智能体
dev.to ·
@Atharva
FraudLens：基于 TigerGraph 的自主 GraphRAG 欺诈调查与 Next-Best-Action Agent
该项目以 TigerGraph Savanna 作为记录系统，构建自主 GraphRAG 金融犯罪调查与 Next-Best-Action Agent。FraudGraph schema 通过 SHARED_DEVICE_PROFILE、NEXT_TRANSACTION、CASE_SIMILAR_TO 等边暴露欺诈团伙关系；使用原生 GSQL 算法（connected_components 做团伙聚类、velocity_burst_detection 识别卡测试模式）而非 Python 重写。Agent 执行 8 步可检查状态机，进行多跳证据收集、不确定性度量与补充验证请求，并输出可审计的监管建议。技术栈包括 MCP、LangGraph、Claude/Anthropic、FastAPI、React 与 Tailwind。下游 mock-action-service 要求 L1/L2 动作必须携带已认证的 approval_event_id，否则拒绝执行。项目为黑客松作品，尚无生产验证数据。
AI推荐理由 这是一篇黑客松项目（Team Hacker House Goa 2026）的技术长文，具体信息较丰富：给出 TigerGraph Savanna 上的 FraudGraph schema（SHARED_DEVICE_PROFILE、NEXT_TRANSACTION、CASE_SIMILAR_TO）、原生 GSQL 算法（connected_components、velocity_burst_detection）、8 步可检查状态机、MCP + LangGraph + Claude 技术栈，以及基于 approval_event_id 的动作审批机制。局限在于：属参赛/演示项目，无生产部署或效果数据，正文片段在动作服务处截断，无法验证实际效果；来源为个人 DEV 博客，非官方或独立评测。
62
正文
Building an Autonomous GraphRAG Fraud Investigation & Next-Best-Action Agent with TigerGraph
A deep-dive into graph-native financial crime investigation, evidence-sufficiency gating, and self-updating institutional memory.
Author: Team Hacker House Goa 2026
Stack: TigerGraph Savanna · GSQL & Native Algorithms · Model Context Protocol (MCP) · LangGraph · Claude / Anthropic · FastAPI · React & Tailwind
1. Executive Summary: Moving Beyond "Is Fraud" Labels
In real-world banking operations, transactions do not arrive with an "Is Fraud" label. What institutions actually have is an ocean of high-velocity authorizations, imperfect heuristic risk scores from ML models, and fragmented customer reports.
Traditional rules engines and isolated machine learning classifiers suffer from two fatal failure modes:
High False Positive Rates: Legitimate cardholders making unusual travel purchases or high-ticket electronics purchases get their cards blocked abruptly, causing customer churn and reputational harm.
Blindness to Syndicates: Sophisticated card-testing rings and account takeover gangs deliberately keep individual transaction scores low (e.g. $1–$3 authorizations) while distributing operations across dozens of cards and synthetic identities.
To solve this, we engineered an Autonomous GraphRAG Fraud Investigation & Next-Best-Action System powered by TigerGraph Savanna as the system of record. Instead of relying on static thresholds or dumping uncurated rows into an LLM prompt, our agent executes an 8-step inspectable state machine that traverses graph topology, gathers multi-hop evidence, measures uncertainty, pauses to request additional validation, and recommends regulatory actions with complete auditability.
2. How TigerGraph Powers the Solution
TigerGraph is not used as a passive database; it serves as the computational heart of the entire investigation workflow:
System of Record for Topology:
The FraudGraph schema exposes relationships that make fraud rings visible at the storage layer:
SHARED_DEVICE_PROFILE (Customer ↔ Customer): Direct undirected edge connecting customers whose transactions share hardware fingerprints (DeviceInfo, OS, browser, screen resolution).
NEXT_TRANSACTION (Transaction → Transaction): Temporal chains allowing instant detection of rapid-fire micro-authorizations.
CASE_SIMILAR_TO (FraudCase ↔ FraudCase): Weighted edges linking past closed cases (CC-0001 through CC-5565) to new investigations.
Native GSQL Algorithms (No Python Reimplementation):
connected_components: BFS label-propagation running inside TigerGraph to partition the customer network into syndicate clusters.
velocity_burst_detection: Sliding-window query identifying Rule R5 card-testing patterns (3+ authorizations \$2,500$, BLOCK_ALL_CARDS, FILE_REPORT).
The downstream mock-action-service enforces this cryptographically: any attempt to execute an L1 or L2 action without an authenticated approval_event_id is immediately rejected with a logged policy citation in permission_log.jsonl.
6. Results on the 20 Benchmark Cases
Running our batch benchmark runner (python eval/benchmark_runner.py --all) evaluated all 20 exam cases non-interactively:
Pass Rate: 20 / 20 Cases (100% Schema & Logic Compliance)
Average Latency: 0.01s / case
SAR Precision: Exactly 2 cases generated regulatory filings (HHG-010 for $1,000+ exposure; HHG-014 for multi-card syndicate ring), while 18 were safely gated out.
Graph Persistence: 20/20 cases written to TigerGraph with assigned graph_case_id vertices.
7. Key Learnings & Future Enhancements
GraphRAG vs. Raw RAG: Dumping hundreds of Vesta feature columns into an LLM context creates hallucination and latency. Pre-aggregating graph topology into structured evidence sections (Baseline, Syndicate Context, Prior Memory) cut prompt tokens by 75% while dramatically improving reasoning accuracy.
Deterministic Gating: Giving the LLM an explicit numerical uncertainty threshold (0.70) forced the agent to behave like a cautious human investigator rather than a trigger-happy classifier.
Future Roadmap: Integrating streaming transaction graphs via Kafka directly into TigerGraph Savanna, and deploying Graph Neural Networks (GNNs) directly on TigerGraph Cloud for automated inductive link prediction.
Built for TigerGraph × Hacker House Goa 2026 Hackathon.