Graph Computing for Risk Control in WeChat Pay: From Feature Engineering to Network Analysis

Guest Speaker: Zhang Jie, Senior Researcher at Tencent Editor: Wang Yanlei, LingShu Technology Platform: DataFunTalk

Introduction: WeChat Pay is a national‑level tool with billions of daily transactions, making it a prime target for black‑market activities. Effective risk control therefore requires network‑centric tools such as graph algorithms and graph databases.

01 – New Perspectives on Risk Control

1. New Viewpoint: Emerging scams exploit popular trends (e.g., meme coins) to lure users into fraudulent schemes.

2. From Feature Engineering to Network Engineering: Traditional feature stacks have grown to six‑figure dimensions with diminishing returns and rising costs. Switching to a network‑wide view reduces storage and management overhead.

3. Individual vs. Gang Perspective: Black‑market actors are often organized teams rather than lone hackers; understanding group dynamics is crucial for effective mitigation.

4. Network Construction – From Points to Planes: Analyzing relationships among thousands of nodes dramatically increases difficulty (e.g., a fully connected 100‑node graph yields ~10,000× more complexity), but also offers huge risk‑control benefits.

02 – Graph Computing Platform

The WeChat Pay graph data platform consists of three pillars:

Graph computation engine

Graph storage engine (graph database)

Business‑specific algorithm design

Two open‑source projects are highlighted:

Angel: A general‑purpose big‑data platform supporting graph and traditional machine‑learning algorithms (Apache top‑level project).

Plato: Tencent’s internally developed graph‑computing platform, inspired by Gemini.

Speed is the primary selection criterion for a graph platform; experiments show that slow platforms can turn a one‑hour experiment into a ten‑hour effort.

03 – Graph Computing Practice

1. Sample Augmentation: Use network relationships to generate “look‑alike” users, mitigating the scarcity of labeled data in fraud detection.

2. Propagation Coloring: Apply algorithms like Personalized PageRank to spread risk signals across the network, identifying additional malicious users.

3. Time‑Series Anomaly Mining: Combine HP filtering with T‑LSTM and ego‑network concepts to detect abnormal transaction patterns.

4. Rapid Gang Extraction: Use weakly connected components to partition the graph into sub‑communities, then apply role‑identification algorithms (e.g., TPNet) to reveal gang structures.

5. GNN on Device Networks: Heterogeneous user‑device graphs are transformed into homogeneous graphs; GNNs (e.g., node2vec, GAT, GraphSAGE) improve detection AUC from 0.92 to 0.97 when combined with traditional features.

6. Team Innovations: Researchers from Nanyang Technological University, Hong Kong Polytechnic, and top Chinese universities have contributed novel motifs, self‑training, and joint‑learning GNN techniques for payment networks.

04 – Technology for Good

The team’s work supports anti‑fraud, anti‑gambling, and anti‑money‑laundering initiatives, providing high‑purity networks for law‑enforcement and protecting vulnerable users.

05 – Q&A

Q: Which graph databases are used? A: Internally, EasyGraph (built on S2Graph) is used; externally, TigerGraph and Nebula Graph are recommended.

Q: Are the graphs homogeneous or heterogeneous? A: We start with heterogeneous graphs (users‑merchants, users‑devices) and convert them to homogeneous graphs for algorithm execution.

Q: Why convert heterogeneous graphs to homogeneous? A: Most algorithms, especially GNNs, require homogeneous inputs; conversion simplifies learning from limited labeled data.

Q: How is graph analysis applied to anti‑money‑laundering? A: By constructing high‑purity transaction networks, applying weakly connected component analysis, and role‑identification to isolate illicit groups.

Q: How is noise reduced in device networks? A: By pruning irrelevant nodes and edges, improving network purity while tolerating slight recall loss.

Thank you for attending the session.

Follow, like, and give a triple‑click boost at the end of the article!