DESIGN AND IMPLEMENTATION OF DISK-BASED GRAPH FEATURE PREPROCESSOR FOR TERRORIST FINANCING DETECTION

Bolshibayeva A. Rakhmetulayeva S. Kulbayeva A. Yasar A.-U.-H.
2025 Technology Center

Eastern-European Journal of Enterprise Technologies
2025 #5 Issue 9 104 - 116 pp.

The object of the study is streaming payment transactions modeled as directed multigraphs. This study investigates terrorism-financing detection in payment transaction networks using disk-based graph processing and anomaly detection. The key problem addressed is the high memory consumption of graph-based detectors, which prevents analysis on systems with limited Random Access Memory, typical of small and mid-sized financial institutions. A disk-based graph feature preprocessor (DGFP) was made to get around this problem. During stream processing, DGFP dynamically labels connected components and identifies eight graph patterns characteristic of terrorist financing, including fan-in/fan-out stars and multi-hop chains. The system persists component descriptors to a columnar store on an SSD and uses an LRU-managed hot cache to serve the features, enabling real-time transaction scoring with sub-second latency. On a two-million-transaction AMLSim stream, the system integrates with a lightweight Isolation Forest and achieves an F1-score of 0.76 while reducing peak RAM from 18.3 GB to 9.8 GB and maintaining 410 ± 15 ms mean latency for 10 000 transactions. Per-motif computation remains ≤ 28.4 ms (median < 24 ms), supporting real-time scoring on commodity hardware. DGFP produces model-agnostic graph features that interoperate with standard anomaly detectors without retraining GNNs. Contributions of this research include an external memory architecture for streaming graph feature extraction; a motif-aware feature labeling scheme stored on SSD and cached by LRU; and an empirical evaluation demonstrating real-time performance and memory efficiency improvements on anti-money laundering data. Copyright

anomaly detection , compliance , external-memory algorithms , graph processing , terrorism-financing

Text of the article Перейти на текст статьи

Department of Information Systems, International IT University, Manas str., 34/1, Almaty, 050060, Kazakhstan
Department of Cybersecurity, Information Processing and Storage, Satbayev University, Satbaev str., 22, Almaty, 050013, Kazakhstan
Department of Information Systems, International IT University, Manas str., 34/1, Almaty, 050060, Kazakhstan
Transportation Research Institute (IMOB), Hasselt University, Martelarenlaan str., 42, Diepenbeek, 3590, Belgium

Department of Information Systems
Department of Cybersecurity
Department of Information Systems
Transportation Research Institute (IMOB)

10 лет помогаем публиковать статьи Международный издатель

Книга Публикация научной статьи Волощук 2026 Book Publication of a scientific article 2026