aws / aws/graph-notebook

Sample application notebook: detecting money-mule networks (AML flow tracing with Gremlin)

Open
#781 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Jupyter Notebook
Stars
819
Forks
179
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
The 03-Sample-Applications folder has a strong fraud notebook (01-Building-a-Fraud-Graph-Application), but it focuses on card-fraud rings and identity theft via shared features. There's currently no sample covering the other big financial-crime use case for graphs: anti-money-laundering / payments fraud — tracing the flow of funds through money-mule networks (placement → layering → integration).

**Describe the solution you'd like**
A self-contained sample notebook, `03-Sample-Applications/01-Fraud-Graphs/02-Detecting-Money-Mule-Networks.ipynb`, that builds a small (30-account) synthetic mule network with a single Gremlin write query and walks through five detection patterns an investigator would actually use:

1. finding cash-out accounts structurally (sinks with large in-flows)
2. tracing a layering chain from a victim to a cash-out (`repeat().until()` + `path()`)
3. finding the facilitator account via path-bottleneck counting (`groupCount()` over victim→exit paths)
4. shared-identifier rings (accounts linked only by a common phone/device vertex)
5. wash-cycle detection (circular flows with no economic purpose)

Each query comes with an "investigator read" explaining the decision it informs, plus graph visualisations coloured by account role. Because it creates its own data, it runs on Neptune or any TinkerPop-compatible endpoint; I've verified all cells end-to-end against Gremlin Server 3.7.3 (TinkerGraph).

**Describe alternatives you've considered**
Extending the existing fraud notebook — but it's already long, uses a seeded dataset, and covers a different typology; a separate complementary notebook keeps both focused.

**Additional context**
I have the notebook written and executing cleanly. Happy to open a PR if the maintainers think it's a good fit — and glad to adjust naming, placement, or the data model (e.g. `amount` vs `amount_gbp`) to match your conventions.

Contributor guide

Open the contributing guide

Research direction

Start with 03-Sample-Applications/01-Fraud-Graphs/01-Building-a-Fraud-Graph-Application.ipynb and compare its naming, data model, and visualisation conventions with the proposed 02-Detecting-Money-Mule-Networks.ipynb. Run the new notebook against Gremlin Server 3.7.3 with TinkerGraph. Done means it creates its 30-account synthetic network, demonstrates all five detection patterns, and includes investigator explanations and role-coloured visualisations.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, jupyter-notebook
Domain
data
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.