At COLLIDE 2025, Aerospike Solution Architect Stan Christ took two of eight database nodes offline during a live load test and showed the cluster rebalance without help from IT. He then demonstrated graph-based fraud detection that blocked suspicious transfers by tracing relationships many hops away.
Key takeaways
- Failure is expected. Christ shut down two of eight nodes under load, and the cluster rebalanced with no failed reads and no manual reconfiguration.
- Reads and writes at the same time. The demo cluster served about 834,000 reads and 449,000 writes a second, with 99.9% under a millisecond.
- Hybrid memory keeps nodes dense. Indexes stay in memory and data sits on SSD used as a raw device, which Christ said lets the client reach a record in one hop.
- Graphs reveal hidden links. A transfer between two clean accounts was flagged because of a problem 12 hops away.
- No predefined relationships. Christ said graph relationships are generated at query time, unlike joins in a relational database.
Aerospike Solution Architect Stan Christ used a Solution Showcase at COLLIDE Data + AI Conference 2025 in Atlanta to run two live demonstrations: a database cluster that kept serving reads after he shut down part of it, and a graph-based fraud detection app scoring money transfers as they happened. The session was sponsored by Aerospike. Christ described Aerospike as a high-performance, ACID-compliant NoSQL database.
What happens to a database when nodes fail under load?
The first demo ran on an eight-node Aerospike cluster on AWS, with 16 client machines each running roughly 150 threads against it. The cluster was reading about 834,000 records a second while writing about 449,000 a second at the same time, across roughly 964 million records that Christ said took about 45 minutes to load that morning. He said 99.9% of reads and writes were completing in under a millisecond.
Christ called the dashboard "really boring" because nothing failed. Then he shut down two of the eight nodes, a quarter of the cluster. Aerospike detected the loss through a heartbeat and began repartitioning data across the remaining six nodes. Reads dipped to about 744,000 a second, then climbed back to about 838,000.
"I had no IT involvement. Nobody had to go in and reconfigure the environment," he said. Christ reported 15 client timeouts, which he attributed to clients that had been connected to the nodes he removed, and no failed reads. The cluster keeps two copies of all data, he explained, so a read can be served from the replica if the primary copy is lost.
How does Aerospike's hybrid memory architecture work?
Christ said Aerospike can run fully in memory, fully on SSD, or in a patented hybrid memory mode. In hybrid mode the index stays in memory and the data sits on SSD. Aerospike treats the SSD as a raw device with no file system, he said, so it controls the I/O and knows exactly where each record lives.
That allows what Christ called "one hop to data": the client knows which node holds a record, goes straight to it and returns the result in under a millisecond. Because nodes can be packed densely with data, he said, PayPal reduced its systems from roughly 1,200 compute clusters to 60.
How does graph analysis help detect fraud?
Christ turned to fraud with a story about a new credit card that was flagged when he first used it at Home Depot. He then cited PayPal, which he said uses Aerospike for fraud detection. Before Aerospike, according to Christ, PayPal could screen about 98.5% of transactions within its service-level agreement and had to let the rest through unchecked, losing roughly $5 million a day. After the change, he said, losses fell to roughly $110,000 a day. "We paid for ourselves in a day," he said.
He credited that result to Aerospike's graph capabilities. A graph, he explained, captures relationships among people, devices and accounts without defining those relationships in advance. If person A sends money to person B, the transfer may look legitimate. If B then sends it on to C, a known criminal, the pattern becomes visible. Each step from one node to the next is a hop, and following hops can get expensive when a graph holds billions of nodes.
What did the live fraud detection demo show?
The second demo used about 10,000 pre-generated users and a sample risk model. Scores under 25 meant no risk, 25 to 70 meant medium to high risk, and anything over 70 was very high risk. Three sample rules flagged transactions involving a flagged account, a flagged device, or an association with flagged parties.
He streamed about 18,000 simulated transfers, then entered his own. A veterinarian buying supplies from a vendor was flagged even though nothing in either account looked suspicious. The fraud analytics showed the system had found a problem 12 hops away. Christ said this is the point where a bank would call the customer to confirm the purchase. A later $3,000 transfer from a different sender was blocked outright because the account had flagged devices, flagged accounts and a fraud score of 100.
How is a graph different from a blockchain or relational database?
Asked how graph compares with blockchain, Christ said a blockchain links blocks through a transaction ID, while a graph does not predefine relationships. Unlike a relational database, where table A must be joined to table B to table C, relationships in a graph are generated dynamically at query time. "I don't have to previously know the content. I can infer it from the data that I already have," he said. One flagged transfer in the demo had gone through 13 evaluation steps before it was marked as potential fraud.
Another attendee asked whether graph data can live in the same cluster as other data. Christ said it can. Graph data is stored in a separate namespace, which he compared to a separate database, so the same cluster can be queried for different kinds of content.
See live demos like this at COLLIDE 2027
COLLIDE, the largest AI conference in the Southern U.S., brings more than 1,000 enterprise data and AI leaders to Atlanta for keynotes, panels and solution showcases. The 2027 conference takes place Wednesday, October 13, 2027, at the Sandy Springs Performing Arts Center. More details are at the COLLIDE event page, with registration coming soon.
Frequently asked questions
How does a database handle node failure without downtime?
In Christ's demo, Aerospike detected lost nodes through a heartbeat, repartitioned data across the remaining nodes and served reads from a second copy of the data, without IT involvement.
What is hybrid memory architecture?
Aerospike's patented mode keeps the index in memory and stores data on SSD, which it manages as a raw device without a file system, according to Christ.
How does graph analysis detect fraud?
It follows relationships between people, accounts and devices across multiple hops, so a transfer can be flagged when it connects to known fraudulent parties further along the chain.
Can graph data and other data share one Aerospike cluster?
Yes. Christ said graph data is stored in a separate namespace in the same cluster, so both can be queried together.
Watch: Solution Showcase: High Performance Data infrastructure for AI on YouTube
Event: COLLIDE AI Conference · More coverage: COLLIDE AI Conference insights
