Dr Dheeraj Kumar - Office of National Intelligence, Government of Australia 

Unmasking criminal asset transfer patterns using big data analytics

Cryptoasset networks are increasingly exploited by criminals and fraudsters, who leverage their pseudonymity and the proliferation of unregulated intermediaries to obscure money trails. Existing detection approaches predominantly rely on static snapshots of transaction networks, limiting their ability to capture evolving fraudulent behaviour and respond promptly. This work addresses these limitations by modelling cryptoasset systems as dynamic transaction networks and learning evolving representations of user behaviour from structural and embedding-based features derived from time-partitioned graphs. The resulting multivariate time-series representations enable a dynamic anti-money laundering framework that supports incremental learning as new transaction data arrives, allowing fraudulent wallets to be identified as anomalies in an adaptive, temporally aware manner. To enhance transparency and legal provenance, we incorporate Shapley Additive Explanations (SHAP) to identify the most influential features driving detection decisions, supporting perception-aware anomaly understanding suitable for downstream legal action. 

A central challenge in this domain is the scarcity of reliable, large-scale labelled data for training high-performance supervised models. To address this, we additionally propose unsupervised learning over evolving network representations, enabling discovery of latent structure, emerging behavioural patterns, and anomalies critical for characterising concept drift. Existing evolutionary clustering methods, however, suffer from restrictive assumptions - fixed data points, a constant number of clusters across timestamps, and limited scalability - and cannot account for essential dynamics such as cluster splitting and merging. We overcome these limitations with evolVAT, a fast and scalable evolutionary clustering algorithm that incrementally updates clustering results by leveraging previously inferred structure, accommodates multiple data-point transitions between consecutive snapshots, and supports the addition and removal of entities over time. Together, these contributions provide a comprehensive framework for dynamic, explainable, and scalable fraud detection in real-world cryptoasset networks. 

Profile