A Network Fraud Behavior Identification Model for Smart Policing

Abstract

Network fraud now appears through linked URLs, communication traces, payment movements, and recurring technical identifiers. Police analytics must join those fragments early enough for intervention and keep the reasoning path inspectable. This paper proposes a network-fraud behavior identification method for smart-policing settings. Case reports, URLs, devices, accounts, and payments become a temporal heterogeneous graph; relation-aware GNN and behavioral Transformer branches score the case, with a small explanation layer for feature and path inspection. A public-data check on the UCI Phishing Websites benchmark, 11,055 samples with 30 engineered webpage features, keeps the design empirical. The fusion prototype obtains 0.970 accuracy, 0.966 F1-score, and 0.998 AUC on the held-out split, narrowly ahead of strong kNN and random-forest baselines. Error analysis ties false negatives to legitimate-looking SSL and anchor features, and false positives to URL-pattern cues. The results support relation-aware triage while showing that static public phishing features cannot validate a police graph system alone.