Anti-fraud classification model training method and fraud user identification method and device

Abstract

The invention provides an anti-fraud classification model training method and a fraud user identification method and device, and the method comprises the steps: obtaining the communication data of a sample user, constructing an intimacy complex network of the sample user for the communication data through employing a sliding window strategy, dividing the network through employing a community segmentation algorithm, obtaining a plurality of sub-relation networks, for a target node in each sub-relation network, generating a guide node corresponding to the target node; selecting neighbor nodes in the sub-relation network through an adversarial agent fusion learning strategy based on the guide nodes to obtain a screened neighbor node set; performing node information aggregation on the screened neighbor node set through a graph neural network to obtain a comprehensive representation vector of a target node; and inputting the comprehensive representation vector into a preset classifier to train a to-be-trained anti-fraud classification model to obtain the anti-fraud classification model. Therefore, the accuracy and robustness of the anti-fraud classification model in the aspect of fraud user identification are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a training method for an anti-fraud classification model and a method and apparatus for identifying fraudulent users. Background Technology

[0002] In order to effectively curb telecom fraud, major telecom operators are using their business experience and big data technology to build their own anti-fraud models for corporate voice dedicated lines.

[0003] Currently, telecom operators primarily employ two approaches to constructing anti-fraud models: First, rule-based models, which filter suspicious customers by setting multiple business indicator thresholds. For example, if a user meets certain standards in indicators such as "the month-on-month change in the number of unique outgoing numbers," "the number of SMS messages sent in the current month," and "the number of outgoing calls in the current month," they are flagged as a suspected fraudster. Second, machine learning models are built, utilizing simple data mining techniques to identify fraudulent behavior. However, due to the unique nature of anti-fraud models, positive samples (i.e., real fraudulent user samples) are extremely scarce. Existing models often use "oversampling" or "undersampling" methods to achieve sample balance, but these methods often lead to overfitting or underfitting, affecting model performance.

[0004] The existing methods have the following main problems: First, whether it is a business rule model or a simple machine learning model, its construction relies on limited modeling metrics, resulting in unsatisfactory model performance; second, the scarcity of positive samples makes simple sampling methods unable to effectively improve the accuracy of the model; third, the existing model algorithms are relatively simple, which easily leads to overfitting, and the requirements for data cleaning and preprocessing are strict, and the model performance is difficult to guarantee when the metrics are not comprehensive; finally, fraudsters in reality often use various means to disguise themselves and increase suspicion, causing inconsistencies at the data level, and simple machine learning models are unable to effectively cope with this complexity.

[0005] In summary, existing anti-fraud models suffer from limited modeling metrics and scarce samples, resulting in poor model performance and inaccurate identification of fraudsters' spoofing behavior. Summary of the Invention

[0006] This application provides a training method for an anti-fraud classification model and a method and apparatus for identifying fraudulent users, in order to solve the technical problem that existing anti-fraud models have limited modeling indicators and scarce samples, resulting in poor model performance and inaccurate identification of fraudsters' disguised behavior.

[0007] To solve the above-mentioned technical problems, this application is implemented as follows:

[0008] In a first aspect, embodiments of this application provide a method for training an anti-fraud classification model, the method comprising:

[0009] The communication data of the sample users is obtained. A sliding window strategy is used to construct a complex intimacy network of the sample users based on the communication data. The complex intimacy network is then divided using a community segmentation algorithm to obtain multiple sub-relationship networks. Each sub-relationship network includes a target node and neighbor nodes of the target node. The target node represents the sample user, and the neighbor nodes represent other users related to the sample user as determined based on the communication data.

[0010] For each target node in the sub-relationship network, a guiding node corresponding to the target node is generated based on a global contrastive learning method;

[0011] Based on the guiding node, the neighbor nodes in the sub-relation network are selected through an adversarial agent fusion learning strategy to obtain a filtered set of neighbor nodes.

[0012] The node information of the filtered set of neighboring nodes is aggregated by a graph neural network to obtain the comprehensive representation vector of the target node; the comprehensive representation vector is input into a preset classifier to train the anti-fraud classification model to obtain the anti-fraud classification model, wherein the anti-fraud classification model is composed of the graph neural network and the classifier.

[0013] Optionally, the communication data includes any of the following:

[0014] Package subscription information and communication behavior;

[0015] The package order information and tracking information;

[0016] The package subscription information, the communication behavior, and the trajectory information;

[0017] Acquire communication data of sample users, and construct a complex affinity network of the sample users using a sliding window strategy on the communication data, including:

[0018] Collect communication data from the sample users, and construct a composite information matrix with the package subscription information as the main object based on the communication data;

[0019] Initialize the time-series observation window and slide the time-series observation window on the composite information matrix. Within each time-series observation window, calculate the correlation coefficient between the sample user and each of the other users. The correlation coefficient includes any one of the following: the package sharing correlation coefficient and the communication correlation coefficient; the package sharing correlation coefficient and the behavioral trajectory similarity; or the package sharing correlation coefficient, the communication correlation coefficient, and the behavioral trajectory similarity.

[0020] Based on the correlation coefficient, the composite correlation coefficient between the sample user and each of the remaining users in each time series observation window is determined, and the average composite correlation coefficient between the sample user and each of the remaining users in all time series observation windows is determined.

[0021] The proximity complex network is constructed by taking the sample user as the target node, the other users as neighbor nodes, and the average composite correlation coefficient between the sample user and the other users as the edge connecting the target node and the other users.

[0022] Optionally, the communication correlation coefficient is determined by the frequency and duration of calls between the sample user and other users;

[0023] The behavioral trajectory similarity is determined by the positional correlation between the sample user and the other users at the same point in time within the time-series observation window.

[0024] Optionally, the complex intimacy network is divided using a community segmentation algorithm to obtain multiple sub-relationship networks, including:

[0025] The community segmentation algorithm is used to divide the intimacy complex network to obtain multiple initial sub-relationship networks, and the remaining discrete nodes after the division are determined. The mean attribute similarity between the discrete nodes and all nodes in each of the initial sub-relationship networks is calculated.

[0026] The discrete nodes are assigned to an initial sub-relationship network with the highest mean attribute similarity, thus forming multiple sub-relationship networks.

[0027] Optionally, for each target node in the sub-relationship network, generating a guiding node corresponding to the target node based on a global contrastive learning method includes:

[0028] The target node and the sub-relationship network to which the target node belongs are input into a preset graph neural network encoder to obtain the representation vector of the sub-relationship network output by the graph neural network encoder;

[0029] The representation vector is input into a preset multilayer perceptron to obtain the attribute vector of the guiding node output by the multilayer perceptron, and the guiding node is obtained based on the attribute vector;

[0030] During the training phase of the graph neural network encoder and the multilayer perceptron, the global contrastive learning method is used to optimize the parameters of the graph neural network encoder and the multilayer perceptron, so as to increase the similarity between the attribute vector of the guiding node and the positive sample, and increase the difference between it and the negative sample. The positive sample is composed of the mean of the attribute vectors of the guiding nodes corresponding to nodes belonging to the same fraud category as the target node in the current training batch, and the mean of the attribute vectors of the nodes belonging to the same fraud category as the target node themselves. The negative sample is composed of the mean of the attribute vectors of the guiding nodes corresponding to nodes belonging to the same normal category as the target node in the current training batch, and the mean of the attribute vectors of the nodes belonging to the same normal category as the target node themselves.

[0031] Optionally, based on the guiding node, neighbor nodes within the sub-relationship network are selected using an adversarial agent fusion learning strategy to obtain a filtered set of neighbor nodes, including:

[0032] For each neighboring node of the target node, construct a state subgraph containing the target node, the neighboring nodes, and the guiding node;

[0033] The state subgraph is input into a preset value evaluation module to obtain the value score of the neighbor node for identifying whether the target node is a fraudulent user, as output by the value evaluation module.

[0034] The state subgraph is used as the current state observed by the preset reinforcement learning agent and input into the reinforcement learning agent to obtain the selection result output by the reinforcement learning agent. The selection result is to select the neighbor node corresponding to the state subgraph or not select the neighbor node corresponding to the state subgraph.

[0035] Based on the selection results of all neighbor nodes in the sub-relation network, the filtered neighbor node set is obtained.

[0036] The reinforcement learning agent is used in the current training round during the training phase to determine a reward value based on the value score, the selection result, and the baseline, and to update its own parameters using the reward value. The baseline is the current average value score of all neighbor nodes in the sub-relationship network in the historical training rounds, and the baseline can be dynamically updated according to the changes in the historical training rounds.

[0037] Optionally, the filtered set of neighboring nodes is aggregated using a graph neural network to obtain a comprehensive representation vector of the target node; the comprehensive representation vector is then input into a preset classifier to train the anti-fraud classification model, resulting in an anti-fraud classification model, including:

[0038] Within each of the sub-relationship networks, the filtered set of neighbor nodes within the sub-relationship network is aggregated using the aggregation function of the graph neural network to obtain an intermediate representation vector;

[0039] The intermediate representation vectors corresponding to each of the sub-relationship networks are aggregated to obtain the comprehensive representation vector.

[0040] The comprehensive representation vector is input into the classifier to obtain the probability that the target node is a fraudulent user as predicted by the classifier. The anti-fraud classification model is trained by minimizing a preset loss function based on the real label of the sample user, wherein the real label is any one of the following: the sample user is a fraudulent user or the sample user is a normal user.

[0041] Secondly, embodiments of this application provide a method for identifying fraudulent users based on an anti-fraud classification model, the method comprising:

[0042] Acquire the communication data of the user to be detected;

[0043] A sliding window strategy is used to construct a target intimacy complex network for the communication data of the user to be detected, and a community segmentation algorithm is used to divide the target intimacy complex network to obtain multiple target sub-relationship networks. The target sub-relationship networks include target nodes and neighbor nodes of the target nodes. The target nodes represent the user to be detected, and the neighbor nodes represent other users related to the user to be detected based on the communication data of the user to be detected.

[0044] The multiple target sub-relationship networks are input into the anti-fraud classification model to obtain the predicted probabilities output by the anti-fraud classification model;

[0045] The predicted probability is compared with a preset threshold. If the predicted probability is higher than the preset threshold, the user to be detected is determined to be a fraudulent user.

[0046] If the probability is less than or equal to the preset threshold, the user to be detected is determined to be a normal user.

[0047] Thirdly, embodiments of this application provide a training apparatus for an anti-fraud classification model, the apparatus comprising:

[0048] The first acquisition module is used to acquire the communication data of the sample users, construct the intimacy complex network of the sample users using a sliding window strategy on the communication data, and divide the intimacy complex network using a community segmentation algorithm to obtain multiple sub-relationship networks. Each sub-relationship network includes a target node and the neighbor nodes of the target node. The target node represents the sample user, and the neighbor nodes represent other users related to the sample user as determined based on the communication data.

[0049] The first execution module is used to generate a guiding node corresponding to each target node in each of the sub-relationship networks based on a global contrastive learning method.

[0050] Based on the guiding node, the neighbor nodes in the sub-relation network are selected through an adversarial agent fusion learning strategy to obtain a filtered set of neighbor nodes.

[0051] The node information of the filtered set of neighboring nodes is aggregated by a graph neural network to obtain the comprehensive representation vector of the target node; the comprehensive representation vector is input into a preset classifier to train the anti-fraud classification model to obtain the anti-fraud classification model, wherein the anti-fraud classification model is composed of the graph neural network and the classifier.

[0052] Fourthly, embodiments of this application provide a fraudulent user identification device based on an anti-fraud classification model, the device comprising:

[0053] The second acquisition module is used to acquire the communication data of the user to be detected;

[0054] The second execution module is used to construct a target intimacy complex network of the user to be detected using a sliding window strategy based on the communication data of the user to be detected, and to divide the target intimacy complex network using a community segmentation algorithm to obtain multiple target sub-relationship networks; wherein, the target sub-relationship network includes target nodes and neighbor nodes of the target nodes, the target nodes represent the user to be detected, and the neighbor nodes represent other users related to the user to be detected as determined based on the communication data of the user to be detected;

[0055] The multiple target sub-relationship networks are input into the anti-fraud classification model to obtain the predicted probabilities output by the anti-fraud classification model;

[0056] The predicted probability is compared with a preset threshold. If the predicted probability is higher than the preset threshold, the user to be detected is determined to be a fraudulent user.

[0057] If the probability is less than or equal to the preset threshold, the user to be detected is determined to be a normal user.

[0058] Fifthly, embodiments of this application provide a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the steps of the training method for the anti-fraud classification model as described in the first aspect, or, when the program is executed by the processor, it implements the steps of the fraud user identification method based on the anti-fraud classification model as described in the second aspect.

[0059] In a sixth aspect, embodiments of this application provide a computer-readable storage medium storing a computer program, wherein when the computer program is executed by the processor, it implements the steps of the training method for the anti-fraud classification model as described in the first aspect, or, when the program is executed by the processor, it implements the steps of the fraud user identification method based on the anti-fraud classification model as described in the second aspect.

[0060] In a seventh aspect, embodiments of this application provide a computer program product, including computer instructions, which, when executed by the processor, implement the steps of a training method for an anti-fraud classification model as described in the first aspect, or, when executed by the processor, implement the steps of a fraudulent user identification method based on an anti-fraud classification model as described in the second aspect.

[0061] In this embodiment, the original communication data is processed using a sliding window strategy and a community segmentation algorithm to construct a sub-relationship network that more accurately reflects the user's core social circle, laying a high-quality data foundation for subsequent analysis. Next, for each target node in the sub-relationship network, a global contrastive learning method is used to generate a guiding node. This guiding node encapsulates global information, providing a robust benchmark for measuring the importance of neighboring nodes. Subsequently, through an adversarial agent fusion learning strategy, using the guiding node as an anchor, the most relevant and information-rich neighboring nodes are intelligently selected, effectively filtering out noise interference in the complex relationship network and highlighting key features. Based on this, a graph neural network is used to aggregate information from the selected set of high-quality neighboring nodes, generating a high-quality comprehensive representation vector that comprehensively and deeply characterizes user behavior patterns. Finally, this vector is input into a classifier for training, enabling the entire model to make accurate decisions based on the purified, strongly correlated features.

[0062] In summary, by constructing a pure subnetwork, generating a global guiding node, adversarially filtering key neighbors, and employing a coherent model training mechanism that deeply aggregates information, the accuracy and robustness of the anti-fraud model in detecting hidden fraudulent behavior in complex social relationships are significantly improved. Attached Figure Description

[0063] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0064] Figure 1 A flowchart illustrating a training method for an anti-fraud classification model provided in this application embodiment;

[0065] Figure 2 A flowchart illustrating a fraudulent user identification method based on an anti-fraud classification model, provided for embodiments of this application;

[0066] Figure 3 This application provides a schematic diagram of a sliding window in an embodiment.

[0067] Figure 4 A schematic diagram of a table of node attribute features provided in an embodiment of this application;

[0068] Figure 5 A schematic diagram of a complex user intimacy network provided in an embodiment of this application;

[0069] Figure 6 This is a schematic diagram illustrating inconsistent communication data when a fraudulent user is faking their behavior, as provided in an embodiment of this application.

[0070] Figure 7 This is a schematic diagram illustrating the insertion of a guide node to assist in the selection of neighboring nodes, as provided in an embodiment of this application.

[0071] Figure 8 This is a schematic diagram illustrating the community merging and partitioning of discrete nodes according to an embodiment of this application;

[0072] Figure 9 This is a schematic diagram illustrating the insertion of a guide node in a relational subnetwork (community) as provided in an embodiment of this application.

[0073] Figure 10 This is a schematic diagram illustrating the neighbor node value evaluation and selection under an agent reinforcement learning framework provided in an embodiment of this application.

[0074] Figure 11 A schematic diagram of a state sub-diagram provided in an embodiment of this application;

[0075] Figure 12 A structural block diagram of a training device for an anti-fraud classification model provided in an embodiment of this application;

[0076] Figure 13A structural block diagram of a fraud user identification device based on an anti-fraud classification model provided in this application embodiment;

[0077] Figure 14 This is a structural block diagram of a network device provided in an embodiment of this application. Detailed Implementation

[0078] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0079] Figure 1 This paper illustrates a training method for an anti-fraud classification model according to an embodiment of this application, such as... Figure 1 As shown, the method includes:

[0080] Step S101: Obtain the communication data of the sample users, construct the intimacy complex network of the sample users using the sliding window strategy, and divide the intimacy complex network using the community segmentation algorithm to obtain multiple sub-relationship networks.

[0081] Each sub-relationship network includes a target node and its neighboring nodes. The target node represents the sample user, and the neighboring nodes represent the other users related to the sample user, as determined by communication data.

[0082] Step S102: For each target node in the sub-relation network, generate a guiding node corresponding to the target node based on the global contrastive learning method;

[0083] Step S103: Based on the guiding node, select neighbor nodes in the sub-relation network through the adversarial agent fusion learning strategy to obtain the filtered neighbor node set.

[0084] Step S104: Aggregate node information of the filtered neighbor node set through graph neural network to obtain the comprehensive representation vector of the target node; input the comprehensive representation vector into the preset classifier to train the anti-fraud classification model to be trained, and obtain the anti-fraud classification model.

[0085] The anti-fraud classification model consists of a graph neural network and a classifier.

[0086] The communication data includes any of the following: package subscription information and communication behavior; package subscription information and trajectory information; package subscription information, communication behavior and trajectory information.

[0087] It should be noted that this application provides a training method for an anti-fraud classification model, the core of which lies in constructing a high-performance fraud user identification model through a multi-level, refined graph structure learning process. The method begins by acquiring the communication data of sample users (such as package subscription information, communication behavior, and trajectory information), and firstly uses a sliding window strategy to dynamically construct a complex network that reflects the changes in user intimacy over time; then, a community segmentation algorithm is used to divide this macroscopic complex network into multiple internally connected sub-relationship networks. Each sub-relationship network contains a target node representing the sample user and its related neighbor nodes, which is equivalent to dividing the user's overall social circle into several communities with specific meanings.

[0088] Subsequently, for each target node in the sub-relationship network, a guide node generated based on a global contrastive learning method is introduced. This guide node is not a real user, but a virtual node learned through the model, embodying common characteristics of both fraudulent and legitimate users, serving as a high-level reference for evaluating the importance of neighboring nodes. Building upon this, an adversarial agent fusion learning strategy is employed. Using the guide node as a benchmark, a reinforcement learning agent intelligently identifies and selects the neighboring nodes most informative for identifying the fraudulent attributes of the target node, thus filtering out irrelevant or interfering social connections and forming a purified set of neighboring nodes. Then, a graph neural network performs deep information aggregation on this filtered high-quality set of neighboring nodes to extract a comprehensive representation vector of the target node. This vector more accurately characterizes the user's behavioral patterns within their core social environment. Finally, this comprehensive representation vector is input into a classifier for training, resulting in an anti-fraud classification model composed of a graph neural network and a classifier.

[0089] In a specific application scenario, suppose a telecommunications company needs to identify potential fraudulent numbers. When applying this method, the first step is to collect historical data of a suspected number (sample user), including call records, SMS exchanges, shared data plans, and location trajectories. Through sliding window analysis, it is found that this number frequently calls, shares data plans, and exhibits highly overlapping activity patterns with numbers A, B, and C across multiple time periods. This constructs a complex proximity network with the suspected number as the target node and A, B, and C as neighboring nodes. Community segmentation algorithms may further reveal that this network contains two sub-networks: one is a tightly knit group consisting of the target node and A and B (e.g., a fraud ring), and the other is a relatively loose connection between the target node and C (C might just be an ordinary customer). Subsequently, the model generates a leading node representing a "typical fraudulent behavior pattern" for the suspected number. Next, the adversarial AI evaluates the three neighbors A, B, and C. It may find that A and B, which are highly similar to the leading node's pattern, are crucial for identifying fraud, while C, which differs significantly from the leading node, may be noise. Therefore, it intelligently selects to retain A and B, forming a filtered set of neighboring nodes. The graph neural network then focuses on aggregating information from A and B to generate a comprehensive representation vector that strongly suggests the number is involved in a fraud ring, enabling the classifier to accurately identify it as a fraudulent user with a high probability.

[0090] Therefore, this training method effectively extracts stable and discriminative feature representations from complex and noisy communication data through a coherent technical chain of constructing a temporal affinity network, dividing communities, generating global guiding nodes, adversarially selecting key neighbors, and aggregating graph neural networks. This significantly improves the accuracy and robustness of the final anti-fraud classification model in the task of identifying fraudulent users.

[0091] In one possible implementation, communication data of sample users is acquired, and a sliding window strategy is used to construct a complex network of intimacy among the sample users. This includes: collecting communication data of sample users; constructing a composite information matrix with package subscription information as the main object based on the communication data; initializing a time-series observation window and sliding the time-series observation window on the composite information matrix; calculating the correlation coefficient between the sample user and each other user within each time-series observation window, where the correlation coefficient includes any of the following: package sharing correlation coefficient and communication correlation coefficient; package sharing correlation coefficient and behavioral trajectory similarity; package sharing correlation coefficient, communication correlation coefficient, and behavioral trajectory similarity; determining the composite correlation coefficient between the sample user and each other user within each time-series observation window based on the correlation coefficient, and determining the average composite correlation coefficient between the sample user and each other user within all time-series observation windows; constructing an intimacy complex network with the sample user as the target node, the other users as neighbor nodes, and the average composite correlation coefficient between the sample user and the other users as the edge connecting the target node and the other users.

[0092] It should be noted that this implementation details how to construct a complex affinity network from raw communication data for subsequent analysis. Its core lies in accurately quantifying the strength of the association between users through a method that integrates temporal and multi-dimensional aspects.

[0093] The method begins by collecting communication data from sample users and constructing a composite information matrix with subscription information as the primary dimension. This matrix integrates various aspects of user behavior data. Subsequently, a time-series observation window is initialized and slid across this composite information matrix. This strategy aims to capture the dynamic evolution of user relationships over time, rather than performing a static, one-off snapshot analysis. Within each sliding time-series observation window, multi-dimensional correlation coefficients can be calculated between the sample user and each of the other users. These correlation coefficients may include one or more combinations of subscription sharing correlation coefficients, communication correlation coefficients, and behavioral trajectory similarity, thereby comprehensively evaluating the intimacy between users from multiple perspectives such as business binding, communication tightness, and physical space intersection.

[0094] Based on these multi-dimensional correlation coefficients, a composite correlation coefficient representing the overall correlation strength within the current time-series observation window can be further calculated. After completing the sliding calculation for all time-series observation windows, an average composite correlation coefficient is obtained by averaging the composite correlation coefficients between the sample user and a specific remaining user within all windows. This average effectively smooths out short-term fluctuations and reflects the stable and long-term average correlation strength between the two. Finally, using the sample user as the target node and the remaining users as neighbor nodes, and using the calculated average composite correlation coefficient as the weight of the edge connecting these two nodes, a weighted, undirected proximity complex network is constructed.

[0095] In a specific application scenario, suppose we analyze a suspected fraudulent number (sample user). Traditional methods might only look at the total number of calls. However, the method shown in this application sets a time-series observation window (e.g., one window per week) and performs sliding analysis over eight consecutive weeks. In one week, it is found that this number has frequent calls with number A (high communication correlation coefficient) and shares a family plan (high plan sharing correlation coefficient), but their location trajectories are completely different (low behavioral trajectory similarity). In the following weeks, the calls may decrease, but the plan sharing relationship remains. By calculating the composite correlation coefficient for each window and finally taking the average over eight weeks, the resulting average composite correlation coefficient can stably reflect a strong association between this number and number A based on plan binding, rather than just fluctuating call connections. This average value becomes the final weight of the edge connecting these two nodes, and the network constructed in this way can better reveal the essential social relationship.

[0096] Therefore, through time-sliding multi-dimensional association analysis, the original and fragmented communication records are transformed into a structured network graph with solid data foundation and clear business significance for edge weights. This network not only records who users are associated with, but also accurately characterizes the strength and stability of the associations, providing a high-quality and robust data foundation for subsequent community division and in-depth analysis.

[0097] In one possible implementation, the communication correlation coefficient is determined by the frequency and duration of calls between the sample user and the other users; the behavioral trajectory similarity is determined by the positional correlation between the sample user and the other users at the same point in time within the time series observation window.

[0098] It should be noted that this implementation specifically defines the calculation basis for the correlation coefficients of two key dimensions in the process of constructing a complex intimacy network, thus providing a quantifiable and solid foundation for deriving the composite correlation coefficient. The determination of the communication correlation coefficient directly depends on the objective communication behavior records between the sample users and other users, namely the two core indicators of call frequency and call duration. Call frequency reflects the frequency of communication between the two parties, while call duration describes the depth of each communication. The synergistic effect of the two can comprehensively quantify the intimacy shown between users through communication channels.

[0099] Determining behavioral trajectory similarity relies on a more spatiotemporally fine-grained analysis. This is achieved by examining the correlation between the location coordinates of sample users and other users within the same time-series observation window at the same point in time. This method emphasizes the temporal synchronicity and spatial overlap of the behaviors of both parties (e.g., shopping together at the same time). For example, it determines whether two individuals frequently appear in the same or nearby locations at the same time, thereby inferring potential connections in their offline activities. Combining communication correlation coefficients with behavioral trajectory similarity expands the measurement of relationships between users beyond a single communication level to include the similarity of offline physical space behaviors. This multi-perspective fusion provides a more comprehensive and realistic reflection of the strength and patterns of potential social relationships between users.

[0100] Therefore, by clarifying the specific calculation source of communication correlation coefficient and behavioral trajectory similarity, it is ensured that the subsequently calculated composite correlation coefficient and even the final constructed intimacy complex network have clear behavioral data support and good interpretability, effectively improving the accuracy and reliability of relationship quantification.

[0101] In one possible implementation, the intimacy complex network is partitioned using a community segmentation algorithm to obtain multiple sub-relationship networks. This includes: partitioning the intimacy complex network using a community segmentation algorithm to obtain multiple initial sub-relationship networks, determining the remaining discrete nodes after partitioning, calculating the average attribute similarity between the discrete nodes and all nodes in each initial sub-relationship network, and assigning the discrete nodes to the initial sub-relationship network with the largest average attribute similarity to form multiple sub-relationship networks.

[0102] It should be noted that this implementation specifically illustrates how, after obtaining the intimacy complex network, a community segmentation algorithm combined with subsequent optimization processing is used to form multiple high-quality sub-relationship networks. Specifically: First, a community segmentation algorithm is used to initially partition the overall intimacy complex network. This algorithm can automatically classify a large-scale network into several tightly connected communities based on the tightness of the connections between nodes, thus obtaining multiple initial sub-relationship networks. However, in practice, classic community segmentation algorithms often leave some discrete nodes that fail to be assigned to any community. These discrete nodes become a challenge in network partitioning due to their relatively sparse connections.

[0103] To address this issue, the method described in this application does not simply discard these discrete nodes. Instead, it designs a refined attribution allocation strategy: First, it calculates the average attribute similarity between each discrete node and all nodes within each formed initial sub-relationship network. This average reflects the degree of conformity between the discrete node and the overall properties of a specific sub-relationship network. Then, by comparing these calculated average attribute similarities, the discrete node is finally assigned to the initial sub-relationship network with the highest average attribute similarity. This approach ensures that even nodes marginalized in the initial partitioning can find the most suitable community affiliation based on their attribute characteristics.

[0104] Therefore, based on the macroscopic network structure obtained by using the community segmentation algorithm, the integrity and rationality of the network partitioning are significantly improved by the discrete node redistribution mechanism based on the mean of attribute similarity. This effectively reduces information fragmentation caused by the limitations of the algorithm, making each sub-relationship network formed in the end not only tightly connected but also with more consistent node attributes.

[0105] In one possible implementation, for each target node in a sub-relation network, generating a guide node corresponding to the target node based on a global contrastive learning method includes: inputting the target node and its sub-relation network into a preset graph neural network encoder to obtain the representation vector of the sub-relation network output by the graph neural network encoder; inputting the representation vector into a preset multilayer perceptron to obtain the attribute vector of the guide node output by the multilayer perceptron; and obtaining the guide node based on the attribute vector. During the training phase of the graph neural network encoder and the multilayer perceptron, the parameters of the graph neural network encoder and the multilayer perceptron are optimized using a global contrastive learning method to increase the similarity between the attribute vector of the guide node and positive samples, and to increase the difference between the attribute vector of the guide node and negative samples. Positive samples are composed of the mean of the attribute vectors of guide nodes corresponding to nodes belonging to the same fraud category as the target node in the current training batch, and the mean of the attribute vectors of the nodes belonging to the same fraud category as the target node themselves. Negative samples are composed of the mean of the attribute vectors of guide nodes corresponding to nodes belonging to the same normal category as the target node in the current training batch, and the mean of the attribute vectors of the nodes belonging to the same normal category as the target node themselves.

[0106] It should be noted that this implementation details the specific process and core training mechanism for generating the corresponding guide node for the target node in the sub-relation network. Specifically: First, the target node and its entire sub-relation network are taken as input and passed to a pre-defined graph neural network encoder. This encoder can comprehensively learn the network structure and node attributes and output a representation vector that represents the overall characteristics of the sub-relation network. Then, this representation vector is input to a pre-defined multilayer perceptron for nonlinear transformation. Finally, the multilayer perceptron outputs a vector with specific attributes, namely the attribute vector of the guide node, and the guide node is constructed based on this attribute vector.

[0107] The key to this generation process lies in the training and optimization of the graph neural network encoder and multilayer perceptron parameters. The training phase employs a global contrastive learning approach. The optimization goal is to continuously increase the similarity between the attribute vector of the guide node generated for the current target node and a feature center represented by a positive sample, while simultaneously increasing the difference between it and a feature center represented by a negative sample. The positive sample is not constructed as a single sample, but rather by fusing the average of the attribute vectors of the guide nodes corresponding to all nodes in the same fraud category as the target node in the current training batch, as well as the average of the attribute vectors of these fraud-category nodes themselves. This allows the positive sample to aggregate global fraud-related common information. Correspondingly, the negative sample is constructed in the same way from the relevant information of all normal category nodes in the current batch, serving as the opposite of fraud features. Through this unique contrastive learning mechanism, the generated guide node no longer merely reflects the characteristics of its local sub-relationship network, but is endowed with a global, categorical perspective, thus becoming a powerful reference benchmark that can guide the model to identify fraudulent behavior.

[0108] Therefore, the guide node generated by the global comparative learning strategy effectively injects global fraud and normal pattern knowledge into the analysis of each local sub-relation network, enabling this virtual guide node to serve as an intelligent and information-rich "anchor point," providing crucial discrimination criteria for the subsequent accurate selection of key neighbor nodes.

[0109] In one possible implementation, based on a guiding node, a set of neighboring nodes within a sub-relationship network is selected using an adversarial agent fusion learning strategy. This involves: constructing a state subgraph for each neighboring node of the target node, including the target node, neighboring nodes, and the guiding node; inputting the state subgraph into a pre-defined value evaluation module to obtain the value score of the neighboring nodes for identifying whether the target node is a fraudulent user; inputting the state subgraph as the current state observed by a pre-defined reinforcement learning agent into the reinforcement learning agent to obtain the selection result output by the reinforcement learning agent, where the selection result is either selecting the neighboring node corresponding to the state subgraph or not selecting the neighboring node corresponding to the state subgraph; and summarizing the selection results for all neighboring nodes within the sub-relationship network to obtain the set of selected neighboring nodes. The reinforcement learning agent, during the training phase, determines a reward value based on the value score, selection result, and baseline in the current training round, and updates its own parameters using the reward value. The baseline is the current average value score of all neighboring nodes within the sub-relationship network in historical training rounds, and the baseline can be dynamically updated according to changes in historical training rounds.

[0110] It should be noted that this implementation specifically illustrates how to leverage a guiding node and an adversarial agent fusion learning strategy to accurately filter neighbor nodes within a sub-relational network. Its core mechanism involves dynamically constructing a state subgraph for each neighbor node of the target node, containing a triple of the target node, that neighbor node, and the previously generated guiding node. Inputting this state subgraph into a preset value evaluation module yields a quantified value score. This score objectively assesses the importance of this neighbor node in the final determination of whether the target node is a fraudulent user.

[0111] Simultaneously, this state subgraph is also considered as the current environment state observed by a pre-defined reinforcement learning agent, and is input into this agent. Based on the analysis of the current state, the reinforcement learning agent outputs a selection result, deciding whether to select or not to include the neighbor node in the final selection set. By traversing all neighbor nodes and performing this process, the results of all selections are summarized to obtain the selected set of neighbor nodes.

[0112] The essence of the entire strategy lies in its adversarial learning mechanism during the training phase: In each training round, the reinforcement learning agent calculates its reward value based on the value score provided by the value assessment module, its own choices, and a dynamically updated baseline, and uses this reward value to update its decision parameters. The baseline is not a fixed value but is dynamically calculated based on the current average value score of all neighboring nodes in previous training rounds. This design allows the reward signal to effectively distinguish between decisions that are better or worse than the historical average. By combining static value assessment with dynamic decision learning, the reinforcement learning agent is trained to learn a strategy that prioritizes neighboring nodes whose value scores contribute more to fraud detection compared to the historical average, while suppressing the selection of nodes whose value contributions are below average.

[0113] Thus, through the adversarial interaction between value assessment and reinforcement learning decision-making, an adaptive and intelligent neighbor node selection process is achieved, which can automatically filter out the most discriminative key connections from complex social relationships that may contain noise, thereby significantly improving the feature quality of subsequent information aggregation steps and the overall discriminative ability of the model.

[0114] In one possible implementation, a graph neural network is used to aggregate node information from the filtered set of neighboring nodes to obtain a comprehensive representation vector of the target node. This comprehensive representation vector is then input into a pre-defined classifier to train an anti-fraud classification model, resulting in the anti-fraud classification model. This includes: within each sub-relational network, aggregating the filtered set of neighboring nodes within the sub-relational network using the aggregation function of the graph neural network to obtain intermediate representation vectors; aggregating the intermediate representation vectors corresponding to each sub-relational network to obtain a comprehensive representation vector; inputting the comprehensive representation vector into the classifier to obtain the probability that the predicted target node is a fraudulent user; and training the anti-fraud classification model by minimizing a pre-defined loss function based on the real labels of the sample users, where the real labels are either: the sample user is a fraudulent user, or the sample user is a normal user.

[0115] It should be noted that this implementation specifically illustrates how to generate a comprehensive representation vector of the target node using the filtered set of neighbor nodes, and complete the final training of the anti-fraud classification model. Specifically: First, operations are performed within each independent sub-relationship network. The aggregation function of the graph neural network aggregates information from the set of high-value neighbor nodes retained after the adversarial agent fusion learning strategy. This step effectively extracts key features from the specific social circles represented by each sub-relationship network, forming intermediate representation vectors. Each intermediate representation vector encodes the local behavioral pattern of the target node in that specific community. Subsequently, the intermediate representation vectors corresponding to all the previously obtained sub-relationship networks are aggregated again. This step fuses the multiple local patterns of the target node in different social circles, ultimately generating a comprehensive representation vector that comprehensively reflects the multifaceted social behavior of the user. At this point, the graph neural network has completed its feature extraction task. The generated comprehensive representation vector is input into a pre-defined classifier (such as a logistic regression or neural network classifier), which outputs a probability value predicting that the target node is a fraudulent user.

[0116] The model is trained based on the known real labels of the sample users (fraudulent users or normal users). The difference between the predicted probability and the real label is minimized by the backpropagation algorithm (i.e., minimizing the preset loss function, such as cross-entropy loss), thereby simultaneously optimizing the parameters of the graph neural network aggregation part and the parameters of the classifier.

[0117] For example, if a user to be detected belongs to both a high-frequency communication "business promotion" circle and a "suspicious gang" circle with abnormal geographical locations, the method shown in the embodiments of this application can learn the user's behavior patterns in these two circles respectively (generating intermediate representation vectors), and then merge these patterns (generating comprehensive representation vectors), so as to more accurately determine whether the user's overall behavior constitutes fraud, rather than relying solely on information from a single dimension.

[0118] Therefore, by combining local sub-network aggregation with global cross-sub-network aggregation, the resulting comprehensive representation vector can simultaneously capture the subtle behavioral features of users in their different social circles as well as the overall behavioral patterns across circles. This provides the classifier with extremely rich and structured feature inputs, significantly enhancing the anti-fraud classification model's ability to distinguish complex fraudulent behaviors and its discrimination accuracy.

[0119] In this embodiment, the original communication data is processed using a sliding window strategy and a community segmentation algorithm to construct a sub-relationship network that more accurately reflects the user's core social circle, laying a high-quality data foundation for subsequent analysis. Next, for each target node in the sub-relationship network, a global contrastive learning method is used to generate a guiding node. This guiding node encapsulates global information, providing a robust benchmark for measuring the importance of neighboring nodes. Subsequently, through an adversarial agent fusion learning strategy, using the guiding node as an anchor, the most relevant and information-rich neighboring nodes are intelligently selected, effectively filtering out noise interference in the complex relationship network and highlighting key features. Based on this, a graph neural network is used to aggregate information from the selected set of high-quality neighboring nodes, generating a high-quality comprehensive representation vector that comprehensively and deeply characterizes user behavior patterns. Finally, this vector is input into a classifier for training, enabling the entire model to make accurate decisions based on the purified, strongly correlated features.

[0120] In summary, by constructing a pure subnetwork, generating a global guiding node, adversarially filtering key neighbors, and employing a coherent model training mechanism that deeply aggregates information, the accuracy and robustness of the anti-fraud model in detecting hidden fraudulent behavior in complex social relationships are significantly improved.

[0121] Figure 2 This application illustrates a method for identifying fraudulent users based on an anti-fraud classification model, as provided in an embodiment of the present application. Figure 2 As shown, the method includes:

[0122] Step S201: Obtain the communication data of the user to be detected;

[0123] Step S202: Construct a target intimacy complex network of the user to be detected using a sliding window strategy based on the communication data of the user to be detected, and divide the target intimacy complex network using a community segmentation algorithm to obtain multiple target sub-relationship networks;

[0124] The target sub-relationship network includes the target node and the target node's neighboring nodes. The target node represents the user to be detected, and the neighboring nodes represent other users related to the user to be detected, determined based on the user's communication data.

[0125] Step S203: Input multiple target sub-relationship networks into the anti-fraud classification model to obtain the predicted probabilities output by the anti-fraud classification model;

[0126] Step S204: Compare the predicted probability with a preset threshold. If the predicted probability is higher than the preset threshold, the user to be detected is determined to be a fraudulent user.

[0127] Step S205: If the probability is less than or equal to a preset threshold, the user to be detected is determined to be a normal user.

[0128] It should be noted that the anti-fraud classification model in the fraud user identification method based on the anti-fraud classification model provided in this application embodiment can be based on... Figure 1 The training is performed using the method shown. Figure 2 The method shown begins by acquiring the communication data of the user to be detected, which serves as the original basis for analysis. Subsequently, the data is processed using a sliding window strategy identical to that used in the model training phase to construct a target intimacy complex network specific to the user to be detected. This network characterizes the strength of its association with other users. Then, a community segmentation algorithm is applied to divide this target intimacy complex network into multiple target sub-relationship networks with tighter internal connections. Each target sub-relationship network contains target nodes representing the user to be detected and their related neighbor nodes.

[0129] Next, these multiple target sub-relationship networks, reflecting different social aspects of the user under test, are fed into the pre-trained anti-fraud classification model. Based on the fraud pattern knowledge learned during training, the model performs deep processing on the input network structure information and ultimately outputs a predicted probability indicating the likelihood that the user under test is a fraudster. To make a final judgment, this predicted probability is compared with a pre-set threshold: if the predicted probability is higher than the threshold, the user under test is determined to be a fraudster; conversely, if the predicted probability is less than or equal to the threshold, the user under test is determined to be a legitimate user.

[0130] For example, in the application scenario of telecommunications operators monitoring fraudulent calls, the application... Figure 2The method shown can automatically collect call, text message, and location data of a suspected number, build its social network, and analyze its behavioral patterns in different circles (such as family circles, work circles, and suspicious high-frequency contact circles). Finally, it gives a risk score. If the score exceeds the threshold, it will automatically trigger an alarm and hand it over to human customer service for further verification and handling.

[0131] Therefore, the ability of the anti-fraud classification model to perform hierarchical analysis and discriminative feature extraction of complex social relationships, learned during the training phase, can be applied to the detection of new users. Through a standardized and automated process, the raw communication data can be transformed into a reliable risk probability value, thereby achieving efficient and accurate automated identification of fraudulent users, which greatly improves the efficiency and accuracy of anti-fraud work.

[0132] From the perspective of specific application scenarios, this application introduces the training method of the anti-fraud classification model shown in the embodiments and the fraud user identification method based on the anti-fraud classification model, and also introduces the specific formulas for implementing the method.

[0133] In general, this application proposes a method for constructing a three-dimensional graph network fraud user identification model (i.e., the aforementioned anti-fraud classification model) oriented towards hidden behavior. The method mainly includes the following steps: 1. From a business perspective, a complex user affinity network is constructed, and users are divided into communities from a network perspective to form sub-relationship networks; 2. A global contrastive learning attribute generation strategy is proposed, which can generate attributes of the guiding node in the relation subgraph of each target node, and then evaluate the value of each neighbor node based on the guiding node; 3. A neighbor selection model oriented towards node representation enhancement and a neighbor node information aggregation strategy are proposed, and finally, the graph neural network fraud model is trained. Specifically, it can be divided into the following steps:

[0134] Step 1: Collect users' package subscription information, communication behavior, and trajectory information, and construct a multi-information composite information matrix; the matrix takes subscription information as the main object, and associates the remaining information below it, with each subscription information being a digit.

[0135] Step Two: For the composite information matrix, a time-series observation window optimization strategy is adopted to extract the communication correlation coefficients, behavioral trajectory similarities, and package sharing correlation information of users within the observation window. A complex user intimacy network is constructed using this composite correlation information, where network nodes represent individual users, and the edges between nodes represent the composite correlation coefficients (Corr) between users, including:

[0136] Step 1: Initialize the timing observation window. Set the initial position of the window to be... The window length is T (in days), and the sliding step size is... (Unit: day), then the first The start and end positions of each time series observation window are:

[0137] and .

[0138] Taking December 2024 as an example, the specific time series observation window sliding is as follows: Figure 3 As shown.

[0139] Step 2: Using the start and end dates of the observation window as indicators, perform Cartesian product matching on all existing online users and calculate the communication correlation coefficient between each matched user within the window. Behavioral trajectory similarity Shared (including) correlation coefficient with package The calculation formula is as follows, taking user A and user B as examples:

[0140] ;

[0141] ;

[0142] ;

[0143] in, To observe the frequency of calls between user A and user B within the observation window, The duration of the call between user A and user I; To divide the observation window into n time points, the positional correlation between user A and user B at the m-th time point is... This represents the distance between user A and user B at the m-th time point. ... The products in the calculation formula specifically refer to three types: "Family Network", "Family Network", and "Primary and Secondary Cards".

[0144] Step 3: Based on communication correlation coefficient Behavioral trajectory similarity Shared (including) correlation coefficient with package Calculate the composite correlation coefficient on each time series observation window, and finally combine and average the multiple time series observation windows to draw the final user intimacy complex network.

[0145] ;

[0146] in and These are time series observation windows. The weighted coefficients of communication correlation coefficient and behavioral trajectory similarity are given by K, where K is the number of time series observation windows.

[0147] ;

[0148] The composite correlation coefficient between users, with users as nodes. To establish connections, construct a complex network of combined intimacy among users. The larger the value, the thicker the edge and the closer the node association.

[0149] Step 4: Construct a node attribute index system for the complex network and perform positive and negative sample labeling on the nodes to support the subsequent construction of the graph neural network model. The node attribute index system is constructed from the perspectives of basic attributes, communication characteristics, consumption information, and stop / resume information, etc., for use in the subsequent graph neural network model construction. The specific index system is as follows: Figure 4 As shown.

[0150] For example, assuming the actual fraudulent phone numbers in a month are the actual positive fraud samples, and assuming there are a total of 156 positive sample users, with the rest being negative samples, node labeling is performed on the affinity complex network to support the subsequent construction of the graph neural network, as shown in the diagram below. Red nodes represent fraudulent user nodes, and black nodes represent normal user nodes. Figure 5 As shown.

[0151] Step 3: Based on the constructed user intimacy complex network, to address the data inconsistency problem (behavior concealment), the idea of ​​"guide nodes" in sub-relationship networks is proposed. This involves generating appropriate "guide nodes" for each sub-relationship network of the user intimacy complex network to guide subsequent nodes to converge and aggregate quickly; behavior masquerading (data inconsistency, such as...) Figure 6 As shown, and Figure 6 (The left part represents structural inconsistencies, the middle part represents feature inconsistencies, and the right part is an explanation.) Inconsistencies are prevalent in various fraudulent activities. For example, in financial transactions, accounts involved in money laundering often disguise themselves by diversifying, obfuscating, or creating fake transactions to reduce suspicion. In e-commerce platforms, fraudulent users attempt to mimic the language style and vocabulary choices of genuine users to make their reviews appear more authentic and avoid arousing suspicion. Therefore, effectively addressing the poor efficiency of fraudulent user identification caused by data inconsistency is a key aspect of the method shown in this application's embodiments. Data inconsistency problems can be specifically divided into two categories: one is structural inconsistency caused by relationship spoofing, and the other is feature inconsistency caused by feature spoofing. The specific differences are illustrated in the diagram below. Because the relationships and features of some fraudulent users are extremely similar to those of normal users, the target node... Misjudgments may occur when identifying target node categories based on neighboring nodes.

[0152] The method described in this application starts from a global perspective, first splitting the entire complex network into sub-relationship hierarchies. When identifying target node categories, a neighbor selection "guide node" is inserted into the sub-relationship network based on a self-developed contrastive learning attribute generation model, and this "guide node" is used to select subsequent neighbor nodes. Specifically, as follows... Figure 7 As shown.

[0153] The steps for inserting a neighbor and selecting a "guide node" in a sub-relational network based on a contrastive learning generative model are as follows:

[0154] Step 1: From the perspective of complex networks, the edge removal strategy in the community partitioning method is used to partition the user affinity complex network generated in Step 1 into network communities, resulting in several sub-level networks. During community partitioning, the community splitting coefficient before and after each step is calculated. To evaluate the effectiveness of community partitioning, the community splitting coefficient after iterative partitioning is used. If the value is higher than before the iteration, it indicates that the partition is a positive partition and should be adopted; otherwise, the further partitioning process should be stopped.

[0155] The formula for calculating the club split coefficient is as follows:

[0156] ;

[0157] ;

[0158] in Representation Nodes and nodes The weight values ​​of the edges connecting them. Represents nodes The sum of the weights of connected edges. This represents the number of edges in a node of the network.

[0159] Step 2: For individual scattered nodes that cannot be classified into a community, iterate through and calculate the average attribute similarity between the discrete node and all nodes in the communities to which the discrete node belongs. Then, reclassify the discrete node into the community with the highest average attribute similarity. For example... Figure 8 As shown (and Figure 8 The left part represents the discrete nodes before they were assigned to communities. Figure 8 The right side represents the discrete nodes after they are assigned to communities.

[0160] The formula for calculating the mean attribute similarity between discrete nodes and communities is as follows:

[0161] ;

[0162] For the discrete node Individual attribute characteristics, such as "the percentage of calls that were immediately disconnected in the current month" or "network duration", etc. Let P represent the nth attribute of the i-th node within the community, where P is the total number of network nodes within the community. and To adjust the parameters, and 1.

[0163] Step 3 proposes a contrastive learning attribute generation model, which can learn the pattern distribution differences of various relation subgraphs (communities) under different labels at the scale of global data, and then insert the neighbor nodes "guide nodes" of the target node to be identified into the relation subgraph (community), such as... Figure 9 As shown.

[0164] The core of the contrastive learning attribute generation model is the graph neural network algorithm. Let's assume the current relationship subgraph (community) is... The target node is Then the embedding of the guiding node Represented as:

[0165] ;

[0166] in Indicates the first The feature vector output by the layer, (aggregation) aggregation The characteristics of the neighboring nodes, (Update) Update nodes using aggregated information. Vector representation, and Initialized from the input node features. The attribute generation module obtains the attributes of the guiding node through a multilayer perceptron. , Consider as target node In relational subgraph The behavioral patterns are reflected in the following calculation method:

[0167] ;

[0168] In the process of training the contrastive learning attribute generation model, the method shown in the embodiments of this application increases the generated attributes. Compared with positive samples The similarity between them increases the generated attributes. With negative samples The main purpose is to identify the differences between them, thereby improving the classification effect of the fraud user identification detector in subsequent work.

[0169] Relationship subgraph (communities) Learning positive samples by comparing the attributes of the lower guide node It is expressed as follows:

[0170] ;

[0171] ;

[0172] ;

[0173] in As a weighting factor, It is with nodes Other nodes with the same label in the relationship The average value of the attributes of the guiding nodes generated from the relationship subgraph below. For the node set of the current training batch, yes Average original features, and Corresponding nodes The attribute characteristics and tag values.

[0174] Negative samples for comparative learning of node attributes under relation r Defined as:

[0175] ;

[0176] ;

[0177] ;

[0178] To measure generated attributes The method described in this application calculates the similarity score between nodes based on the following formula, which is as follows: (The similarity score is calculated based on the similarity between nodes and both positive and negative samples.)

[0179] ;

[0180] ;

[0181] To reduce the similarity between the guiding node attributes and negative samples, while maximizing its similarity with positive samples, the method described in this application proposes an improved binary classification cross-entropy loss function, the calculation formula of which is as follows:

[0182] ;

[0183] in, n is the batch size. It contains 2n elements.

[0184] Step 4: Based on the guiding node inserted for the target node under the relational subgraph (community), construct an adversarial agent fusion learning method, evaluate the value of the target node's neighbor nodes, and selectively select several neighbor nodes for information aggregation, such as... Figure 10 As shown.

[0185] The framework for neighbor node value evaluation and selection under the adversarial agent fusion learning approach is shown above. Figure 7 As shown. It mainly includes the following two parts:

[0186] 1. Neighbor node value assessment

[0187] The method described in this application provides a value assessment module. Define the target node. In relation The set of neighboring nodes is For any neighboring node ,Will Except Other neighboring nodes are hidden, forming a state subgraph. ,like Figure 11 As shown, where These are the edges connecting the nodes, as shown in Figure 1.

[0188] Assuming the graph neural network fraud detection model's first... Layer to neighbor nodes Perform value assessment using state subgraphs. Each node in the first The layer representation is used as input, and then processed in the graph neural network model. The aggregator within the layer calculates the representation of the bootstrap node. Use the value assessment module according to Calculate and obtain the predicted label value That is, neighboring nodes The value, specifically the value assessment module The detailed calculation formula is explained below:

[0189] set up For the first In a layered network, the internal aggregator of relationships involves neighboring nodes. value The calculation formula is:

[0190] ;

[0191] Use the target node tags Value evaluator The training process uses a loss function defined as follows:

[0192] ;

[0193] 2. Neighbor selection strategy based on adversarial agent fusion learning

[0194] state space Since the neighbor selection strategy proposed in the method of this application embodiment is expanded based on the guiding node, the method of this application embodiment defines a state subgraph. The state observed by each agent The sub-relationship network contains only the target node. Guide node and neighboring nodes .

[0195] Action space The purpose of a reinforcement learning policy network is to determine whether to select a neighboring node; therefore, the action space is defined as follows: If and only if the state hour, This indicates that the neighboring node is selected for information aggregation and that node is included. Add to collection , This indicates that the neighboring node should be discarded and no information aggregation should be performed.

[0196] reward function Based on the node value assessment strategy above, the relative value of neighboring nodes to the bootstrap node can be calculated. value Throughout the training process, the value assessment module The parameters of a graph neural network model will continuously change, therefore, with each training epoch... Iteration, The scope will also change. The reward function is defined in the method shown in this embodiment as follows:

[0197] ;

[0198] in, It is a relationship from previous training rounds The average value of all neighboring nodes, as the training rounds iterate. It will gradually increase. If and only if This means that the action is a positive action, and the parameters of the policy network will evolve in the direction of increasing the probability of the action occurring. The size of the reward determines the extent of the policy network optimization. It is a tolerance threshold, when the value of neighboring nodes... If the difference between the two values ​​is within the tolerance threshold, then the action will continue to be rewarded.

[0199] Step 5: Based on the neighbor nodes selected in the previous step, aggregate node information based on the multi-dimensional attribute features of the nodes and train the final anti-fraud model.

[0200] Assuming the neighbor selection strategy is applied, The set of selected neighbor nodes of the layer is , where nodes In relation The next In a layered network, the aggregation of information for target nodes involves the following steps:

[0201] Step 1: Based on the selected set of neighbor nodes, aggregate information about neighbor nodes within each sub-relationship network, and then aggregate information from the selected set of neighbor nodes within each sub-relationship network. Information aggregation is performed, and the calculation formula is as follows:

[0202] ;

[0203] in Representing relations The next The average aggregation function of the layer network, Indicates a connection operation. For activation function, It is a parameter matrix.

[0204] Step 2: Aggregate information across the various sub-relationship networks. The information aggregation logic between each relationship is as follows:

[0205] ;

[0206] in, Characterizing the first Layer network output nodes Vector representation, For the first Layer Relationship Vector representation of internal neighbor information aggregation, through polymerization Post-assembly Obtain Node In the Layer vector representation . The dimension of the parameter matrix depends on the specific... Depending on the aggregation type, The aggregation type can be various types such as averaging, summing, and concatenation. The method shown in the embodiment of this application selects simple average information aggregation.

[0207] Step 3, Model Training and Prediction Output: After completing the neighbor information aggregation, the target node is generated based on the output of the last layer of the graph neural network. vector representation The method described in this application uses an MLP (Multilayer Perceptron) as a classifier and a GNN (Graph Neural Network) to jointly train and predict target nodes. The method described in this application uses the cross-entropy function as the loss function for model optimization. The specific loss function is defined as follows:

[0208] ;

[0209] ;

[0210] Define the overall loss function of the fraud detection model as follows: It is the loss function of the node label prediction model. Combined with the node value assessment loss function, where The weighting coefficients are calculated using the following formula:

[0211] .

[0212] In summary, the measures provided in this application include: constructing a complex user intimacy network based on a sliding window strategy and composite correlation coefficients between users; dividing the complex intimacy network into communities from a network perspective to generate several sub-relationship networks; given that fraudulent users have relatively significant behavioral masquerading characteristics, a global contrastive learning attribute generation strategy is proposed, which can generate attributes of guiding nodes in the relational subgraph of each target node, and then evaluate the value of neighboring nodes based on the guiding nodes; a neighbor selection model oriented towards node representation enhancement is proposed, which uses a reinforcement learning-based neighbor selector to determine whether each neighboring node is aggregated; and an in-graph neural network algorithm is used to summarize, integrate, and identify node information in the network to form an accurate identification of fraudulent users.

[0213] In summary, in this embodiment, by processing the original communication data using a sliding window strategy and a community segmentation algorithm, a sub-relationship network that more accurately reflects a user's core social circle can be constructed, laying a high-quality data foundation for subsequent analysis. Next, for each target node in the sub-relationship network, a global contrastive learning method is used to generate a guiding node. This guiding node encapsulates global information, providing a robust benchmark for measuring the importance of neighboring nodes. Subsequently, through an adversarial agent fusion learning strategy, using the guiding node as an anchor point, the most relevant and information-rich neighboring nodes can be intelligently selected, effectively filtering out noise interference in complex relationship networks and highlighting key features. Based on this, a graph neural network is used to aggregate information from the selected set of high-quality neighboring nodes, generating a high-quality comprehensive representation vector that comprehensively and deeply characterizes user behavior patterns. Finally, this vector is input into a classifier for training, enabling the entire model to make accurate decisions based on the purified strong correlation features.

[0214] In summary, by constructing a pure subnetwork, generating a global guiding node, adversarially filtering key neighbors, and employing a coherent model training mechanism that deeply aggregates information, the accuracy and robustness of the anti-fraud model in detecting hidden fraudulent behavior in complex social relationships are significantly improved.

[0215] Figure 12 A training apparatus for an anti-fraud classification model according to an embodiment of this application is shown, such as... Figure 12 As shown, the device 120 includes:

[0216] The first acquisition module 1201 is used to acquire the communication data of the sample users, construct a complex network of intimacy of the sample users using a sliding window strategy, and divide the complex network of intimacy using a community segmentation algorithm to obtain multiple sub-relationship networks. Each sub-relationship network includes a target node and the target node's neighbor nodes. The target node represents the sample user, and the neighbor nodes represent the other users related to the sample user as determined based on the communication data.

[0217] The first execution module 1202 is used to generate a guide node corresponding to the target node based on a global contrastive learning method for each target node in the sub-relation network.

[0218] Based on the guiding node, the neighbor nodes in the sub-relation network are selected through the adversarial agent fusion learning strategy to obtain the filtered set of neighbor nodes;

[0219] The node information of the filtered set of neighboring nodes is aggregated by a graph neural network to obtain the comprehensive representation vector of the target node. The comprehensive representation vector is then input into a preset classifier to train the anti-fraud classification model to be trained, thereby obtaining the anti-fraud classification model, which consists of a graph neural network and a classifier.

[0220] Figure 13 This application illustrates a fraudulent user identification device based on an anti-fraud classification model, as provided in an embodiment of the present application. Figure 13 As shown, the device 130 includes:

[0221] The second acquisition module 1301 is used to acquire the communication data of the user to be detected;

[0222] The second execution module 1302 is used to construct a target intimacy complex network of the user to be detected using a sliding window strategy based on the communication data of the user to be detected, and to divide the target intimacy complex network using a community segmentation algorithm to obtain multiple target sub-relationship networks; wherein, the target sub-relationship network includes target nodes and neighbor nodes of the target nodes, the target nodes represent the user to be detected, and the neighbor nodes represent other users related to the user to be detected as determined based on the communication data of the user to be detected;

[0223] Multiple target sub-relationship networks are input into the anti-fraud classification model to obtain the predicted probabilities output by the anti-fraud classification model;

[0224] The predicted probability is compared with a preset threshold. If the predicted probability is higher than the preset threshold, the user to be detected is determined to be a fraudulent user.

[0225] If the probability is less than or equal to the preset threshold, the user to be tested is determined to be a normal user.

[0226] In this embodiment, the original communication data is processed using a sliding window strategy and a community segmentation algorithm to construct a sub-relationship network that more accurately reflects the user's core social circle, laying a high-quality data foundation for subsequent analysis. Next, for each target node in the sub-relationship network, a global contrastive learning method is used to generate a guiding node. This guiding node encapsulates global information, providing a robust benchmark for measuring the importance of neighboring nodes. Subsequently, through an adversarial agent fusion learning strategy, using the guiding node as an anchor, the most relevant and information-rich neighboring nodes are intelligently selected, effectively filtering out noise interference in the complex relationship network and highlighting key features. Based on this, a graph neural network is used to aggregate information from the selected set of high-quality neighboring nodes, generating a high-quality comprehensive representation vector that comprehensively and deeply characterizes user behavior patterns. Finally, this vector is input into a classifier for training, enabling the entire model to make accurate decisions based on the purified, strongly correlated features.

[0227] In summary, by constructing a pure subnetwork, generating a global guiding node, adversarially filtering key neighbors, and employing a coherent model training mechanism that deeply aggregates information, the accuracy and robustness of the anti-fraud model in detecting hidden fraudulent behavior in complex social relationships are significantly improved.

[0228] This application provides a network device 140, such as... Figure 14 As shown, the network device 140 includes: a processor 1401, a memory 1402, and a program stored in the memory 1402 and executable on the processor 1401. When the program is executed by the processor 1401, it implements the steps of a training method for an anti-fraud classification model and a fraudulent user identification method as shown in the above embodiment.

[0229] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the steps of the anti-fraud classification model training method and the fraudulent user identification method shown in the above embodiments, and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0230] This application also provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement the steps of the training method for an anti-fraud classification model and the fraud user identification method shown in the above embodiments, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0231] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0232] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0233] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A training method for an anti-fraud classification model, characterized in that, The method includes: The communication data of the sample users is obtained. A sliding window strategy is used to construct a complex intimacy network of the sample users based on the communication data. The complex intimacy network is then divided using a community segmentation algorithm to obtain multiple sub-relationship networks. Each sub-relationship network includes a target node and neighbor nodes of the target node. The target node represents the sample user, and the neighbor nodes represent other users related to the sample user as determined based on the communication data. For each target node in the sub-relationship network, a guiding node corresponding to the target node is generated based on a global contrastive learning method; Based on the guiding node, the neighbor nodes in the sub-relation network are selected through an adversarial agent fusion learning strategy to obtain a filtered set of neighbor nodes. The node information of the filtered set of neighboring nodes is aggregated by a graph neural network to obtain the comprehensive representation vector of the target node; the comprehensive representation vector is input into a preset classifier to train the anti-fraud classification model to obtain the anti-fraud classification model, wherein the anti-fraud classification model is composed of the graph neural network and the classifier.

2. The method according to claim 1, characterized in that, The communication data includes any of the following: Package subscription information and communication behavior; The package order information and tracking information; The package subscription information, the communication behavior, and the trajectory information; Acquire communication data of sample users, and construct a complex affinity network of the sample users using a sliding window strategy on the communication data, including: Collect communication data from the sample users, and construct a composite information matrix with the package subscription information as the main object based on the communication data; Initialize the time-series observation window and slide the time-series observation window on the composite information matrix. Within each time-series observation window, calculate the correlation coefficient between the sample user and each of the other users. The correlation coefficient includes any one of the following: the package sharing correlation coefficient and the communication correlation coefficient; the package sharing correlation coefficient and the behavioral trajectory similarity; or the package sharing correlation coefficient, the communication correlation coefficient, and the behavioral trajectory similarity. Based on the correlation coefficient, the composite correlation coefficient between the sample user and each of the remaining users in each time series observation window is determined, and the average composite correlation coefficient between the sample user and each of the remaining users in all time series observation windows is determined. The proximity complex network is constructed by taking the sample user as the target node, the other users as neighbor nodes, and the average composite correlation coefficient between the sample user and the other users as the edge connecting the target node and the other users.

3. The method according to claim 2, characterized in that, The communication correlation coefficient is determined by the frequency and duration of calls between the sample user and other users; The behavioral trajectory similarity is determined by the positional correlation between the sample user and the other users at the same point in time within the time-series observation window.

4. The method according to claim 1, characterized in that, The complex intimacy network is divided using a community segmentation algorithm to obtain multiple sub-relationship networks, including: The community segmentation algorithm is used to divide the intimacy complex network to obtain multiple initial sub-relationship networks, and the remaining discrete nodes after the division are determined. The mean attribute similarity between the discrete nodes and all nodes in each of the initial sub-relationship networks is calculated. The discrete nodes are assigned to an initial sub-relationship network with the highest mean attribute similarity, thus forming multiple sub-relationship networks.

5. The method according to claim 1, characterized in that, For each target node in the sub-relationship network, generating a guiding node corresponding to the target node based on a global contrastive learning method includes: The target node and the sub-relationship network to which the target node belongs are input into a preset graph neural network encoder to obtain the representation vector of the sub-relationship network output by the graph neural network encoder; The representation vector is input into a preset multilayer perceptron to obtain the attribute vector of the guiding node output by the multilayer perceptron, and the guiding node is obtained based on the attribute vector; During the training phase of the graph neural network encoder and the multilayer perceptron, the global contrastive learning method is used to optimize the parameters of the graph neural network encoder and the multilayer perceptron, so as to increase the similarity between the attribute vector of the guiding node and the positive sample, and increase the difference between it and the negative sample. The positive sample is composed of the mean of the attribute vectors of the guiding nodes corresponding to nodes belonging to the same fraud category as the target node in the current training batch, and the mean of the attribute vectors of the nodes belonging to the same fraud category as the target node themselves. The negative sample is composed of the mean of the attribute vectors of the guiding nodes corresponding to nodes belonging to the same normal category as the target node in the current training batch, and the mean of the attribute vectors of the nodes belonging to the same normal category as the target node themselves.

6. The method according to claim 1, characterized in that, Based on the guiding node, neighbor nodes within the sub-relation network are selected using an adversarial agent fusion learning strategy to obtain a filtered set of neighbor nodes, including: For each neighboring node of the target node, construct a state subgraph containing the target node, the neighboring nodes, and the guiding node; The state subgraph is input into a preset value evaluation module to obtain the value score of the neighbor node for identifying whether the target node is a fraudulent user, as output by the value evaluation module. The state subgraph is used as the current state observed by the preset reinforcement learning agent and input into the reinforcement learning agent to obtain the selection result output by the reinforcement learning agent. The selection result is to select the neighbor node corresponding to the state subgraph or not select the neighbor node corresponding to the state subgraph. Based on the selection results of all neighbor nodes in the sub-relation network, the filtered neighbor node set is obtained. The reinforcement learning agent is used in the current training round during the training phase to determine a reward value based on the value score, the selection result, and the baseline, and to update its own parameters using the reward value. The baseline is the current average value score of all neighbor nodes in the sub-relationship network in the historical training rounds, and the baseline can be dynamically updated according to the changes in the historical training rounds.

7. The method according to any one of claims 1-6, characterized in that, The node information of the filtered neighbor node set is aggregated by a graph neural network to obtain the comprehensive representation vector of the target node. The comprehensive representation vector is input into a preset classifier to train the anti-fraud classification model to obtain the anti-fraud classification model, including: Within each of the sub-relationship networks, the filtered set of neighbor nodes within the sub-relationship network is aggregated using the aggregation function of the graph neural network to obtain an intermediate representation vector; The intermediate representation vectors corresponding to each of the sub-relationship networks are aggregated to obtain the comprehensive representation vector. The comprehensive representation vector is input into the classifier to obtain the probability that the target node is a fraudulent user as predicted by the classifier. The anti-fraud classification model is trained by minimizing a preset loss function based on the real label of the sample user, wherein the real label is any one of the following: the sample user is a fraudulent user or the sample user is a normal user.

8. A method for identifying fraudulent users based on an anti-fraud classification model, characterized in that, The method includes: Acquire the communication data of the user to be detected; A sliding window strategy is used to construct a target intimacy complex network for the communication data of the user to be detected, and a community segmentation algorithm is used to divide the target intimacy complex network to obtain multiple target sub-relationship networks. The target sub-relationship networks include target nodes and neighbor nodes of the target nodes. The target nodes represent the user to be detected, and the neighbor nodes represent other users related to the user to be detected based on the communication data of the user to be detected. The multiple target sub-relationship networks are input into the anti-fraud classification model to obtain the predicted probabilities output by the anti-fraud classification model; The predicted probability is compared with a preset threshold. If the predicted probability is higher than the preset threshold, the user to be detected is determined to be a fraudulent user. If the probability is less than or equal to the preset threshold, the user to be detected is determined to be a normal user.

9. A training device for an anti-fraud classification model, characterized in that, The device includes: The first acquisition module is used to acquire the communication data of the sample users, construct the intimacy complex network of the sample users using a sliding window strategy on the communication data, and divide the intimacy complex network using a community segmentation algorithm to obtain multiple sub-relationship networks. Each sub-relationship network includes a target node and the neighbor nodes of the target node. The target node represents the sample user, and the neighbor nodes represent other users related to the sample user as determined based on the communication data. The first execution module is used to generate a guiding node corresponding to each target node in each of the sub-relationship networks based on a global contrastive learning method. Based on the guiding node, the neighbor nodes in the sub-relation network are selected through an adversarial agent fusion learning strategy to obtain a filtered set of neighbor nodes. The node information of the filtered set of neighboring nodes is aggregated by a graph neural network to obtain the comprehensive representation vector of the target node; the comprehensive representation vector is input into a preset classifier to train the anti-fraud classification model to obtain the anti-fraud classification model, wherein the anti-fraud classification model is composed of the graph neural network and the classifier.

10. A fraudulent user identification device based on an anti-fraud classification model, characterized in that, The device includes: The second acquisition module is used to acquire the communication data of the user to be detected; The second execution module is used to construct a target intimacy complex network of the user to be detected using a sliding window strategy based on the communication data of the user to be detected, and to divide the target intimacy complex network using a community segmentation algorithm to obtain multiple target sub-relationship networks; wherein, the target sub-relationship network includes target nodes and neighbor nodes of the target nodes, the target nodes represent the user to be detected, and the neighbor nodes represent other users related to the user to be detected as determined based on the communication data of the user to be detected; The multiple target sub-relationship networks are input into the anti-fraud classification model to obtain the predicted probabilities output by the anti-fraud classification model; The predicted probability is compared with a preset threshold. If the predicted probability is higher than the preset threshold, the user to be detected is determined to be a fraudulent user. If the probability is less than or equal to the preset threshold, the user to be detected is determined to be a normal user.

11. A network device, characterized in that, include: The processor, the memory, and the program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the program implements the steps of a training method for an anti-fraud classification model as described in any one of claims 1 to 7, or, when the program is executed by the processor, the program implements the steps of a fraud user identification method based on an anti-fraud classification model as described in claim 8.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of a training method for an anti-fraud classification model as described in any one of claims 1 to 7, or, when executed by the processor, implements the steps of a fraudulent user identification method based on an anti-fraud classification model as described in claim 8.

13. A computer program product, characterized in that, The computer instructions, when executed by a processor, implement the steps of a training method for an anti-fraud classification model as described in any one of claims 1 to 7, or, when executed by the processor, implement the steps of a fraudulent user identification method based on an anti-fraud classification model as described in claim 8.

Images