Fraudulent user identification method and device, equipment, storage medium and program product

Abstract

The invention discloses a fraudulent user identification method and device, equipment, a storage medium and a program product, and relates to the technical field of artificial intelligence, and the fraudulent user identification method comprises the steps: obtaining communication data of a to-be-identified user; establishing a target graph structure based on the communication data; mapping each node in the target graph structure to a hyperbolic space, and in the hyperbolic space, outputting a target embedding representation of the target graph structure through a hyperbolic graph convolution model; compared with Euclidean space, the hyperbolic space is usually considered to be more suitable for representing high-dimensional or hierarchical data, and in the hyperbolic space, target embedding representation more suitable for a task scene of fraudulent user identification can be obtained; based on the target embedded representation, determining a user classification result, namely accurately identifying whether the user to be identified is a fraud user or a normal user; therefore, the identification accuracy of the fraudulent user can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a fraudulent user identification method, apparatus, device, storage medium and program product. Background Art

[0002] At present, there is a method for identifying telecommunications fraud users: real data is constructed into a target graph structure, and based on the target graph structure, the connections and interaction patterns between users are analyzed through social network analysis methods and graph neural networks to discover potential fraudulent behaviors.

[0003] However, since the graph structure corresponding to the real data in many scenarios usually exhibits relatively strong power-law distribution characteristics and hierarchical characteristics, the traditional graph neural network defined in Euclidean space will produce certain data distortion when representing such real data, reducing the accuracy of identifying fraudulent users. Summary of the invention

[0004] The main purpose of this application is to provide a fraudulent user identification method, device, equipment, storage medium and program product, aiming to solve the technical problem of low accuracy in identifying fraudulent users.

[0005] To achieve the above purpose, the present application proposes a method for identifying fraudulent users, the method comprising:

[0006] Obtaining communication data of the user to be identified;

[0007] establishing a target graph structure based on the communication data;

[0008] Mapping each node in the target graph structure to a hyperbolic space, and outputting a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model;

[0009] Based on the target embedding representation, a user classification result is determined, where the user classification result includes whether the user to be identified is a fraudulent user or a normal user.

[0010] In one embodiment, the hyperbolic graph convolution model includes multiple layers of hyperbolic graph convolution layers, and the step of outputting the target embedding representation of the target graph structure through the hyperbolic graph convolution model in the hyperbolic space includes:

[0011] Mapping the hidden states of neighbor nodes of each node from the hyperbolic space to the tangent space through a target hyperbolic graph convolution layer, wherein the target hyperbolic graph convolution layer is any layer of a multi-layer hyperbolic graph convolution layer;

[0012] In the tangent space, the aggregation weights between the nodes are calculated, and neighbor aggregation processing is performed based on the aggregation weights to obtain an aggregation result;

[0013] Map each aggregation result from the tangent space to the hyperbolic space, pass the mapping result as the hidden state of the node in the target hyperbolic graph convolution layer to the next hyperbolic graph convolution layer, and return to the step of mapping the hidden state of the neighbor nodes of each node from the hyperbolic space to the tangent space through the target hyperbolic graph convolution layer, until the target hyperbolic graph convolution layer is the last hyperbolic graph convolution layer, and obtain the target embedding representation of the target graph structure.

[0014] In one embodiment, the target graph structure includes a first graph structure and a second graph structure, and the step of establishing the target graph structure based on the communication data includes:

[0015] Establishing a first graph structure based on the communication data;

[0016] The step of establishing a target graph structure based on the communication data comprises:

[0017] Calculating the similarity between nodes corresponding to each edge in the first graph structure based on the feature matrix and the adjacency matrix corresponding to the first graph structure;

[0018] Using the similarity as the weight of each edge in the first graph structure;

[0019] Based on each weight, the first graph structure is processed by a minimum spanning tree algorithm to obtain a second graph structure.

[0020] In one embodiment, the step of processing the first graph structure by a minimum spanning tree algorithm based on each weight to obtain the second graph structure includes:

[0021] Based on each weight, the target edge in the first graph structure is deleted through the minimum spanning tree algorithm to obtain a second graph structure, wherein the target edge is the other edges among the edges except the edge formed between each node and its neighboring node with the highest similarity, and the weight is negatively correlated with the similarity.

[0022] In one embodiment, the target graph structure further includes a third graph structure, and after the step of deleting the target edge in the first graph structure by the minimum spanning tree algorithm based on each weight to obtain the second graph structure, the step further includes:

[0023] Based on a preset sampling probability, randomly sampling from the target edges to obtain a first edge set;

[0024] On the basis of the second graph structure, edges in the first edge set are added to obtain a third graph structure.

[0025] In one embodiment, the target graph structure further includes a plurality of fourth graph structures, and after the step of deleting the target edge in the first graph structure by the minimum spanning tree algorithm based on each weight to obtain the second graph structure, the step further includes:

[0026] Repeating the step of randomly sampling from the target edge based on a preset sampling probability to obtain multiple second edge sets;

[0027] On the basis of the second graph structure, edges in each second edge set are added respectively to obtain multiple fourth graph structures.

[0028] In one embodiment, the step of mapping each node in the target graph structure to a hyperbolic space and outputting a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model includes:

[0029] Mapping each node in each fourth graph structure to a hyperbolic space, and outputting a target embedding representation of each of the fourth graph structures in the hyperbolic space through a hyperbolic graph convolution model;

[0030] The step of determining the user classification result based on the target embedding representation comprises:

[0031] Mapping each target embedding representation from the hyperbolic space to the tangent space, and calculating each target embedding representation in the tangent space by a multi-layer perceptron and a normalized exponential function to obtain a target probability distribution of whether the user to be identified is a fraudulent user or a normal user;

[0032] Based on the target probability distribution, the user classification result is determined.

[0033] In one embodiment, before the step of obtaining the communication data of the user to be identified, the method further includes:

[0034] Obtain historical communication data and user type labels of historical users;

[0035] establishing a fifth graph structure based on the historical communication data;

[0036] Preprocessing the fifth graph structure to obtain a plurality of sixth graph structures;

[0037] Each node in each sixth graph structure is mapped to a hyperbolic space. In the hyperbolic space, based on each of the sixth graph structures and the user type label, the hyperbolic graph convolution network to be trained is iteratively trained to obtain a hyperbolic graph convolution model.

[0038] In one embodiment, the user type label includes a fraudulent user and a normal user, and the step of iteratively training the hyperbolic graph convolution network to be trained in the hyperbolic space based on each of the sixth graph structures and the user type label to obtain the hyperbolic graph convolution model includes:

[0039] In the hyperbolic space, outputting the historical embedding representation of each sixth graph structure through the hyperbolic graph convolutional network to be trained;

[0040] Mapping multiple historical embedding representations to a tangent space, and calculating each of the historical embedding representations in the tangent space by a multi-layer perceptron and a normalized exponential function to obtain a historical probability distribution of whether the historical user is a fraudulent user or a normal user;

[0041] The cross entropy loss between each historical probability distribution and the user type label is calculated by a semi-supervised task loss function, and the distance between each historical probability distribution and the average value of each probability distribution is calculated by a consistency loss function;

[0042] Calculate a total loss based on the cross entropy loss and the distance;

[0043] Determining whether the total loss meets the preset loss standard;

[0044] If the loss result does not meet the preset loss standard, return to the step of outputting the historical embedding representation of each sixth graph structure in the hyperbolic space through the hyperbolic graph convolution network to be trained, and stop training until the total loss meets the preset loss standard to obtain a hyperbolic graph convolution model.

[0045] In addition, to achieve the above purpose, the present application also proposes a fraudulent user identification device, the fraudulent user identification device comprising:

[0046] An acquisition module, used to acquire communication data of a user to be identified;

[0047] An establishing module, used for establishing a target graph structure based on the communication data;

[0048] A processing module, used for mapping each node in the target graph structure to a hyperbolic space, and outputting a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model;

[0049] A classification module is used to determine a user classification result based on the target embedding representation, wherein the user classification result includes whether the user to be identified is a fraudulent user or a normal user.

[0050] In addition, to achieve the above-mentioned purpose, the present application also proposes a fraudulent user identification device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the fraudulent user identification method described above.

[0051] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the fraudulent user identification method described above are implemented.

[0052] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the fraudulent user identification method described above are implemented.

[0053] One or more technical solutions proposed in this application have at least the following technical effects:

[0054] The present application obtains the communication data of the user to be identified; establishes a target graph structure based on the communication data; maps each node in the target graph structure to a hyperbolic space, and outputs a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model; since the target graph structure established based on the communication data usually exhibits relatively strong power-law distribution characteristics and hierarchical characteristics, if the traditional graph neural network defined in Euclidean space is used to represent the communication data of the user to be identified, certain data distortion will occur. In order to reduce data distortion, the present application maps each node in the target graph structure to a hyperbolic space, and in the hyperbolic space In the embodiment, a target embedding representation of the target graph structure is outputted through a hyperbolic graph convolution model; compared with the Euclidean space, when the distance between points in the hyperbolic space increases linearly, the volume of the original Euclidean space covered will increase exponentially; therefore, the hyperbolic space is generally considered to be more suitable for representing high-dimensional or hierarchical data. In the hyperbolic space, the present application can obtain a target embedding representation that is more suitable for the task scenario of fraudulent user identification; based on the target embedding representation, the user classification result is determined, and it is possible to accurately identify whether the user to be identified is a fraudulent user or a normal user; therefore, the present application can improve the accuracy of identifying fraudulent users. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0056] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0057] Figure 1 A flowchart of the first embodiment of the method for identifying fraudulent users of the present application is provided;

[0058] Figure 2 A schematic diagram of a first scenario provided for Embodiment 1 of the fraudulent user identification method of the present application;

[0059] Figure 3 A schematic diagram of a second scenario provided for the second embodiment of the fraud user identification method of the present application;

[0060] Figure 4 A logical architecture diagram of a fraudulent user identification method provided in Example 3 of the present application;

[0061] Figure 5 This is a schematic diagram of the module structure of the fraud user identification device according to an embodiment of the present application;

[0062] Figure 6 Schematic diagram of the device structure of the hardware operating environment involved in the fraud user identification method in the embodiment of the present application.

[0063] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0064] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0065] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0066] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a fraudulent user identification device, etc. The following takes the fraudulent user identification device as an example to illustrate this embodiment and the following embodiments.

[0067] Based on this, the present application embodiment provides a fraud user identification method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the fraudulent user identification method of the present application.

[0068] In this embodiment, the fraud user identification method includes steps S10 to S40:

[0069] Step S10, obtaining communication data of the user to be identified;

[0070] It should be noted that the identification of telecommunications fraud users is crucial to protecting user personal information and property safety. It is also a key link in maintaining the order of the telecommunications market and promoting the healthy development of the industry. Specifically, by accurately identifying and preventing telecommunications fraud users, it can effectively reduce economic losses, enhance user trust, and bring a more solid customer base and market competitiveness to telecommunications operators.

[0071] At present, there is a method for identifying telecommunications fraud users: real data is constructed into a target graph structure, and based on the target graph structure, the connections and interaction patterns between users are analyzed through social network analysis methods and graph neural networks to discover potential fraudulent behaviors; however, since the graph structure corresponding to real data in many scenarios usually exhibits relatively strong power-law distribution characteristics and hierarchical characteristics; the traditional graph neural network defined in Euclidean space will produce certain data distortion when representing such real data, thereby reducing the accuracy of identifying fraudulent users.

[0072] In order to solve the above problems, this embodiment first obtains the communication data of the user to be identified, and the communication data includes the communication account information and communication behavior data of the user to be identified; wherein the communication behavior data includes traffic usage data, voice usage data, SMS usage data, etc.; this embodiment comprehensively utilizes the communication account information and communication behavior data in the telecommunications scenario, which is the basis for accurately identifying fraudulent users.

[0073] Step S20, establishing a target graph structure based on the communication data;

[0074] In order to intuitively and effectively reflect the communication behavior between users, this embodiment establishes a target graph structure based on the communication data, so as to accurately identify fraudulent users based on the communication behavior between users.

[0075] Specifically, the target graph structure can be expressed as G = (V, E), where V = (v1, v2, ..., v N ), V represents the set of all nodes in the target graph structure, N is the number of nodes in the target graph structure; E is the set of edges in the target graph structure; in the telecommunications scenario of this embodiment, the communication account information of the user to be identified (for example, the telephone number account or smart terminal code of the user to be identified) can be represented as a node in the target graph structure. If there is communication behavior between two users to be identified, the corresponding nodes of the two users to be identified are connected to form an edge, and the edge is used to represent the topological adjacency relationship between the corresponding nodes of the two users to be identified.

[0076] Alternatively, the target graph structure can also be expressed as G = (A, X), where A is the adjacency matrix, A ∈ [0, 1] N×N, the adjacency matrix is ​​used to record the topological adjacency relationship between nodes in the target graph structure. If there is an edge between node i and node j, then A ij =1; X is the feature matrix, X = (x1, x2,…, x N ) is a matrix consisting of the initial features of the nodes, x i ∈R d , x i Representative Node The initial features of , the feature dimension is d.

[0077] Specifically, the feature matrix can be a matrix composed of numerical features that can be processed by the model based on the transformation of user attribute information (communication data). For example, the user attribute information can be classified, and different feature engineering solutions can be given for different types of attribute information.

[0078] For example, in the telecom operator scenario, the user's attribute information can be divided into numerical attributes, categorical attributes, text attributes, etc.; among them, numerical attributes include the number of calls, call duration, number of text messages, Internet traffic, etc.; categorical attributes include user level, account status, user type (individual user, corporate user), etc.; text attributes include user information, user comments, etc.

[0079] It should be noted that numerical attributes can be used directly for model processing, but they need to be standardized or normalized to ensure that the scales of different features are consistent; for category attributes, this embodiment can use tools such as scikit-learn and Pandas to convert the user attributes of each category into one-hot encoding; for text attributes, this embodiment can use BERT (Bidirectional Encoder Representations from Transformers, a pre-trained language model) model and Word2Vec (Word to Vector, a technology that maps vocabulary to real number vectors) model for word embedding, and convert text content into dense word vectors.

[0080] After obtaining the feature vectors of different types of attribute information, this embodiment concatenates the feature vectors corresponding to the different types of attribute information corresponding to each node as the vector representation of the corresponding node, and then integrates the feature vectors of each node to obtain the final feature matrix X.

[0081] Step S30, mapping each node in the target graph structure to a hyperbolic space, and outputting a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model;

[0082] Furthermore, since the target graph structure established based on communication data usually exhibits relatively strong power-law distribution characteristics and hierarchical characteristics, if the traditional graph neural network defined in Euclidean space is used to represent the communication data of the user to be identified, certain data distortion will occur. In order to reduce data distortion, this application maps each node in the target graph structure to a hyperbolic space, and in the hyperbolic space, outputs the target embedding representation of the target graph structure through a hyperbolic graph convolution model.

[0083] It should be noted that hyperbolic geometry is a type of non-Euclidean geometry, and the conclusions of traditional Euclidean geometry such as the parallel axiom do not hold in the hyperbolic geometry system. Compared with Euclidean space, when the distance between points in the hyperbolic space increases linearly, the volume of the original Euclidean space covered will increase exponentially. Therefore, hyperbolic space is generally considered to be more suitable for representing high-dimensional or hierarchical data. In this embodiment, in the hyperbolic space, a target embedding representation that is more suitable for the task scenario of fraudulent user identification can be obtained.

[0084] Specifically, refer to Figure 2 , the hyperbolic graph convolution model includes multiple layers of hyperbolic graph convolution layers, and the specific implementation of outputting the target embedding representation of the target graph structure through the hyperbolic graph convolution model in the hyperbolic space may be:

[0085] Through a target hyperbolic graph convolution layer, the hidden states of the neighbor nodes of each node are mapped from the hyperbolic space to the tangent space, and the target hyperbolic graph convolution layer is any layer of the multi-layer hyperbolic graph convolution layer; in the tangent space, the aggregation weights between the nodes are calculated, and the neighbor aggregation processing is performed based on the aggregation weights to obtain an aggregation result; each aggregation result is mapped from the tangent space to the hyperbolic space, and the mapping result is passed to the next layer of hyperbolic graph convolution layer as the hidden state of the node in the target hyperbolic graph convolution layer, and the step of mapping the hidden states of the neighbor nodes of each node from the hyperbolic space to the tangent space through the target hyperbolic graph convolution layer is returned until the target hyperbolic graph convolution layer is the last layer of hyperbolic graph convolution layer, and the target embedding representation of the target graph structure is obtained.

[0086] Since the tangent plane has the properties of a conventional Euclidean space, in order to complete some traditional graph convolution operations in the Euclidean space, this embodiment may map and transform the hidden states of neighbor nodes of each node between the hyperbolic space and the tangent space.

[0087] Specifically, in this embodiment, the adjacency matrix corresponding to the target graph structure is represented as A m , node v i The neighbors in this graph can be represented as N m (v i), the lth layer of the hyperbolic graph convolution model performs graph convolution based on the first formula, where the first formula can be expressed as:

[0088]

[0089] Based on this, the present embodiment can first map the hidden state of the neighbor nodes of each node from the hyperbolic space to the tangent space through the target hyperbolic graph convolution layer, wherein the target hyperbolic graph convolution layer is any layer in the multi-layer hyperbolic graph convolution layer; for example, through logarithmic mapping Each node v in the (l-1) layer i Corresponding neighbor node u j The hidden state of Transformed into tangent space (at level 0, h (0) For exponential mapping The node v after i The feature matrix X) is represented by the exponential logarithmic mapping used in the first formula, wherein the exponential logarithmic mapping used in the first formula is defined at the zero point ο of the hyperbolic model, and the curvature K used in the spatial mapping is a trainable parameter of the hyperbolic graph convolution model.

[0090] Furthermore, this embodiment can be based on the preset parameter matrix W (l) The result mapped to the tangent space is linearly transformed by the bias term b. Through the linear transformation, the node features are effectively represented and transformed before the neighbors are aggregated. Thus, in the tangent space, the aggregation weights between the nodes are calculated, and the neighbors are aggregated based on the aggregation weights to obtain the aggregation results.

[0091] Specifically, in the tangent space, the specific implementation method of calculating the aggregation weight between each node can be: based on the second formula, each node (node ​​v i and node u j The aggregation weight w between ij , where the second formula can be:

[0092]

[0093] Specifically, we can first transform the node v in the hyperbolic space into i and node u i The hidden state of Map to the tangent space, and then map the result ( and ) to get the splicing result Then use the Multilayer Perceptron (MLP) and SOFTMAX function to get the attention weight, and use the attention weight as the aggregation weight.

[0094] Furthermore, the activation function σ is used to perform nonlinear activation on the aggregation result, so that the target hyperbolic graph convolution layer can learn and represent more complex function mappings. Map each aggregation result from the tangent space to the hyperbolic space, pass the mapping result as the hidden state of the node in the target hyperbolic graph convolution layer to the next hyperbolic graph convolution layer, and return to the step of mapping the hidden state of the neighbor nodes of each node from the hyperbolic space to the tangent space through the target hyperbolic graph convolution layer, until the target hyperbolic graph convolution layer is the last hyperbolic graph convolution layer, and obtain the target embedding representation of the target graph structure.

[0095] It can be understood that in each layer of hyperbolic graph convolution, neighbor aggregation operation is completed in the tangent space. The tangent point between the tangent space and the hyperbolic fluid can be referred to Figure 2 .

[0096] Step S40: determining a user classification result based on the target embedding representation, wherein the user classification result includes whether the user to be identified is a fraudulent user or a normal user.

[0097] Since this embodiment maps each node in the target graph structure to a hyperbolic space, and outputs a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model, data distortion can be reduced, and the target embedding representation can better express the hierarchical structure and power-law distribution characteristics of the target graph structure; this embodiment determines the user classification result based on the target embedding representation, and can accurately identify whether the user to be identified is a fraudulent user or a normal user, thereby improving the accuracy of identifying fraudulent users.

[0098] Specifically, based on the target embedding representation, the specific implementation method of determining the user classification result can be to map each node in the target graph structure to the hyperbolic space, and in the hyperbolic space, output a target embedding representation of the target graph structure through the hyperbolic graph convolution model; map a target embedding representation from the hyperbolic space to the tangent space, and in the tangent space, calculate a target embedding representation through a multi-layer perceptron and a normalized exponential function to obtain the probability distribution of the user to be identified as a fraudulent user and a normal user, thereby determining the user classification result based on the probability distribution, referring to Figure 3 .

[0099] For example, when the probability distribution of fraudulent users and normal users is (0.7, 0.3), the user to be identified is considered to be a fraudulent user, and when the probability distribution of fraudulent users and normal users is (0.3, 0.7), the user to be identified is considered to be a normal user.

[0100] In this embodiment, a hyperbolic graph convolution algorithm is used to characterize communication data with high power-law characteristics, thereby solving the data distortion problem of a conventional graph neural network model defined in Euclidean space on a specific graph structure. This embodiment defines the hyperbolic graph convolution model in the hyperbolic space, thereby improving the performance of the graph neural network model for telecommunications fraud user identification tasks; thereby determining the user classification result based on a more accurate target embedding representation, and accurately identifying whether the user to be identified is a fraudulent user or a normal user, thereby improving the accuracy of identifying fraudulent users.

[0101] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar content as the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. On this basis, the target graph structure includes a first graph structure and a second graph structure, and the specific implementation method of establishing the target graph structure based on the communication data can be: establishing a first graph structure based on the communication data.

[0102] Specifically, the first graph structure can be established by an initial matrix composed of numerical features that can be processed by the model obtained by converting the user's attribute information (communication data); that is, each node in the first graph structure can be directly mapped to the hyperbolic space, and in the hyperbolic space, the target embedding representation of the target graph structure is output through the hyperbolic graph convolution model.

[0103] In addition, in order to improve the hierarchy of the target graph structure and make it more suitable for the hyperbolic graph convolution model, the specific implementation method of establishing the target graph structure based on the communication data may be:

[0104] Based on the feature matrix and adjacency matrix corresponding to the first graph structure, the similarity between the nodes corresponding to each edge in the first graph structure is calculated; the similarity is used as the weight of each edge in the first graph structure; based on each weight, the first graph structure is processed by a minimum spanning tree algorithm to obtain a second graph structure.

[0105] It should be noted that the target graph structure also includes a second graph structure; since the hierarchy of the graph structure is usually measured by δ-hyperbolicity, from the definition, the δ-hyperbolicity indicator can measure the degree to which the graph structure is close to a tree, and the δ-hyperbolicity of the tree structure is zero (representing the strongest hierarchy); therefore, this embodiment can achieve enhanced hierarchy of the graph structure by converting the first graph structure into a tree structure.

[0106] Specifically, refer to Figure 3, the first graph structure can be processed by the minimum spanning tree algorithm to obtain a second graph structure that is close to a tree structure; thereby, the hyperbolic graph convolution model can be applied to general graph structures with weaker hierarchies, thereby improving the performance of the hyperbolic graph neural network model on such data and expanding the scope of application of the hyperbolic graph convolution model.

[0107] Since the minimum spanning tree algorithm is mainly aimed at weighted undirected connected graphs, its minimum spanning tree is the one with the smallest total weight in the connected subgraph containing all the nodes of the original graph; and the edges formed between the nodes in the data set used by the general graph neural network do not have weights, this embodiment can calculate the similarity between the nodes corresponding to each edge in the first graph structure based on the feature matrix and adjacency matrix corresponding to the first graph structure, and use the similarity as the weight of each edge in the first graph structure.

[0108] Specifically, the similarity may be cosine similarity or Pearson correlation coefficient, etc. When the similarity is cosine similarity, the reciprocal of the cosine similarity may be used as the weight. The reciprocal of the cosine similarity is positively correlated with the weight, that is, the similarity is negatively correlated with the weight.

[0109] The method for calculating the cosine similarity between the nodes corresponding to each edge in the first graph structure may be:

[0110]

[0111] Among them, x is the feature matrix and A is the adjacency matrix.

[0112] Since cosine similarity can reflect the similarity between two vectors, in the graph data scenario, the nodes at both ends of the edge with higher similarity are more likely to belong to the same category, and the edge with higher similarity is correspondingly more valuable in the above-mentioned neighbor aggregation process; specifically, in the telecommunications scenario, the feature vectors of the nodes at both ends of the edge with higher similarity are more correlated, and the corresponding user attribute information is more similar; therefore, the similarity between the corresponding nodes of the above-mentioned edges is used as the weight.

[0113] Furthermore, since the minimum spanning tree can retain the edges that are more important to the hyperbolic graph convolution module, this embodiment processes the first graph structure through the minimum spanning tree algorithm based on each weight, and the obtained second graph structure can achieve the effect of data denoising while ensuring the calculation accuracy, thereby enhancing the hierarchy of the graph structure.

[0114] Specifically, the specific implementation of processing the first graph structure by a minimum spanning tree algorithm based on each weight to obtain the second graph structure may be:

[0115] Based on each weight, the target edge in the first graph structure is deleted through the minimum spanning tree algorithm to obtain a second graph structure, wherein the target edge is the other edges among the edges except the edge formed between each node and its neighboring node with the highest similarity, and the weight is negatively correlated with the similarity.

[0116] It can be understood that by using the minimum spanning tree algorithm to delete the edges except the edges formed between each node and its neighboring node with the highest similarity according to the weight, that is, a second graph structure is obtained in which each node with the highest similarity neighbors is retained. Since the weight is negatively correlated with the similarity, the second graph structure is a tree structure with the smallest total weight.

[0117] It should be noted that commonly used spanning tree algorithms include Prim's algorithm and Kruskal's algorithm. Taking Prim's algorithm as an example, you can first select any node in the first graph structure as the starting point of the tree structure, and then add an edge to the tree structure each time, and repeat this process to expand the final tree structure (since the first graph structure is not necessarily a connected graph, the minimum spanning tree algorithm calculates what is actually not a spanning tree, but a spanning forest with multiple spanning trees as different connected subgraphs. In this embodiment, the running results of the minimum spanning tree algorithm are collectively referred to as tree structures).

[0118] The selection principles for adding edges to the tree structure each time include:

[0119] (1) The two endpoints of the added edge are the nodes that have been added to the tree structure and the nodes that have not been added to the tree structure.

[0120] (2) Among the edges that meet (1), select the edge with the smallest weight (i.e., the edge with the greatest similarity).

[0121] Based on the above principles, this embodiment deletes the edges with lower similarity in the first graph structure, that is, deletes the edges with larger weights through the minimum spanning tree algorithm to obtain a spanning tree with the smallest total weight, thereby obtaining a second graph structure that retains the nodes with the neighbors with the highest similarity.

[0122] Specifically, the process of performing edge deletion operation using the minimum generation algorithm can be expressed by the following formula:

[0123] G mst =MST(G,similarity);

[0124] Among them, G is the first graph structure, similarity is the inverse of cosine similarity, MST is the minimum spanning tree algorithm, G mst It is the second graph structure.

[0125] In this embodiment, the edges in the first graph structure are deleted through the minimum spanning tree algorithm, so that the second graph structure has a stronger hierarchy and is more suitable for the hyperbolic graph convolution model; by retaining the edges corresponding to the nodes with higher similarity, the edges corresponding to the nodes with lower similarity are deleted. Since in the graph data scenario, the edges corresponding to such nodes with lower similarity are more likely to belong to different categories and thus become potential noise edges, deleting the edges corresponding to the nodes with lower similarity can simultaneously play a role in data denoising; and this embodiment does not randomly delete any edges, and will not generate new isolated points, which provides a guarantee for the message passing and neighbor aggregation process in the graph convolution process.

[0126] Based on the first and second embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. On this basis, the target graph structure also includes a third graph structure, and after the step of deleting the target edge in the first graph structure based on each weight through the minimum spanning tree algorithm to obtain the second graph structure, it is also possible to:

[0127] Based on a preset sampling probability, a first edge set is obtained by randomly sampling from the target edges; and on the basis of the second graph structure, edges in the first edge set are added to obtain a third graph structure.

[0128] It should be noted that although the above method retains the neighbors with the highest similarity of each node in the first graph structure, since the neighbor topological structure information is the basis for realizing the neighbor aggregation and message passing mechanism in the graph convolution process, retaining only one neighbor for each node still deletes too much information, resulting in too much communication data loss, which may reduce the effect of the hyperbolic graph convolution model.

[0129] In order to reduce the loss of neighbor information, this embodiment randomly samples the target edges to obtain a first edge set based on a preset sampling probability, and adds the edges in the first edge set to the second graph structure to obtain a third graph structure, thereby restoring the loss of the above-mentioned neighbor information and ensuring the performance of the hyperbolic graph convolution model.

[0130] In the process of deleting the target edge in the first graph structure by using the minimum spanning tree algorithm, the target edge can be saved; specifically, the set of target edges can be expressed as:

[0131]

[0132] Among them, E G is the set of edges in the first graph structure, is the set of edges in the second graph structure.

[0133] For E delEach edge e in del i In this embodiment, based on a preset sampling probability, a first edge set is obtained by randomly sampling from the target edges.

[0134] Specifically, sampling can be performed with a certain probability δ according to the Bernoulli distribution, that is: Among them, δ is a hyperparameter of the model; after sampling, the elements whose sampling result value is 1 can be selected to form the first edge set:

[0135] Alternatively, sampling may be performed with a certain probability according to a normal distribution. However, in order to simplify the calculation, the present embodiment preferably performs sampling with a certain probability δ according to a Bernoulli distribution.

[0136] Furthermore, based on the fourth formula, on the basis of the second graph structure, the edges in the first edge set can be added to obtain a third graph structure, wherein the fourth formula can be expressed as:

[0137]

[0138] This embodiment implements edge re-addition in the above manner, that is, in the second graph structure G mst On the basis of , some edges in the second graph structure are restored; thus, on the basis of ensuring that the topological structure is close to the tree, the deleted neighbor information is restored to a certain extent, that is, while ensuring that the topological structure is suitable for the operation of the hyperbolic graph convolution model, the balance of the message transmission mechanism between neighbors is achieved. Figure 3 .

[0139] Furthermore, the target graph structure further includes a plurality of fourth graph structures. After the step of deleting the target edge in the first graph structure by the minimum spanning tree algorithm based on each weight to obtain the second graph structure, the following steps may be further performed:

[0140] Repeat the step of randomly sampling from the target edge based on a preset sampling probability to obtain multiple second edge sets; on the basis of the second graph structure, add the edges in each second edge set respectively to obtain multiple fourth graph structures.

[0141] In order to improve the generalization ability and robustness of the model, this embodiment repeatedly executes the step of randomly sampling from the target edge based on a preset sampling probability to obtain multiple second edge sets, and on the basis of the second graph structure, adds the edges in each second edge set to obtain multiple fourth graph structures.

[0142] The above method of this embodiment is not a simple re-adding of edges, but in the second graph structure Based on this, multiple random samplings are performed to generate multiple different fourth graph structures (with Em Representation), taking multiple different fourth graph structures as input of the hyperbolic graph convolution model, and obtaining multiple corresponding embedding representations as output through the hyperbolic graph convolution model operation, thereby improving the accuracy of user classification.

[0143] Specifically, after obtaining multiple fourth graph structures, each node in the target graph structure is mapped to a hyperbolic space, and in the hyperbolic space, a target embedding representation of the target graph structure is output through a hyperbolic graph convolution model. Based on the target embedding representation, a specific implementation method of determining the user classification result may be:

[0144] Map each node in each fourth graph structure to a hyperbolic space, and in the hyperbolic space, output a target embedding representation of each of the fourth graph structures through a hyperbolic graph convolution model; map each target embedding representation from the hyperbolic space to a tangent space, and in the tangent space, calculate each target embedding representation through a multilayer perceptron and a normalized exponential function to obtain a target probability distribution of the user to be identified as a fraudulent user and a normal user; and determine the user classification result based on the target probability distribution.

[0145] Specifically, after the above processing, this embodiment has converted the input containing communication data into a more hierarchical input (each fourth graph structure); further, each node in each fourth graph structure obtained above (for example, M graph structures, M is a hyperparameter) is mapped to a hyperbolic space, and in the hyperbolic space, a target embedding representation of each of the fourth graph structures is output through a hyperbolic graph convolution model, and each target embedding representation is mapped from the hyperbolic space to the tangent space. In the tangent space, each target embedding representation is calculated by a multilayer perceptron and a normalized exponential function to obtain a more accurate target probability distribution (that is, the probability that the user to be identified is a fraudulent user and the probability that M is a normal user).

[0146] Furthermore, the user classification result may be determined based on the target probability distribution through an argmax operation or a threshold decision operation.

[0147] In this embodiment, a first edge set is obtained by randomly sampling from the target edges based on a preset sampling probability, and on the basis of the second graph structure, edges in the first edge set are added to obtain a third graph structure, thereby restoring the loss of the above-mentioned neighbor information and ensuring the performance of the hyperbolic graph convolution model; multiple random samplings are performed on the basis of the second graph structure to generate multiple different fourth graph structures (represented by), and multiple different fourth graph structures are used as inputs of the hyperbolic graph convolution model. Through the operation of the hyperbolic graph convolution model, multiple corresponding embedded representations are obtained as outputs, thereby improving the robustness of the model.

[0148] Based on the first, second and third embodiments of the present application, in the fourth embodiment of the present application, the same or similar contents as those of the first embodiment can be referred to the above description, and will not be described in detail later. Figure 4 Before obtaining the communication data of the user to be identified, the following may also be performed:

[0149] Acquire historical communication data and user type labels of historical users; establish a fifth graph structure based on the historical communication data; preprocess the fifth graph structure to obtain multiple sixth graph structures; map each node in each sixth graph structure to a hyperbolic space, and in the hyperbolic space, iteratively train the hyperbolic graph convolution network to be trained based on each of the sixth graph structures and the user type labels to obtain a hyperbolic graph convolution model.

[0150] It should be noted that the fraudulent user identification task of this embodiment can be modeled as a node binary classification task. Specifically, a small number of labeled samples are obtained, such as historical communication data of historical users and user type labels.

[0151] Reference Figure 4 , a fifth graph structure is established based on the historical communication data, and the fifth graph structure is preprocessed (including the above-mentioned minimum spanning tree algorithm, multiple re-addition edge operations, etc.) to obtain multiple sixth graph structures (after preprocessing, the obtained sixth graph structure is a tree structure with a higher degree of hierarchy that is more suitable for a hyperbolic graph convolutional network); each node in each sixth graph structure is mapped to a hyperbolic space, and in the hyperbolic space, based on each of the sixth graph structures and the user type label, the hyperbolic graph convolutional network to be trained is iteratively trained, thereby obtaining a hyperbolic graph convolutional model that has the ability to identify whether an unknown sample is a fraudulent user.

[0152] Specifically, the user type label includes a fraudulent user and a normal user. In the hyperbolic space, based on each of the sixth graph structures and the user type label, the hyperbolic graph convolution network to be trained is iteratively trained to obtain a specific implementation of the hyperbolic graph convolution model may be:

[0153] In the hyperbolic space, the historical embedding representation of each sixth graph structure is output through the hyperbolic graph convolution network to be trained; multiple historical embedding representations are mapped to the tangent space, and in the tangent space, each of the historical embedding representations is calculated by a multi-layer perceptron and a normalized exponential function to obtain the historical probability distribution of historical users being fraudulent users and normal users; the cross entropy loss between each historical probability distribution and the user type label is calculated by a semi-supervised task loss function, and the distance between each historical probability distribution and the average value of each probability distribution is calculated by a consistency loss function; the total loss is calculated based on the cross entropy loss and the distance; it is determined whether the total loss meets the preset loss standard; if the loss result does not meet the preset loss standard, the step of outputting the historical embedding representation of each sixth graph structure through the hyperbolic graph convolution network to be trained in the hyperbolic space is returned, and the training is stopped until the total loss meets the preset loss standard to obtain a hyperbolic graph convolution model.

[0154] It should be noted that, in addition to using the semi-supervised task loss function during the training process, this embodiment also introduces a consistency loss function to optimize the hyperbolic graph convolutional network to be trained.

[0155] Specifically, in the hyperbolic space, the hyperbolic graph convolutional network to be trained outputs each sixth graph structure A m Corresponding multiple historical embedding representations; mapping the multiple historical embedding representations to the tangent space, in the tangent space, calculating each of the historical embedding representations through a multi-layer perceptron and a normalized exponential function, and obtaining the historical probability distribution of historical users being fraudulent users and normal users; calculating the cross entropy loss between each historical probability distribution and the user type label through a semi-supervised task loss function, and calculating the distance between each historical probability distribution and the average value of each probability distribution through a consistency loss function.

[0156] It can be understood that the differences between the sixth graph structures are calculated and optimized through the consistency loss function, and the differences in probability distributions obtained by different adjacency matrices are evaluated. During the training process, by reducing the consistency loss, the multiple outputs of the model will be closer, so that the final output of the model is the comprehensive result of multiple inputs with slight differences, that is, balancing the approximation of multiple outputs, reducing the sensitivity of the model to specific edges, thereby increasing the robustness of the model and reducing overfitting, thereby ensuring the reliability and stability of the classification results.

[0157] Specifically, assuming that the sixth graph structure G m As input, we get the last layer output Z of the hyperbolic graph convolutional network to be trained m ∈R N×d′(multiple historical embedding representations), in the node classification task, multiple historical embedding representations are mapped to the tangent space, in which each of the historical embedding representations is calculated by a multi-layer perceptron MLP and a normalized exponential function (softmax function), and the historical probability distribution of whether the historical user is a fraudulent user or a normal user is obtained Where C is the number of user categories. In the fraud identification binary classification task, C is 2. Specifically, the calculation formula of the historical probability distribution is:

[0158]

[0159] Further, based on the fifth formula (the final loss function of the model), the cross entropy loss and the distance calculation total loss are calculated, where the fifth formula can be expressed as:

[0160] L=L sup +λL con ;

[0161] Among them, λ is a model hyperparameter used to balance the weight of the consistency loss term, L sup is the loss function of the semi-supervised task, that is, the historical probability distribution The cross entropy loss between the user type label, L con is the consistency loss function, that is, each historical probability distribution With the average probability distribution The distance between them is used to measure the historical probability distribution The degree of similarity between each other.

[0162] Among them, the calculation formula of the semi-supervised task loss function can be expressed as:

[0163]

[0164] Among them, the hyperparameter M is the number of the sixth graph structure;

[0165] Specifically, the average probability distribution can be the average probability distribution after sharpening The calculation formula of the consistency loss function can be expressed as:

[0166]

[0167] To calculate Based on the sixth formula, we can first take the average of the predicted probability distribution of each node. The sixth formula can be expressed as:

[0168]

[0169] Then, the user type label is smoothly predicted according to the average probability distribution through sharpening operation (the highest probability value in the probability distribution can be made higher, while other probability values ​​can be made lower, thereby enhancing the confidence in the prediction of the most likely category), and the sharpened average probability distribution is obtained:

[0170]

[0171] Among them, temperature T is a hyperparameter. When T is 0, the average prediction obtained approaches a one-hot distribution.

[0172] Further, it is determined whether the total loss meets a preset loss standard (for example, the total loss is less than a preset loss value, etc.); if the loss result does not meet the preset loss standard, returning to the step of outputting the historical embedding representation of each sixth graph structure through the hyperbolic graph convolution network to be trained in the hyperbolic space, until the total loss meets the preset loss standard and the training is stopped to obtain a hyperbolic graph convolution model, and referring to Figure 4 .

[0173] Based on the above method, this embodiment can calculate the cross entropy loss based on a small number of labeled samples to measure the performance of the model in the fraud identification task, and at the same time calculate the consistency loss function for the embedded representations corresponding to multiple graph structures to improve the generalization ability of the model. The loss terms of the two parts are combined to complete the calculation of the overall loss function L, so as to achieve the update and optimization of the parameters in the hyperbolic graph convolution model (refer to Figure 4 ), improving the accuracy of the model in identifying fraudulent users.

[0174] In this embodiment, multiple graph structures are obtained by repeatedly adding edges, and by introducing a consistency loss function term in the model training process, the generalization ability and robustness of the model are improved, and ultimately the performance of the trained hyperbolic graph convolution model is improved.

[0175] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the fraudulent user identification method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0176] This application also provides a fraud user identification device, please refer to Figure 5 , the fraud user identification device comprises:

[0177] An acquisition module 10 is used to acquire communication data of a user to be identified;

[0178] An establishing module 20, configured to establish a target graph structure based on the communication data;

[0179] A processing module 30 is used to map each node in the target graph structure to a hyperbolic space, and output a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model;

[0180] The classification module 40 is used to determine a user classification result based on the target embedding representation, and the user classification result includes whether the user to be identified is a fraudulent user or a normal user.

[0181] In one embodiment, the hyperbolic graph convolution model includes multiple layers of hyperbolic graph convolution layers, and the processing module 30 includes:

[0182] A mapping submodule, used to map the hidden states of neighbor nodes of each node from the hyperbolic space to the tangent space through a target hyperbolic graph convolution layer, wherein the target hyperbolic graph convolution layer is any layer of the multi-layer hyperbolic graph convolution layer;

[0183] A neighbor aggregation submodule is used to calculate the aggregation weights between nodes in the tangent space, perform neighbor aggregation processing based on the aggregation weights, and obtain aggregation results;

[0184] The first processing submodule is used to map each aggregation result from the tangent space to the hyperbolic space, pass the mapping result as the hidden state of the node in the target hyperbolic graph convolution layer to the next hyperbolic graph convolution layer, and return to the step of mapping the hidden state of the neighboring nodes of each node from the hyperbolic space to the tangent space through the target hyperbolic graph convolution layer, until the target hyperbolic graph convolution layer is the last hyperbolic graph convolution layer, and obtain the target embedding representation of the target graph structure.

[0185] In one embodiment, the target graph structure includes a first graph structure and a second graph structure, and the establishing module 20 includes:

[0186] A first establishing submodule, configured to establish a first graph structure based on the communication data;

[0187] Wherein, the establishment module 20 further includes:

[0188] A second establishing submodule is used to calculate the similarity between the nodes corresponding to each edge in the first graph structure based on the feature matrix and the adjacency matrix corresponding to the first graph structure;

[0189] Setting a submodule, configured to use the similarity as a weight of each edge in the first graph structure;

[0190] The second processing submodule is used to process the first graph structure through a minimum spanning tree algorithm based on each weight to obtain a second graph structure.

[0191] In one embodiment, the second processing submodule includes:

[0192] A deleting unit is used to delete the target edges in the first graph structure based on the weights through the minimum spanning tree algorithm to obtain a second graph structure, wherein the target edges are the edges other than the edges formed between each node and its neighboring node with the highest similarity, and the weight is negatively correlated with the similarity.

[0193] In one embodiment, the target graph structure further includes a third graph structure, and after the step of deleting the target edge in the first graph structure by the minimum spanning tree algorithm based on each weight to obtain the second graph structure, the device further includes:

[0194] A first sampling module, configured to obtain a first edge set by randomly sampling from the target edges based on a preset sampling probability;

[0195] The first adding module is used to add the edges in the first edge set on the basis of the second graph structure to obtain a third graph structure.

[0196] In one embodiment, the target graph structure further includes a plurality of fourth graph structures, and after the step of deleting the target edge in the first graph structure by the minimum spanning tree algorithm based on each weight to obtain the second graph structure, the device further includes:

[0197] A second sampling module, configured to repeatedly perform the step of randomly sampling from the target edge based on a preset sampling probability to obtain a plurality of second edge sets;

[0198] The second adding module is used to add the edges in each second edge set respectively on the basis of the second graph structure to obtain multiple fourth graph structures.

[0199] In one embodiment, the processing module 30 includes:

[0200] A first convolution submodule, used for mapping each node in each fourth graph structure to a hyperbolic space, and outputting a target embedding representation of each of the fourth graph structures in the hyperbolic space through a hyperbolic graph convolution model;

[0201] The classification module 40 includes:

[0202] A first prediction submodule is used to map each target embedding representation from the hyperbolic space to the tangent space, and in the tangent space, each target embedding representation is calculated by a multi-layer perceptron and a normalized exponential function to obtain a target probability distribution of whether the user to be identified is a fraudulent user or a normal user;

[0203] Based on the target probability distribution, the user classification result is determined.

[0204] In one embodiment, before the step of obtaining the communication data of the user to be identified, the method further includes:

[0205] A historical data acquisition module is used to acquire historical communication data and user type labels of historical users;

[0206] A graph structure establishing module, configured to establish a fifth graph structure based on the historical communication data;

[0207] A preprocessing module, used for preprocessing the fifth graph structure to obtain a plurality of sixth graph structures;

[0208] A training module is used to map each node in each sixth graph structure to a hyperbolic space. In the hyperbolic space, based on each of the sixth graph structures and user type labels, the hyperbolic graph convolution network to be trained is iteratively trained to obtain a hyperbolic graph convolution model.

[0209] In one embodiment, the training module includes:

[0210] A second convolution submodule is used to output the historical embedding representation of each sixth graph structure in the hyperbolic space through the hyperbolic graph convolutional network to be trained;

[0211] A second prediction submodule is used to map multiple historical embedding representations to a tangent space, and in the tangent space, each of the historical embedding representations is calculated by a multi-layer perceptron and a normalized exponential function to obtain a historical probability distribution of whether the historical user is a fraudulent user or a normal user;

[0212] A first loss calculation submodule is used to calculate the cross entropy loss between each historical probability distribution and the user type label through a semi-supervised task loss function, and to calculate the distance between each historical probability distribution and the average value of each probability distribution through a consistency loss function;

[0213] A second loss calculation submodule, configured to calculate a total loss based on the cross entropy loss and the distance;

[0214] A judgment submodule, used to judge whether the total loss meets a preset loss standard;

[0215] A training submodule is used for returning to the step of outputting the historical embedding representation of each sixth graph structure in the hyperbolic space through the hyperbolic graph convolution network to be trained if the loss result does not meet the preset loss standard, and stopping the training until the total loss meets the preset loss standard to obtain a hyperbolic graph convolution model.

[0216] The fraudulent user identification device provided by the present application adopts the fraudulent user identification method in the above embodiment, which can solve the technical problem of low fraudulent user identification accuracy. Compared with the prior art, the beneficial effects of the fraudulent user identification device provided by the present application are the same as the beneficial effects of the fraudulent user identification method provided by the above embodiment, and other technical features in the fraudulent user identification device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0217] The present application provides a fraudulent user identification device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the fraudulent user identification method in the above-mentioned embodiment 1.

[0218] Reference below Figure 6 , which shows a schematic diagram of the structure of a fraudulent user identification device suitable for implementing the embodiment of the present application. The fraudulent user identification device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, tablet computers, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The fraudulent user identification device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0219] like Figure 6As shown, the fraud user identification device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the fraud user identification device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the fraud user identification device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a fraud user identification device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided alternatively.

[0220] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0221] The fraudulent user identification device provided by the present application adopts the fraudulent user identification method in the above embodiment, which can solve the technical problem of low accuracy in identifying fraudulent users. Compared with the prior art, the beneficial effects of the fraudulent user identification device provided by the present application are the same as the beneficial effects of the fraudulent user identification method provided by the above embodiment, and other technical features in the fraudulent user identification device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0222] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0223] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0224] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the fraudulent user identification method in the above-mentioned embodiment.

[0225] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0226] The computer-readable storage medium may be included in the fraudulent user identification device; or may exist independently without being assembled into the fraudulent user identification device.

[0227] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the fraudulent user identification device, the fraudulent user identification device executes the fraudulent user identification method.

[0228] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0229] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0230] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0231] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned fraudulent user identification method, and can solve the technical problem of low accuracy in identifying fraudulent users. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the fraudulent user identification method provided by the above-mentioned embodiment, and will not be described in detail here.

[0232] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned fraudulent user identification method when executed by a processor.

[0233] The computer program product provided by this application can solve the technical problem of low accuracy in identifying fraudulent users. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as those of the fraudulent user identification method provided by the above embodiment, which will not be repeated here.

[0234] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A fraudulent user identification method, characterized in that: The method includes: Obtaining communication data of the user to be identified; establishing a target graph structure based on the communication data; Mapping each node in the target graph structure to a hyperbolic space, and outputting a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model; Based on the target embedding representation, a user classification result is determined, where the user classification result includes whether the user to be identified is a fraudulent user or a normal user.

2. The method according to claim 1, characterized in that The hyperbolic graph convolution model includes multiple layers of hyperbolic graph convolution layers, and the step of outputting the target embedding representation of the target graph structure through the hyperbolic graph convolution model in the hyperbolic space includes: Mapping the hidden states of neighbor nodes of each node from the hyperbolic space to the tangent space through a target hyperbolic graph convolution layer, wherein the target hyperbolic graph convolution layer is any layer of a multi-layer hyperbolic graph convolution layer; In the tangent space, the aggregation weights between the nodes are calculated, and neighbor aggregation processing is performed based on the aggregation weights to obtain an aggregation result; Map each aggregation result from the tangent space to the hyperbolic space, pass the mapping result as the hidden state of the node in the target hyperbolic graph convolution layer to the next hyperbolic graph convolution layer, and return to the step of mapping the hidden state of the neighbor nodes of each node from the hyperbolic space to the tangent space through the target hyperbolic graph convolution layer, until the target hyperbolic graph convolution layer is the last hyperbolic graph convolution layer, and obtain the target embedding representation of the target graph structure.

3. The method according to claim 1, characterized in that The target graph structure includes a first graph structure and a second graph structure, and the step of establishing the target graph structure based on the communication data includes: Establishing a first graph structure based on the communication data; The step of establishing a target graph structure based on the communication data further includes: Calculating the similarity between nodes corresponding to each edge in the first graph structure based on the feature matrix and the adjacency matrix corresponding to the first graph structure; Using the similarity as the weight of each edge in the first graph structure; Based on each weight, the first graph structure is processed by a minimum spanning tree algorithm to obtain a second graph structure.

4. The method according to claim 3, characterized in that The step of processing the first graph structure by a minimum spanning tree algorithm based on each weight to obtain a second graph structure includes: Based on each weight, the target edge in the first graph structure is deleted through the minimum spanning tree algorithm to obtain a second graph structure, wherein the target edge is the other edges among the edges except the edge formed between each node and its neighboring node with the highest similarity, and the weight is negatively correlated with the similarity.

5. The method according to claim 4, characterized in that The target graph structure further includes a third graph structure. After the step of deleting the target edge in the first graph structure by the minimum spanning tree algorithm based on each weight to obtain the second graph structure, the step further includes: Based on a preset sampling probability, randomly sampling from the target edges to obtain a first edge set; On the basis of the second graph structure, edges in the first edge set are added to obtain a third graph structure.

6. The method according to claim 4, characterized in that The target graph structure further includes a plurality of fourth graph structures. After the step of deleting the target edges in the first graph structure by the minimum spanning tree algorithm based on the weights to obtain the second graph structure, the step further includes: Repeating the step of randomly sampling from the target edge based on a preset sampling probability to obtain multiple second edge sets; On the basis of the second graph structure, edges in each second edge set are added respectively to obtain multiple fourth graph structures.

7. The method according to claim 6, characterized in that The step of mapping each node in the target graph structure to a hyperbolic space and outputting a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model comprises: Mapping each node in each fourth graph structure to a hyperbolic space, and outputting a target embedding representation of each of the fourth graph structures in the hyperbolic space through a hyperbolic graph convolution model; The step of determining the user classification result based on the target embedding representation comprises: Mapping each target embedding representation from the hyperbolic space to the tangent space, and calculating each target embedding representation in the tangent space by a multi-layer perceptron and a normalized exponential function to obtain a target probability distribution of whether the user to be identified is a fraudulent user or a normal user; Based on the target probability distribution, the user classification result is determined.

8. The method according to any one of claims 1 to 7, characterized in that Before the step of acquiring the communication data of the user to be identified, the method further includes: Obtain historical communication data and user type labels of historical users; establishing a fifth graph structure based on the historical communication data; Preprocessing the fifth graph structure to obtain a plurality of sixth graph structures; Each node in each sixth graph structure is mapped to a hyperbolic space. In the hyperbolic space, based on each of the sixth graph structures and the user type label, the hyperbolic graph convolution network to be trained is iteratively trained to obtain a hyperbolic graph convolution model.

9. The method according to claim 8, characterized in that The user type labels include fraudulent users and normal users. The step of iteratively training the hyperbolic graph convolution network to be trained based on each of the sixth graph structures and the user type labels in the hyperbolic space to obtain a hyperbolic graph convolution model includes: In the hyperbolic space, outputting the historical embedding representation of each sixth graph structure through the hyperbolic graph convolutional network to be trained; Mapping multiple historical embedding representations to a tangent space, and calculating each of the historical embedding representations in the tangent space by a multi-layer perceptron and a normalized exponential function to obtain a historical probability distribution of whether the historical user is a fraudulent user or a normal user; The cross entropy loss between each historical probability distribution and the user type label is calculated by a semi-supervised task loss function, and the distance between each historical probability distribution and the average value of each probability distribution is calculated by a consistency loss function; Calculate a total loss based on the cross entropy loss and the distance; Determining whether the total loss meets the preset loss standard; If the loss result does not meet the preset loss standard, return to the step of outputting the historical embedding representation of each sixth graph structure in the hyperbolic space through the hyperbolic graph convolution network to be trained, and stop training until the total loss meets the preset loss standard to obtain a hyperbolic graph convolution model.

10. A fraud user identification device, characterized in that: The device comprises: An acquisition module, used to acquire communication data of a user to be identified; An establishing module, used for establishing a target graph structure based on the communication data; A processing module, used for mapping each node in the target graph structure to a hyperbolic space, and outputting a target embedding representation of the target graph structure in the hyperbolic space through a hyperbolic graph convolution model; A classification module is used to determine a user classification result based on the target embedding representation, wherein the user classification result includes whether the user to be identified is a fraudulent user or a normal user.

11. A fraud user identification device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the fraudulent user identification method according to any one of claims 1 to 9.

12. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the fraudulent user identification method according to any one of claims 1 to 9 are implemented.

13. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the fraudulent user identification method according to any one of claims 1 to 9 are implemented.

Images