Nowadays data are in motion, change continuously and are -possibly- unbounded implying data sources that are also constantly evolving. From the data persistence point of view this reality breaks the usual paradigm of having dynamic but stable data sources. This, together with the increasing number applications based on data streams for taking critical decisions in real time, raises the need for re-thinking both the data and the query models to fit these new requirements. Therefore, under these circumstances, it seems reasonable that a suitable data model is a continuously evolving data graph. In this work we tackled the problem of querying continuously evolving data graphs in the context of ATM transactions, in particular anomalous ones. Under this context, evaluating continuous queries corresponds to recognize patterns usually associated with anomalous behaviors in the volatile subgraph of ATM transactions. We propose an evaluation process based on the dynamic pipeline computational model, a stream processing technique allowing the emission of alerts as soon as anomalous patterns are identified. Stream based Bank applications that monitor ATM transactions are direct beneficiaries of our proposal since they can continuously query data graphs to get “fresh” data as are produced, avoiding the computational overhead of having to discard non-valid data.
CEUR ceur-ws.org
Although from a classical point of view databases are thought of for persistent data, nowadays
this perspective is changing since data are in motion, continuously changing and (possibly)
unbounded. So, the following questions arise: (i) What is the proper data model? and (ii) What
is the proper query model?
Regarding the data model, the new nature of data requires a de facto new database paradigm
-continuously evolving databases- where data can be both stable and volatile. Even though
evolving databases can be implemented according to any approach, graph databases seem
especially well suited here [
Related work. Recently, in Rost et al. [
Contribution. The main contribution of this work is to provide, using a stream processing approach, a general technique for addressing the problem of continuous query evaluation against an evolving graph database by decomposing the datagraph into volatile and stable well defined subgraphs. Among the advantages of using the dynamic pipeline computational model are its parallel/concurrent nature and its suitability for developing real-time systems that emit results as they are computed, in a progressive way. In regards to detecting abnormal or suspicious ATM transaction, to our knowledge, most of the work addressing this topic provide a delayed detection based on predictions given by ML systems. Also, it is frequent the classical treatment of the problem by consulting log files because of the complaint of customers when detecting by themselves some weird movement in their accounts. This involves annoying processes for customers in order to have their money back. The idea is that, in presence of some weird finding in an ATM transaction, banks have a tool able to either ask card holders for authorizations or to take any other fraud preventing action at real-time.
Defining and implementing a continuous query engine requires to address many diferent problems, each of diferent nature. In addition, the proof of concept we intend to provide has itself its own complications.
It is not trivial to establish what is and in which circumstances a transaction can be considered
anomalous. Based on a work that have addressed this characterization [
To define a proper architecture for a continuous query engine is one of the most challenging
activities of our work. Among other tasks, this comprises: to define a graph-based query
language expressive enough to allow for capturing the diferent patterns representing
anomalous queries; to establish the algorithms for identifying the patterns associated to anomalous
queries; to choose and manage the right windowing approach and other features related to
distributed query-evaluation; to deal with the evaluation of many continuous queries
simultaneously; to evaluate the suitability of the implementation language, tools and the proper
system configuration. Figure 3 depicts a preliminary architecture for a continuous query engine
for detecting anomalous ATM transactions, DPATM. We propose a solution that follows the
Dynamic Computational Model [
The main luck stone, in order to be able to provide the proof of concept that we propose, is to have a proper dataset. Given the confidential and private nature of bank data, it has been impossible to find a real dataset for our experiments. In this regard, we are currently constructing a synthetic property graph bank dataset based on the Wisabi Bank Dataset1. In fact, we consider that our synthetic dataset will be an important contribution of this work.
A prototype implementation of the DPATM for detecting the anomalous ATM transaction pattern presented in Figure 1b has been developed using Go language. For testing this implementation2 we have constructed a small stable bank PG using Neo4j graph database management system. We plan to extend the prototype including window management and multiple continuous query evaluation. Once we had generated a big enough stable bank property graph, to be able to conduct experiments to assess our proposal, we need to tackle two important issues: (i) to find appropriate baselines to compare our solution and (ii) to establish what are the proper statistic frequency distributions for including anomalous ATM transactions in the input streams of volatile relations. 1https://www.kaggle.com/datasets/obinnaiheanachor/wisabi-bank-dataset 2https://github.com/FCanfran/ATM-DP This work has been supported by MCIN/AEI/10.13039/501100011033 under grant PID2020112581GB-C21.