Skip to content

Sample application notebook: detecting money-mule networks (AML flow tracing with Gremlin) #781

Description

@TemidayoA

Is your feature request related to a problem? Please describe.
The 03-Sample-Applications folder has a strong fraud notebook (01-Building-a-Fraud-Graph-Application), but it focuses on card-fraud rings and identity theft via shared features. There's currently no sample covering the other big financial-crime use case for graphs: anti-money-laundering / payments fraud — tracing the flow of funds through money-mule networks (placement → layering → integration).

Describe the solution you'd like
A self-contained sample notebook, 03-Sample-Applications/01-Fraud-Graphs/02-Detecting-Money-Mule-Networks.ipynb, that builds a small (30-account) synthetic mule network with a single Gremlin write query and walks through five detection patterns an investigator would actually use:

  1. finding cash-out accounts structurally (sinks with large in-flows)
  2. tracing a layering chain from a victim to a cash-out (repeat().until() + path())
  3. finding the facilitator account via path-bottleneck counting (groupCount() over victim→exit paths)
  4. shared-identifier rings (accounts linked only by a common phone/device vertex)
  5. wash-cycle detection (circular flows with no economic purpose)

Each query comes with an "investigator read" explaining the decision it informs, plus graph visualisations coloured by account role. Because it creates its own data, it runs on Neptune or any TinkerPop-compatible endpoint; I've verified all cells end-to-end against Gremlin Server 3.7.3 (TinkerGraph).

Describe alternatives you've considered
Extending the existing fraud notebook — but it's already long, uses a seeded dataset, and covers a different typology; a separate complementary notebook keeps both focused.

Additional context
I have the notebook written and executing cleanly. Happy to open a PR if the maintainers think it's a good fit — and glad to adjust naming, placement, or the data model (e.g. amount vs amount_gbp) to match your conventions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions