Business Context
The bank's Fraud Department wants to identify 'synthetic identity' rings. These are groups of accounts that artificially inflate their creditworthiness by circulating money rapidly among themselves. By calculating the Core Decomposition, the bank can isolate these densely connected subgraphs (high k-cores) which represent the fraud rings, separating them from legitimate, looser transaction chains.
Data Preparation
Creating a transaction log. Accounts A1-A4 form a tight fraud ring. Accounts C1-C3 are normal retail customers.
Copied!
| 1 | |
| 2 | DATA mycas.transactions; |
| 3 | INFILE DATALINES delimiter=','; |
| 4 | INPUT from_acc $ to_acc $ amount; |
| 5 | DATALINES; |
| 6 | A1,A2,1000, A2,A3,1000, A3,A4,1000, A4,A1,1000, A1,A3,500, A2,A4,500, C1,C2,50, C2,C3,20, C1,M1,10; |
| 7 | |
| 8 | RUN; |
| 9 |
Étapes de réalisation
1
Execute Core Decomposition on the transaction graph to find dense structures.
Copied!
| 1 | |
| 2 | PROC CAS; |
| 3 | network.core / links={name='transactions'} outNodes={name='account_scores', replace=true} outLinks={name='ring_structures', replace=true}; |
| 4 | |
| 5 | RUN; |
| 6 | |
| 7 | QUIT; |
| 8 |
2
Filter results to isolate high-risk accounts (High Core Number).
Copied!
| 1 | |
| 2 | PROC CAS; |
| 3 | TABLE.fetch / TABLE={name='account_scores'} where='core_out > 1'; |
| 4 | |
| 5 | RUN; |
| 6 | |
| 7 | QUIT; |
| 8 |
Expected Result
The action should identify Accounts A1, A2, A3, and A4 as belonging to a higher core (e.g., 3-core) due to their dense interconnectivity. Regular customers (C1, C2) should fall into lower cores (0 or 1-core), allowing the fraud team to prioritize the 'A' cluster for investigation.