3. Capture Complexity
Allow Flexibility
Performance for Automated
processing
Bridge the gap between
business and IT
Rich Graph Model
Dynamic Graph Model
Graph Native Storage
Humane (intuitive) Model
10. MATCH (a:Element { id: “A”})
MATCH p = (a)-[:DEPENDS_ON*]->(n { id: “N”})
RETURN p
SELECT
d1.ElementId, d2.ElementId, d3.ElementId
FROM dpndncs AS d1
INNER JOIN dpndncs AS d2
ON d1.dependsOnElemId = d2.ElemId
INNER JOIN dpndncs AS d3
ON d2.dependsOnElemId = d3.ElemId
… <arbitrary number of joins>…
WHERE d1.ElementId = “A”
AND d3.ElementId = “N”
Element Depends On
A B
A C
A D
C H
D J
E F
E G
F J
G L
H I
J N
J M
L M
Does X depend on Y ?
11. Is X affected by a failure in Y?
Does X depend on Y ?
=
37. Data volume:
518 card payments were made every
second last year by cardholders both in
the UK and travelling overseas (*)
(*) 2017 Stats. The UK Cards Association: http://www.theukcardsassociation.org.uk/
38. WITH { amount: 2.50, currency:"USD", txid:"05015244006",
mid:"5073047", tid:"5073440-7", timestamp:1490060618007,
cardno:"5224654370862586050" } AS newTxData
MATCH (lastTx:Transaction { cardno: newTxData.cardno })
WHERE NOT (lastTx)-[:NEXT]->()
CREATE (newTx:Transaction) SET newTx += newTxData
CREATE (lastTx)-[:NEXT]->(newTx)
WITH newTx, newTxData
MERGE (term:Terminal { tid: newTxData.tid})
CREATE (newTx)-[:IN_TERMINAL]->(term)
Tx
Tx
Tx
Tx
Fraud
Fraud
Data load: Transactions
39. WITH { amount: 2.50, currency:"USD", txid:"05015244006",
mid:"5073047", tid:"5073440-7", timestamp:1490060618007,
cardno:"5224654370862586050" } AS newTxData
MATCH (lastTx:Transaction { cardno: newTxData.cardno })
WHERE NOT (lastTx)-[:NEXT]->()
CREATE (newTx:Transaction) SET newTx += newTxData
CREATE (lastTx)-[:NEXT]->(newTx)
WITH newTx, newTxData
MERGE (term:Terminal { tid: newTxData.tid})
CREATE (newTx)-[:IN_TERMINAL]->(term)
Tx
Tx
Tx
Tx
Fraud
Fraud
Data load: Transactions
40. WITH { amount: 2.50, currency:"USD", txid:"05015244006",
mid:"5073047", tid:"5073440-7", timestamp:1490060618007,
cardno:"5224654370862586050" } AS newTxData
MATCH (lastTx:Transaction { cardno: newTxData.cardno })
WHERE NOT (lastTx)-[:NEXT]->()
CREATE (newTx:Transaction) SET newTx += newTxData
CREATE (lastTx)-[:NEXT]->(newTx)
WITH newTx, newTxData
MERGE (term:Terminal { tid: newTxData.tid})
CREATE (newTx)-[:IN_TERMINAL]->(term)
Tx
Tx
Tx
Tx
Fraud
Fraud
Data load: Transactions
41. WITH { amount: 2.50, currency:"USD", txid:"05015244006",
mid:"5073047", tid:"5073440-7", timestamp:1490060618007,
cardno:"5224654370862586050" } AS newTxData
MATCH (lastTx:Transaction { cardno: newTxData.cardno })
WHERE NOT (lastTx)-[:NEXT]->()
CREATE (newTx:Transaction) SET newTx += newTxData
CREATE (lastTx)-[:NEXT]->(newTx)
WITH newTx, newTxData
MERGE (term:Terminal { tid: newTxData.tid})
CREATE (newTx)-[:IN_TERMINAL]->(term)
Tx
Tx
Tx
Tx
Fraud
Fraud
Data load: Transactions
42.
43. WITH { txid:"0501524400006"} AS unrecognizedTx
MATCH (tx:Transaction { txid: unrecognizedTx.txid })
SET tx:FraudTx
Tx
Tx
Tx
Tx
Fraud
Fraud
Data load: Reported fraud
44. WITH { txid:"0501524400006"} AS unrecognizedTx
MATCH (tx:Transaction { txid: unrecognizedTx.txid })
SET tx:FraudTx
Tx
Tx
Tx
Tx
Fraud
Fraud
Data load: Reported fraud
45. WITH { txid:"0501524400006"} AS unrecognizedTx
MATCH (tx:Transaction { txid: unrecognizedTx.txid })
SET tx:FraudTx
Tx
Tx
Tx
Tx
Fraud
Fraud
Data load: Reported fraud
46. WITH { txid:"0501524400006"} AS unrecognizedTx
MATCH (tx:Transaction { txid: unrecognizedTx.txid })
SET tx:FraudTx
Tx
Tx
Tx
Tx
Fraud
Fraud
Data load: Reported fraud
47.
48. MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx)
WITH term , count(distinct t.cardno) as ct,
min(t.timestamp) as mindate, max(t.timestamp) as maxdate
WHERE ct > 1
MATCH (term)<-[:IN_TERMINAL]-(otherTx)
WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate
RETURN term.tid AS terminal,mindate,maxdate,
100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact,
(maxdate - mindate)/(24*3600000) as timewindow
ORDER BY impact DESC, timewindow DESC
Query: Fraud origination at terminal level
49. MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx)
WITH term , count(distinct t.cardno) as ct,
min(t.timestamp) as mindate, max(t.timestamp) as maxdate
WHERE ct > 1
MATCH (term)<-[:IN_TERMINAL]-(otherTx)
WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate
RETURN term.tid AS terminal,mindate,maxdate,
100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact,
(maxdate - mindate)/(24*3600000) as timewindow
ORDER BY impact DESC, timewindow DESC
Query: Fraud origination at terminal level
50. MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx)
WITH term , count(distinct t.cardno) as ct,
min(t.timestamp) as mindate, max(t.timestamp) as maxdate
WHERE ct > 1
MATCH (term)<-[:IN_TERMINAL]-(otherTx)
WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate
RETURN term.tid AS terminal,mindate,maxdate,
100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact,
(maxdate - mindate)/(24*3600000) as timewindow
ORDER BY impact DESC, timewindow DESC
Query: Fraud origination at terminal level
51. MATCH (term:Terminal)<-[:IN_TERMINAL]-(t)-[n:NEXT*]->(:FraudTx)
WITH term , count(distinct t.cardno) as ct,
min(t.timestamp) as mindate, max(t.timestamp) as maxdate
WHERE ct > 1
MATCH (term)<-[:IN_TERMINAL]-(otherTx)
WHERE otherTx.timestamp < maxdate and otherTx.timestamp > mindate
RETURN term.tid AS terminal,mindate,maxdate,
100 * ct / COUNT(DISTINCT otherTx.cardno) AS impact,
(maxdate - mindate)/(24*3600000) as timewindow
ORDER BY impact DESC, timewindow DESC
Query: Fraud origination at terminal level
53. WITH { tid : '2373743-7', from: 1487340089000, to:
1488039852000 } AS compTerm
MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t)
WHERE NOT (t)-[:NEXT*]->(:FraudTx)
AND t.timestamp > compTerm.from
AND t.timestamp < compTerm.to
RETURN distinct t.cardno AS cardAtRisk
Query: Proactive prevention
54. WITH { tid : '2373743-7', from: 1487340089000, to:
1488039852000 } AS compTerm
MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t)
WHERE NOT (t)-[:NEXT*]->(:FraudTx)
AND t.timestamp > compTerm.from
AND t.timestamp < compTerm.to
RETURN distinct t.cardno AS cardAtRisk
Query: Proactive prevention
55. WITH { tid : '2373743-7', from: 1487340089000, to:
1488039852000 } AS compTerm
MATCH (term:Terminal { tid: compTerm.tid} )<-[:IN_TERMINAL]-(t)
WHERE NOT (t)-[:NEXT*]->(:FraudTx)
AND t.timestamp > compTerm.from
AND t.timestamp < compTerm.to
RETURN distinct t.cardno AS cardAtRisk
Query: Proactive prevention