severalcorrectivemechanismswereintroduced,including degree-stratified sampling, cross-contamination between legitimate and laundering nodes, and the introduction of sham motifs to mimic illicit structures within legitimate activity.

Furtherrefinementsinvolvedembeddinglaunderingpaths within normal transaction flows and controlling the frequency and placement of intermediary nodes. These changessignificantlyincreasedstructuralambiguity,forcing themodeltorelyondeeperrelationalpatternsratherthan superficial cues. The effectivenessof eachcalibrationstep wasevaluatedthroughchangesinmodelperformanceacross successive experimental phases, ensuring that improvementsweredrivenbygenuinelearningratherthan datasetartefacts.

Table -1: ImprovementThroughCalibration

0.9421 0.0612 Dataleakageissue 3D 0.9745 0.0844 Partialrecovery 3E 0.9583 0.5515 Finalstablemodel

4.4 Evaluation and Validation Framework

The evaluation framework is designed to assess both the predictive performance of the detection model and the practical usability of the system in an AML context. Performancemetricsarecomputedonthetestsettoensure unbiasedevaluation,withparticularemphasisonF1-score andrecall,asthesemetricsarecriticalforidentifyingillicit activityinimbalanceddatasets,awidelystudiedchallengein fraudandanomalydetectiontasks[10]

The final model achieves a precision of 0.5515, a recall of 0.5515, an F1-score of 0.5515, and an AUC of 0.9583, significantly outperforming the baseline model, which achievesanF1-scoreof0.1713andanAUCof0.7167.These results demonstrate the effectiveness of the graph-based approachincapturingcomplexlaunderingpatterns.

Beyondquantitativemetrics,themethodologyincorporates qualitativevalidationthroughtheinvestigationlayer.Each detected alert is converted into a case report, and the consistency of detected motifs and temporal patterns is analysed across cases. The distribution of typologies and anomaliesisexaminedtoensurealignmentwithexpected laundering behaviours, providing an additional layer of validationthatgoesbeyondnumericalperformance.

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

4.5 Investigation-Centric Validation and Case Analysis

Thefinalphaseofthemethodologyfocusesonvalidatingthe system from an investigative perspective. Rather than treatingdetectionastheendgoal,thesystemevaluateshow effectively detected alerts can be transformed into meaningfulandinterpretablecases.

EachalertgeneratedbytheGNNisprocessedthroughthe investigation pipeline, resulting in a one-to-one mapping betweenalertsandcasereports.Forthefinaldataset,449 alerts produce 449 structured cases, each containing detailed information about subgraph structure, detected motifs,temporalanomalies,andexplanatoryreasoning.

Thedistributionofdetectedtypologiesshowsadominance of circular patterns, followed by layering and smurfing behaviours,reflectingthediversityoflaunderingstrategies embedded within the dataset. Temporal anomaly analysis furtherrevealsa significantpresenceofburstactivityand rapidtransactionchains,indicatingcoordinatedandtimesensitivefinancialmovements.

Additionally, the integration of a similarity retrieval mechanismallowscasestobecomparedbasedonstructural and temporal characteristics, similar to representationbasedanomalydetectionapproaches[6][10].Thisnotonly validates the consistency of detected patterns but also enhances the system’s practical applicability by enabling analyststoidentifyrecurringlaunderingstrategies.

5. RESULTS AND DISCUSSION

TheperformanceoftheproposedAMLsystemisevaluated acrossmultipledimensions,includingclassificationaccuracy, robustness to structural ambiguity, and the quality of investigationoutputs.Theevaluationisconductedonthetest split to ensure that the results reflect true generalisation ratherthanmemorisationoftrainingpatterns

5.1 Detection Performance Comparison

Table -2: BaselinevsGNNPerformance

TheresultsclearlydemonstratethattheGNNsignificantly outperformsthebaselineacrossallevaluationmetrics.While the baseline achieves an F1-score of 0.1713, the GNN improvesthisto0.5515,indicatingasubstantialincreasein the model’s ability to correctly identify laundering nodes. Similarly,theAUCimprovesfrom0.7167to0.9583,showing thattheGNNeffectivelycapturescomplexrelationalpatterns thatarenotaccessibletotraditionalmethods.

5.2 Investigation Output Analysis

Thesystemgeneratesatotalof449alertsandcorresponding case reports, each containing detailed structural and temporal analysis. The distribution of detected typologies showsthatcircularpatternsdominate,followedbylayering andsmurfingbehaviours

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

Thisdistributionalignswiththeembeddedcampaign design,wherecircularandmulti-hoppatternsaremore prevalent.Thepresenceof“unknown”casesindicatesthat thesystemiscapableofidentifyingsuspiciousbehaviour evenwhenitdoesnotstrictlymatchpredefined typologies.

5.3 Temporal Pattern Analysis

Temporal behaviour plays a crucial role in identifying coordinated financial activity. The system analyses transaction timestamps within subgraphs to detect anomaliessuchasburstsandrapidchains.

5.4 Risk & Subgraph Distribution Analysis

Theriskscoredistributionshowsthatmostdetectednodes fallwithinahigh-riskrange,confirmingtheeffectivenessof the model’s scoring mechanism. At the same time, the variation in subgraph sizes indicates that the system is capableofhandlingbothsmalllocalisedpatternsandlarger transactionnetworks.

5.5 Explainability Validation

To evaluate the effectiveness of the investigation layer, qualitative analysis is performed on the generated case reports. Each case includes detected motifs, temporal

anomalies, and structural context derived from subgraph extraction.

The consistency of detected patterns across cases is analysed,andthedistributionoftypologiesalignswiththe embedded laundering strategies in the dataset. Circular patterns dominate, followed by layering and smurfing behaviours,indicatingthatthesystemsuccessfullyidentifies diverselaunderingtechniques.

Additionally, similarity-based case retrieval produces clusters of structurally similar cases, providing further validation that the system captures meaningful and repeatablepatternsratherthanrandomanomalies.

6. CONCLUSION

This work presents a comprehensive Anti-Money Laundering(AML)frameworkthatintegratessyntheticdata generation, graph-based detection, and explainable investigation into a unified pipeline. Unlike conventional approaches that rely heavily on static rules or simplistic datasets, the proposed system emphasises realism, structural ambiguity, and interpretability as core design principles.

Amajorcontributionofthisresearchliesintheconstruction ofacalibratedsyntheticdatasetthatavoidstrivialstructural signatures.Throughiterativerefinement,includingdegree stratification, cross-contamination, and embedded laundering paths, the dataset evolves into a challenging benchmarkwhereillicitactivityisdeeplyintegratedwithin legitimate transaction flows. This ensures that model performance reflects genuine pattern recognition rather thanexploitationofartificialartefacts.

Thedetectionlayer,builtusingaGraphAttentionNetwork (GAT),demonstratesstrongcapabilityincapturingcomplex relational dependencieswithinthetransactiongraph.The final model achieves a significant improvement over the baseline,withanF1-scoreof0.5515andanAUCof0.9583, indicating robust performance under realistic conditions. More importantly, the model avoids the pitfall of nearperfectaccuracyobservedinearlieriterations,confirming that the learned representations are meaningful and generalizable.

Beyonddetection,theintroductionofaninvestigationlayer transforms the system into a practical analytical tool. By generating structured case reports that include subgraph analysis, motif detection, temporal anomalies, and deterministic explanations, the system bridges the gap betweenautomatedpredictionandhumandecision-making. The addition of similar case retrieval further enhances analytical efficiency by enabling pattern-based reasoning acrosscases.

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

Overall, the proposed system demonstrates that effective AML solutions require a combination of realistic data modelling, advanced graph learning techniques, and interpretableoutputs.Theintegrationofthesecomponents results in a balanced framework that is both technically robustandpracticallyapplicable.

7. FUTURE WORK

While the proposed framework demonstrates strong performanceoncalibratedsyntheticdata,futureworkwill focus on validating the system using real-world financial transactiondatasetstoassessitsrobustnessunderpractical conditions. Incorporating temporal graph learning techniques, such as dynamic or Temporal Graph Neural Networks,canfurtherenhancethemodel’sabilitytocapture evolving laundering behaviours. Additionally, improving scalabilityforlarge-scalefinancialnetworksandintegrating advanced explainability methods, including attention visualisation and feature attribution, can strengthen the system’sapplicabilityinreal-worldAMLoperations.

REFERENCES

[1] Kipf, T. N., & Welling, M. (2017). Semi-Supervised Classification with Graph Convolutional Networks. InternationalConferenceonLearningRepresentations (ICLR).

[2] Veličković,P.,Cucurull,G.,Casanova,A.,Romero,A.,Liò, P., & Bengio, Y. (2018). Graph Attention Networks InternationalConferenceonLearningRepresentations (ICLR).

[3] Weber,M.,Domeniconi,G.,Chen,J.,Weidele,D.K.,Bellei, C., Robinson, T., & Leiserson, C. E. (2019). Anti-Money Laundering in Bitcoin: Experimenting with Graph Convolutional Networks for Financial Forensics. Proceedingsofthe25thACMSIGKDDConference.

[4] Rossi,E.,Chamberlain,B.,Frasca,F.,Eynard,D.,Monti,F., & Bronstein, M. (2020). Temporal Graph Networks for Deep Learning on Dynamic Graphs.ICMLWorkshopon GraphRepresentationLearning.

[5] Dou, Y., Liu, Z., Sun, L., Deng, Y., Peng, H., & Yu, P. S. (2020). Enhancing Graph Neural Network-Based Fraud DetectorsAgainstCamouflagedFraudsters.Proceedings oftheACMInternationalConferenceonInformationand KnowledgeManagement(CIKM).

[6] Akoglu,L.,Tong,H.,&Koutra,D.(2015).Graph-based anomaly detection and description: A survey. Data MiningandKnowledgeDiscovery,29(3),626–688.

[8] Perozzi,B.,Al-Rfou,R.,&Skiena,S.(2014).DeepWalk: Onlinelearningofsocialrepresentations.Proceedingsof the 20th ACM SIGKDD International Conference on KnowledgeDiscoveryandDataMining.

[9] Ahmed, N. K., Neville, J., Kompella, R., & Kolda, T. G. (2015). Network sampling: From static to streaming graphs. ACM Transactions on Knowledge Discovery fromData(TKDD),8(2).

[10]Chalapathy,R.,&Chawla,S. (2019).Deeplearningfor anomaly detection: A survey. arXiv preprint arXiv:1901.03407.

[7] Ribeiro, L. F. R., Saverese, P. H. P., & Figueiredo, D. R. (2017).struc2vec:Learningnoderepresentationsfrom structural identity. Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge DiscoveryandDataMining.