Anti-fraud method and system based on complex relation network

Abstract

The invention provides an anti-fraud method and system based on a complex relation network, and the method comprises the steps: carrying out the preprocessing and association rule mining of multi-source data, constructing a heterogeneous relation network model, carrying out the abnormal behavior detection of real-time data, updating the heterogeneous relation network model based on an abnormal behavior detection result and historical data, and carrying out the recognition of the abnormal behavior. And performing risk quantification, community discovery, abnormal path analysis and related result visualization on the updated heterogeneous relation network model, calculating a fraud risk score of each node through a pre-trained machine learning model based on a related result, and finally generating a service instruction of each node based on the fraud risk score and a preset score interval. By adopting the method, the problems of poor adaptability, high false alarm rate, low gang crime recognition rate and the like of the existing anti-fraud technology can be relieved.

Description

Technical Field

[0001] The present invention relates to the field of anti-fraud technology, and in particular to an anti-fraud method and system based on a complex relationship network. Background Art

[0002] Traditional anti-fraud methods rely on single or simple social relationships (such as single group divisions) and fail to effectively integrate multiple complex relationships (such as multi-dimensional associations such as relatives, colleagues, and financial transactions), resulting in incomplete group divisions and low accuracy in fraud risk prediction. Traditional fraud detection relies on fixed complex network structures and cannot dynamically adapt to changes in the online transaction environment (such as new fraud methods and real-time data updates), resulting in reduced timeliness and accuracy in fraud identification. Traditional anti-fraud methods mostly rely on a single data dimension (such as call records or static user attributes) and fail to fully explore the correlation characteristics of multi-source heterogeneous data (such as user device information, geographic location, and behavioral trajectories), resulting in weak generalization capabilities of the prediction model. Traditional anti-fraud methods find it difficult to clearly display multiple relationships in complex networks (such as multiple role overlaps and dynamic interaction paths), hindering the understanding of the deep structure of fraud gangs. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide an anti-fraud method and system based on a complex relationship network to alleviate the above-mentioned problems existing in existing anti-fraud technologies.

[0004] In a first aspect, an embodiment of the present invention provides an anti-fraud method based on a complex relationship network, comprising: obtaining original user data from multiple data sources, and preprocessing the original user data; wherein the original user data includes structured data and unstructured data; performing association rule mining on the preprocessed data to identify implicit associations between users, and constructing a heterogeneous relationship network model based on the preprocessed data and the implicit associations; wherein, in the heterogeneous relationship network model, entities are represented by nodes and implicit associations between entities are represented by edges between nodes, each edge has corresponding weights and timestamp attributes, and the weights are calculated based on multiple indicators; real-time monitoring of the entity corresponding to each node Real-time data is collected and abnormal behavior detection is performed on the real-time data, and then the heterogeneous relationship network model is updated based on the abnormal behavior detection results and the historical data of the entity corresponding to each node; risk quantification, community discovery and abnormal path analysis are performed on the updated heterogeneous relationship network model, and the risk quantification results, community discovery results and abnormal path analysis results are visualized; a feature vector of each node is constructed based on the risk quantification results, community discovery results and abnormal path analysis results, and the feature vector is input into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model, and then a business instruction for each node is generated based on the fraud risk score of each node and a preset score interval.

[0005] In a second aspect, an embodiment of the present invention further provides an anti-fraud system based on a complex relationship network, comprising: a preprocessing module for acquiring original user data from multiple data sources and preprocessing the original user data; wherein the original user data includes structured data and unstructured data; a construction module for performing association rule mining on the preprocessed data to identify implicit associations between users, and constructing a heterogeneous relationship network model based on the preprocessed data and the implicit associations; wherein, in the heterogeneous relationship network model, entities are represented by nodes and implicit associations between entities are represented by edges between nodes, each edge has corresponding weights and timestamp attributes, and the weights are calculated based on multiple indicators; a detection module for real-time monitoring of the data corresponding to each node. The system collects the real-time data of entities and performs abnormal behavior detection on the real-time data, and then updates the heterogeneous relationship network model based on the abnormal behavior detection results and the historical data of the entities corresponding to each node; a visualization module is used to perform risk quantification, community discovery and abnormal path analysis on the updated heterogeneous relationship network model, and visualize the risk quantification results, community discovery results and abnormal path analysis results; a calculation module is used to construct a feature vector of each node based on the risk quantification results, community discovery results and abnormal path analysis results, and input the feature vector into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model, and then generate business instructions for each node based on the fraud risk score of each node and a preset score range.

[0006] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the anti-fraud method based on a complex relationship network described in the first aspect above.

[0007] An embodiment of the present invention provides an anti-fraud method and system based on a complex relationship network. The method first pre-processes the original user data obtained from multiple data sources, then performs association rule mining on the pre-processed data to identify implicit associations between users, and constructs a heterogeneous relationship network model based on the pre-processed data and the implicit associations. The method then monitors the real-time data of the entity corresponding to each node in real time, and performs abnormal behavior detection on the real-time data. The heterogeneous relationship network model is then updated based on the abnormal behavior detection results and the historical data of the entity corresponding to each node. Risk quantification, community discovery, and abnormal path analysis are then performed on the updated heterogeneous relationship network model, and the risk quantification results, community discovery results, and abnormal path analysis results are visualized. A feature vector of each node is then constructed based on the risk quantification results, community discovery results, and abnormal path analysis results, and the feature vector is input into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model. Finally, a business instruction for each node is generated based on the fraud risk score of each node and a preset score range. By adopting the above technology, the limitations of static network structure can be broken through by utilizing the dynamic network model reconstruction capability, and the ability to dynamically adapt to changes in the online transaction environment can be improved, thereby improving the timeliness and accuracy of fraud identification. By integrating multi-source user data to solve the problem of information islands, the correlation characteristics of multi-source heterogeneous data can be fully explored, and multiple complex relationships can be effectively integrated to improve the accuracy of fraud risk score calculations. By visualizing risk quantification results, community discovery results, and abnormal path analysis results, it is beneficial for relevant personnel to understand the deep structure of fraud gangs, so that relevant personnel can make targeted decisions, thereby improving decision-making efficiency.

[0008] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or understood by practicing the present invention. The purposes and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0009] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0011] Figure 1 Schematic diagram of a flow chart of an anti-fraud method based on a complex relationship network in an embodiment of the present invention;

[0012] Figure 2 Schematic diagram of the structure of an anti-fraud system based on a complex relationship network in an embodiment of the present invention;

[0013] Figure 3 Schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0014] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0015] To facilitate understanding of this embodiment, firstly, an anti-fraud method based on a complex relationship network disclosed in an embodiment of the present invention is introduced in detail. Figure 1 As shown, the method may include the following steps:

[0016] Step S102: obtaining original user data from multiple data sources and preprocessing the original user data.

[0017] The original user data may include structured data and unstructured data.

[0018] In actual application, data can be collected from multiple data sources (such as credit records, blacklist libraries, etc.). The collected data includes but is not limited to users' personal information (such as ID number, occupation, etc.), device fingerprints (such as IMEI code, WiFi address, etc.), transaction records (such as transfer frequency, amount, etc.), communication behavior (such as call records, SMS frequency, etc.), device information, network access behavior, network platform interaction data, internal case data of the public security system, and other structured data and unstructured data, covering various information sources that may be related to fraud activities, so as to fully grasp potential fraud clues and patterns.

[0019] The preprocessing of raw user data may include text data cleaning (such as denoising, word segmentation and standardization, entity alignment, etc.), image data preprocessing (such as format conversion, noise reduction and enhancement, face detection and alignment, etc.), heterogeneous data normalization, missing value processing, format conversion, etc., without limitation.

[0020] Heterogeneous data normalization: Unstructured data (such as text and images) is converted into structured features (such as "frequent contacts" in social relationships) through technologies such as natural language processing (NLP) and computer vision (CV). For example, text features of unstructured text data are extracted through NLP, and image features of unstructured image data are extracted through CV. The text features and image features are then fused and normalized (such as Min-Max normalization or Z-score normalization).

[0021] Missing value handling: Fill in missing data points based on the characteristics of adjacent data points (e.g., the device type of a new user is inferred by associating with the Wi-Fi network).

[0022] Format conversion: Convert data into a standardized feature table in a unified format (including user ID, user behavior characteristics, timestamp, etc.).

[0023] Step S104 , performing association rule mining on the pre-processed data to identify implicit associations between users, and constructing a heterogeneous relationship network model based on the pre-processed data and the implicit associations.

[0024] In the heterogeneous relational network model, nodes can be used to represent entities and edges between nodes can be used to represent implicit associations between entities. Each edge can have corresponding weight and timestamp attributes, and the weight can be calculated based on multiple indicators.

[0025] Step S106 , real-time monitoring of the real-time data of the entity corresponding to each node, and abnormal behavior detection of the real-time data, and then updating the heterogeneous relationship network model based on the abnormal behavior detection results and the historical data of the entity corresponding to each node.

[0026] Step S108 , performing risk quantification, community discovery, and abnormal path analysis on the updated heterogeneous relationship network model, and visualizing the risk quantification results, community discovery results, and abnormal path analysis results.

[0027] Step S110: construct a feature vector for each node based on the risk quantification results, community discovery results, and abnormal path analysis results, and input the feature vector into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model. Then, generate business instructions for each node based on the fraud risk score of each node and the preset score range.

[0028] An embodiment of the present invention provides an anti-fraud method based on a complex relationship network. The method first pre-processes the original user data obtained from multiple data sources, then performs association rule mining on the pre-processed data to identify implicit associations between users, and constructs a heterogeneous relationship network model based on the pre-processed data and the implicit associations. The method then monitors the real-time data of the entity corresponding to each node in real time, and performs abnormal behavior detection on the real-time data. The method then updates the heterogeneous relationship network model based on the abnormal behavior detection results and the historical data of the entity corresponding to each node. The updated heterogeneous relationship network model is then subjected to risk quantification, community discovery, and abnormal path analysis, and the risk quantification results, community discovery results, and abnormal path analysis results are visualized. The method then constructs a feature vector for each node based on the risk quantification results, community discovery results, and abnormal path analysis results, and inputs the feature vector into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model. Finally, a business instruction for each node is generated based on the fraud risk score of each node and a preset score interval. By adopting the above technology, the limitations of static network structure can be broken through by utilizing the dynamic network model reconstruction capability, and the ability to dynamically adapt to changes in the online transaction environment can be improved, thereby improving the timeliness and accuracy of fraud identification. By integrating multi-source user data to solve the problem of information islands, the correlation characteristics of multi-source heterogeneous data can be fully explored, and multiple complex relationships can be effectively integrated to improve the accuracy of fraud risk score calculations. By visualizing risk quantification results, community discovery results, and abnormal path analysis results, it is beneficial for relevant personnel to understand the deep structure of fraud gangs, so that relevant personnel can make targeted decisions, thereby improving decision-making efficiency.

[0029] As a possible implementation, performing association rule mining on the pre-processed data to identify implicit associations between users in step S104 may include:

[0030] Step a1: determine association rule mining parameters.

[0031] Among them, the association rule mining parameters include support, confidence and lift.

[0032] The core of association rule mining is to discover frequent item sets (a collection of items that appear frequently in a data set) and strong association rules (association relationships between items with high confidence) generated based on these frequent item sets.

[0033] Support: The frequency with which an itemset appears across all transactions, used to measure the prevalence of the itemset. The choice of support threshold should be determined based on the size of the dataset and business requirements. A too high support threshold may result in the omission of some meaningful association rules, while a too low support threshold may generate a large number of meaningless rules.

[0034] Confidence: The probability that a transaction containing item set X also contains item set Y. This is used to measure the reliability of the rule. The choice of confidence threshold also needs to be determined based on business needs to ensure that the generated association rules have high credibility.

[0035] Lift: An optional parameter used to measure the strength of the association between itemsets X and Y in a rule. This parameter is the ratio of the probability that a transaction containing X also contains Y to the probability that a transaction containing Y but not X contains X. A lift greater than 1 indicates a positive correlation between X and Y, a lift less than 1 indicates a negative correlation between X and Y, and a lift equal to 1 indicates an unrelated relationship between X and Y.

[0036] Step a2: using an association rule mining algorithm to process the pre-processed data to find frequent item sets and association rules, and filtering out target association rules from the association rules based on association rule mining parameters.

[0037] The association rule mining algorithm may adopt an Apriori algorithm, an FP-Growth algorithm, etc., and is not limited thereto.

[0038] User behavior data (such as users' browsing history, purchase history, social interaction history, etc.) usually exists in the form of transactions, and each transaction contains one or more items (such as the products browsed by the user, the users followed, etc.); before performing association rule mining, the collected user behavior data can be subjected to noise removal, missing value processing, and outlier removal to ensure data quality; the original data is converted into a format suitable for association rule mining, for example, the user's browsing history is converted into a transaction database (where each transaction represents a user's browsing behavior, and each transaction contains a list of product IDs browsed by the corresponding user); relevant features are extracted according to business needs, such as the user's basic information (age, gender, region, etc.) and behavioral characteristics (browsing time, purchase frequency, etc.). These features can be used for subsequent user segmentation and association analysis.

[0039] You can choose an appropriate association rule mining algorithm based on the size and characteristics of your dataset. For small datasets, the Apriori algorithm may be sufficiently efficient; for large datasets, the FP-Growth algorithm is often a better choice. After selecting an association rule mining algorithm, you can run it on the preprocessed data to identify frequent itemsets and association rules. Then, based on the set support, confidence, and lift, you can filter out meaningful association rules. At the same time, consider the length (itemset size) and business relevance of the association rules to remove association rules that are too long or do not conform to business logic.

[0040] In step a3, users are divided into different user groups based on target association rules and user behavior characteristics, and the behavior patterns and association rules between different user groups are analyzed to find implicit associations between users.

[0041] User clustering can be performed based on the mined association rules and user characteristics to divide users into different groups. For example, if it is found that users who purchase product A often also purchase product B, then these users can be divided into a group with similar purchasing preferences. The behavioral patterns and association rules between different user groups are then analyzed to identify implicit associations between users. These implicit associations may include common interest associations, behavioral pattern associations, social network associations, etc. Common interest associations: Different user groups may have a common interest in the same type of goods or services, even though they have no direct social connection. Behavioral pattern associations: User groups may exhibit similar patterns in browsing, purchasing, and evaluation behaviors, and these patterns may reflect their potential needs or preferences. Social network associations: In social network data, association rule mining can discover indirect associations between users, such as implicit associations formed through common friends, commonly participated groups, etc.

[0042] In actual application, visualization tools (such as network diagrams, heat maps, etc.) can also be used to display implicit associations between users, helping business personnel to intuitively understand the association relationships; at the same time, business explanations can be given for the mined association rules to explain the possible reasons and potential value behind the association rules.

[0043] As a possible implementation, the step S104 of constructing a heterogeneous relationship network model based on the pre-processed data and implicit associations may include:

[0044] In step A1, entities are used as nodes and implicit associations between entities as edges to construct an initial heterogeneous relationship network model.

[0045] In step A2, the weight of each edge is calculated based on multiple indicators, and a weight is assigned to each edge to obtain a heterogeneous relationship network model; wherein the multiple indicators include transaction frequency, communication density, and geographic location overlap.

[0046] The operation method of calculating the weight of each edge based on multiple indicators in the above step A2 may include: calculating the indicator value corresponding to each edge of the multiple indicators, and normalizing the indicator value corresponding to each edge; inputting the normalized indicator value of each edge into a pre-built weight calculation model to calculate and output the weight of each edge through the weight calculation model.

[0047] Before building a weight calculation model, it is necessary to first clarify the meaning and quantification method of each indicator.

[0048] Transaction Frequency (TF): The number of transactions between nodes, reflecting the level of economic activity. Transaction frequency can be quantified by directly counting the number of transactions within a certain time window. Transaction frequency can be normalized (e.g., by dividing the transaction frequency by the maximum transaction frequency) to fall within the range [0, 1]. For example, if nodes A and B have an average of 10 transactions per month (i.e., the transaction frequency between nodes A and B is 10), and the maximum transaction frequency is 50, then the normalized transaction frequency between nodes A and B is 0.2.

[0049] Communication Density (CD): The frequency of information exchange between nodes, reflecting the depth of interaction. Communication density can be quantified by calculating the ratio of the number of communication events (such as emails and text messages) to the length of a given time window. For example, if nodes A and B communicate five times per day for 30 days, the communication density between nodes A and B is 150 times per month.

[0050] Geographic Overlap (GO): The degree of geographic proximity between nodes reflects the possibility of spatial interaction. The Haversine formula can be used to calculate the spherical distance between nodes and normalize the spherical distance (e.g., spherical distance divided by the maximum distance) to the interval [0,1]. The geographic overlap between nodes can then be calculated based on the normalized distance. If the nodes share the same location (e.g., company, residence), the geographic overlap is 1. If the nodes do not share the same location, the geographic overlap decays with distance. For example, if node A and node B are 1 km apart and the maximum distance is 10 km, the normalized distance is 0.1, and the geographic overlap between node A and node B can be calculated as 1-0.1=0.9.

[0051] Exemplarily, the weight calculation model may include a basic weighting model, a nonlinear combination model, and a time decay model.

[0052] The basic weighted model is used to linearly weight each normalized indicator. The formula of the basic weighted model can be:

[0053] W=w1·TF norm +w2·CD norm +w3·GO norm

[0054] Where W is the weight of the edge, w1, w2 and w3 are the corresponding weight coefficients, w1+w2+w3=1, TF norm is the normalized transaction frequency, CD norm is the normalized communication density, GO normis the normalized geographic location overlap.

[0055] The nonlinear combination model is used to perform nonlinear weighting on the normalized indicators. The formula of the nonlinear combination model can be:

[0056] W=w1'·TF norm CD norm +w2'·GO norm

[0057] Wherein, w1' and w2' are corresponding weight coefficients respectively, w1'+w2'=1.

[0058] The multiplication term w1'·TF of the nonlinear combination model norm CD norm It is used to capture the interaction between transaction frequency (TF) and communication density (CD); for example, high-frequency trading accompanied by high-density communication may significantly amplify risks or returns rather than simply linearly superimpose them. The additive term w2'·GO in the nonlinear combination model norm The linear influence of a single variable (i.e., geographic overlap) is isolated, preventing multiplication from masking the significant contribution of a single variable. Historical data can be used to fit w1' and w2' using regression analysis (e.g., ridge regression, LASSO) or machine learning algorithms (e.g., gradient boosting tree) to minimize the prediction error (e.g., mean square error, mean average error ...

[0059] The time decay model is used to give lower weight to historical data by considering the time factor. The formula of the time decay model can be:

[0060]

[0061] Where λ is the attenuation factor, λ∈(0,1), t is the time step, w1”, w2” and w3” are the corresponding weight coefficients, TF t is the normalized transaction frequency at time step t, CD t is the normalized communication density at time step t, GO t is the normalized geographic location overlap at time step t, w1”+w2”+w3”=1.

[0062] The time decay model is implemented by λ t This model implements exponential decay, giving higher weight to recent data and lower weight to distant data. The time decay model linearly combines the three features and then performs a weighted summation, taking into account multi-dimensional information. The parameter λ of the time decay model can be dynamically adjusted based on data periodicity (e.g., seasonal business requires lowering λ to preserve historical patterns).

[0063] After calculating the transaction frequency, communication density and geographic location overlap corresponding to each edge, the transaction frequency, communication density and geographic location overlap corresponding to each edge can be normalized; then the normalized transaction frequency, communication density and geographic location overlap of each edge are input into the weight calculation model to calculate and output the weight of each edge through the weight calculation model.

[0064] The operation method of calculating and outputting the weight of each edge through the weight calculation model may include: based on the type of each edge and the pre-established correspondence between the edge type and the basic weighted model, the nonlinear combination model and the time decay model, determining the target model corresponding to each edge from the basic weighted model, the nonlinear combination model and the time decay model; for each edge, calculating and outputting the weight of the edge through the target model corresponding to the edge.

[0065] Heterogeneous relational network models can be constructed using graph databases such as Neo4j. The nodes of the heterogeneous relational network model can be entities such as users, devices, mobile phone numbers, IP addresses, etc. The edges of the heterogeneous relational network model can be defined as multiple types of relationships such as relatives, transactions, device sharing, and geographic location co-occurrence, and a timestamp attribute can be attached to each edge.

[0066] Using Neo4j to build a heterogeneous relational network model can create independent labels for different entities (such as users, products, and locations), distinguish relationship types through the -[:REL_TYPE]-> syntax, and support many-to-many relationship modeling; both nodes and relationships can have attributes attached (such as purchase amount, geographic location, etc.) to achieve attributed modeling; the Cypher query language can be applied to path queries to achieve multi-hop relationship traversal and support complex path analysis; the WHERE clause can be used to filter relationship attributes to achieve dynamic relationship filtering; WITH and RETURN can be combined for statistics to achieve aggregate calculations; it also supports node indexing and relationship indexing, and creates indexes for high-frequency query fields (such as user ID) and relationships to achieve indexing and performance optimization.

[0067] As a possible implementation, the abnormal behavior detection on the real-time data in step S106 may include one of the following operations:

[0068] Operation method 1 is to match the real-time data with the preset exception rules. If there is first target data in the real-time data that matches the preset exception rules, it is determined that the entity corresponding to the real-time data has abnormal behavior, and the entity corresponding to the first target data is determined as an abnormal entity.

[0069] Operation mode 2 is to perform statistics on real-time data to calculate the deviation between the user behavior corresponding to the real-time data and the pre-established normal behavior statistical model. If there is a second target data in the real-time data whose deviation exceeds the preset deviation threshold, it is determined that the entity corresponding to the real-time data has abnormal behavior, and the entity corresponding to the second target data is determined as an abnormal entity.

[0070] Operation method 3 uses a pre-trained machine learning algorithm to predict real-time data, determines whether the entity corresponding to the real-time data has abnormal behavior based on the prediction result, and determines the entity with abnormal behavior as an abnormal entity.

[0071] As a possible implementation, updating the heterogeneous relationship network model based on the abnormal behavior detection results and the historical data of the entity corresponding to each node in the above-mentioned step S106 may include: obtaining the topological information of the heterogeneous relationship network model, and determining the influence range of each abnormal behavior based on the topological information and the determined abnormal nodes; determining the abnormal severity level of each abnormal behavior based on the type, frequency and influence range of each abnormal behavior; determining the update strategy of the heterogeneous relationship network model based on the historical data and topological information as well as the influence range and abnormal severity level of each abnormal behavior; and updating the heterogeneous relationship network model according to the update strategy.

[0072] For ease of understanding, the implementation of the above step S106 is exemplarily described below using a specific application.

[0073] To automatically trigger the topology reconstruction of heterogeneous relationship network models when abnormal behavior is detected, a complete automated response mechanism is built, covering abnormal behavior detection and identification, decision-making and topology reconstruction strategies, and automatic triggering of topology reconstruction execution. The following is a detailed implementation plan:

[0074] Abnormal behavior detection and identification can mainly include the following parts:

[0075] (1.1) Real-time monitoring and data collection.

[0076] Network traffic monitoring: By deploying traffic monitoring tools (such as NetFlow, sFlow, or deep packet inspection (DPI) technology), data packets in the network can be captured in real time to extract key information (such as source / destination IP, port, protocol type, packet size, timestamp, etc.).

[0077] Log collection and analysis: Integrate logs generated by network devices (such as routers, switches, firewalls), servers, and applications, and use log analysis tools (such as ELK Stack and Splunk) for centralized storage and preliminary analysis.

[0078] Host status monitoring: Use host monitoring agents (such as Zabbix Agent, Nagios Plugins) to collect host status information such as CPU, memory, disk, and process in real time.

[0079] (1.2) Abnormal behavior detection algorithm.

[0080] Rule-based detection: A set of rules are pre-defined, such as abnormal traffic patterns on a specific port, a large number of failed login attempts within a short period of time, etc. When monitoring data matches these rules, the corresponding behavior of the monitoring data is identified as abnormal and an abnormality alarm is triggered.

[0081] Statistics-based detection: Build a statistical model of normal network behavior (such as mean, variance, and distribution) and calculate the deviation between the current behavior and the statistical model in real time. When the deviation exceeds a preset threshold, the current behavior is identified as abnormal.

[0082] Machine learning-based detection: Utilize machine learning algorithms (such as Isolation Forest and One-Class SVM) to train historical normal data and known abnormal data to build a detection model. Real-time data is fed into the detection model, which then predicts whether the behavior corresponding to the real-time data is abnormal.

[0083] (1.3) Alarm generation and correlation analysis.

[0084] Alarm generation: When abnormal behavior is detected, an alarm is generated immediately. The alarm information may include the type of abnormality, the time of occurrence, the host or network device involved, and the detailed characteristics of the abnormal behavior.

[0085] Correlation Analysis: Correlation analysis is performed on multiple alerts to identify potential attack chains or complex abnormal scenarios. For example, by analyzing alert information from different time points and hosts, it can determine whether there are signs of a distributed denial of service (DDoS) attack.

[0086] Decision-making and topology reconstruction strategies can mainly include the following parts:

[0087] (2.1) Risk assessment and impact analysis.

[0088] Determine the scope of impact: Use topology discovery tools (such as LLDP, CDP, and SNMP) to obtain topology information of the heterogeneous network model. Combined with the nodes involved in the abnormal behavior, determine the scope of impact of the abnormal behavior.

[0089] Assess the severity of anomalies: Evaluate the potential impact of abnormal behaviors on network security, availability, and performance based on factors such as the type, frequency, and scope of impact of the abnormal behavior. For example, abnormal behaviors targeting critical business systems should be assigned a higher severity level.

[0090] (2.2) Develop a reconstruction strategy.

[0091] New node planning: Based on the risk assessment results, determine whether new nodes are needed and the type, location, and number of new nodes. This decision must be made based on actual needs and resource availability.

[0092] Association edge design: Design the connection method between the new nodes and the existing heterogeneous relationship network model topology, that is, determine the association edges.

[0093] Strategy Verification and Optimization: Use network simulation tools (such as GNS3 and Cisco Packet Tracer) to simulate and verify the developed reconfiguration strategy, evaluating its effectiveness in different scenarios and its impact on the performance of heterogeneous network models. Based on the verification results, optimize the reconfiguration strategy.

[0094] Automatically triggering topology reconstruction mainly includes:

[0095] Use orchestration tools: Use automated orchestration tools (such as Ansible, Puppet, and Chef) to define new node configuration templates for rapid deployment and configuration of new nodes.

[0096] Integrated monitoring and decision-making systems: Integrate the abnormal behavior detection system with automated orchestration tools. When abnormal behavior is detected and a refactoring strategy is determined, the orchestration tool is automatically triggered to execute the corresponding configuration changes. For example, refactoring instructions can be sent to Ansible Tower through the API, which schedules the execution of the Playbook.

[0097] As a possible implementation, the risk quantification result may be a dynamic risk coefficient of each node. Based on this, the risk quantification, community discovery, and abnormal path analysis of the updated heterogeneous relationship network model in step S108 may include:

[0098] In step b1, the TrustRank algorithm is used to quantify the risk of the updated heterogeneous relationship network model to calculate the dynamic risk coefficient of each node and mark the dynamic risk coefficient of each node.

[0099] The TrustRank algorithm is used to identify high-risk nodes (such as blacklisted users and fraudulent devices). The implementation of risk quantification using the TrustRank algorithm can mainly include the following steps:

[0100] (1) Initialize risk labels: Mark blacklisted users, fraudulent devices, etc. as high-risk seed nodes (risk value = 1.0). Mark other nodes as nodes with unclear initial risk values. It can be assumed that the risk values ​​of other nodes are 0 or undefined.

[0101] (2) Calculate risk diffusion through adjacency matrix iteration:

[0102] Iterative formula: r(k+1)=α·T·r(k)+(1-α)·d, where α is the attenuation factor used to control the intensity of risk propagation, α∈(0,1), and α can generally be taken as 0.8; T is the adjacency matrix, which represents the connection relationship between nodes; d is the initial risk vector (including the risk value of the seed node), and r is the dynamic risk coefficient vector of the node (including the risk coefficient of the node); T·r(k) indicates that the risk is propagated to adjacent nodes through the adjacency relationship, α controls the weight of the propagated risk, and (1-α)·d retains the impact of the initial risk.

[0103] Iterative process: Construct a normalized adjacency matrix T; initialize r(0) and the initial risk vector d, mark the seed node and set the risk value of the seed node to 1.0, and set the risk value of other nodes to 0; iterate according to r(k+1) = α·T·r(k)+(1-α)·d until convergence (that is, the difference between r(k+1) and r(k) is very small), and output the dynamic risk coefficient of all nodes.

[0104] In step b2, the Louvain algorithm is used to perform community discovery on the updated heterogeneous relational network model to divide the updated heterogeneous relational network model into multiple communities, and high-density communities are identified from the multiple communities based on the edge density and number of nodes within the community.

[0105] Community discovery aims to partition nodes in an updated heterogeneous network model into communities, ensuring that nodes within a community are tightly connected and nodes between communities are sparsely connected. The Louvain algorithm is a community discovery algorithm based on modularity optimization. By iteratively optimizing modularity, the Louvain algorithm can discover community structures in an updated heterogeneous network model. Modularity is a measure of the quality of community partitioning; a higher modularity value indicates a better community partitioning effect.

[0106] The Louvain algorithm can be applied to community discovery to identify high-density communities and identify group fraud groups. The steps for applying the Louvain algorithm to identify high-density communities may include:

[0107] (1) Initialize the updated heterogeneous relational network model: Initialize each node in the updated heterogeneous relational network model as an independent community.

[0108] (2) Apply the Louvain algorithm to divide the community:

[0109] Modularity calculation: For each node, the change in modularity after moving it to the adjacent community is calculated.

[0110] Node movement: Move the node to the adjacent community that increases its modularity the most. If the modularity does not increase after the movement, keep the node in the current community.

[0111] Iterative optimization: Repeat the above steps of modularity calculation and node movement until the modularity no longer increases or reaches the preset number of iterations.

[0112] Community aggregation: Aggregate the divided communities into new nodes, rebuild the relationship network, and repeat the above steps to divide the next level of communities. This helps to discover hierarchical community structures.

[0113] (3) High-density community identification:

[0114] Identify high-density communities within the communities delineated by the Louvain algorithm. High-density communities typically correspond to closely connected groups of nodes and may be potential fraud rings. High-density communities can be identified by calculating metrics such as edge density and node degree distribution within the community. For example, high-density communities with a community modularity greater than 0.7 can be identified as potential fraud rings.

[0115] (4) Fraud gang identification:

[0116] Feature extraction: For identified high-density communities (i.e., potential fraud gangs), extract their features (such as gang size, frequency of transactions within the gang, and behavior patterns of gang members).

[0117] Rule matching and machine learning: Combined with preset fraud rules or a selected machine learning model (different from the machine learning model used to calculate the fraud risk score), the extracted features are evaluated to determine whether a high-density community that is a potential fraud ring is actually a fraud ring.

[0118] Visualization and verification: Use visualization tools to display community delineation results and high-density communities to facilitate manual verification and further analysis.

[0119] Centrality algorithms can also be used to discover important and influential figures in fraud gangs, providing business personnel with verification clues such as fraudsters, thereby improving the efficiency of fraud investigation and handling.

[0120] Step b3: Use the shortest path algorithm to perform abnormal path analysis on the updated heterogeneous relationship network model to identify abnormal paths; wherein the abnormal paths pass through pre-defined high-risk nodes.

[0121] The shortest path algorithm (such as the Dijkstra algorithm) can be used to identify unexpected abnormal behaviors across high-risk nodes in the updated heterogeneous relationship network model. Combined with risk weight modeling, dynamic thresholds, and abnormal pattern matching, efficient detection of abnormal behaviors across high-risk nodes can be achieved.

[0122] The core ideas of abnormal path analysis can mainly include:

[0123] (1) Risk modeling: The relationship network is abstracted into a weighted directed graph, where nodes represent entities (such as users, devices, IP addresses), edges represent behavioral paths (such as access, transactions, and communications), and the weight of the node is the risk value (such as threat intelligence score, historical anomaly frequency, sensitivity level, etc.); high-risk nodes (such as privileged accounts, vulnerable devices, external network exits, etc.) need to be explicitly marked, and the weight of high-risk nodes can be set to a negative value (penalty) or an extremely high positive value (forced detour).

[0124] (2) The dual meaning of the shortest path:

[0125] Normal path: The shortest path calculated by the Dijkstra algorithm under legal risk constraints (such as compliance processes and low-risk channels).

[0126] Abnormal path: An actual path that deviates from the shortest path and actively passes through high-risk nodes (such as bypassing audits and directly accessing core systems), or an actual path whose total risk value exceeds the dynamic threshold.

[0127] The implementation steps of abnormal path analysis can mainly include:

[0128] (1) Data preprocessing and graph construction:

[0129] Input data: logs, traffic, event streams (such as user login records, API call chains, network packet metadata).

[0130] Node and edge definitions:

[0131] Node attributes: ID, risk level (low / medium / high), type (user / system / IP).

[0132] Edge attributes: source node, target node, behavior type (such as login, transfer), risk weight (such as -10 indicates high risk penalty).

[0133] (2) Risk weight design:

[0134] Static weight: A fixed risk weight for a node based on rule settings. For example, you can set the risk weight for high-risk ports to -5 and the risk weight for unauthorized access to -20.

[0135] Dynamic weight: A dynamically changing risk weight for a node based on context (e.g., historical user behavior, time window, etc.). For example, the risk weight for a node can be set to vary in different time periods (e.g., doubling the risk weight during non-working hours), and a lower limit for node weight changes can be set to prevent the node from having an infinite negative weight.

[0136] (3) Abnormal path detection:

[0137] Step 1: Use Dijkstra algorithm to calculate the legal shortest path (excluding high-risk nodes).

[0138] Step 2: Compare the actual path with the shortest path.

[0139] Abnormal path judgment condition 1: The actual path contains high-risk nodes, and the actual path does not appear in the legal shortest path alternatives (for example, a low-risk alternative path exists but is not selected).

[0140] Abnormal path judgment condition 2: The total risk value of the actual path exceeds the dynamic threshold; for example, the dynamic threshold is mean_risk+3*std_risk, where mean_risk is the mean of the risk value of the actual path, and std_risk is the standard deviation of the risk value of the actual path.

[0141] Step 3: Output abnormal pattern.

[0142] If the actual path and the shortest path meet at least one of the abnormal path determination condition 1 and the abnormal path determination condition 2, the actual path is determined to be an abnormal path and the abnormal path is output.

[0143] (4) Dynamic optimization and expansion:

[0144] Incremental update: Update the graph structure in real time (for example, when a new vulnerable device is added, its weight is set to -∞ and the path is recalculated).

[0145] Heuristic acceleration: Combined with the A* algorithm, heuristic functions (such as target node distance) are used to reduce the amount of calculation.

[0146] Multi-objective optimization: Minimize path length and risk value simultaneously to obtain Pareto optimal solution.

[0147] Through the above-mentioned abnormal path analysis operation mode, the Dijkstra algorithm can be effectively transformed into a risk-aware shortest path detector. Combined with dynamic graph modeling and threshold analysis, it can achieve accurate identification of abnormal behaviors across high-risk nodes.

[0148] For ease of understanding, the implementation method of the above-mentioned step S110 (i.e., constructing a feature vector for each node based on the risk quantification results, community discovery results and abnormal path analysis results, and inputting the feature vector into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model, and then generating business instructions for each node based on the fraud risk score of each node and the preset score range) is described as follows by taking a specific application as an example.

[0149] Machine learning models (such as random forests, XGBoost, and graph neural networks) can be used to train the extracted features. This allows the trained machine learning model to calculate each entity's fraud risk score, generating a dynamic score (e.g., 0-100) based on the risk factor, community affiliation, and path anomaly. After obtaining each entity's fraud risk score, threshold conditions (e.g., a fraud risk score > 75 points) can be set to trigger automatic interception or manual review.

[0150] To dynamically score entity fraud risk (0-100 points) and trigger an early warning mechanism, it is necessary to combine feature engineering, model training, score mapping, and threshold strategies. Implementing dynamic scoring of entity fraud risk and triggering an early warning mechanism mainly involves the following aspects:

[0151] 1. Feature construction.

[0152] Three types of features are generated based on risk factor, community affiliation, and path abnormality:

[0153] Risk coefficient characteristics: transaction amount volatility (standard deviation / mean), night trading ratio (percentage of transactions between 22:00 and 6:00), number of short-term high-frequency transactions (such as ≥5 transactions within 1 hour), etc.

[0154] Community affiliation features (applicable to graph neural networks): Degree Centrality of the entity in the transaction network, fraud density of the community to which it belongs (the proportion of known fraudulent entities in the community), shortest path length between the community to which it belongs and high-risk entities, etc.

[0155] Path anomaly characteristics: transaction path entropy (negative logarithm of path diversity), abnormal jump ratio (such as unnatural cross-provincial / cross-national transactions), deviation from historical behavior patterns (such as the first visit to a certain IP address), etc.

[0156] 2. Model selection and training.

[0157] Model selection: You can choose random forest model, XGBoost model, graph neural network model, etc.

[0158] The Random Forest model is highly interpretable, can handle nonlinear relationships, and is robust to outliers, making it suitable for processing basic statistical features (such as amount and frequency). The XGBoost model offers high accuracy and supports feature importance ranking, making it suitable for processing high-dimensional sparse data and mixed features (statistics, paths, and communities). The Graph Neural Network model can capture complex relationships between entities and is suitable for analyzing community affiliation and path anomaly, as well as for processing social network and transaction graph data.

[0159] Model training process: mainly includes data division, model tuning and fusion strategy.

[0160] Data partitioning: 70% training set, 15% validation set, and 15% test set.

[0161] Model tuning: For random forest models, adjust the tree depth (max_depth) and the minimum number of split samples (min_samples_split); for XGBoost models, optimize the learning rate (learning_rate) and subsampling ratio (subsample); for graph neural network models, use the GraphSAGE or GAT architecture and adjust the hidden layer dimension (such as 128 dimensions).

[0162] Fusion strategy: A stacking strategy can be used, specifically using the outputs of the random forest model and the XGBoost model as meta-features and inputting them into a lightweight model (such as Logistic Regression). A weighted voting strategy can also be used, specifically assigning weights based on the F1-score of the validation set (for example, a weight of 0.6 for the XGBoost model and a weight of 0.4 for the random forest model).

[0163] 3. Dynamic score mapping and threshold setting.

[0164] Score mapping: linearly map the probability value (0-1) output by the model to the range of 0-100 points; use PlattScaling or Isotonic Regression to correct the probability calibration deviation.

[0165] Threshold setting: Business rules can be defined and thresholds can be adjusted dynamically.

[0166] Business rules:

[0167] High risk (>75 points): The transaction will be automatically blocked and pushed for manual review;

[0168] Medium risk (50-75 points): triggers secondary verification (such as SMS verification code);

[0169] Low risk (<50 points): Release directly.

[0170] Dynamically adjust the threshold: The threshold is adjusted quarterly based on historical interception results (false positive rate, missed negative rate). For example, if the high-risk false positive rate is greater than 5%, the threshold is lowered from 75 points to 70 points.

[0171] 4. Real-time detection and early warning mechanism.

[0172] Real-time scoring calculation: Stream processing can be used and a caching mechanism can be introduced.

[0173] Stream processing: Use Apache Flink or Spark Streaming to extract features and call the model in real time for each new transaction.

[0174] Caching mechanism: Pre-calculate entity historical behavior characteristics (such as 30-day transaction average) and cache them to reduce real-time computing overhead.

[0175] Alert triggering: Configurable rule engine and notification method.

[0176] Rule engine: If the score is greater than 75 points, a "high-risk warning" is triggered; if the score is between 50-75 points and the path abnormality is greater than 0.8, a "medium-risk warning" is triggered.

[0177] Notification method: There are two main notification methods: automatic interception and manual review.

[0178] Automatic blocking: Abort the transaction by calling the payment gateway through the API.

[0179] Manual review: Push to the risk control team's workstation and mark key risk points (such as "associated with 3 fraud communities").

[0180] The model can also be continuously optimized, which may include feature iteration, model retraining and adversarial learning.

[0181] Feature iteration: New high-value features are added every month (such as new IP blacklists).

[0182] Model retraining: The model is fully retrained every quarter using the latest fraud samples.

[0183] Adversarial learning: Simulate fraudster behavior to generate adversarial samples and improve model robustness.

[0184] 5. Example scenario

[0185] User A's trading behavior: risk coefficient characteristics include a nighttime transaction ratio of 30% (high) and an amount volatility of 2.5 (high); community affiliation characteristics include a fraud density of 15% (medium) in the community and direct association with three known fraud entities; path anomaly characteristics include a cross-provincial transaction path entropy value of 0.9 (high).

[0186] Model output: The XGBoost model output probability is 0.82, which is mapped to a score of 82. The random forest model output probability is 0.78, which is mapped to a score of 78. The fusion probability is 0.82×0.6+0.78×0.4=0.804, which is mapped to a score of 80.

[0187] Decision: 80 points > 75 points, indicating high risk, triggering automatic interception, pushing manual review, and marking the risk point "high-frequency cross-provincial transactions at night, associated with high-risk communities."

[0188] Through the above solution, by leveraging the effectiveness of features, the real-time nature of the model, and the dynamic tuning capability of thresholds, dynamic and accurate fraud risk scoring can be achieved, balancing interception efficiency and user experience.

[0189] This invention addresses the limitations of existing anti-fraud technologies by constructing a dynamic complex network, integrating multi-dimensional attribute features, and introducing an iterative optimization mechanism to achieve accurate identification and efficient prevention of fraudulent behavior. Compared with existing technologies, the beneficial effects of this invention are reflected in the following aspects:

[0190] 1) Utilize dynamic network reconstruction capabilities to break through the limitations of static networks.

[0191] Existing technologies often rely on fixed rules or static network models, making them difficult to adapt to the rapid changes in fraudulent behavior. This invention iteratively reconstructs the relationship network based on the characteristics of known fraud gangs, achieving dynamic restructuring of the network structure. It also divides nodes into normal gangs and potential fraud gangs, achieving adaptive community segmentation and improving the identification rate of group fraud.

[0192] 2) Solve the problem of information islands through multi-dimensional attribute fusion.

[0193] Traditional anti-fraud systems typically use a single data dimension in isolation, resulting in information fragmentation. This invention integrates multiple node attributes into a unified network and quantitatively analyzes node fraud risk, enabling cross-dimensional feature correlation. By constructing a weighted calculation model to calculate edge weights, this invention achieves dynamic weight allocation, helping to strengthen key risk signals and reduce false alarm rates.

[0194] 3) Strong adaptability and scalability, covering diverse fraud scenarios.

[0195] Compared to traditional anti-fraud technologies, this invention can be quickly adapted to other scenarios, such as supply chain finance and e-commerce fraud prevention, by adjusting network construction rules (e.g., replacing "ID card" with "business information"). This invention also has the ability to learn from small samples. Even during the cold start phase of a new business, it can identify potential risks through unsupervised community discovery technology, breaking through the traditional anti-fraud model's reliance on large amounts of labeled data.

[0196] In summary, the present invention alleviates the problems of poor adaptability, high false alarm rate, and low gang crime identification rate of existing anti-fraud technologies through dynamic network reconstruction and multi-dimensional attribute fusion.

[0197] On the basis of the above-mentioned anti-fraud method based on complex relationship network, the embodiment of the present invention further provides an anti-fraud system based on complex relationship network, see Figure 2 As shown, the system may include the following modules:

[0198] The pre-processing module 202 is configured to obtain original user data from multiple data sources and pre-process the original user data; wherein the original user data includes structured data and unstructured data.

[0199] Construction module 204 is used to perform association rule mining on the preprocessed data to identify implicit associations between users, and to construct a heterogeneous relationship network model based on the preprocessed data and the implicit associations; wherein, in the heterogeneous relationship network model, nodes are used to represent entities and edges between nodes are used to represent implicit associations between entities, each edge has a corresponding weight and timestamp attribute, and the weight is calculated based on multiple indicators.

[0200] The detection module 206 is used to monitor the real-time data of the entity corresponding to each node in real time, perform abnormal behavior detection on the real-time data, and then update the heterogeneous relationship network model based on the abnormal behavior detection results and the historical data of the entity corresponding to each node.

[0201] The visualization module 208 is used to perform risk quantification, community discovery, and abnormal path analysis on the updated heterogeneous relationship network model, and to visualize the risk quantification results, community discovery results, and abnormal path analysis results.

[0202] The calculation module 210 is used to construct a feature vector for each node based on the risk quantification results, community discovery results and abnormal path analysis results, and input the feature vector into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model, and then generate business instructions for each node based on the fraud risk score of each node and a preset score range.

[0203] The above-mentioned anti-fraud system based on complex relationship networks can utilize the dynamic network model reconstruction capability to break through the limitations of static network structures, dynamically adapt to changes in the online transaction environment, and improve the timeliness and accuracy of fraud identification; by integrating multi-source user data to solve the problem of information islands, it can fully explore the correlation characteristics of multi-source heterogeneous data, effectively integrate multiple complex relationships, and improve the accuracy of fraud risk score calculations; by visualizing risk quantification results, community discovery results, and abnormal path analysis results, it is beneficial for relevant personnel to understand the deep structure of fraud gangs, so that relevant personnel can make targeted decisions, thereby improving decision-making efficiency.

[0204] The anti-fraud system based on a complex relationship network provided in the embodiment of the present invention has the same implementation principle and technical effects as the aforementioned anti-fraud method embodiment based on a complex relationship network. For the sake of brief description, for parts not mentioned in the embodiment of the anti-fraud system based on a complex relationship network, please refer to the corresponding content in the aforementioned anti-fraud method embodiment based on a complex relationship network.

[0205] The embodiment of the present invention further provides an electronic device, such as Figure 3 As shown, it is a structural diagram of the electronic device, wherein the electronic device includes a processor 31 and a memory 30, the memory 30 stores computer executable instructions that can be executed by the processor 31, and the processor 31 executes the computer executable instructions to implement the above-mentioned anti-fraud method based on complex relationship network.

[0206] exist Figure 3 In the illustrated embodiment, the electronic device further includes a bus 32 and a communication interface 33 , wherein the processor 31 , the communication interface 33 and the memory 30 are connected via the bus 32 .

[0207] Among them, the memory 30 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 33 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. The bus 32 can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 32 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0208] The processor 31 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor 31 or by software instructions. The processor 31 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present invention may be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor 31 reads the information in the memory and combines its hardware to complete the steps of the anti-fraud method based on complex relationship network of the aforementioned embodiment.

[0209] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0210] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0211] In the description of the present invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0212] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. An anti-fraud method based on complex relationship network, characterized in that: include: Acquire original user data from multiple data sources and pre-process the original user data; wherein the original user data includes structured data and unstructured data; Performing association rule mining on the preprocessed data to identify implicit associations between users, and constructing a heterogeneous relationship network model based on the preprocessed data and the implicit associations; wherein the heterogeneous relationship network model uses nodes to represent entities and uses edges between nodes to represent implicit associations between entities, each edge having a corresponding weight and a timestamp attribute, and the weight is calculated based on multiple indicators; monitoring the real-time data of the entity corresponding to each node in real time, performing abnormal behavior detection on the real-time data, and then updating the heterogeneous relationship network model based on the abnormal behavior detection results and the historical data of the entity corresponding to each node; Perform risk quantification, community discovery, and abnormal path analysis on the updated heterogeneous relationship network model, and visualize the risk quantification results, community discovery results, and abnormal path analysis results; Based on the risk quantification results, community discovery results and abnormal path analysis results, a feature vector of each node is constructed, and the feature vector is input into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model. Then, business instructions for each node are generated based on the fraud risk score of each node and the preset score range.

2. The anti-fraud method based on complex relationship network according to claim 1, characterized in that: Constructing a heterogeneous relationship network model based on the preprocessed data and the implicit association includes: Entities are used as nodes and implicit relationships between entities as edges to construct an initial heterogeneous relationship network model; The weight of each edge is calculated based on multiple indicators, and the weight is assigned to each edge to obtain the heterogeneous relationship network model; wherein the multiple indicators include transaction frequency, communication density and geographical location overlap.

3. The anti-fraud method based on complex relationship network according to claim 2, characterized in that: The weight of each edge is calculated based on multiple metrics, including: Calculating the index value of each edge corresponding to the multiple indicators, and normalizing the index value corresponding to each edge; The normalized index value of each edge is input into a pre-built weight calculation model to calculate and output the weight of each edge through the weight calculation model.

4. The anti-fraud method based on complex relationship network according to claim 3 is characterized in that: The weight calculation model includes a basic weighted model, a nonlinear combination model and a time decay model; The basic weighted model includes: W=w1·TF norm +w2·CD norm +w3·GO norm Where W is the weight of the edge, w1, w2 and w3 are the corresponding weight coefficients, w1+w2+w3=1, TF norm is the normalized transaction frequency, CD norm is the normalized communication density, GO norm is the normalized geographic location overlap; The nonlinear combination model includes: W=w1’·TF norm ·CD norm +w2’·GO norm Wherein, w1' and w2' are corresponding weight coefficients, w1'+w2'=1; The time decay model includes: Where λ is the attenuation factor, λ∈(0,1), t is the time step, w1”, w2” and w3” are the corresponding weight coefficients, TF t is the normalized transaction frequency at time step t, CD t is the normalized communication density at time step t, GO t is the normalized geographic location overlap at time step t, w1”+w2”+w3”=1; The weight calculation model is used to calculate and output the weight of each edge, including: Determining a target model corresponding to each edge from the basic weighted model, the nonlinear combination model, and the time decay model based on the type of each edge and a pre-established correspondence between the type of the edge and the basic weighted model, the nonlinear combination model, and the time decay model; For each edge, the weight of the edge is calculated and output through the target model corresponding to the edge.

5. The anti-fraud method based on complex relationship network according to claim 4 is characterized in that: Performing abnormal behavior detection on the real-time data includes one of the following: Matching the real-time data with preset exception rules; if the real-time data contains first target data that matches the preset exception rules, determining that the entity corresponding to the real-time data has abnormal behavior, and determining the entity corresponding to the first target data as an abnormal entity; Performing statistics on the real-time data to calculate the deviation between the user behavior corresponding to the real-time data and a pre-established normal behavior statistical model; if the real-time data contains second target data whose deviation exceeds a preset deviation threshold, determining that the entity corresponding to the real-time data has abnormal behavior, and determining the entity corresponding to the second target data as an abnormal entity; A pre-trained machine learning algorithm is used to predict the real-time data, and based on the prediction result, it is determined whether the entity corresponding to the real-time data has abnormal behavior, and the entity with abnormal behavior is determined as an abnormal entity.

6. The anti-fraud method based on complex relationship network according to claim 5, characterized in that: Updating the heterogeneous relationship network model based on the abnormal behavior detection results and the historical data of the entity corresponding to each node includes: Acquire topology information of the heterogeneous relationship network model, and determine the impact range of each abnormal behavior based on the topology information and the determined abnormal nodes; Determine the severity level of each abnormal behavior based on the type, frequency, and impact scope of each abnormal behavior; Determining an update strategy for the heterogeneous relationship network model based on the historical data, the topology information, and the impact scope and severity level of each abnormal behavior; The heterogeneous relationship network model is updated according to the update strategy.

7. The anti-fraud method based on complex relationship network according to claim 6, characterized in that: The risk quantification result is the dynamic risk coefficient of each node; Perform risk quantification, community discovery, and abnormal path analysis on the updated heterogeneous relationship network model, including: The TrustRank algorithm is used to quantify the risk of the updated heterogeneous relationship network model to calculate the dynamic risk coefficient of each node and mark the dynamic risk coefficient of each node; Performing community discovery on the updated heterogeneous relational network model using the Louvain algorithm to divide the updated heterogeneous relational network model into multiple communities, and identifying high-density communities from the multiple communities based on edge density and number of nodes within the communities; The shortest path algorithm is used to perform abnormal path analysis on the updated heterogeneous relationship network model to identify abnormal paths; wherein the abnormal paths pass through pre-defined high-risk nodes.

8. The anti-fraud method based on complex relationship network according to claim 1, characterized in that: Perform association rule mining on pre-processed data to identify implicit associations between users, including: Determining association rule mining parameters; wherein the association rule mining parameters include support, confidence and lift; Using an association rule mining algorithm to process the pre-processed data to find frequent item sets and association rules, and filtering target association rules from the association rules based on the association rule mining parameters; Users are divided into different user groups based on target association rules and user behavior characteristics, and the behavior patterns and association rules between different user groups are analyzed to find the implicit associations between users.

9. An anti-fraud system based on a complex relationship network, characterized in that: include: A preprocessing module, configured to obtain original user data from multiple data sources and preprocess the original user data; wherein the original user data includes structured data and unstructured data; A construction module is configured to perform association rule mining on the preprocessed data to identify implicit associations between users, and to construct a heterogeneous relationship network model based on the preprocessed data and the implicit associations; wherein the heterogeneous relationship network model uses nodes to represent entities and edges between nodes to represent implicit associations between entities, and each edge has a corresponding weight and timestamp attribute, and the weight is calculated based on multiple indicators; A detection module is used to monitor the real-time data of the entity corresponding to each node in real time, perform abnormal behavior detection on the real-time data, and then update the heterogeneous relationship network model based on the abnormal behavior detection results and the historical data of the entity corresponding to each node; A visualization module is used to perform risk quantification, community discovery, and abnormal path analysis on the updated heterogeneous relationship network model, and to visualize the risk quantification results, community discovery results, and abnormal path analysis results; A calculation module is used to construct a feature vector for each node based on the risk quantification results, community discovery results, and abnormal path analysis results, and input the feature vector into a pre-trained machine learning model to calculate the fraud risk score of each node through the machine learning model. Then, a business instruction for each node is generated based on the fraud risk score of each node and a preset score range.

10. An electronic device, characterized in that: It includes a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the anti-fraud method based on a complex relationship network as described in any one of claims 1 to 8.

Images