MutationGuard: A Graph and Temporal-Spatial Neural Method for Detecting Mutation Telecommunication Fraud

1 Introduction

Telecom fraud refers to fabricating stories through messages, phone calls, and other communication methods to acquire a large amount of public and private property illegally. It is a pervasive issue with significant societal and economic implications [Barson et al., 1996], resulting in substantial financial losses and compromised user personal safety.

∗Corresponding Author

Due to the trust granted by communication service providers to users with a history of good communication behavior, fraudsters often resort to buying or renting communication cards from legitimate users to carry out fraudulent activities. Furthermore, fraudsters may also simulate a large volume of normal call activities to conceal a small amount of fraudulent call behavior. This leads to the phenomenon of mutation fraud. Mutation fraud refers to fraudulent activities interleaved with legitimate behaviors within a short time window. Unlike persistent fraud, mutation fraud exhibits abrupt shifts in communication patterns, such as sudden changes in call recipients (e.g., from known contacts to strangers) or temporal anomalies (e.g., short-duration calls clustered in unusual hours), as illustrated in Figure 1.

Existing methods assume that the users under detection exhibit stable behavioral patterns and directly convert the entire Voice of Call (VOC) records of the user into a handdesigned statistical feature vector (average call duration, total number of calls, etc.) [Hu et al., 2022; Hu et al., 2024; Ji et al., 2020]. Subsequently, they solve the problem by using vector classification approaches. This classification approach based on statistical features is inadequate for adapting to complex and evolving fraud patterns. In the long-term adversarial scenario between fraudsters and regulators, fraud techniques are constantly updated. Once fraud patterns change (e.g., mutation fraud), the existing statistical feature extraction methods are likely to become ineffective.

There are three major challenges in the task of mutation telecommunication fraud detection: (1) Research in this field is currently limited by the absence of datasets created specifically for mutation telecommunication fraud. (2) Mutation fraud has its inherent patterns, but existing methods based on manual statistical features make it difficult to capture these patterns. (3) Telecom fraud detection is a complex task that requires the integration of multiple sources of information. However, existing methods often lack the capability to fuse multi-source information effectively.

To address the first challenge, we have curated a dataset named MutationTeleFraud, specifically containing mutation fraud data. This dataset is obtained from a telecommunication carrier after removing PII (Personally Identifiable Information) and sensitive data and is made publicly accessible to facilitate further research. In addressing the second challenge, we introduce a deep neural method called MutationGuard, specifically designed to handle the intricate pattern detection issues associated with mutation fraud. The main difference between our approach and previous methods for VOC modeling is illustrated in Figure 2. Although mutation fraud is very covert, it still has two significant patterns: 1. From a static perspective, there must be local fraud behaviors; 2. From a dynamic perspective, there are significant temporal behavior changes. Our method processes each call record into a vector, with the entire VOC records forming a list of vectors, and employs a sequence classification method following the above two insights to detect telecom fraud. Existing methods cannot effectively utilize the above two insights because manual features cannot effectively focus on local behaviors and reflect the temporal changes. Regarding the third challenge, we consider users under investigation to be central nodes, with all users communicating with them treated as neighboring nodes. For users engaged in mutation fraud, their communication often undergoes significant changes. For example, an ordinary individual with regular social connections would typically have dense communication with family and friends. However, if their mobile SIM card is lost or sold for fraudulent purposes, their calling users would include both friends and a large number of strangers, as illustrated in Figure 1. Considering that the message-passing mechanism can effectively discover relevant patterns [Zhao et al., 2021; Zhou et al., 2020; Scarselli et al., 2004], we effectively capture the evolving patterns within user communication graphs by employing a graph attention mechanism. In summary, the main contributions are as follows:

1. Our study represents the first investigation into the phenomenon of mutation telecommunication fraud, offering empirical data from real-world scenarios coupled with comprehensive analytical insights.
2. The proposedMutationGuard facilitatesmulti-source information fusion and constitutes a significant advancement in detecting mutation fraud. MutationGuard not only captures local fraud behaviors and temporal behavior changes in VOC records but also discerns evolving patterns within user communication graphs.
3. Our MutationGuard shows a significant improvement on the proposed MutationTeleFraud dataset and the opensource dataset. Specifically, experiment results reveal a significant improvement in the AUC score by 1.52% and the F1 score by 1.36% on the proposed telecommunication fraud dataset.

2 RelatedWork

Rule-based Methods. Early research on telecom fraud detection primarily employs rule-based approaches, emphasizing the manual design of filtering rules based on expert knowledge. For instance, Hilas [2009] utilizes professional expertise and data mining techniques to design an expert system for telecom fraud detection. Prakash et al. [2010] employ the Singular Value Decomposition (SVD) method to analyze anomalous patterns in large-scale telephone communication networks. Liu et al. [2017] introduce a metric named 'contrast suspiciousness,' utilizing graph topology information to identify potential fraudsters.

Machine Learning Methods. With the advent of machine learning technology, researchers have shifted towards manually designing features and employing classical machine learning methods to classify fraudulent telephone numbers. Dong et al. [2004] extract 55 feature attributes from user call records and utilize a Support Vector Machine (SVM) with a Radial Basis Function (RBF) kernel to predict fraudulent users. Xing et al. [2020] employ random forests as a benchmark method, outperforming SVM with an RBF kernel on fraud detection datasets. To overcome the high bias of the dataset, Arafat et al. [2019] apply ensemble techniques of classifiers. Despite the computational efficiency of classical machine learning methods, their constrained fitting capability poses challenges in adapting to intricate patterns.

Deep Learning Methods. Deep learning methods have been widely used in an adversarial scenario nowadays [Zhou et al., 2024], including in the field of telecommunication fraud detection [Ravi et al., 2022; Hu et al., 2024]. Wahid et al. [2023] introduce a real-time fraud detection method utilizing a Neural Factorization Autoencoder (NFA). Ji et al. [2020] employ a Multi-Range Gated Graph Neural Network for telecom fraud detection. Hu et al. [2022] utilize subscriber synergy behavior to reconstruct connectivity, thereby bridging the gap between sparse connectivity data and graph machine learning. These methods commonly require manually extracting statistical features from telecommunication users' VOC information and various behavioral records. To fully utilize the temporal features in VOC records, Zhen and Gao [2023] introduce CDR2IMG that leverages temporal periodicity to enhance fraud detection. Specifically, they compress the call duration feature into a 2D image and employ Convolutional Neural Networks (CNN) to extract latent fraud features embedded in the image. These existing approaches heavily depend on predefined feature engineering methods, making existing methods challenging to adapt to complex mutation fraud scenarios. In contrast, our proposed MutationGuard directly utilizes the raw data from call records as input, allowing the method to better capture complex mutation patterns.

3 Our Method

3.1 Overview

Figure 3 shows the architecture of our MutationGuard, which is based on multi-source information joint learning. MutationGuard follows the design principles presented in the Introduction section, using the VOC Encoder to capture local fraud behaviors and temporal behavior changes, and then leveraging the User Encoder to incorporate user interactions.

3.2 Embedding Layer

User Feature Initialization. User features are encoded into a vector encompassing: static attributes (e.g., SMS usage, app preferences) and temporal distribution features (e.g., call time distribution). Ultimately, we obtain the user feature matrix U ∈ RM×du , where M denotes the number of nodes in the graph, and du denotes the dimensionality of features.

VOC Feature Initialization. VOC refers to detailed records about communication activities generated by the telephone system. These records encompass details such as the call start time, call duration, call type (e.g., incoming or outgoing), etc. Assuming a target user to be identified generates a set of records with a length of N over a period, we obtain the VOC feature representation matrix C ∈ RN×dc , where dc represents the dimensionality of each VOC record feature.

3.3 VOC Encoder

To capture fraud behaviors, we design two corresponding modules inspired by Pointnet++ [Qi et al., 2017] and BiLSTM: the Local Fraud Feature Extraction (LFFE) Module and the Temporal Change Feature Extraction (TCFE) Module. The components are shown in Figure 3.

Locality. To achieve better local fraud feature representation, it's essential to reconsider the locality within human activity data. Organizing data based on the principle of local similarity enables more effective extraction of local features. If data isn't organized according to this principle, during local aggregation, the model might blend distinct fraud patterns with normal behavior, resulting in higher false positives or overlooking critical fraud features. Image data naturally lends itself to the concept of locality through geometric relations, where neighboring pixels often exhibit similar values due to spatial proximity. VOC data is 1D time-series data that exhibits local behavioral similarity within adjacent time windows. However, humans also engage in similar activities at the same time on different days, which cannot be reflected in the 1D time series, thus losing some local information. Therefore, we need to address the question: How can we reorganize VOC records so that reorganized human activity behaviors exhibit better local similarity, facilitating the detection of local fraudulent activities? Zhen and Gao [2023] uses a 2D time grid to solve this problem, but the sparsity of features is caused by fixed intervals. Unlike them, we conceptualize time as a spiral structure to solve this problem.

Spatial Position Calculation (SPC). Spatial Position Calculation provides spatial position inputs for the LFFE Layer in the VOC encoder. Specifically, we transform each timestamp in VOC records into coordinates on a cylindrical surface to ensure a reasonable distance measurement between these embeddings. The projection of human behavior data onto a cylindrical surface is a deliberate design choice that leverages the natural periodicity of time to provide better locality. In further detail, time can be conceptualized as a spiral structure when viewed in a cylindrical projection. The cylindrical surface allows for the representation of time as progressing both in the vertical direction and along the horizontal axis of the cylindrical surface. As we move through time, the data forms a spiral that encircles the cylinder. Each complete rotation represents a full day, and the height of the spiral indicates the temporal progression of the days themselves, as shown in Figure 4. We not only ensure that feature vectors corresponding to temporally adjacent times on the same day (along the horizontal axis of the cylindrical surface: e.g., 2024-10-1 20:00:00 and 2024-10-1 20:01:00) are spatially adjacent but also that feature vectors corresponding to adjacent times on different days are spatially adjacent (in the vertical direction: e.g., 2024-10-1 20:00:00 and 2024-10-2 20:00:00). Clearly, by selecting the same number of feature points within any local neighborhood, our proposed data organization method exhibits higher local similarity compared to the simple 1D sequence feature similarity, thereby achieving better locality. For any VOC record (at time t on the x-th day), where 0 ≤ t<24 and x ∈ N (we set the earliest VOC record time at x = 0.), we obtain its cylindrical coordinates:

We normalize x + t/24 to the range [-1, 1] and convert the cylindrical coordinates to Cartesian coordinates for subsequent Euclidean distance calculation in the S&G step. Then we get the spatial position matrix S ∈ RN×3 for VOC records after SPC, where N represents the number of calls.

Sampling and Grouping (S&G). The goal of the Sampling and Grouping (S&G) layer is to extract the most informative and relevant local fraud features from VOC data to detect patterns of telecom fraud. This is achieved by first selecting a representative subset of points and then grouping them based on their proximity in time, as shown in Figure 4.

Sampling. Given the VOC feature representation matrix C ∈ RN×dc and the spatial position matrix S ∈ RN×3 , where N is the number of calls. Each point pi = (Si,Ci) represents a moment of activity. Thus, the complete set of points can be represented as: P = {p1, p2, . . . , pN}. We apply the farthest point sampling (FPS) method to sample a subset of the points. We aim to sample a subset Psample of points from P, where |Psample| = K and K represents the number of selected samples. Using FPS, we iteratively select points that are maximally distant from already selected ones. The sampling process can be mathematically formulated as:

where ∥pi -pj∥2 is the Euclidean distance between points pi and pj, and Psample is the selected points. This procedure ensures that the selected points Psample are representative.

Grouping. After selecting the representative points, we group the sampled points based on their temporal proximity. For each sampled point pk, we define a neighborhood N(pk) consisting of points within a radius r.

This step ensures that each point is grouped with others that exhibit similar behaviors, allowing the model to capture localized patterns of user activity.

We empirically determined optimal sampling ratios (K/N) and grouped radius through a grid search on the validation set. LFFE Layer. Once the neighborhoods are formed, we aggregate the features within each group, as shown in Figure 4. A common approach is to apply max pooling to capture the most significant features within each neighborhood. The aggregated feature fk for each neighborhood N(pk) is:

where φ(·) performs the element-wise maximum operation over the features in the neighborhood N(pk). Each input feature point pk is updated as pnew k = (Sk,MLP(fk)).

Aggregation. The aggregation Layer aggregates features directly across all points to obtain a comprehensive feature representation of local fraud behaviors in VOC records:

Where K′ represents the total number of feature points input to the Aggregation layer, and ψ(·) represents the feature transformation function, which is a Multi-Layer Perceptron. TCFE Layer. Due to the inability of the LFFE module to perceive the order of data, the TCFE layer employs a bidirectional Long Short-Term Memory (BiLSTM) to incorporate temporal dynamics perception. It allows the model to learn how current actions might relate to future fraudulent tendencies. For instance, a fraudster may engage in a series of small, unremarkable actions that gradually escalate into a full-blown scam. By analyzing from a dynamic perspective, the TCFE Layer can detect pattern changes in behavior. The final output feature representation of the TCFE module is FT.

3.4 User Encoder

Generally, there are significant differences between the communication graphs of normal users and those of fraudulent users. Differences in user features include variations in data usage expenses and app usage patterns. Differences in graph features are evident as the user groups contacted by normal users and fraudulent users often differ significantly, leading to substantial differences in the overall features of the graph.

Our approach is capable of directly encoding any available features into the node attributes of users and utilizes the User Encoder to capture various latent features, highlighting the importance of incorporating multi-source information in telecom fraud detection. We conduct L-layer graph attention mechanism to obtain user interaction pattern features FU.

where uli represents the input feature vector for node i in layer l, W is the weight matrix, Ni represents the neighborhood of node i in the graph, a is the attention weight vector, σ is the activation function. Then we get the graph pattern feature:

4 Experiments

In this section, we evaluate the performance of MutationGuard. We make all of our source code and datasets publicly available to facilitate future study 1 . The research data were provided by China Mobile Communications Group Shaanxi Co., Ltd. The identification of fraudsters was achieved through various measures after long-term efforts by China Mobile Communications Group Shaanxi Co., Ltd.

1 https://github.com/nlgandnlu/MutationGuard

4.1 Datasets

We first conduct experiments on the Sichuan telecom fraud dataset 2 including 4587 subscribers with complete features from the 2020 Digital Sichuan Innovation Competition, organized by the Sichuan Provincial Big Data Center in China. Some users in this dataset have missing attributes. To ensure fair comparison, we test all baseline methods using users with complete attributes. We also conduct experiments on the introduced dataset MutationTeleFraud. This dataset comprises 9874 subscribers, documenting their VOC records and other relevant user information generated between August 1, 2023, and September 14, 2023. The dataset encompasses 1849 normal fraudulent users, 388 users exhibiting mutation fraud, and 7637 normal users. The mutation fraudsters are defined as users who: (1) maintained normal communication behaviors for at least 12 consecutive months; (2) were flagged by both telecom operators and public security agencies for participating in fraud incidents during the latest month. Following the previous work [Hu et al., 2024], the ratio of the training set, validation set, and testing set in both datasets is 60%, 20%, and 20%, respectively. The main differences between the proposed dataset and the publicly available Sichuan dataset are illustrated in Table 1.

4.2 EvaluationMetrics and Baselines

Following the previous work [Zhen and Gao, 2023], we evaluate the performance with AUC, macro Recall, macro Precision, and macro F1. The default threshold for prediction is 0.5. To gain a comprehensive understanding of the performance of regular fraud and mutation fraud data, we also provide results on Accuracy for the two types of fraudulent activities. The baselines for the Sichuan telecom fraud dataset we compared include (1) machine learning methods: Support Vector Machine (SVM) [Cortes and Vapnik, 1995], Logistic Regression (LR) [Cox, 1972], Random Forest (RF) [Breiman, 2001]; (2) deep learning methods: Multilayer Perceptron (MLP), GCN [Kipf and Welling, 2016], GAT [Veliˇckovi´c et al., 2017], CDR2IMG [Zhen and Gao, 2023], GAT-COBO [Hu et al., 2024]. We follow the hyperparameter settings in the provided official implementations [Zhen and Gao, 2023; Hu et al., 2024].

For the construction of manual features of VOC, we employ three approaches: '-B', '-W', and '-D', representing basic feature engineering [Hu et al., 2022], basic features combined with weekly-level features, and basic features combined with daily-level features, respectively. Since previous work does not consider the presence of mutation fraud, the basic feature engineering method directly extracts stable long-term fraud-related features. However, for mutation fraud, these features are less effective because the presence of fraud is short-term, and the average call duration within a week or a day may be abnormal but appears normal in the long term. Therefore, we further supplement weekly-level and daily-level features for comparison. Specifically, the '-B' method extracts 42-dimensional features from VOC without considering temporal granularity, and '-W' and '-D' additionally extract 27-dimensional features respectively.

2 https://aistudio.baidu.com/aistudio/datasetdetail/40690

4.3 Experiment Settings

We use the Adam optimizer with the learning rate being 0.001 for the User Encoder, and 0.0001 for the other learnable modules. The dropout rate is 0.1 and the batch size is 16. The first-level sampling retains 70% of points (ratio=0.7) with grouping radius r=0.5, while the second-level sampling uses 30% of remaining points (ratio=0.3) with r=0.2. Other detailed hyperparameters can be found in the open-source code.

4.4 Experiment onMutationTeleFraud Dataset

The evaluation results on the MutationTeleFraud Dataset are presented in Table 2.

Firstly, we see that the GCN-B method outperforms the MLP-B method, achieving an improvement of 1.61% points on normal fraud data and 12.65% points on mutation fraud data. The difference between the two methods lies in the introduction of the user communication graph, indicating that the user communication graph can significantly aid in fraud detection, particularly in the detection of mutation fraud.

Secondly, we see our method outperforms all baselines in all metrics. Specifically, MutationGuard shows a 1.36% improvement in the F1 score and a 1.52% improvement in the AUC score. Particularly, on mutation fraud data, our method shows a significant improvement of 13.93%.

Finally, comparing the three baseline methods GAT-B, GAT-W, and GAT-D, we see that a more fine-grained feature engineering approach GAT-D can effectively improve the detection results of mutation fraud by 10.12%. This further indicates the necessity to effectively utilize mutation features in mutation fraud. Our method leverages these features by effective neural modeling, resulting in a further improvement of 13.93% compared to GAT-D's manual feature engineering.

To intuitively analyze the performance differences among these methods, we further provide the AUC curves of deep learning-based baseline methods during the training process on the validation set, as shown in Figure 5. The GAT-COBO, being a graph node classification method, is trained for 2000 epochs, so it is not included in the figure. We observe a high consistency between the performance results reported on the testing set and those on the validation set, further confirming the effectiveness of our proposed method.

4.5 Ablation Study

Table 2 presents the evaluation results of the ablation study. We see some important conclusions from the results.

• The method's ability to capture local fraud features and temporal change features is crucial for the recognition of mutation fraud. Table 2 shows that both modules for individual ablation and combined ablation exhibit significant performance degradation.
• The GAT trained on the user graph can enhance the method's ability to detect mutation fraud. We see that the score given by the ablated version of "without User Encoder" has decreased by 0.5% and 0.37% in the F1 score and AUC score. The decline is most severe in mutation data, amounting to a decrease of 6.33%.

4.6 VOCModeling Test

To explore the neural modeling method of VOC records, we test the following deep learning-based methods in Table 3: 1-D CNN, TCFE Module, LFFE Module and TCFE&LFFE. We see TCFE&LFFE achieves the best results.Both 1-D CNN and LFFE structures are adept at discovering local fraud features in data. Due to the reasonable utilization of temporal periodicity, our proposed Time-aware LFFE Module performs better. We achieve a more effective neural method by combining the Time-aware LFFE Module with TCFE Module.

4.7 Experiment on Sichuan Fraud Dataset

The evaluation results on the open Sichuan telecom fraud dataset are shown in Table 4. It is important to note that the publicly available dataset does not provide communication feature information for the receivers, and we cannot utilize information from the user communication graph. Instead, we directly employ a Multilayer Perceptron (MLP) to extract user features. Our approach demonstrates a pronounced advantage compared to other classical and benchmark methods. Results show that our MutationGuard achieves the best performance in terms of AUC and F1 metrics.

4.8 Computational Efficiency Evaluation

The proposed method consists of three main components: the User Encoder, LFFE Module, and TCFE Module. We test the average time consumption of our method and each component, as shown in Figure 6. The majority inference cost is from two modules: the TCFE Module and the User Encoder. Our method shows remarkable scalability and efficiency, enabling inference of more than 250,000 users in one hour on a single GPU, making it suitable for applications.

5 Conclusion

This paper addresses the issue of mutation telecommunication fraud, a complex form of fraudulent activity characterized by intermittent and abrupt patterns. We present MutationTeleFraud enriched with mutation fraud instances, which fills a critical absence in the available resources for researching this specific type of fraud. We also contribute by introducing MutationGuard, a deep neural network designed explicitly for the detection of mutation telecommunication fraud. Future work includes (1) integrating real-time streaming data for instant fraud alerts, (2) extending MutationGuard to crossdomain fraud detection (e.g., financial scams), and (3) addressing ethical challenges in user privacy preservation.