A financial fraud detection method and system based on hypergraph neural network dynamic neighborhood modeling
By constructing multi-dimensional hyperedges and dynamic neighborhood aggregation strategies using hypergraph neural networks, the problems of identifying complex spoofing and class imbalance in fraud detection by graph neural networks are solved, achieving more efficient network fraud detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Chinese People's Liberation Army Cyberspace Force Information Engineering University
- Filing Date
- 2026-04-20
- Publication Date
- 2026-06-23
AI Technical Summary
Existing network fraud detection methods based on graph neural networks struggle to effectively identify complex fraud spoofing techniques and handle class imbalances, resulting in insufficient detection accuracy and robustness.
A dynamic neighborhood modeling method based on hypergraph neural networks is adopted. By constructing multi-dimensional hyperedges to capture high-order relationships, and designing a dynamic neighborhood aggregation strategy guided by anomaly probability, the detection performance is improved by combining dual-view information fusion and joint loss function.
It significantly improves the accuracy and robustness of online fraud detection, effectively identifies complex fraud disguises and mitigates class imbalance problems, thereby enhancing the reliability of detection.
Smart Images
Figure CN122263956A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network fraud and abnormal transaction detection technology, and in particular to a financial fraud detection method and system based on dynamic neighborhood modeling of hypergraph neural networks. Background Technology
[0002] Cyber fraud refers to illegal activities committed by criminals during online social interactions, financial transactions, and other online activities. These activities involve fabricating facts, concealing the truth, or using other improper means to defraud financial institutions or users of their funds or property, harming the interests of the general public and disrupting the normal order of cyberspace. With the continuous expansion of social networks and the rapid development of financial technology, cyber fraud methods are becoming increasingly diversified, complex, and covert, causing significant losses to people's property security. Therefore, developing effective cyber fraud detection methods is of great practical significance. Most existing cyber fraud detection technologies adopt feature engineering and traditional machine learning models, focusing on modeling and classifying user or transaction data features, but neglecting the complex interaction relationships between user accounts.
[0003] With the rapid development of Graph Neural Networks (GNNs), graph-based fraud detection technology has attracted much attention due to its unique advantages. This technology abstracts entities (such as users) into nodes and models interactions between entities (such as transactions) as edges, effectively capturing the correlation information between entities. Compared with traditional feature-driven methods that ignore relationships, this technology is more in line with the essential characteristics of fraudulent behavior: "group-based" and "associative." Its core objective is to accurately distinguish fraudulent entities from legitimate entities in the graph by learning node representations that integrate structural and attribute information.
[0004] However, graph-based fraud detection methods still face two major challenges. First, fraud camouflage techniques are becoming increasingly sophisticated, significantly increasing the difficulty of identification. Fraudsters mainly employ two strategies to evade detection: multi-hop camouflage and structural camouflage. Multi-hop camouflage involves establishing connections with multiple neighbors to form implicit collusion, using indirect associations to hide fraudulent intentions. Structural camouflage involves fraudulent nodes deliberately establishing connections with a large number of normal nodes, integrating into the normal network structure to reduce their suspiciousness, thus causing the neighborhood signal to become mixed. Both of these camouflage strategies blur the feature boundaries between fraudulent and normal nodes, making it difficult for traditional methods to accurately capture fraud clues. Second, the class imbalance problem is extremely prominent. In real fraud graphs, the proportion of fraudulent nodes is extremely low (for example, the fraud rate in the T-Finance dataset is only 4.58%), while the number of benign nodes is extremely large. Detection methods based on ordinary graphs tend to favor the majority class, causing the rare and valuable features of fraudulent nodes to be masked, severely affecting detection performance. Summary of the Invention
[0005] To address the limitations of traditional GNNs in fraud detection, this invention proposes a financial fraud detection method and system based on dynamic neighborhood modeling of hypergraph neural networks. It achieves accurate detection of complex fraud spoofing through two key steps. First, a two-dimensional hypergraph construction mechanism is designed, upgrading traditional binary connections to multi-node collaborative associations from both structural and feature dimensions, thereby comprehensively capturing higher-order relationships in fraud scenarios. Second, an anomaly probability-guided dynamic neighborhood aggregation strategy is proposed. Based on the consistency of node-hypergraph subgraph features, anomaly probabilities are estimated, and higher-order neighborhood information is adaptively grouped and aggregated from both benign and fraudulent perspectives. This not only separates the mixed signals caused by structural spoofing but also strengthens the rare features of a few fraudulent nodes, mitigating the impact of class imbalance.
[0006] To achieve the above objectives, the present invention adopts the following technical solution:
[0007] The first aspect of this invention proposes a financial fraud detection method based on dynamic neighborhood modeling of a hypergraph neural network, comprising:
[0008] Construct a hypergraph of the target network, wherein the hypergraph contains multiple hyperedges, and the hyperedges are generated based at least on the structural dimension information of the network and the feature dimension information of the nodes;
[0009] For a target node in the hypergraph, a local subgraph is obtained through subgraph sampling, and the anomaly probability of the target node is estimated based on the feature comparison between the target node and the local subgraph.
[0010] Based on the anomaly probability, information is aggregated from both benign and fraudulent perspectives for the high-order neighborhood of the target node, and the aggregation results from the two perspectives are fused to generate the final embedded representation of the target node.
[0011] Based on the final embedded representation, it is determined whether the target node is a fraudulent node.
[0012] Furthermore, constructing the hypergraph includes:
[0013] Based on the structural dimension of the network, a first type of hyperedge is generated, which includes at least a 1-hop neighborhood hyperedge that contains the direct neighbors of each node.
[0014] Based on the feature dimension of the network, the feature similarity between nodes is calculated, and a second type of hyperedge is generated based on the feature similarity. The second type of hyperedge associates each node with its k nearest neighbor nodes in the feature space.
[0015] The adjacency matrices corresponding to the first type of hyperedge and the second type of hyperedge are concatenated to form the adjacency matrix of the hypergraph.
[0016] Furthermore, generating hyperedges based on the network's structural dimensions also includes:
[0017] For each node, an n-hop neighborhood hyperedge is constructed, which contains all nodes reachable in n steps, to capture higher-order structural dependencies between nodes; where n is an integer greater than 1.
[0018] Furthermore, estimating the anomaly probability of the target node includes:
[0019] A random walk strategy with restart is adopted, starting from the target node, sampling on the hypergraph to obtain a local subgraph containing the target node and some neighboring nodes;
[0020] The subgraph-level embedding representation of the local subgraph is calculated using a graph neural network, and the original features of the target node are projected into the same feature space as the subgraph-level embedding to obtain the node embedding representation;
[0021] Calculate the similarity between the subgraph-level embedding representation and the node embedding representation, and quantify the anomaly probability of the target node based on the similarity measure.
[0022] Furthermore, when calculating the subgraph-level embedding representation of the local subgraph, the features of the target node in the local subgraph are set to zero to avoid interference from the target node's own features on the overall representation of the subgraph.
[0023] Furthermore, the aggregation of information on the higher-order neighborhood of the target node from both benign and fraudulent perspectives includes:
[0024] Normalize the abnormal probability of neighboring nodes into the benign tendency probability;
[0025] Using the probability of benign tendency as the weight, the features of neighboring nodes in the higher-order neighborhood are weighted and aggregated to obtain benign perspective aggregated features;
[0026] Using the complement of the benign tendency probability as the weight, the features of neighboring nodes in the higher-order neighborhood are weighted and aggregated to obtain the fraud perspective aggregated features.
[0027] The positive perspective aggregation feature is added to the fraudulent perspective aggregation feature to obtain the high-order neighborhood comprehensive embedding of the target node.
[0028] Further, generating the final embedded representation of the target node includes:
[0029] The current layer embedding of the target node is spliced with the higher-order neighborhood comprehensive embedding to achieve the fusion of its own features and aggregated features.
[0030] Furthermore, it also includes:
[0031] A joint loss function is constructed based on the labeled nodes. The joint loss function includes a classification loss (such as weighted cross-entropy loss) to distinguish between benign nodes and fraudulent nodes, and a contrastive loss to enhance the consistency difference between the features of a node and its corresponding subgraph.
[0032] By optimizing the joint loss function, the parameters in the hypergraph construction, anomaly probability estimation, and information aggregation processes are jointly trained.
[0033] A second aspect of this invention proposes a financial fraud detection system based on dynamic neighborhood modeling using a hypergraph neural network, comprising:
[0034] The hypergraph construction module is used to construct the hypergraph of the target network. The hypergraph contains multiple hyperedges, which are generated based at least on the structural dimension information of the network and the feature dimension information of the nodes.
[0035] An anomaly probability estimation module is used to obtain a local subgraph by sampling the subgraph for a target node in the hypergraph, and estimate the anomaly probability of the target node based on the feature comparison between the target node and the local subgraph.
[0036] The dual-dimensional dynamic neighbor aggregation module is used to aggregate information of the high-order neighborhood of the target node from both benign and fraudulent perspectives based on the anomaly probability, and to fuse the aggregation results from the two perspectives to generate the final embedded representation of the target node.
[0037] A fraud detection module is used to identify whether the target node is a fraud node based on the final embedded representation.
[0038] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any of the financial fraud detection methods based on dynamic neighborhood modeling of hypergraph neural networks as described in any one of the claims.
[0039] Compared with the prior art, the present invention has the following beneficial effects:
[0040] By constructing a hypergraph that integrates structural and feature dimensions, the direct neighborhood associations, higher-order reachability associations, and feature space similarity associations of nodes are uniformly represented as hyperedges. This effectively overcomes the limitation of traditional graph structures that can only express pairwise relationships, and can more comprehensively capture the hidden higher-order collusion relationships and feature similarities between fraudulent nodes, providing a richer relational foundation for subsequent detection.
[0041] A subgraph sampling strategy with restarted random walks is employed, combined with a comparative learning mechanism between nodes and subgraphs, to estimate the anomaly probability of target nodes. This approach can quantify the suspiciousness of nodes by utilizing the differences in consistency between nodes and local environmental features without relying on additional labels, providing effective guidance for the subsequent aggregation process.
[0042] This design employs a dual-perspective dynamic high-order neighborhood aggregation mechanism. Based on estimated anomaly probabilities, it weights and aggregates high-order neighborhood information from both benign and fraudulent perspectives, then fuses the dual-perspective aggregation results with the node's own features. This method dynamically adjusts the information contribution weights according to the anomalous tendencies of neighboring nodes, preserving the effective information of normal nodes while enhancing the feature representation of a few fraudulent nodes. This significantly alleviates the identification difficulties caused by extreme class imbalance and deliberate disguise by fraudulent nodes in fraud detection.
[0043] An optimization objective was constructed for joint classification loss and contrastive loss. On the one hand, a weighted strategy was used to increase attention to a few fraud categories. On the other hand, the contrastive loss was used to strengthen the feature patterns of similarity between benign nodes and subgraphs and difference between fraudulent nodes and subgraphs. This enabled the model to synergistically improve classification accuracy and reliability of anomaly representation during training, ultimately improving the accuracy and robustness of network fraud detection. Attached Figure Description
[0044] Figure 1 This is a basic flowchart of a financial fraud detection method based on dynamic neighborhood modeling of a hypergraph neural network according to an embodiment of the present invention;
[0045] Figure 2 This is a schematic diagram of the architecture of a financial fraud detection system based on dynamic neighborhood modeling of a hypergraph neural network according to an embodiment of the present invention;
[0046] Figure 3 This is a schematic diagram illustrating the principle framework of a financial fraud detection method based on dynamic neighborhood modeling of a hypergraph neural network, according to an embodiment of the present invention. Detailed Implementation
[0047] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:
[0048] like Figure 1 As shown, a financial fraud detection method based on dynamic neighborhood modeling using a hypergraph neural network includes:
[0049] Construct a hypergraph of the target network, wherein the hypergraph contains multiple hyperedges, and the hyperedges are generated based at least on the structural dimension information of the network and the feature dimension information of the nodes;
[0050] For a target node in the hypergraph, a local subgraph is obtained through subgraph sampling, and the anomaly probability of the target node is estimated based on the feature comparison between the target node and the local subgraph.
[0051] Based on the anomaly probability, information is aggregated from both benign and fraudulent perspectives for the high-order neighborhood of the target node, and the aggregation results from the two perspectives are fused to generate the final embedded representation of the target node.
[0052] Based on the final embedded representation, it is determined whether the target node is a fraudulent node.
[0053] Furthermore, constructing the hypergraph includes:
[0054] Based on the structural dimension of the network, a first type of hyperedge is generated, which includes at least a 1-hop neighborhood hyperedge that contains the direct neighbors of each node.
[0055] Based on the feature dimension of the network, the feature similarity between nodes is calculated, and a second type of hyperedge is generated based on the feature similarity. The second type of hyperedge associates each node with its k nearest neighbor nodes in the feature space.
[0056] The adjacency matrices corresponding to the first type of hyperedge and the second type of hyperedge are concatenated to form the adjacency matrix of the hypergraph.
[0057] Furthermore, generating hyperedges based on the network's structural dimensions also includes:
[0058] For each node, an n-hop neighborhood hyperedge is constructed, which contains all nodes reachable in n steps, to capture higher-order structural dependencies between nodes; where n is an integer greater than 1.
[0059] Furthermore, estimating the anomaly probability of the target node includes:
[0060] A random walk strategy with restart is adopted, starting from the target node, sampling on the hypergraph to obtain a local subgraph containing the target node and some neighboring nodes;
[0061] The subgraph-level embedding representation of the local subgraph is calculated using a graph neural network, and the original features of the target node are projected into the same feature space as the subgraph-level embedding to obtain the node embedding representation;
[0062] Calculate the similarity between the subgraph-level embedding representation and the node embedding representation, and quantify the anomaly probability of the target node based on the similarity measure.
[0063] Furthermore, when calculating the subgraph-level embedding representation of the local subgraph, the features of the target node in the local subgraph are set to zero to avoid interference from the target node's own features on the overall representation of the subgraph.
[0064] Furthermore, the aggregation of information on the higher-order neighborhood of the target node from both benign and fraudulent perspectives includes:
[0065] Normalize the abnormal probability of neighboring nodes into the benign tendency probability;
[0066] Using the probability of benign tendency as the weight, the features of neighboring nodes in the higher-order neighborhood are weighted and aggregated to obtain benign perspective aggregated features;
[0067] Using the complement of the benign tendency probability as the weight, the features of neighboring nodes in the higher-order neighborhood are weighted and aggregated to obtain the fraud perspective aggregated features.
[0068] The positive perspective aggregation feature is added to the fraudulent perspective aggregation feature to obtain the high-order neighborhood comprehensive embedding of the target node.
[0069] Further, generating the final embedded representation of the target node includes:
[0070] The current layer embedding of the target node is spliced with the higher-order neighborhood comprehensive embedding to achieve the fusion of its own features and aggregated features.
[0071] Furthermore, it also includes:
[0072] A joint loss function is constructed based on labeled nodes. The joint loss function includes a classification loss for distinguishing between benign nodes and fraudulent nodes, and a contrast loss for reinforcing the consistency difference between a node and its corresponding subgraph features.
[0073] By optimizing the joint loss function, the parameters in the hypergraph construction, anomaly probability estimation, and information aggregation processes are jointly trained.
[0074] This invention first designs a two-dimensional hypergraph construction mechanism, upgrading traditional binary connections to multi-node collaborative associations from structural and feature dimensions, thereby comprehensively capturing high-order relationships in fraud scenarios. Second, it proposes a dynamic neighborhood aggregation strategy guided by anomaly probability, estimating anomaly probability based on the consistency of node-hypergraph subgraph features, and adaptively grouping and aggregating high-order neighborhood information from both "benign perspective" and "fraud perspective". This not only separates the mixed signals caused by structural camouflage, but also strengthens the rare features of a few fraudulent nodes, mitigating the impact of class imbalance.
[0075] Based on the above embodiments, such as Figure 2As shown, this invention also proposes a financial fraud detection system based on hypergraph neural network dynamic neighborhood modeling, comprising:
[0076] The hypergraph construction module is used to construct the hypergraph of the target network. The hypergraph contains multiple hyperedges, which are generated based at least on the structural dimension information of the network and the feature dimension information of the nodes.
[0077] An anomaly probability estimation module is used to obtain a local subgraph by sampling the subgraph for a target node in the hypergraph, and estimate the anomaly probability of the target node based on the feature comparison between the target node and the local subgraph.
[0078] The dual-dimensional dynamic neighbor aggregation module is used to aggregate information of the high-order neighborhood of the target node from both benign and fraudulent perspectives based on the anomaly probability, and to fuse the aggregation results from the two perspectives to generate the final embedded representation of the target node.
[0079] A fraud detection module is used to identify whether the target node is a fraud node based on the final embedded representation.
[0080] The present invention also proposes a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements any of the financial fraud detection methods based on dynamic neighborhood modeling of hypergraph neural networks as described in the present invention.
[0081] like Figure 3 As shown in the figure, this embodiment proposes another network fraud detection method based on dynamic neighborhood modeling of hypergraph neural networks. This method consists of the following parts: two-dimensional hypergraph construction, hypergraph subgraph sampling and node anomaly probability estimation, and dynamic high-order neighborhood aggregation.
[0082] The specific implementation steps are as follows:
[0083] Step 1: Construct the hypergraph
[0084] 1) Data preprocessing
[0085] Transaction data is obtained through online trading service platforms. Basic account information includes account opening time, region, account type, transaction behavior characteristics (such as average transaction amount and transaction frequency), and risk score. Transaction information includes transaction time, transaction amount, and transaction type. Numerical features such as transaction amount and timestamp are standardized or normalized; categorical features such as account region and transaction type are represented using one-hot encoding or embedding. The final result is a general graph representation of the transaction data. Here, V is a set of nodes, representing registered accounts on the online trading platform, such as buyer accounts and merchant accounts; H represents an adjacency matrix, containing edges between accounts established based on behaviors such as transfers, payments on behalf of others, and logins from shared devices; X represents node features, including numerical or encoded feature vectors such as account opening time, region, account type, average transaction amount, transaction frequency, risk score, and transaction information (including transaction time, transaction amount, and transaction type); Y represents the node label, used to mark whether an account is a fraudulent account (e.g., 1 indicates a fraudulent account, 0 indicates a legitimate account). It is worth noting that for the training data, the corresponding constructed graph representation of the transaction data... Y is known.
[0086] 2) Construction of hyperedges based on structure
[0087] From a structural perspective, we can capture higher-order structural dependencies between nodes by preserving local information through 1-hop neighborhoods and expanding global associations through n-hop neighborhoods.
[0088] 1-hop neighborhood superedge Preserve the local pairwise relationships of the original graph for each node. The formula for constructing a superedge that includes its direct neighbors is:
[0089]
[0090] in The adjacency matrix of the original graph ( express and (directly connected) for The 1-hop neighborhood set is designed to ensure that the hypergraph does not lose the basic structural information of the traditional graph.
[0091] n-hop neighborhood superedge Extending to global distant neighbors, it captures implicit higher-order associations between nodes (such as the 3-hop collusion of fraudsters). For nodes... Its n-hop neighborhood is defined as all nodes reachable in n steps, and the formula for generating hyperedges is:
[0092]
[0093] in The n-order adjacency matrix of the original graph (calculated by matrix multiplication). express and There exists an n-step path between them.
[0094] 3) Feature-based hyperedge construction
[0095] Starting from the feature dimension, hyperedges are generated based on node feature similarity to capture higher-order information of unstructured associations, such as fraudulent nodes with similar features but no direct connection. Cosine similarity is used to select the k nearest neighbors for each node. The hyperedge generation formula is:
[0096]
[0097] in, For cosine similarity, for The top-k nearest neighbor set in the feature space. In the experiments, k is either 4 (YelpChi) or 5 (Amazon), and is co-optimized with the hypergraph structure dimension parameters.
[0098] 4) Hyperedge merging
[0099] The adjacency matrices corresponding to the three types of hyperedges mentioned above are horizontally concatenated to form the final adjacency matrix of the hypergraph, as shown in the formula:
[0100]
[0101] in , , These are the adjacency matrices of three types of hyperedges, respectively. "" indicates that the matrix is concatenated horizontally, and the final result is... The dimension is , The number of hyperedges represents the number of the three types, and this operation achieves a unified representation of the high-order relationship between structure and features in two dimensions.
[0102] The values of n and k are adjusted according to different data, and the optimal values are obtained through cross-validation.
[0103] Finally, a hypergraph was obtained. .
[0104] Step 2: Node Anomaly Probability Estimation
[0105] 1) Subgraph sampling
[0106] The original graph has a high degree of structural complexity. Directly comparing nodes with the original graph would lead to a sharp increase in computational complexity, loss of local information, feature redundancy, and noise interference. Therefore, we first perform random walk sampling on the graph to obtain subgraphs, and then estimate the anomaly probability of nodes by comparing nodes with subgraphs, thus providing guidance signals for subsequent dynamic aggregation.
[0107] A random walk strategy with restart is adopted for each target node. The sampling process includes subgraphs and involves the following steps:
[0108] a. Initialization: From the target node Departure, a collection of travel routes The restart probability is r=0.5;
[0109] b. Iterative walking: Each step starts from the current node. Randomly select a node from the superedge. Restart with probability r Continue walking with probability 1-r;
[0110] c. When the number of steps reaches k=8, or the number of nodes in the path reaches a preset threshold (e.g., 50 nodes), a subgraph is finally obtained. ,in For the set of nodes in the subgraph, The adjacency matrix of the subgraph. This is the feature matrix of the subgraph.
[0111] 2) Node anomaly probability estimation
[0112] The anomaly probability of a node is calculated by comparing the node with the similarity of the node to its subgraph. The higher the similarity, the more benign the node is; the lower the similarity, the more likely the node is to be fraudulent.
[0113] First, the embedding representation of the subgraph is calculated. A graph convolutional network is used to learn the embedding representation of the hypergraph subgraph. To avoid interference from the target node's own features, its features in the subgraph are set to 0. The calculation formula is as follows:
[0114]
[0115] in, , for The matrix after setting the features of the target nodes to 0; The degree matrix of the subgraph; Let L be the learnable weight matrix of the l-th layer; This is the activation function.
[0116] The output of the last layer This is called a subgraph. The embedding representation matrix, as one possible implementation method, is taken in the embodiments of the present invention. To ensure feature consistency between computed nodes and subgraphs, the subgraph embeddings and target node embeddings need to be aligned to the same space. First, the mean aggregation method is used to transform the subgraph node embeddings into global subgraph embeddings. The formula is as follows:
[0117]
[0118] in, express The j-th row, This indicates the number of nodes in the subgraph. This operation captures the overall characteristics of the subgraph.
[0119] Next, to align the target node with the semantic distribution of the subgraph and make the calculation of feature consistency more physically meaningful, a nonlinear transformation is used to enhance the model's ability to capture complex fraud patterns, thereby improving the accuracy of anomaly probability estimation. This is achieved by utilizing a multilayer perceptron to... The original features are projected onto the same dimension as the subgraph embedding, as shown in the following formula:
[0120]
[0121] in and These represent the weights and biases of the projection layer, respectively. express The original feature vector, This indicates the embedding of nodes after projection.
[0122] Finally, based on subgraph embedding With node embedding Similarity, quantization nodes The anomaly probability is calculated, and the feature differences between benign and fraudulent nodes are reinforced by comparing the loss. First, the anomaly probability is calculated: benign nodes and subgraphs have high consistency in features, while fraudulent nodes have low feature consistency. Based on this, the anomaly probability can be defined as:
[0123]
[0124] in, , A larger value indicates that the node is more likely to be benign, while a smaller value indicates that it is more likely to be fraudulent.
[0125] Step 3: Two-dimensional dynamic neighbor aggregation
[0126] Graph neural networks, based on the assumption of neighbor node similarity, aggregate information from neighbor nodes using an adjacency matrix during training to update the features of the target node, but they neglect local anomaly signals. In fraud detection, class imbalance is widespread, and fraudsters deliberately associate with a large number of normal nodes to reduce their suspiciousness by integrating into normal network structures, making it difficult for traditional methods to accurately capture fraudulent nodes. We design a dynamic neighborhood modeling method that fully considers the probability of a node being benign or fraudulent when aggregating neighbor information. Specifically, when updating the target node... When processing information, the information of its neighboring nodes is aggregated from both benign and fraudulent perspectives, and the aggregation results from the two perspectives are fused to obtain the final embedded representation of the target node.
[0127] Before aggregation, neighboring nodes need to be... abnormal probability Normalize to a benign tendency probability to ensure the weights are within the range of [0,1]. The specific formula is as follows:
[0128]
[0129] in Representing neighboring nodes The probability of exhibiting a benign tendency. The normalization operation eliminates the original probability of fraudulent tendencies. The negative value has an effect that is beneficial to subsequent weighted aggregation.
[0130] Next, neighborhood information is aggregated from both benign and fraudulent perspectives, targeting the node in the hypergraph. Higher-order neighborhood is defined as Neighbors with a higher probability of being benign are weighted to preserve the effective information of normal nodes. The formula is expressed as:
[0131]
[0132] in Indicates neighbors In the Layer embedding representation, The aggregate weight matrix represents the benign perspective. Indicates the first Layer feature dimension.
[0133] For neighboring nodes with a higher probability of fraudulent activity, a weighted average is also applied to reinforce the characteristics of the few fraudulent nodes. The formula is expressed as follows:
[0134]
[0135] in The aggregated weight matrix representing the fraudulent perspective, and Independent learning ensures differentiated capture of the two types of signals.
[0136] Finally, the aggregation results from both perspectives are fused to obtain a comprehensive embedding of the higher-order neighborhood:
[0137]
[0138] To prevent fraudulent nodes from losing their own features due to heterogeneity, we concatenate the target node's own embedding with its higher-order neighborhood embedding, as shown in the following formula:
[0139]
[0140] in Represents the target node In the The layer itself is embedded; "||" indicates horizontal concatenation of vectors, and the dimension of the concatenated layer is... This operation aims to ensure that nodes retain their unique characteristics while absorbing domain information.
[0141] Step 4: Combine Loss Function
[0142] Incorporating label information helps improve the reliability of node anomaly probabilities. We further designed a node-subgraph contrastive loss function to strengthen the feature pattern of "benign-subgraph similarity, fraudulent-subgraph difference." Specifically, the embedding representations of benign nodes and their corresponding subgraphs should be as similar as possible, while the two embedding representations of fraudulent nodes should show significant differences. The contrastive loss function is designed as follows:
[0143]
[0144] in , Let represent the set of benign nodes and the set of fraudulent nodes in the training set, respectively, and τ be the temperature coefficient. This loss forces benign nodes to... As the value increases, the fraudulent node... The value decreases. Because the subgraph sampling strategy is random, word sampling cannot fully reflect the feature information of neighboring nodes. Therefore, we used multiple subgraph samplings during model training.
[0145] The final embedded vector after dynamic aggregation is input into a multilayer perceptron, and the fraud probability of the node is output through the sigmoid function:
[0146]
[0147] in For the target node The final embedding vector, express The probability of a node being fraudulent. This represents a benign probability.
[0148] To balance class imbalance and feature discriminative power, we designed a joint loss function that combines weighted cross-entropy loss and node-subgraph contrastive loss:
[0149]
[0150] Where λ is the balance coefficient. The weighted cross-entropy loss aims to address the class imbalance problem by assigning higher weights to fraudulent nodes. Its formula is as follows:
[0151]
[0152] in This represents the set of labeled nodes in the training set. For nodes The true label (1 represents fraud, 0 represents benign). This is a weighting coefficient, equal to the ratio of the number of benign nodes to the number of fraudulent nodes, ensuring that the model pays sufficient attention to the minority class.
[0153] Step 5: Perform backpropagation of the overall loss, starting from the output layer and propagating the error layer by layer. Calculate the gradient of the loss function with respect to each parameter in each layer, and update the parameter values based on these gradients to optimize the model.
[0154] Step 6: Continue iterative forward and backward propagation until the loss function converges or the preset number of iterations is reached. At this point, the model has been optimized. When detecting a suspicious network account, the features of the account node are updated using the trained hypergraph neural network; then, the anomaly probability of the node is calculated, and the embedding representation x of the target node is obtained using the trained two-dimensional dynamic neighbor aggregation module; finally, the anomaly probability of the target node is obtained using the trained multilayer perceptron, as follows:
[0155]
[0156] This invention constructs a hypergraph that integrates structural and feature dimensions, unifying the direct neighborhood associations, higher-order reachability associations, and feature space similarity associations of nodes as hyperedges. This effectively overcomes the limitation of traditional graph structures that can only express pairwise relationships, and can more comprehensively capture the hidden higher-order collusion relationships and feature similarities between fraudulent nodes, providing a richer relational foundation for subsequent detection.
[0157] A subgraph sampling strategy with restarted random walks is employed, combined with a comparative learning mechanism between nodes and subgraphs, to estimate the anomaly probability of target nodes. This approach can quantify the suspiciousness of nodes by utilizing the differences in consistency between nodes and local environmental features without relying on additional labels, providing effective guidance for the subsequent aggregation process.
[0158] This design employs a dual-perspective dynamic high-order neighborhood aggregation mechanism. Based on estimated anomaly probabilities, it weights and aggregates high-order neighborhood information from both benign and fraudulent perspectives, then fuses the dual-perspective aggregation results with the node's own features. This method dynamically adjusts the information contribution weights according to the anomalous tendencies of neighboring nodes, preserving the effective information of normal nodes while enhancing the feature representation of a few fraudulent nodes. This significantly alleviates the identification difficulties caused by extreme class imbalance and deliberate disguise by fraudulent nodes in fraud detection.
[0159] An optimization objective was constructed using joint weighted cross-entropy loss and node-subgraph contrastive loss. On the one hand, the weighting strategy increases attention to a few fraud categories, and on the other hand, the contrastive loss strengthens the feature patterns of similarity between benign nodes and subgraphs and difference between fraudulent nodes and subgraphs. This enables the model to synergistically improve classification accuracy and reliability of anomaly representation during training, ultimately improving the accuracy and robustness of network fraud detection.
[0160] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A financial fraud detection method based on dynamic neighborhood modeling of hypergraph neural networks, characterized in that, include: Construct a hypergraph of the target network, wherein the hypergraph contains multiple hyperedges, and the hyperedges are generated based at least on the structural dimension information of the network and the feature dimension information of the nodes; For a target node in the hypergraph, a local subgraph is obtained through subgraph sampling, and the anomaly probability of the target node is estimated based on the feature comparison between the target node and the local subgraph. Based on the anomaly probability, information is aggregated from both benign and fraudulent perspectives for the high-order neighborhood of the target node, and the aggregation results from the two perspectives are fused to generate the final embedded representation of the target node. Based on the final embedded representation, it is determined whether the target node is a fraudulent node.
2. The financial fraud detection method based on dynamic neighborhood modeling of hypergraph neural networks according to claim 1, characterized in that, Constructing the hypergraph includes: Based on the structural dimension of the network, a first type of hyperedge is generated, which includes at least a 1-hop neighborhood hyperedge that contains the direct neighbors of each node. Based on the feature dimension of the network, the feature similarity between nodes is calculated, and a second type of hyperedge is generated based on the feature similarity. The second type of hyperedge associates each node with its k nearest neighbor nodes in the feature space. The adjacency matrices corresponding to the first type of hyperedge and the second type of hyperedge are concatenated to form the adjacency matrix of the hypergraph.
3. The financial fraud detection method based on dynamic neighborhood modeling of hypergraph neural networks according to claim 2, characterized in that, Generating hyperedges based on the structural dimension of networks also includes: For each node, an n-hop neighborhood hyperedge is constructed, which contains all nodes reachable in n steps, to capture higher-order structural dependencies between nodes; where n is an integer greater than 1.
4. The financial fraud detection method based on dynamic neighborhood modeling of hypergraph neural networks according to claim 1, characterized in that, Estimating the anomaly probability of the target node includes: A random walk strategy with restart is adopted, starting from the target node, sampling on the hypergraph to obtain a local subgraph containing the target node and some neighboring nodes; The subgraph-level embedding representation of the local subgraph is calculated using a graph neural network, and the original features of the target node are projected into the same feature space as the subgraph-level embedding to obtain the node embedding representation; Calculate the similarity between the subgraph-level embedding representation and the node embedding representation, and quantify the anomaly probability of the target node based on the similarity measure.
5. The financial fraud detection method based on dynamic neighborhood modeling of a hypergraph neural network according to claim 4, characterized in that, When calculating the subgraph-level embedding representation of the local subgraph, the features of the target node in the local subgraph are set to zero to avoid interference from the target node's own features on the overall representation of the subgraph.
6. The financial fraud detection method based on dynamic neighborhood modeling of hypergraph neural networks according to claim 1, characterized in that, The information aggregation of the target node's higher-order neighborhood from both benign and fraudulent perspectives includes: Normalize the abnormal probability of neighboring nodes into the benign tendency probability; Using the probability of benign tendency as the weight, the features of neighboring nodes in the higher-order neighborhood are weighted and aggregated to obtain benign perspective aggregated features; Using the complement of the benign tendency probability as the weight, the features of neighboring nodes in the higher-order neighborhood are weighted and aggregated to obtain the fraud perspective aggregated features. The positive perspective aggregation feature is added to the fraudulent perspective aggregation feature to obtain the high-order neighborhood comprehensive embedding of the target node.
7. The financial fraud detection method based on dynamic neighborhood modeling of a hypergraph neural network according to claim 6, characterized in that, The final embedded representation of the target node is generated as follows: The current layer embedding of the target node is spliced with the higher-order neighborhood comprehensive embedding to achieve the fusion of its own features and aggregated features.
8. The financial fraud detection method based on dynamic neighborhood modeling of hypergraph neural networks according to claim 1, characterized in that, Also includes: A joint loss function is constructed based on labeled nodes. The joint loss function includes a classification loss for distinguishing between benign nodes and fraudulent nodes, and a contrast loss for reinforcing the consistency difference between a node and its corresponding subgraph features. By optimizing the joint loss function, the parameters in the hypergraph construction, anomaly probability estimation, and information aggregation processes are jointly trained.
9. A financial fraud detection system based on dynamic neighborhood modeling using a hypergraph neural network, characterized in that, include: The hypergraph construction module is used to construct the hypergraph of the target network. The hypergraph contains multiple hyperedges, which are generated based at least on the structural dimension information of the network and the feature dimension information of the nodes. An anomaly probability estimation module is used to obtain a local subgraph by sampling the subgraph for a target node in the hypergraph, and estimate the anomaly probability of the target node based on the feature comparison between the target node and the local subgraph. The dual-dimensional dynamic neighbor aggregation module is used to aggregate information of the high-order neighborhood of the target node from both benign and fraudulent perspectives based on the anomaly probability, and to fuse the aggregation results from the two perspectives to generate the final embedded representation of the target node. A fraud detection module is used to identify whether the target node is a fraud node based on the final embedded representation.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements a financial fraud detection method based on dynamic neighborhood modeling of a hypergraph neural network as described in any one of claims 1 to 8.