FraudGraph Sentinel
Agent Name
FraudGraph Sentinel
What It Does
FraudGraph Sentinel is a Neo4j Aura Agent for investigating synthetic cyber-fraud transaction patterns. It turns row-level fraud labels into a graph investigation workflow: the agent first identifies repeated fraudulent destination accounts, then profiles one suspicious destination account as a case brief with source accounts, transaction types, amounts, and risk indicators.
Instead of only answering "is this transaction fraud?", the agent explains connected fraud context: who sent money, which destination received repeated fraudulent activity, what transaction types were involved, where high-value paths appear, and which risk indicators explain the suspicious pattern.
Dataset And Why A Graph Fits
The project uses a synthetic financial transaction fraud dataset with 6,362,620 source rows. The AuraDB Free graph keeps all 8,213 fraud rows plus a deterministic 5,000-row non-fraud sample, so the graph stays within a conservative free-tier target.
A graph fits this dataset because fraud is relational. A flat table can show a suspicious row, but a graph can reveal repeated recipients, source-to-transaction-to-destination paths, concentrated fraud exposure, fraud type patterns, and shared risk signals across related entities.
Verified Graph Statistics
- Enhanced nodes: 38,797
- Enhanced relationships: 74,262
- Transaction nodes: 13,213
- Fraud transactions: 8,213
- Conservative AuraDB Free target: below 50,000 nodes and 175,000 relationships
- Cost path: existing AuraDB Free instance and Internal Aura Agent only
Graph Model
Core graph:
(:Account)-[:SENT]->(:Transaction)(:Transaction)-[:TO]->(:Account)(:Transaction)-[:HAS_TYPE]->(:TransactionType)(:Transaction)-[:HAS_LABEL]->(:FraudLabel)
Optional cyber-risk layer:
(:Transaction)-[:HAS_RISK_INDICATOR]->(:RiskIndicator)(:EmailSample)-[:HAS_RISK_INDICATOR]->(:RiskIndicator)(:URLSample)-[:HAS_RISK_INDICATOR]->(:RiskIndicator)
The optional risk layer connects separate synthetic email, URL, and transaction samples through shared risk indicators only. It does not claim that a phishing email caused a specific transaction.
Agent Tools Used
- Cypher Template
- Text2Cypher
Prepared Cypher Template Tools
fraud_overviewrepeated_fraud_destinationshigh_value_fraud_pathsaccount_fraud_neighborhooddestination_fraud_profilefraud_type_comparisonfraud_concentrationrisk_indicator_overviewshared_risk_indicator_context
Demo Flow
-
Ask:
Which destination accounts received multiple fraudulent transfers?
The agent uses a Cypher Template to find repeated fraudulent destination accounts, total fraud amount, fraud count, and sample origin accounts. -
Ask:
Create a fraud investigation brief for destination account C668046170.
The agent profiles one destination account with fraud count, total amount, source accounts, transaction types, risk indicators, and a suspiciousness explanation. -
Ask:
Show the highest-value suspicious fraud paths.
The agent returns high-value source-account -> transaction -> destination-account paths with amount, fraud type, and risk context.
Example Finding From The Demo
Destination account C668046170 received 2 fraudulent transactions totaling 10,160,088.68 in the synthetic graph. One transaction was a TRANSFER of 10,000,000.00 and another was a CASH_OUT of 160,088.68. The profile shows different source accounts and risk indicators such as FraudTransaction, HighAmountTransfer, RepeatedFraudDestination, and ZeroedOriginBalance.
Important Safety Note
This project uses synthetic data. The agent does not claim that any account, email, URL, or transaction represents a real person, real victim, real criminal, company, or real-world crime.
GitHub Repository
Screenshots
Aura Console graph/database screenshot
Repeated fraudulent destinations agent screenshot
Destination fraud profile case-brief screenshot
high-value fraud paths screenshot
