2026 DIGITIMES AI Innovation Hackathon - BitoPro Track
Click the image to watch the demo video.
BitoGuard is a machine-learning-based mule account detection system. It uses Focal Loss LightGBM to handle highly imbalanced data (30:1), and combines 145 engineered features covering transaction behavior, temporal anomalies, IP hopping, and more.
Its core innovation lies in graph-toxicity-based feature engineering. A user relationship network is built from shared wallets and transfer relationships, and each wallet is assigned a "toxicity score" based on the proportion of known mule accounts associated with it. The same idea is extended to second-order neighbor toxicity, allowing the model to capture how risk propagates through the network. The system further visualizes this graph through Ego Networks, showing 1-2 hop wallet relationships and fund flow paths so compliance analysts can intuitively understand how risk spreads, while also integrating an LLM to generate risk reports automatically.
Our AWS architecture consists of:
Data Layer: S3 stores raw tables, feature matrices, and prediction outputs, which are read directly by the API with live refresh support.Graph Analytics: adjacency-list-based relationship construction, toxicity feature computation, and Ego Network generation.Model Serving: containerized deployment with a Next.js frontend and a FastAPI backend, integrating offline SHAP analysis and real-time LLM-powered risk reporting.
BitoGuard System Architecture
+---------------+ +---------------+ +---------------+
| Data Layer | | ML Pipeline | | Presentation |
| | | | | |
| 7 Tables |---->| Feature Eng |---->| Next.js UI |
| Parquet/CSV | | (145 feats) | | Dashboard |
| | | Focal LGB | | Ego Network |
| | | LOO Toxicity | | LLM Reports |
+-------+-------+ +---------------+ +-------+-------+
| |
========|=========== AWS Services =================|========
| |
+-------v-------+ +---------------+ +-------v-------+
| S3 | | Bedrock | | EC2 |
| | | | | |
| Raw Data | | Claude 3.5 |<----| FastAPI |
| Features | | Haiku | | Next.js |
| Predictions | | Risk Reports | | Serving |
+---------------+ +---------------+ +---------------+
| Category | Representative Features | Description |
|---|---|---|
| User Profile | account_age_days, kyc_completion_days |
KYC completion speed and demographic signals |
| TWD Flow | twd_deposit_total, fund_retention_hours |
Fund retention time and in/out flow ratios |
| Crypto Transfer | crypto_deposit_total, unique_wallet_count |
Crypto transfer volume and wallet diversity |
| Trading Behavior | buy_sell_ratio, burst_transaction_count |
Rapid turnover and burst-trading detection |
| Time Series | night_trading_ratio, tx_interval_cv |
Overnight trading and interval variability |
| IP Features | shared_ip_user_count, ip_change_frequency |
Shared IP signals and location hopping |
| Graph Structure | pagerank_score, community_id, in_degree |
PageRank, Louvain community, graph connectivity |
| Fund Flow | twd_dep_to_crypto_wit_ratio, net_fiat_flow |
Core fiat-in / crypto-out patterns |
| LOO Toxicity | w_tox_max, toxic_neighbor_count |
Key breakthrough: F1 from 0.36 to 0.80 |
| Entropy | amount_entropy_x, dow_entropy |
Uncertainty in transaction distributions |
| Domain Knowledge | round_10k_ratio, structuring_flag |
Round-number amounts and structuring detection |
LOO Toxicity Formula:
toxicity(wallet_w, user_i) = (mule_count - label_of_user_i + S × global_rate) / (total_users - 1 + S)
With S=50, smoothing reduces target leakage while preserving 99.99% of the signal.
Focal Loss LightGBM (5-fold stratified CV)
Focal Loss: -α(1-p)^γ log(p)
├── α = 0.646 (positive-class weight: 64.6%)
├── γ = 0.532 (focus on hard examples)
├── n_estimators: 1500
├── learning_rate: 0.044
├── num_leaves: 148
├── max_depth: 9
├── Feature Selection: Top 60 / 190+
└── Threshold: 0.415 (optimized for F1)
Model Performance (OOF):
| Metric | Value |
|---|---|
| F1 Score | 0.8051 |
| Precision | 0.8949 |
| Recall | 0.7317 |
| AUC-ROC | 0.9746 |
- SHAP: global and local feature attribution
- Rule-based explanation: Chinese-language risk factors generated from feature deviations
- LLM Risk Report: natural-language risk diagnosis generated with Amazon Bedrock Claude 3.5 Haiku (SSE streaming)
- Interactive graph: 1-2 hop Ego Network visualization for mule-account relationships
# Training environment
pip install -r requirements.txt
# API service
pip install -r requirements-api.txt
# Web frontend
cd app/web && npm install# Feature engineering + training + prediction generation
# (raw data should be placed under data/raw/)
python src/pipeline/run.py# API backend
cd app/api && uvicorn main:app --reload --port 8000
# Web frontend (run in another terminal)
cd app/web && npm run dev
# Or start everything with Docker Compose
docker-compose upBitoGuard/
├── config/ # Model config (config.yaml)
├── src/
│ ├── data/loader.py # Data loading and preprocessing
│ ├── features/
│ │ ├── build.py # Feature engineering entrypoint
│ │ ├── transactions.py # Transaction features (TWD/Crypto/Trading/Swap)
│ │ ├── behavior.py # Behavioral features (fund flow/domain/entropy)
│ │ └── network.py # Network features (IP/Graph/LOO Toxicity)
│ ├── models/
│ │ └── focal_lgbm.py # Focal Loss LightGBM implementation
│ └── pipeline/
│ └── run.py # Training pipeline entrypoint
├── app/
│ ├── api/main.py # FastAPI backend (S3 + local dual source)
│ └── web/ # Next.js + shadcn/ui frontend
│ ├── app/page.tsx # Main dashboard
│ ├── components/dashboard/
│ │ ├── overview-tab.tsx # KPI overview
│ │ ├── users-tab.tsx # User list (pagination/filtering/sorting)
│ │ ├── user-lookup-tab.tsx # User lookup + detail + LLM report
│ │ ├── features-tab.tsx # Feature comparison (search/paging/sorting)
│ │ ├── ego-network-graph.tsx # Interactive relationship graph
│ │ └── model-tab.tsx # Model architecture and metrics
│ └── lib/api.ts # TypeScript API client
├── docs/
│ ├── AWS_DEPLOY.md # AWS deployment guide
│ └── TRAINING.md # Training guide
├── outputs/ # Training outputs
│ ├── features_real.parquet # Full feature matrix
│ ├── submission.csv # Prediction labels
│ └── submission_proba.csv # Risk scores
├── requirements.txt # Training dependencies
├── requirements-api.txt # API dependencies
└── docker-compose.yml # Containerized deployment
| Service | Purpose |
|---|---|
| S3 | Data storage for raw tables, features, models, and predictions |
| Bedrock | Claude 3.5 Haiku for AI-generated risk reports (~$0.01/report) |
| EC2 | FastAPI + Next.js service hosting |
| Criterion | Weight | Our Strategy |
|---|---|---|
| Model Detection Performance | 40% | Focal Loss LightGBM (F1=0.8051) + LOO Toxicity features |
| Risk Explainability | 30% | SHAP + rule-based explanations + Bedrock Claude risk reports |
| Completeness and Usability | 15% | Interactive Next.js dashboard + user lookup + graph visualization |
| Theme Fit and Creativity | 10% | LOO toxicity propagation, fund flow analysis, and AML domain features |
| Bonus | 5% | Ego Network graph + AWS Bedrock LLM integration |
Team submission for the 2026 DIGITIMES AI Innovation Hackathon.