Selective Graph Attention Networks for Account Takeover Detection

Account takeover (ATO) is a type of fraud where a fraudster gains unauthorized access of a legitimate user's account through phishing, malware, bought credentials from dark web etc. The sophisticated evasion of detection by fraudsters and the requirement of friction-free experience by customers call for a new detection technique. Rather than using statistical features from behavior sequence in most of existing solutions, we represent account/context with graph node embedding and extract inherent sequential patterns with Recurrent Neural Networks (RNNs). Instead of using plain RNN by state-of-art fraud detection models, we further propose a selective graph attention mechanism within sequence (GAS), attending to relevant steps only to assist learning longer dependencies. The proposed selective graph attention mechanism is applicable to general graph structures. Experiments on a real dataset from Alibaba Group are conducted to compare the proposed model to several state-of-the-art approaches. The results demonstrate the effectiveness of the proposed graph attention mechanism. A real case study is also presented to further explain how proposed GAS works.