Joint Detection of Fraud and Concept Drift inOnline Conversations with LLM-Assisted Judgment

TL;DR

This paper introduces a two-stage framework combining ensemble classification, concept drift detection, and LLM-based judgment to improve real-time fraud detection in online conversations, addressing the challenge of distinguishing malicious intent from legitimate topic shifts.

Contribution

It presents a novel modular approach integrating concept drift analysis with LLM judgment, enhancing detection accuracy and interpretability over traditional static methods.

Findings

Improved detection accuracy in social engineering chat scenarios

Effective differentiation between fraudulent manipulation and legitimate topic changes

Enhanced interpretability of fraud detection decisions

Abstract

Detecting fake interactions in digital communication platforms remains a challenging and insufficiently addressed problem. These interactions may appear as harmless spam or escalate into sophisticated scam attempts, making it difficult to flag malicious intent early. Traditional detection methods often rely on static anomaly detection techniques that fail to adapt to dynamic conversational shifts. One key limitation is the misinterpretation of benign topic transitions referred to as concept drift as fraudulent behavior, leading to either false alarms or missed threats. We propose a two stage detection framework that first identifies suspicious conversations using a tailored ensemble classification model. To improve the reliability of detection, we incorporate a concept drift analysis step using a One Class Drift Detector (OCDD) to isolate conversational shifts within flagged dialogues. When drift is detected, a large language model (LLM) assesses whether the shift indicates fraudulent manipulation or a legitimate topic change. In cases where no drift is found, the behavior is inferred to be spam like. We validate our framework using a dataset of social engineering chat scenarios and demonstrate its practical advantages in improving both accuracy and interpretability for real time fraud detection. To contextualize the trade offs, we compare our modular approach against a Dual LLM baseline that performs detection and judgment using different language models.