An Accurate Fraud Source Path Identification Using Integration of Graphical Neural Networks, Long-Short Term Memories, and XGBoost

There exist many studies on fraud identification over social platforms as well as on e-commerce sites. When fraud occurs, it means loss or identity theft of a person or user. Tracking the location of the fraud place, as well as the exact address, is quite challenging. Hence, firstly, we will demonstrate the studies on how the location of the fraud or the source needs to be known, so that action can be initiated. Kumar et al. [1] demonstrate that unwanted portions in e-commerce sites or fraudulent e-commerce sites created by hackers can cause damage to the individual's income. To identify these false sites, a proper stage approach that includes data preprocessing, feature selection, and model training is required. The models used combinedly, such as Ant Lion Optimizer (ALO) and Extreme Learning Machine (ELM), would reduce noise, increase accuracy, and avoid mutual inference. Kumar et al. [1] and Ali et al. [2], attempted a discussion on forensic techniques such as a multistage process, which includes data collection, interviews, forensic auditing, and analytics on irregular transactions.

A set of strategies is demonstrated with their benefits and shortfalls, highlighting effectiveness and flexibility, and ensuring the risks are addressed. Kumar et al. [3] made a discussion on the usage of a deep learning model CNN against others like LSTM, GAN, and RNN in analyzing the accounts, especially in terms of cash deposits, withdrawals, and unusual balances. The significant factor involved is efficiency, which increases the effectiveness of the model in fraud detection in accounts. Vishnu et al. [4] had a discussion on the usage of nonfiscal token (NFT) for the transactions made in e-commerce sites and retail stores. The blockchain-based system NFT makes the transaction more secure and transparent. Hence, warranties are maintained safely by both customers and companies.

From Korchenko et al. [5], a discussion was made on solutions to cyber threats in terms of setting up criteria such as openness, behavior, DDos attacks detection, device identification on which fraud is exposed, speed, content delivery, bot detection, integration environment, confidentiality assurance, cloud or local deployment, and use of AI technology. The strategies used are analyzed with benefits, drawbacks, and accuracy of identification over cyberthreats. Mohan et al. [6] had a demonstration on websites that trick people and commit fraud. The various machine models include decision trees, support vector machines, logistic regressions, and an ensemble of hybrid models using soft voting, grid search, and canopy feature selection. The effectiveness is measured in terms of accuracy, precision, recall, and F1-score. Aljabri and Mohammad [7] had a demonstration on click fraud on the portions of an app/website where advertisements attract users who may lose amounts unnecessarily. This phishing is to be eliminated or minimized using a machine learning model, Random Forest, which produces better accuracy than others in the domain.

Abdul Samad et al. [8] had a discussion on various machine learning models on two datasets for phishing user privacy. The accuracy of Gradient Boosting and Random Forest over Dataset-1 is a little less than that of Extreme Gradient Boosting over Dataset-2. The hyper factors considered are data balancing, feature selection, and hyperparameter tuning. Hafidi and Mahnane [9] had a discussion on providing the website as input, and using a machine learning model to produce output as a fraud site or a genuine site. Before machine learning models, hackers would steal the privacy of an individual and cause damage in terms of identity and money. Zhang et al. [10] had a discussion on fraudulent behavior in e-commerce sites, motivating biometric authentication since biometrics is a unique validation method. To provide faster performance and prevent losses, a method called the multi-modal behavioral transformer is used. This method records every activity using the mouse trajectory, analyzes both the inner details of the page and the inter-page.

Reddy et al. [11] had a discussion on reducing fraud using machine learning and AI approaches. This study recommends practices that proactively enhance the prevention efforts against fraud by identifying anomalies. The conventional practices and proposed system are compared for detailed analysis. From Rao et al. [12], it is demonstrated that systems shift from rule-based to ML, then to DL. The human efforts in the shifts shown are also based on three aspects, such as multi-modal engineering support, scalability addressing, and newer methods such as adversarial ML, federated learning, reinforcement learning, LLMs, and their suitability over e-commerce sites for fraud identification. Hernandez et al. [13] had a discussion on fraud detection, such as credit card fraud. The methods PRISMA, Kichenham, and specific machine learning models are applied for the detection of credit card load fraud from different countries. The studies over a period of users, and specific articles were analyzed for drafting the review. From Zenzerović and Šajrih [14], it is demonstrated that the work of Bao et al. includes objectives such as the usage of new tools to detect fraud and prevent it by combining best practices as a novel detection model. The other studies are compared against the specific study, which would reveal challenges and prevention practices. According to Beemamol [15], a discussion was held on various approaches used in different problem domains since 1989. The methods used to enhance the detection of fraud are taken from interdisciplinary environments. To improve the detection rate, integrate interdisciplinary approaches.

Alrasheed [16] conducted a discussion on the misuse of cryptocurrencies in financial fraud, the challenges that traditional methods experience, such as technological complexity, complexity in user identification, and weakness in legal regulatory aspects. To enhance security and privacy, AI is to be integrated into legal, regulatory, and reinforcement systems. Liu et al. [17] demonstrated browser biometrics in accessing internet applications. Nowadays, sites are accessed with ads, which may cause damage to individuals' income. When fraud occurred through advertisements, the biometric validation feature would track the user and report the location of fraud. Additional details of the user are revealed if browser biometrics are set up. This study tracks HTTP traffic, user interactions, and targets.

From Padmapriya et al. [18], to avoid threats over the usage of web cameras for transmission of surveillance data over the cloud, the encryption and decryption take place using the integration of mechanisms such as DWT, Huffman compression, and ECC. The proposed model supports detecting abnormal events like vulnerabilities or third-party access during the transmission of data over the cloud. The benefits achieved are reduced costs, increased storage space, and tracking of data. Guan and Chen [19] demonstrated that a virtual identity alignment algorithm would identify real identities based on virtual accounts used in multiple sources. Based on functionalities, and behavior such as data collection, management, task management, identity alignment, and suspicious user evaluation, applies automatic strong lawful initiatives over crimes done by users. Hilal et al. [20] had a discussion of machine learning models such as supervised learning, semi-supervised learning, and unsupervised learning models. The fraud occurs in many domains, like insurance, money laundering, commodities, etc. The criminals' acts may not be completely prevented; hence, anomaly detection techniques are required to detect the fraud. Baesens et al. [21] demonstrated machine learning and analytical models for detecting fraud in financial transactions (or money loss transactions. Many data engineering techniques are applied and analyzed to improve the interpretability. The performance is enhanced by dividing the analytical model into feature and instance steps. Based on Dey and Sangaraju [22], the discussion on load balancing is initiated by ensuring features such as global and local stability, improved performance, eliminating the delay and latency, and optimizing the resources. In regard to Dey and Sangaraju [23], it demonstrates hybrid load balancing in a novel performance evaluation that involves multiple balancing approaches based on the category of activity over task load distribution, and enhances measures such as throughput and execution time. In view of Kumar and Raju [24], a hybrid model that detects fraud in financial transactions, with accuracy and security, along with real-time monitoring.

Table 1. Listed methods with their identified gaps

Sha et al. [25] demonstrated diversified graphical networks on transactions that involve users, financial organizations, and nodes using attention mechanisms and temporal patterns in capturing complex scenarios. This study struggles in processing large heterogeneous networks, resulting in false positives. Raju et al. [26] demonstrated exploring the fault detection, such as weak conditions are identified by a hybrid model, especially on flyovers/bridges, using DL approaches, Transfer learning, R-CNN, and LSTM for ensuring better effectiveness.

Table 2 demonstrates the gaps involved in significant studies and recommendations to overcome such gaps.

Table 2. Significant studies and identified gaps

4.1 Dataset description

The dataset used is the IEEE-CIS Fraud Detection Dataset, which is publicly available for financial fraud analysis. The composition involves a total number of transactions of 590,000, in which 96.5% are legitimate transactions, and 3.5% are highly imbalanced. The features of it are classified into 4 categories: identity features, transaction features, network features, and behavioral features. Among these, the first category describes IDs of devices, browser information, and IP attributes, the second category includes amount, time delta, payment type, and product, the third category describes IP-geo mismatch and indicators of Proxy, and the fourth category includes temporal patterns and frequency of transactions. The dataset is split into 70% train, 15% validation, and 15% test. The data preprocessing is initiated over the dataset, in which missing numerical values are handled by median imputation, while categorical features are handled by mode imputation, resulting in bias to be avoided, which was caused by skewed transaction distributions. The standardization of transaction amounts and time intervals using z-score normalization to avoid data leakage. The high cardinalities of card and device identifiers are transformed using one-way hashing to preserve privacy, while low cardinalities are handled by label encoding. LSTM is used to capture temporal dynamics such as transactions and user interactions. The heterogeneous transaction relations are traced using a GNN model among entities such as IP addresses, Devices, accounts, etc.

4.2 Experimental setup observations of measures

The effectiveness of the model is assessed using the fraud score, given in PS1, to assess weighted cross-layer processing of fraud confirmation. If the fraud score > 0.7, it denotes high confidence in fraud activity. The performance is evaluated based on the latency consumed by the specialized models used, such as GNN, LSTM, XGBoost, and XAI SHAP processing time. From this, the multi-layered deep learning model is considered an end-to-end model, and its performance is better than that of traditional models. The proposed model enhances accuracy by a significant extent and lowers false positive generation. The key aspects that made this happen are cross-channel correlation, adaptation to detect novel frauds, and delivery of verified results.

Table 3. Measures assessment over considered models

Based on Table 3, the methodologies were interpreted in the comparison of intensities based on measures such as accuracy, precision, performance, robustness, and cost-effectiveness. From Table 3, the performance is very good for rule-based systems and single-layer ML models. The accuracy is very good for GNNs, and our proposed multi-layered deep learning ensemble approach. The precision is high for models such as GNNs, XAI models, and a multi-layered deep learning ensemble approach. For new fraud detection, the models such as GNNs, SSLs, and a Multilayered deep learning ensemble are high. Nowadays, cost is not an issue due to safety assurance is given as the top priority.

Table 4 demonstrates operational advantages gained from cross-layer learning using GNN, LSTM, and SHAP correlation, resulting in a stronger performance on the proposed model. From Table 4, the only model, a multi-layered deep learning ensemble, is very good at accuracy, precision, and robustness. The proposed model is also good in performance and cost aspects. Compared to traditional and considered individual models, the proposed model is best in its features and layer-wise validation. The performance of the proposed model is superior due to cross-channel fusion from device transaction metadata, behavior analytics, and network forensics, due to graph intelligence in which each entity is independent, suspicious activities over time as temporal patterns are detected by LSTM, combines embeddings of GNN and LSTM by a meta fusion mechanism XGBoost, and increases confidence by SHAP. The benchmark, like a baseline, is a setter for these models, which is a faster execution of the models. In addition to metrics to be evaluated, paired t-test, and McMenar’s test were conducted over 10 folds, and classification per instance, over the same set of instances, for performance assessment.

Table 4. Evaluated scores against the considered models

Figure 3, which is derived from Table 4, shows that the proposed model is best in robustness, accuracy, and precision. For any model, accuracy denotes the number of correctly identified fraud sources such as True positives and True negatives, out of all predictions, Precision denotes the number of correctly flagged fraud cases out of true positives and true negatives, and robustness denotes withstanding and successful validation of novel frauds as well as adversarial attacks, are good means that the model is the best and effective model when compared against other models.

Figure 3. Effectiveness of the models in specific terms

Table 5. Evaluated area under the curves (AUCs) over specified methods in fraud source path detection

Based on Table 5, the evaluated AUCs of specific models involving the proposed model of CNN, LSTM, XGBoost, and XAI are superior, ensuring no leakage of information. The visual drawing of the AUCs of the models would also demonstrate the effectiveness of the models in Figure 4.

4.3 Example case study

Example case study demonstration based on synthetic dataset, would involve stages such as initial compromised clicked source, correlating device used, IP with Geo mismatch detection reveals external threat intelligence, suspicious detection over time (deviation) by LSTM, Fraud entity linkage involves account and device by GNN, meta fusion by XGBoost, and SHAP feature validation (depicts importance of each feature and layer to ensure transparency) for interpretability.

Figure 4. Area under the curves (AUCs) of specific models against the proposed model

Table 6. Confusion matrix for the considered dataset

For the confusion matrix shown in Table 6, justification demonstrates Table 7 on the model's job during a fraud event scenario, in which GNN is used for device and account tracing, LSTM for suspicious behavior, and XGBoost for fusing the confidences of all models, and identifying external threats by dark web and geolocation. For unseen, realistic data, the data is divided into training 70%-validation 15%, and testing 15%. The performance on the test set is demonstrated in the confusion matrix, which is defined in Table 6.

As per Table 6 and the dataset, FPR is observed at 3.3%, which denotes a very low risk flagged wrongly, and FNR is observed as 2.5%, which denotes a few missed dangerous cases.

The SHAP global feature plot set demonstrates that the top contributing factors in fraud detection are Dark web exposure, transaction velocity, Device fingerprint anomaly, Behaviour drift, Account linkage, and IP Geo-mismatch. Global SHAP uses almost 20 contributing factors for fraud detection, whereas Local SHAP denotes a misclassified fraud attempt. SHAP identifies a faster, traceable route and ensures better usability.

4.4 Significance tests

By enforcing a unified dataset, mechanisms such as standardized preprocessing, consistent evaluation metrics, and formal statistical testing were observed, and then the comparative experiments were conducted in a rigorous and unbiased manner. The inclusion of paired statistical tests and misclassification analysis reports the performance gains of the proposed framework are both quantitatively very good and statistically validated. The identical preprocessing was used for all baseline models. The other baseline models, such as combined models, required support network behavior correlation. The statistical tests p-tests and McNemar's test are preferred for confirming significant improvements. The notable tests p-tests for model performance, and McNemar's test for difference in misclassification, provide the effectiveness of the model, and the disagreement. The p-values obtained from the paired t-test and McNemar’s test over 10-fold validation are mentioned in Table 8, which ensures the proposed model has better performance than other models (low performance).

Table 7. Illustration of an example case study a fraud event using the proposed model

Table 8. P-test and McNemars test on models used

Hence, the proposed framework’s benefits lie not only in merging multiple models but in strategically aligning their strengths to ensure relational structure by GNN, temporal evolution by LSTM, and nonlinear feature interactions in a unified manner, by XGBoost. To ensure accuracy, robustness, and interpretability, this integrated combination is required. Especially in the feature interactions aspect, the models used would be useful for capturing higher-order relational dependencies, such as fraud rings, shared device misuse, and coordinated transaction flows using GNN, learning temporal patterns from ordered transaction and interaction sequences, as well as behavioral drift denotes, such as gradual changes in transaction timing, frequency, or interaction style by LSTM. The mechanism for learning feature importance weights and interaction effects between structural embeddings, temporal signals, and engineered risk indicators by XGBoost, to reduce false positives. The usage of global SHAP reveals dominant contributors such as device fingerprint anomalies, transaction velocity, and graph connectivity scores, while local SHAP highlights instance-specific evidence.