moonday124/moneytrail-mule-detector

MoneyTrail: mule-account detection models (IBM AMLworld HI-Small)

Two XGBoost classifiers trained on the IBM Transactions for Anti Money Laundering (AML) HI-Small dataset (5,078,345 txns, 515,088 accounts, 2022-09-01 to 2022-09-18) with account, graph (PageRank / BFS hop distance to known fraud) and window features.

model	task	PR-AUC	ROC-AUC	precision@1%	recall@1%
mule_xgb.joblib	is the account a mule?	0.0946	0.8313	0.1347	0.1431
baseline (rules)	same	0.0154	0.6203	0.0265	0.0282
cashout_xgb.joblib	cash-out within 30 min?	0.3031	0.8979	pos. rate 2.02%	-

Each joblib is a dict {"model": XGBClassifier, "features": [...]} - load with joblib.load(path), build the feature frame in the listed order, then model.predict_proba(...)[:, 1].

Temporal split: single-timestamp 60% row-quantile (W1 train, W2 eval) - HI-Small is extremely front-loaded, so a per-day split would leave W2 degenerate.

Dataset license: CDLA-Sharing-1.0 (IBM AMLworld). Models are for the Synapse 1.0 hackathon demo; not production AML tooling.