Fraud risk prediction method and device based on GCN

Abstract

The present invention discloses a fraud risk prediction method and device based on GCN, which relates to the field of artificial intelligence technology, wherein the method comprises: obtaining current transfer application data; according to the current transfer application data, taking the transferor and the recipient as key nodes, taking the number of transfer business between the transferor and the recipient as edge weights, taking the basic information of the transferor and the recipient as the attributes of each node, and constructing the current transfer business network data; inputting the current transfer business network data into a pre-established GCN fraud risk prediction model, extracting individual characteristics or group characteristics in the current transfer business network data, and further identifying the fraudulent behavior of individuals or groups in the current transfer business network data according to the individual characteristics or group characteristics. The present invention realizes efficient and accurate prediction of fraudulent behavior based on GCN.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a fraud risk prediction method and device based on GCN. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] Financial fraud risk has become one of the most serious risks in the banking industry due to its wide coverage and difficulty in prevention and control. For the banking system, there are two main types of fraud risks, one is credit risk and the other is fraud risk. Credit risk mainly assesses the borrower's repayment ability and willingness, while fraud risk judges whether the borrower's purpose is legitimate.

[0004] Financial institutions can take precautions through risk pricing and own reserves, and the risks are relatively controllable. Fraud risk causes banks to lose hundreds of millions of dollars each year, so banks urgently need to build an accurate and efficient banking fraud identification model to reduce losses caused by fraud.

[0005] In the field of bank anti-fraud, the traditional method is to adopt a "black and white list" and manually formulate detection rules. When the application or transaction information matches the anti-fraud rules, the corresponding business strategy is executed, but it is unable to fully cover all kinds of fraudulent behaviors. As a result, the expert rules are not updated in time, and when a certain number is accumulated, the false alarm rate is usually high, which can affect the actual risk decision-making and actual business development. Summary of the invention

[0006] The embodiment of the present invention provides a fraud risk prediction method based on GCN, which is used to achieve efficient and accurate prediction of fraud behavior based on GCN. The method includes:

[0007] Get the current transfer application data;

[0008] According to the current transfer application data, the transferor and the recipient are taken as key nodes, the number of transfer transactions between the transferor and the recipient is taken as the edge weight, and the basic information of the transferor and the recipient is taken as the attribute of each node to construct the current transfer transaction network data;

[0009] The current transfer business network data is input into a pre-established GCN fraud risk prediction model, individual characteristics or group characteristics in the current transfer business network data are extracted, and individual or group fraud behaviors in the current transfer business network data are identified based on the individual characteristics or group characteristics; the GCN fraud risk prediction model is pre-established based on a sample of transfer business network data constructed based on multiple historical transfer application data.

[0010] The embodiment of the present invention further provides a fraud risk prediction device based on GCN, which is used to achieve efficient and accurate prediction of fraud behavior based on GCN. The device includes:

[0011] An acquisition unit, used to acquire current transfer application data;

[0012] A business network construction unit is used to construct the current transfer business network data based on the current transfer application data, taking the transferor and the recipient as key nodes, the number of transfer transactions between the transferor and the recipient as edge weights, and the basic information of the transferor and the recipient as attributes of each node;

[0013] The prediction unit is used to input the current transfer business network data into a pre-established GCN fraud risk prediction model, extract individual characteristics or group characteristics in the current transfer business network data, and identify individual or group fraudulent behavior in the current transfer business network data based on the individual characteristics or group characteristics; the GCN fraud risk prediction model is pre-established based on a sample of transfer business network data constructed based on multiple historical transfer application data.

[0014] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned GCN-based fraud risk prediction method when executing the computer program.

[0015] An embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program for executing the above-mentioned GCN-based fraud risk prediction method.

[0016] In the embodiment of the present invention, the fraud risk prediction scheme based on GCN is compared with the technical scheme in the prior art that adopts black and white lists to identify fraudulent behaviors, which has low efficiency and accuracy. The scheme includes: obtaining current transfer application data; according to the current transfer application data, taking the transferor and the recipient as key nodes, taking the number of transfer transactions between the transferor and the recipient as edge weights, and taking the basic information of the transferor and the recipient as the attributes of each node to construct the current transfer business network data; inputting the current transfer business network data into a pre-established GCN fraud risk prediction model, extracting individual characteristics or group characteristics in the current transfer business network data, and identifying individual or group fraudulent behaviors in the current transfer business network data according to the individual characteristics or group characteristics; the GCN fraud risk prediction model is pre-established based on a sample of transfer business network data constructed based on multiple historical transfer application data, so as to realize efficient and accurate prediction of fraudulent behaviors based on GCN. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0018] Figure 1 This is a schematic diagram of the graph convolutional neural network GCN classification in an embodiment of the present invention;

[0019] Figure 2 Schematic diagram of the principle of fraud risk prediction based on GCN in an embodiment of the present invention;

[0020] Figure 3 A schematic diagram of a service network in an embodiment of the present invention;

[0021] Figure 4 A schematic diagram of a GCN fraud risk prediction model in an embodiment of the present invention;

[0022] Figure 5 A schematic diagram illustrating each stage of the process of constructing a GCN fraud risk prediction model using a convolutional network in an embodiment of the present invention;

[0023] Figure 6 Schematic diagram of the process of the fraud risk prediction method based on GCN in an embodiment of the present invention;

[0024] Figure 7 Schematic diagram of the structure of a fraud risk prediction device based on GCN in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0026] As banking service models become increasingly diversified, while customers enjoy flexible and convenient services, bank fraud risks are becoming more hidden and professional. Therefore, building an intelligent risk prediction model with machine learning algorithms as the core driver and deeply mining the value of data have become a powerful means of fraud risk prevention. After a long period of time, the anti-fraud business system has stored a large number of data samples. With the help of graph convolutional neural networks, inter-bank fraud data can be further integrated, and more diverse fraud data features can be incorporated into the co-construction anti-fraud model to quickly mine fraudulent behaviors in banking business.

[0027] The embodiment of the present invention proposes a bank anti-fraud risk prediction solution based on GCN, which uses a graph convolutional neural network (GNN, such as Figure 1 The branch (Graph Convolutional Network, GCN) in the graph mining algorithm (shown in Figure 1) conducts data mining on financial product sales, credit card applications, loans, transfers and other businesses in the bank to discover fraudulent behaviors and provide security for the bank's business operations. It is suitable for improving the anti-fraud management platform of the banking industry and further improving the level of fraud prevention and control.

[0028] This solution uses machine learning to learn from a large number of manual review data, draw on the experience of business experts and past fraud cases to create a rule base and train expert manual review models. It has initially completed the cleaning and elimination of many non-suspicious transaction data, focusing on pre-sorting and classifying suspicious cases, and comparing the audit results of historical samples of fraud cases in different time periods with the actual transaction results based on the audit model, mapping it into an expression in high-dimensional space, continuously optimizing model parameters, greatly improving audit efficiency, reducing costs, and ultimately forming a fraud recognition model constructed by a convolutional network. This allows for prediction and scoring of unknown cases after the same feature vector extraction, and even on this basis, it can determine what type of fraud case it belongs to.

[0029] This solution makes the training model close to the level of senior anti-fraud experts, makes up for the shortage of anti-fraud experts, optimizes the allocation of expert resources, and plays a guiding role in providing more accurate and excellent anti-fraud solutions. While building a business interaction network for the flow data of banking business, it helps banks build an intelligent anti-fraud system and create a good fund security and financial ecology.

[0030] The following is a detailed introduction to the GCN-based bank anti-fraud risk prediction solution.

[0031] Figure 6 FIG. 1 is a flow chart of a fraud risk prediction method based on GCN in an embodiment of the present invention. Figure 6 As shown, the method comprises the following steps:

[0032] Step 101: Obtain current transfer application data;

[0033] Step 102: Based on the current transfer application data, the transferor and the recipient are taken as key nodes, the number of transfer transactions between the transferor and the recipient is taken as the edge weight, and the basic information of the transferor and the recipient is taken as the attribute of each node to construct the current transfer transaction network data;

[0034] Step 103: Input the current transfer business network data into a pre-established GCN fraud risk prediction model, extract individual characteristics or group characteristics in the current transfer business network data, and identify individual or group fraudulent behavior in the current transfer business network data based on the individual characteristics or group characteristics; the GCN fraud risk prediction model is pre-established based on a sample of transfer business network data constructed based on multiple historical transfer application data.

[0035] The fraud risk prediction method based on GCN provided by the embodiment of the present invention can construct a transfer business network through the current transfer application data, and then use the GCN fraud risk prediction model to identify individual characteristics or group characteristics in the business network, identify fraudulent behavior based on individual characteristics or group characteristics, and realize efficient and accurate prediction of fraudulent behavior based on GCN. The following is a detailed introduction to each step involved in the method.

[0036] The embodiment of the present invention uses GCN to learn the characteristics of individuals in the network and the relationship between individuals and their surroundings, so as to solve the problem of classifying individuals or groups in the network in banking business. The following takes the transfer in the bank as an example to explain how to build an anti-fraud model (GCN fraud risk prediction model) through GCN. Figure 2 As shown in the figure, the main process is divided into four steps: data collection, feature cleaning and business network construction, graph convolution learning model construction, model learning and prediction. The following is a detailed introduction.

[0037] 1. First, the steps of pre-establishing the GCN fraud risk prediction model are introduced, namely the above-mentioned steps of "collecting data, cleaning features and building business networks, building graph convolutional learning models, and model learning".

[0038] 1. As Figure 2 and Figure 5 As shown, the steps of data preparation (collection) are first introduced.

[0039] Step 1: By analyzing the transfer application approval data, it is determined that the data contains two roles, namely the applicant and the recipient. Ten transfer records within a certain period of time are randomly selected from the daily business system. The information includes the basic information of the transferor, such as age, gender, place of residence, etc. Through the bank's data fusion, the personal information of the recipient can also be collected in other businesses. The information of both parties in the transfer behavior is summarized as follows and constructed as application data (transfer application data). An example is as follows:

[0040] Application data 1: (2021.02.01, Liu Yi, male, 25, ..., Ye AA, female, 26, ...);

[0041] Application data 2: (2021.02.01, Chen Er, male, 25, ..., Zhang B, male, 26, ...);

[0042] Application data 3: (2021.02.01, Zhang San, male, 26, ..., Wu C, male, 27, ...);

[0043] Application data 4: (2021.02.01, Li Si, female, 19, ..., Zhang B, male, 26, ...);

[0044] Application data 5: (2021.03.02, Wang Wu, male, 23, ..., Wang DD, female, 25, ...);

[0045] Application data 6: (2021.02.02, Zhao Liu, male, 25, ..., Wu C, male, 27, ...);

[0046] Application data 7: (2021.02.02, Qian Qi, female, 19, ..., Wang DD, female, 25, ...);

[0047] Application data 8: (2021.03.02, Zhou Ba, male, 23, ..., Zhang B, male, 26, ...);

[0048] Application data 9: (2021.02.03, Wu Jiu, male, 25,..., Wang DD, female, 25...);

[0049] Application data 10: (2021.02.03, Zheng Shi, female, 19, ..., Zhang B, male, 26, ...);

[0050] Application data 11: (2021.02.01, Zhang San, male, 26, ..., Wu C, male, 27, ...);

[0051] Application data 12: (2021.02.01, Zhang San, male, 26, ..., Wang DD, female, 25, ...);

[0052] Application data 13: (2021.02.01, Zhang San, male, 26, ..., Ye AA, female, 26, ...);

[0053] Application data 14: (2021.03.02, Wang Wu, male, 23, ..., Wu C, male, 27, ...);

[0054] Application data 15: (2021.02.02, Zhao Liu, male, 25, ..., Wu C, male, 27, ...);

[0055] Application data 16: (2021.02.02, Qian Qi, female, 19, ..., Wang DD, female, 25, ...);

[0056] Application data 17: (2021.02.03, Zheng Shi, female, 19, ..., Ye AA, female, 26, ...);

[0057] Application data 18: (2021.02.02, Qian Qi, female, 19,..., Wang DD, female, 25,...).

[0058] Step 2: Build user anti-fraud risk label data.

[0059] 2. Then, if Figure 2 and Figure 5 As shown, the preprocessing steps are introduced, namely, feature cleaning and building a business network (transfer business network).

[0060] 1) Data cleaning (preprocessing step): First, remove invalid data and interference data, remove isolated nodes, and remove safe node groups. The cleaning rules are as follows:

[0061] Clear the sub-network with only two nodes. The person who formed the node can basically determine that it is a normal small-amount transfer business, and there is no need to conduct fraud identification if the transfer link is not in the same sub-node.

[0062] Eliminate sub-networks with only three nodes, because groups formed by family relationships are generally composed of at least three people. Groups of this nature are generally family groups, so the risk is relatively low. However, for groups with a large number of people, a high proportion of men, and a small age difference, they may be fraud gangs and require further due diligence.

[0063] From the above, it can be seen that in one embodiment, the above-mentioned fraud risk prediction method based on GCN may also include: cleaning and preprocessing the historical transfer application data to obtain preprocessed historical transfer application data.

[0064] In a specific implementation, the historical transfer application data is cleaned and preprocessed to obtain the preprocessed historical transfer application data, which can further improve the accuracy of fraud identification.

[0065] As can be seen from the above, in one embodiment, the historical transfer application data is cleansed and preprocessed to obtain the preprocessed historical transfer application data, which may include:

[0066] The transfer application data corresponding to the sub-network with only two nodes after the transfer business network is expected to be constructed is cleared, and the transfer application data corresponding to the sub-network with only three nodes after the transfer business network is expected to be constructed is cleared to obtain the pre-processed historical transfer application data.

[0067] In specific implementation, the above data cleaning implementation method can further improve the accuracy of fraud prediction.

[0068] Of course, if Figure 5 As shown, preprocessing can also include data conversion, normalized data, etc.

[0069] 2) Build the network:

[0070] After completing the data cleaning, count each record and record the number of transactions between individual customers (the number of transfer transactions between the transferor and the recipient). For example, if "Zhang San" transferred money to "Wu C" twice on different dates, then "Zhang San-Wu C: 2" will be recorded. This value is used as the weight of the edge link between Zhang San and Wu C in the network. The following information is obtained by sorting out the above records (as shown in Table 1 below), as follows: It can be called a data dictionary:

[0071]

[0072]

[0073] Table 1

[0074] In the process of building the network, the transferor and the recipient are taken as the key nodes of the network, the number of transfer transactions between the transferor and the recipient is taken as the edge weight, and the basic information of the two roles, such as age, mobile phone number, work phone number, email address, education, annual income, position, etc., is taken as the attribute of each node. Figure 3 (Directed graph, i.e., money transfer business network).

[0075] For individuals who are closely connected in the business network, degree centrality, closeness centrality and betweenness centrality are usually used. Degree centrality indicates the number of edges connected to a node. It can be divided into in-degree and out-degree according to the flow of money. For example, Zhang San's out-degree is 7 and in-degree is 0, and Wang DD's out-degree is 0 and in-degree is 12. The larger the node degree of a node, the more important the node is in the network; closeness centrality indicates the average length of the shortest path from a node to all other nodes, reflecting the closeness between a node and other nodes in the network; betweenness centrality indicates how many pairs of nodes a node is on the shortest path. From the perspective of the network, the spread of fraud risk is measured. The degree reflects the number of friends associated with the node, and the shortest path reflects the intimacy between nodes in the network. However, betweenness centrality is a centrality measurement method that can better reflect the role of nodes as bridges in the graph. Betweenness reflects the role and influence of the corresponding node or edge in the entire network, which has a strong practical significance. For example, in a transfer network, people with higher betweenness have very frequent transfer records, indicating that they have fewer third parties involved in the transfer and there is a risk of fraud.

[0076] In terms of the closely connected groups in the network, the above network can be divided into three groups. However, in fact, in the network, analysis can be done not only by the characteristics of each individual in the group, but also by the characteristics of the entire group as a whole. This makes group identification have a sufficiently rich data dimension. Generally speaking, the characteristics of a group can be divided into two dimensions:

[0077] (1) Gang topology characteristics related to network structure.

[0078] (2) Gang entity characteristics related to individual information.

[0079] Among them, the topological characteristics of the group include the number of nodes in the group, the degree of freedom (the degree of freedom is a concept in statistics. The simple explanation is the number of observations - the number of necessary connections in these observations), the longest shortest path between nodes in the group, etc.; the entity characteristics of the group include the ratio of men to women in the group, the maximum age difference, the average age, the total assets of the group, the total liabilities of the group, etc.

[0080] It can be seen from the above that, in one embodiment, the group characteristics may include: group topology characteristics related to network structure and group entity characteristics related to individual information.

[0081] 3. Then, if Figure 2 and Figure 5 As shown in the figure, we introduce how to build a graph convolutional learning model.

[0082] After the transfer network is built, the fraud risk of individuals or groups can be determined simply by counting the indicators of individuals or groups in the network. However, there are two problems with relying solely on statistical indicators to make judgments. First, there are many rules and they are not static. A rule that may be effective today may lead to misjudgment tomorrow. Therefore, the rules should be updated in a timely manner according to the data situation. Second, the information depth is not enough. Indicators can be used to utilize individuals and the information between individual A and individual B, that is, the relationship of 0 or 1 degree. However, the information of individual A-individual B-individual C with a relationship of more than 2 degrees is not utilized. In the current situation where anti-fraud measures are emerging in an endless stream, without sufficient in-depth information, it is impossible to discover fraudulent individuals and groups in a super-large network in a huge network.

[0083] The above two problems can be overcome by using GCN's feature learning and integration capabilities. GCN, also known as graph convolutional network, actually has the same function as CNN, which extracts image information. It is also a feature extractor, but its object is network data. By extracting features from graph data, these features can be used to classify nodes in graph data, and then to classify groups, that is, to determine whether an individual or group belongs to a category with fraud or a category without fraud. Compared with the method of discovering fraud based on individual feature rules, GCN not only considers each individual feature, but also uses the relationship of individuals with more than 1 degree. Moreover, GCN only relies on a small number of fraud black samples to immediately identify fraud, which is particularly suitable for fraud identification in the current situation where there are fewer fraud black samples, and can improve the accuracy of fraud prediction.

[0084] GCN is usually constructed by stacking network layers, such as Figure 4 As shown in the figure, each convolutional layer only processes the first-order neighborhood information. By stacking several convolutional layers, multi-order neighborhood information can be transmitted. Figure 4 It is a GCN network with two hidden layers. The network data is input from the Input layer, and the output Output is obtained through feature learning of two Hidden layers.

[0085] The first-order neighborhood refers to the dimension of processing data. For example, a certain application data 1: (2021.02.01, Liu Yi, male, 25, ..., Ye AA, female, 26, ...) has multiple attribute dimensions. The process of processing data is from a single attribute application data a: (Liu Yi, male, Ye AA, female), to the process of adding all the attributes of this data to the processing, application data 1: (2021.02.01, Liu Yi, male, 25, ..., Ye AA, female, 26, ...).

[0086] For each node in the business network, obtain its feature information from all its neighboring nodes, including its own features. Suppose we use the average() function. The same operation will be performed on all nodes. Finally, these calculated averages are input into the neural network. The layer-by-layer feature transfer is done through the following formula:

[0087]

[0088] Among them, H (l) The activated features of the lth layer, and H 0 is the original input data X, σ is the activation function used to learn nonlinear features, The sum of the network's adjacency matrix and the identity matrix, for The degree matrix of W l is the parameter matrix of each layer. During network training, the input data includes the original input data X and the matrix Network training is done by continuously modifying the parameter matrix W of each layer l , so that the data can get the real result after being calculated by each layer of the network.

[0089] In general, the GCN algorithm principle mainly includes three steps: propagation, aggregation, and nonlinear transformation. The functions completed by each step are as follows:

[0090] Propagation means that each node in the network sends its own characteristic information to adjacent neighbor nodes.

[0091] Aggregation refers to the process in which each node in the network aggregates the feature information of neighboring nodes, which is to fuse the local structural information of the nodes. Local structural information can be understood as the perception domain of CNN, which shares the convolution kernel weights and is proportional to the number of layers of the neural network. At the beginning of the iteration, each node contains the feature information of its directly connected neighbors. When calculating the second layer of the neural network, the feature information of the neighbor's neighbor nodes can be aggregated, so that more and more complete information is involved in the operation. The more layers there are, the wider the perception domain is, and the more node information is involved in the operation.

[0092] Perform nonlinear transformation on the feature information after aggregation to increase the representation capability of the model[^10]

[0093] Using the popular deep learning framework Keras, you can quickly build a GCN network, such as Figure 4 As shown, two GCNs are used in total, with the relu activation function (such as Figure 4 Relu in , a network data learning neural network constructed.

[0094] 4. Then, if Figure 2and Figure 5 As shown, the steps of model learning and prediction are introduced.

[0095] After completing the data organization and GCN construction, the next step is to perform GCN training according to the following steps. To avoid errors caused by random data extraction, the training process can use 10-fold cross-validation to train GCN. Specifically, first divide the data into 10 parts randomly and equally, take 9 of them as training data for the GCN network, and the remaining one as test data. In this way, each part of the data is used as test data for GCN training, and finally 10 training results and test results are obtained, and the training results and test results are taken as the final results of GCN.

[0096] GCN classifies nodes in the network. In the training process, cross entropy is used as the loss function of GCN. The larger the difference between the predicted value and the true value, the larger the value of this function is, so as to drive the network to reduce the gap between the true value and the predicted value, and achieve the purpose of learning network features. In the test, F1-score is used as an evaluation indicator to measure the overall prediction effect of GCN on fraudulent and non-fraudulent personnel. The larger the F1-score value, the better the effect of GCN.

[0097] In summary, in one embodiment, the above-mentioned fraud risk prediction method based on GCN may also include pre-establishing a GCN fraud risk prediction model according to the following method:

[0098] Get historical transfer application data;

[0099] Based on the historical transfer application data, the transferor and the recipient are taken as key nodes, the number of transfer transactions between the transferor and the recipient is taken as the edge weight, and the basic information of the transferor and the recipient is taken as the attribute of each node, so as to construct a transfer transaction network data sample; the sample includes a positive sample without fraudulent behavior and a negative sample with fraudulent behavior;

[0100] Dividing the data sample into a training set and a test set;

[0101] Using the degree centrality index, the closeness centrality index and the betweenness centrality index, the GCN is trained using the training set to obtain a trained GCN fraud risk prediction model;

[0102] The trained GCN fraud risk prediction model is tested using the test set to obtain the pre-established GCN fraud risk prediction model.

[0103] 2. Next, the above steps 101 to 103 are introduced, that is, the steps of using the above step "1" to establish the GCN fraud risk prediction model for actual prediction.

[0104] From the above, it can be seen that the above step "1" establishes a GCN fraud risk prediction model, and in actual prediction, the model can be used to actually make predictions to improve the accuracy and efficiency of predictions. Before making predictions, the above steps 101 and 102 are first introduced.

[0105] In the above step 101, a cleaning preprocessing step may also be performed, and the cleaning preprocessing step may refer to the step of cleaning preprocessing the historical transfer application data in the above “1”. Of course, the above step 102 may also refer to the step of building a business network in the above “1”. The above step 103 may also refer to the “prediction” part of “4” in the above “1”.

[0106] 3. Next, further preferred steps of the embodiment of the present invention are introduced.

[0107] In one embodiment, the above-mentioned fraud risk prediction method based on GCN may further include:

[0108] Detect the types of fraudulent behavior of individuals or groups in the current money transfer business network data;

[0109] When it is detected that the type of the current fraudulent behavior does not exist in the types of historical fraudulent behaviors, the transfer business network data corresponding to the type of the current fraudulent behavior is added to the transfer business network data sample library to obtain an updated transfer business network data sample library;

[0110] The GCN fraud risk prediction model is updated using the updated transfer business network data sample library.

[0111] In specific implementation, after completing the GCN training, the obtained GCN can be deployed into the business system to assist in identifying fraudulent individuals or groups. As the bank's transfer records continue to expand, the network constructed by the transfer behavior will become increasingly complex, and the complexity of fraud will continue to increase. GCN can learn new fraud features through retraining based on the original knowledge. In this way, the model can be iterated and updated conveniently to adapt to new forms of fraud identification.

[0112] In one embodiment, the above-mentioned GCN-based fraud risk prediction method may also include: setting risk labels of different levels for the identified fraudulent behaviors of individuals or groups in the current transfer business network data to obtain a risk label pool; the risk label pool is used to guide bank transactions.

[0113] During specific implementation, for the final predicted risk results, risk labels of different levels are set, and customer behaviors are recorded into a risk label pool, as shown in Table 2 below, to provide substantive guidance for subsequent transactions.

[0114]

[0115] Table 2

[0116] In summary, the effects and advantages of bank anti-fraud risk prediction based on graph convolutional neural network GCN provided by the embodiment of the present invention are:

[0117] The present invention constructs the associated individuals in the business data into an associated network, and then uses GCN to learn the characteristics of individual customers in the network and the characteristics of the relationship between individual customers, and finally identifies the individual character portraits and group identification behaviors in the network. Compared with the traditional rule-based fraud identification method, GCN uses wider and deeper features, and can generally identify better and have a lower false alarm rate than traditional methods. Not only that, GCN is also a semi-supervised method. It only needs to convert a large number of samples with fraud labels into fraud features that can be learned in the network, summarize effective rules, and use convolutional networks to build fraud identification models. At present, big data has become a trend, and most of the bank's businesses can use their huge data resources to build various relationship networks. This invention will effectively help to mine useful features in these relationship networks and promote the safe and efficient risk control management process of bank big data businesses.

[0118] The present invention also provides a fraud risk prediction device based on GCN, as described in the following embodiments. Since the principle of solving the problem by the device is similar to that of the fraud risk prediction method based on GCN, the implementation of the device can refer to the implementation of the fraud risk prediction method based on GCN, and the repeated parts will not be repeated.

[0119] Figure 7 FIG. 1 is a schematic diagram of the structure of a fraud risk prediction device based on GCN in an embodiment of the present invention. Figure 7 As shown, the device comprises:

[0120] Acquisition unit 01, used to obtain current transfer application data;

[0121] The business network construction unit 02 is used to construct the current transfer business network data based on the current transfer application data, taking the transferor and the recipient as key nodes, the number of transfer business between the transferor and the recipient as edge weights, and the basic information of the transferor and the recipient as attributes of each node;

[0122] Prediction unit 03 is used to input the current transfer business network data into a pre-established GCN fraud risk prediction model, extract individual characteristics or group characteristics in the current transfer business network data, and identify individual or group fraudulent behavior in the current transfer business network data based on the individual characteristics or group characteristics; the GCN fraud risk prediction model is pre-established based on a sample of transfer business network data constructed based on multiple historical transfer application data.

[0123] In one embodiment, the GCN-based fraud risk prediction device may further include: an establishment unit, configured to pre-establish a GCN fraud risk prediction model according to the following method:

[0124] Get historical transfer application data;

[0125] Based on the historical transfer application data, the transferor and the recipient are taken as key nodes, the number of transfer transactions between the transferor and the recipient is taken as the edge weight, and the basic information of the transferor and the recipient is taken as the attribute of each node, so as to construct a transfer transaction network data sample; the sample includes a positive sample without fraudulent behavior and a negative sample with fraudulent behavior;

[0126] Dividing the data sample into a training set and a test set;

[0127] Using the degree centrality index, the closeness centrality index and the betweenness centrality index, the GCN is trained using the training set to obtain a trained GCN fraud risk prediction model;

[0128] The trained GCN fraud risk prediction model is tested using the test set to obtain the pre-established GCN fraud risk prediction model.

[0129] In one embodiment, the above-mentioned GCN-based fraud risk prediction device may further include: a preprocessing unit, configured to perform cleaning preprocessing on the historical transfer application data to obtain preprocessed historical transfer application data.

[0130] In one embodiment, the preprocessing unit is specifically used for:

[0131] The transfer application data corresponding to the sub-network with only two nodes after the transfer business network is expected to be constructed is cleared, and the transfer application data corresponding to the sub-network with only three nodes after the transfer business network is expected to be constructed is cleared to obtain the pre-processed historical transfer application data.

[0132] In one embodiment, the above-mentioned fraud risk prediction device based on GCN may further include:

[0133] A detection unit, used to detect the type of fraudulent behavior of an individual or a group in the identified current money transfer business network data;

[0134] A sample updating unit, configured to add the transfer service network data corresponding to the type of the current fraudulent behavior to the transfer service network data sample library when detecting that the type of the current fraudulent behavior does not exist in the types of the historical fraudulent behavior, so as to obtain an updated transfer service network data sample library;

[0135] The model updating unit is used to update the GCN fraud risk prediction model using an updated sample library of transfer business network data.

[0136] In one embodiment, the group characteristics may include: group topology characteristics related to network structure and group entity characteristics related to individual information.

[0137] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned GCN-based fraud risk prediction method when executing the computer program.

[0138] An embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program for executing the above-mentioned GCN-based fraud risk prediction method.

[0139] In the embodiment of the present invention, the fraud risk prediction scheme based on GCN is compared with the technical scheme in the prior art that adopts black and white lists to identify fraudulent behaviors, which has low efficiency and accuracy. The scheme includes: obtaining current transfer application data; according to the current transfer application data, taking the transferor and the recipient as key nodes, taking the number of transfer transactions between the transferor and the recipient as edge weights, and taking the basic information of the transferor and the recipient as the attributes of each node to construct the current transfer business network data; inputting the current transfer business network data into a pre-established GCN fraud risk prediction model, extracting individual characteristics or group characteristics in the current transfer business network data, and identifying individual or group fraudulent behaviors in the current transfer business network data according to the individual characteristics or group characteristics; the GCN fraud risk prediction model is pre-established based on a sample of transfer business network data constructed based on multiple historical transfer application data, so as to realize efficient and accurate prediction of fraudulent behaviors based on GCN.

[0140] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0141] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0144] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A fraud risk prediction method based on GCN, characterized in that: include: Get the current transfer application data; According to the current transfer application data, the transferor and the recipient are taken as key nodes, the number of transfer transactions between the transferor and the recipient is taken as the edge weight, and the basic information of the transferor and the recipient is taken as the attribute of each node to construct the current transfer transaction network data; Input the current money transfer business network data into the pre-established GCN fraud risk prediction model, extract individual characteristics or group characteristics in the current money transfer business network data, and identify individual or group fraudulent behavior in the current money transfer business network data based on the individual characteristics or group characteristics; The GCN fraud risk prediction model is pre-established based on a sample of transfer business network data constructed from a plurality of historical transfer application data; wherein the group characteristics include: group topology characteristics related to the network structure and group entity characteristics related to individual information; The GCN-based fraud risk prediction method also includes pre-establishing a GCN fraud risk prediction model according to the following method: obtaining historical transfer application data; based on the historical transfer application data, taking the transferor and the recipient as key nodes, the number of transfer transactions between the transferor and the recipient as edge weights, and the basic information of the transferor and the recipient as the attributes of each node, to construct a transfer transaction network data sample; the sample includes a positive sample without fraudulent behavior and a negative sample with fraudulent behavior; dividing the data sample into a training set and a test set; using a degree centrality index, a closeness centrality index, and a betweenness centrality index, and using the training set to predict the fraud risk of the fraudulent behavior; GCN is trained to obtain a trained GCN fraud risk prediction model; wherein, the degree centrality index represents the number of edges connected to a node, which is divided into in-degree and out-degree according to the flow of money. The larger the node degree of a node, the more important the node is in the business network; the closeness centrality index represents the average length of the shortest path from a node to all other nodes, reflecting the degree of closeness between a node and other nodes in the business network; the betweenness centrality index represents how many pairs of nodes a node is on the shortest path; the trained GCN fraud risk prediction model is tested using the test set to obtain the pre-established GCN fraud risk prediction model.

2. The fraud risk prediction method based on GCN as claimed in claim 1, characterized in that: Also includes: The historical transfer application data is cleaned and preprocessed to obtain the preprocessed historical transfer application data.

3. The fraud risk prediction method based on GCN as claimed in claim 2, characterized in that: The historical transfer application data is cleaned and preprocessed to obtain the preprocessed historical transfer application data, including: The transfer application data corresponding to the sub-network with only two nodes after the transfer business network is expected to be constructed is cleared, and the transfer application data corresponding to the sub-network with only three nodes after the transfer business network is expected to be constructed is cleared to obtain the pre-processed historical transfer application data.

4. The fraud risk prediction method based on GCN as claimed in claim 1, characterized in that: Also includes: Detect the types of fraudulent behavior of individuals or groups in the current money transfer business network data; When it is detected that the type of the current fraudulent behavior does not exist in the types of historical fraudulent behaviors, the transfer business network data corresponding to the type of the current fraudulent behavior is added to the transfer business network data sample library to obtain an updated transfer business network data sample library; The GCN fraud risk prediction model is updated using the updated transfer business network data sample library.

5. The fraud risk prediction method based on GCN as claimed in claim 1, characterized in that: Also includes: Setting risk labels of different levels for the identified fraudulent behaviors of individuals or groups in the current transfer business network data to obtain a risk label pool; The risk tag pool is used to guide banking transactions.

6. The fraud risk prediction method based on GCN as claimed in claim 1, characterized in that: The group characteristics include: group topology characteristics related to network structure and group entity characteristics related to individual information.

7. A fraud risk prediction device based on GCN, characterized in that: include: An acquisition unit, used to acquire current transfer application data; A business network construction unit is used to construct the current transfer business network data based on the current transfer application data, taking the transferor and the recipient as key nodes, the number of transfer transactions between the transferor and the recipient as edge weights, and the basic information of the transferor and the recipient as attributes of each node; A prediction unit, used to input the current transfer business network data into a pre-established GCN fraud risk prediction model, extract individual characteristics or group characteristics in the current transfer business network data, and identify individual or group fraudulent behavior in the current transfer business network data based on the individual characteristics or group characteristics; The GCN fraud risk prediction model is pre-established based on a sample of transfer business network data constructed from a plurality of historical transfer application data; wherein the group characteristics include: group topology characteristics related to the network structure and group entity characteristics related to individual information; The GCN-based fraud risk prediction device also includes an establishment unit, which is used to pre-establish a GCN fraud risk prediction model according to the following method: obtaining historical transfer application data; according to the historical transfer application data, taking the transferor and the recipient as key nodes, the number of transfer transactions between the transferor and the recipient as edge weights, and the basic information of the transferor and the recipient as the attributes of each node, to construct a transfer transaction network data sample; the sample includes a positive sample without fraudulent behavior and a negative sample with fraudulent behavior; dividing the data sample into a training set and a test set; using the degree centrality index, the closeness centrality index and the betweenness centrality index, and using the training set to predict the fraud risk of the GCN fraud risk prediction model in advance; The training set is used to train GCN to obtain a trained GCN fraud risk prediction model; wherein, the degree centrality index represents the number of edges connected to a node, which is divided into in-degree and out-degree according to the money flow direction, and the larger the node degree of a node, the more important the node is in the business network; the closeness centrality index represents the average length of the shortest path from a node to all other nodes, reflecting the closeness between a node and other nodes in the business network; the betweenness centrality index represents how many pairs of nodes a node is on the shortest path; the test set is used to test the trained GCN fraud risk prediction model to obtain the pre-established GCN fraud risk prediction model.

8. The fraud risk prediction device based on GCN as claimed in claim 7, characterized in that: Also includes: A detection unit, used to detect the type of fraudulent behavior of an individual or a group in the identified current money transfer business network data; A sample updating unit, configured to add the transfer service network data corresponding to the type of the current fraudulent behavior to the transfer service network data sample library when detecting that the type of the current fraudulent behavior does not exist in the types of the historical fraudulent behavior, so as to obtain an updated transfer service network data sample library; The model updating unit is used to update the GCN fraud risk prediction model using an updated sample library of transfer business network data.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 6.

Images