A fine-grained telecommunication network anti-fraud detection method based on micro-event graph

Abstract

The present invention relates to a fine-grained telecommunications network anti-fraud detection method based on a micro-event graph. The method comprises the following steps: obtaining telecommunications network data corresponding to the event to be detected and constructing a corresponding micro-event graph; converting nodes in the micro-event graph into initial embedding vectors; using the embedding vectors as input to an anti-fraud detection model constructed based on a graph neural network; employing an attention-based hidden layer to obtain a hidden layer representation based on the embedding vectors; and utilizing a temporal self-attention mechanism hidden layer to update the hidden layer representation to obtain an event representation; performing a dot product between the hidden layer representation and the event representation, performing a sigmoid transform on the resulting dot product, and comparing it with a set threshold to obtain a fraud label. Compared with existing technologies, the present invention has the advantages of high fraud interception accuracy and good model robustness.

Description

Technical Field

[0001] The present invention relates to the field of telecommunication network fraud prevention technology, and in particular to a fine-grained telecommunication network anti-fraud detection method based on microscopic event graphs. Background Art

[0002] With the rapid growth of internet services and the increasing number of internet users, telecom fraud is becoming increasingly widespread, seriously impacting social harmony and stability, severely disrupting normal market order, and unnecessarily increasing the costs of market transactions and social interactions. With the development of artificial intelligence (AI) and data science, AI has provided new research insights for telecom fraud prevention. Research on AI-based anti-fraud technologies is crucial for combating, preventing, and controlling telecom fraud, protecting the property safety of the public, and maintaining social harmony and stability. There is an urgent need to establish effective and reliable telecom fraud detection methods.

[0003] Telecom fraud, a variant of traditional fraud in the telecom network space, is characterized by diverse methods, concealed behavior, low costs, widespread dissemination, continuous crime, and unpredictable and uncontrollable consequences. The social harm it causes far exceeds that of traditional fraud. Device fingerprinting technology has been maturely applied to telecom network anti-fraud and has achieved impressive performance. Furthermore, many researchers have focused on detecting telecom network fraud using group or individual-level behavioral models. These efforts focus on user behaviors that are nearly impossible to forge or that differ from typical online user behaviors.

[0004] Traditional machine learning anti-fraud technologies, such as device fingerprinting, behavioral modeling, and deep neural network models, place high demands on the quantity and quality of the data provided to the models. However, current telecommunications network anti-fraud technologies still have some limitations. For users, some historical behavioral data is often too limited to accurately describe an individual's behavior patterns. The amount of fraud data is very small, and models trained using this unbalanced data struggle to detect anomalies, limiting the performance of traditional methods. Furthermore, telecommunications network fraud incidents are often a combination of social networks and the information flows within them (in the form of messages, images, and videos). Traditional anti-fraud technologies based on recorded data ignore the rich social network connections. Regarding social network connections, current knowledge graphs, which are primarily based on homogeneous graphs, primarily construct a homogeneous co-occurrence network to reflect the connections between entities. This knowledge representation is overly simplistic, making it difficult to understand the dynamic and complex telecommunications network fraud incidents. Therefore, it is necessary to develop a reliable and effective telecommunications network anti-fraud detection method. Summary of the Invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned existing technologies, design a micro-event graph based on user online behavior data and user social network data to analyze the behavior patterns of telecommunications network users, and introduce prior relationships with the help of external knowledge base to enhance the quality of behavioral data. Therefore, the present invention adopts a fine-grained telecommunications network anti-fraud detection method based on micro-event graph, which is bound to have stronger anti-fraud precision strike capability and model robustness.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] A fine-grained telecommunication network anti-fraud detection method based on micro-event graphs, the method comprising the following steps:

[0008] Obtain telecommunication network data corresponding to the event to be detected and construct the corresponding micro-event graph;

[0009] Convert the nodes in the micro-event graph into initial embedding vectors;

[0010] The embedding vector is used as input to an anti-fraud detection model, the anti-fraud detection model is constructed based on a graph neural network, a hidden layer based on an attention mechanism is used to obtain a hidden layer representation based on the embedding vector, and a hidden layer based on a temporal self-attention mechanism is used to update the hidden layer representation to obtain an event representation;

[0011] The hidden layer representation and the event representation are dot-producted, the resulting dot product is sigmoid-transformed, and compared with a set threshold to obtain a fraud label.

[0012] Furthermore, the telecommunications network data includes user online behavior data and user social network data.

[0013] Furthermore, based on the completeness subspace partitioning method, a three-layer network structure including the subject layer, event layer and attribute layer is constructed, and the intra-layer associations of each layer and the event-centered inter-layer associations are designed to construct the micro-event map.

[0014] Furthermore, the completeness subspace partitioning method is specifically as follows:

[0015] The subject space is divided into the virtual subject sublayer and the real subject sublayer, the event space is divided into the behavior event sublayer and the state event sublayer, and the attribute space is divided into the identification attribute sublayer and the description attribute sublayer.

[0016] Furthermore, the intra-layer association includes subject prior association, event temporal association and attribute co-occurrence association, and the inter-layer relationship includes subject event mapping association and event attribute mapping association.

[0017] Furthermore, the subject prior association extracts associations between subjects by setting meta-paths from user social network data and external knowledge base;

[0018] The event temporal association is performed by sorting events in ascending order according to the occurrence time from the user's online behavior data, and extracting the sequence association between events with adjacent occurrence times;

[0019] The attribute co-occurrence association is obtained by discretizing events from user online behavior data and extracting the association between attributes occurring in the same event and the co-occurrence phenomena between attributes.

[0020] Furthermore, the embedding vector is obtained by performing corresponding processing based on the modality of telecommunications network data. For structured data, it is discretized into attribute values, and then the corresponding word vector is queried from the prior pre-trained word vector as the initial embedding vector; for text data, the natural language analysis tool set CoreNLP is used to convert the corresponding text information into the initial embedding vector; for audio data, its Mel-frequency cepstral coefficient MFCC features are extracted as the initial embedding vector; for image data, a convolutional neural network is used to convert its corresponding pixel matrix into the initial embedding vector.

[0021] Furthermore, the hidden layer based on the attention mechanism includes two parts: a neighbor information attention mechanism and a self-information retention mechanism.

[0022] The hidden layer representation is expressed as:

[0023]

[0024] in, is the node v in the micro-event graph i The hidden layer representation of the l+1th and lth hidden layers, is the node v in the micro-event graph j The hidden layer representation of the lth hidden layer, α ij is node v i and v j The attention weight of the corresponding edge between them, σ() represents a hidden layer of the graph neural network, Γr(v i ) is the node v i The set of neighbor nodes through relationship r, W is the hidden layer network weight matrix.

[0025] Furthermore, the event representation is obtained by using the temporal self-attention mechanism hidden layer based on the hidden layer representation update:

[0026] Get the hidden layer representation of a series of events that occurred to subject u in the time period [a:b], denoted as V u a：b =[va , v a+1 ,…,v b ], using the scaled dotproduct attention function to generate sequential event embeddings and obtain event representations, where for v t ∈V u a：b , allowing the v t Participate in the calculation of all events before and including time t, but v is not allowed t Participate in the calculation of events in the future time period of time t.

[0027] Furthermore, the set threshold is 0.5.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. The present invention constructs a micro-event graph by comprehensively considering and micro-classifying the elements (subjects, events, and attributes) at each level in the telecommunications network fraud ecosystem, making the interactive correlations among the various entities contained in the graph more complex, thereby exploring deeper potential connections and optimizing the accuracy of the model in combating fraudulent behavior.

[0030] 2. This invention uses graph neural networks to learn latent layer representations and introduces an attention mechanism to jointly model user collaborative filtering and content collaborative filtering. At the same time, it aggregates neighbor node information through its own information retention mechanism, effectively characterizing fraudulent behavior patterns and improving the accuracy of intercepting fraudulent behavior.

[0031] 3. The present invention designs a temporal self-attention mechanism hidden layer to update the representation of events, simulating how events in different time periods in the current event sequence differentially affect future events, with high detection accuracy and good model robustness.

[0032] 4. Compared with traditional methods, this invention reduces the cost of detecting fraudulent behavior and improves the anti-fraud performance of the anomaly detection model.

[0033] Other features and advantages of the present invention will be described in the following description. The purpose and other advantages of the present invention can be achieved and obtained through the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is an example diagram of the microscopic event map of the present invention;

[0035] Figure 2 Schematic diagram of the principle of the detection method of the present invention. DETAILED DESCRIPTION

[0036] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0037] Telecom fraud perpetrators exploit the concealment afforded by telecom network technology, hiding behind the network and communicating with victims in virtual spaces. This is a contactless fraud that spans both physical and virtual space. Social media platforms have become the primary means of disseminating information, so telecom fraud incidents often involve a combination of social networks and the information flows (in the form of messages, images, and videos) within them. Current knowledge graphs, primarily based on homogeneous graphs, primarily construct a homogeneous event co-occurrence network to reflect the connections between entities. These graphs identify fraud by capturing subgraph structures with unusual connections. However, these knowledge representations are overly simplistic and difficult to understand given the complex dynamics of telecom fraud.

[0038] In anti-fraud scenarios, beyond considering the attributes of a single point of information, hidden connections between users often contain a wealth of unknown potential information. Mining and constructing these connections, and establishing a user connection graph, can help identify unusual fraudulent behavior. Due to user privacy regulations or the difficulty of data collection, the quality of user behavior data used to build the connection graph is often low. To integrate hidden connections between users with the complex connections between events, a feasible approach is to establish a hierarchical connection graph, treating entities at different levels differently. Using the connection graph can effectively mine hidden connection features in the network, overcoming data challenges posed by user privacy regulations or the difficulty of data collection.

[0039] Through the above research, it is found that a major problem for telecommunications network anti-fraud detection is how to integrate the complex and diverse event data in virtual space and real space, and expand the homogeneous event graph in multiple dimensions such as event sequence, subject association, and attribute distribution. It has a stronger knowledge expression ability and can better describe the dynamic changes of objective events. To this end, the present invention studies a fine-grained telecommunications network anti-fraud detection method based on micro-event graphs. From the three aspects of cross-level synthetic behavior correlation, cross-temporal and spatial sequence behavior norms, and cross-user interactive behavior credibility, a knowledge graph structure centered on event sequences is established to facilitate decision makers' understanding of events, help decision makers quickly obtain and continuously track event progress, quickly and accurately obtain core key information, and provide auxiliary decision-making capabilities.

[0040] like Figure 2As shown, the present invention provides a fine-grained telecommunications network anti-fraud detection method based on a micro-event graph, comprising the following steps: obtaining telecommunications network data corresponding to an event to be detected and constructing a corresponding micro-event graph; converting nodes in the micro-event graph into initial embedding vectors; using the embedding vector as the input of an anti-fraud detection model, the anti-fraud detection model is constructed based on a graph neural network, and a hidden layer based on an attention mechanism is used to obtain a hidden layer representation based on the embedding vector, and a hidden layer based on a temporal self-attention mechanism is used to update an event representation based on the hidden layer representation; performing a dot product between the hidden layer representation and the event representation, performing a sigmoid transform on the obtained dot product, and comparing the result with a set threshold to obtain a fraud label.

[0041] 1. Construction of micro-event map

[0042] In the present invention, the microscopic event graph is designed based on the completeness subspace partitioning method, and three intra-layer correlation and two inter-layer correlation structures are designed.

[0043] The telecommunications network data collected to construct the micro-event graph should include two types: user online behavior data and user social network data. Different data types are processed differently. For user online behavior data, discrete data is retained as discrete values ​​without further processing; continuous data is discretized into discrete data. For user social network data, meta-paths are manually set to extract connections between users. For example, meta-paths can be set as "user-user," "user-address-user," and "user-topic-user."

[0044] The micro-event graph constructed by the present invention adopts a knowledge graph structure centered on the event sequence in the user's online behavior data (the user's online behavior data consists of individual events), which facilitates decision makers' understanding of events, helps decision makers quickly obtain and continuously track the progress of events, quickly and accurately obtain core key information, and provides auxiliary decision-making capabilities. Since the behavioral characteristics of telecommunications network fraud are diverse and hidden, the correlation and sensitivity of online behavioral events under different user subjects to different attributes in the event (the event consists of a group of attributes) are different. To this end, for data of different spatial granularities, with events as the center, a subject layer mainly oriented to users is established from a macro perspective, and an attribute layer mainly oriented to attributes is established from a micro perspective. The telecommunications network fraud incident problem is modeled as a three-layer network architecture, including a subject layer, an event layer, and an attribute layer.

[0045] On the basis of the above three-layer architecture, the consistent associations among subjects, events and attributes are established within each layer, and the corresponding associations between different layers are established from a cross-layer perspective to form the final micro-event map, such as Figure 2 shown.

[0046] The present invention proposes a completeness subspace partitioning method: according to the combination characteristics of online virtual space and offline real space in the telecommunications network fraud scenario, the subject space is divided into two corresponding subspaces, namely the virtual subject sublayer and the real subject sublayer; according to the sequential occurrence characteristics of behavioral events, the event space is divided into two corresponding subspaces, namely the behavioral event space and the state event space; according to the semantic uniqueness of the attributes, the attribute space is divided into two corresponding subspaces, namely the identification attribute sublayer and the description attribute sublayer.

[0047] According to the above three-layer architecture and the above completeness subspace partitioning method, three types of associations within each layer and two types of associations between different layers are designed respectively.

[0048] Specifically, the associations within each of the three layers are subject prior associations, event temporal associations, and attribute co-occurrence associations.

[0049] The subject prior association extracts the association between subjects by manually setting meta-paths from user social network data and external knowledge bases (such as pre-trained word vectors disclosed based on massive data). For example, friend associations in social networks can be extracted to establish subject prior associations. In particular, pre-trained word vectors in external knowledge bases can help establish associations between similar subjects (such as subjects in the same sub-layer), for example, by calculating the similarity between pre-trained word vectors corresponding to different subjects and setting a threshold to specify the similar associations between subjects. For the association between the real sub-layer and the virtual sub-layer, the association between the virtual sub-layer and the real sub-layer is established by comparing their contextual information (the first-order neighbor information of the subject in the subject layer). Specifically, the corresponding pre-trained word vectors of the first-order neighbors of the subject are averaged, and the similarity of the two vector means is calculated.

[0050] Event temporal correlation works by sorting events in ascending order by occurrence time from user online behavior data and then extracting sequential correlations between events with adjacent occurrence times. In particular, many events (state events) persist in the data. For transient behavior events and persistent state events, we establish state start and state end correlations to further establish correlations between the behavior event sublayer and the state events within the sequence information.

[0051] After discretizing events from user online behavior data, attribute co-occurrence associations are considered to consist of a set of attributes. The co-occurrence of attributes and attributes within the same event is considered as the attribute co-occurrence association in the three-layer architecture. For example, the co-occurrence of multiple attributes in a behavioral event can be considered as the co-occurrence association between multiple attributes. In particular, there are some indicative facts in attributes, such as address codes, IP addresses, license plate numbers, etc., while other descriptive attributes are often vague in meaning and have certain similarities. For descriptive attributes, subordinate associations between different attributes are established by extracting the semantic similarity of attributes (through pre-trained word vectors in an external knowledge base).

[0052] The associations between the two different layers are subject-event mapping association and event-attribute mapping association. Subject-event mapping association means that if the subject is the initiator of the event, a cross-layer association is established between the subject layer and the event layer; event-attribute mapping association means that if the attribute is a component element of the event, a cross-layer association is established between the attribute layer and the event layer. Subject-event mapping association achieves the effect of user collaborative filtering through the interaction between subjects and events, reflecting subjects with similar preferences in the graph, and the correlation between users can be characterized through the temporal interaction of events. Event-attribute mapping association achieves the effect of content collaborative filtering through the interaction between events and attributes, reflecting events with similar content in the graph, and the correlation between events can be characterized through the co-occurrence interaction of attributes.

[0053] 2. Transformation of initial embedding vector

[0054] The original user online behavior data and user social network data are usually composed of multimodal data, such as structured data, text, audio, pictures, etc. Specifically, for structured data, it is discretized into attribute values, and then the corresponding word vector is queried from the prior pre-trained word vector as the initial embedding vector; for text data, the natural language analysis tool set CoreNLP is used to convert the corresponding text information into the initial embedding vector; for audio data, its Mel-frequency cepstral coefficient MFCC features are extracted as the initial embedding vector; for image data, a convolutional neural network is used to convert its corresponding pixel matrix into the initial embedding vector. Note that the fixed-length vector initialized to the node allows the model to achieve the function of inductive learning under the same set of learned model weights, that is, to represent the embedding of invisible nodes in the current graph. Finally, a low-dimensional dense vector is generated for each subject, event, and attribute node by randomly inputting the initial embedding vector into a hidden layer feedforward network, denoted as X∈R q×d , that is, we get the embedding matrix, where d is the dimension of the initial embedding vector and q is the number of all nodes in the graph.

[0055] 3. Anti-fraud detection model

[0056] In the anti-fraud detection model, the hidden layer representation is learned through the established graph neural network hidden layer based on the attention mechanism, and the event representation is updated through the designed temporal self-attention mechanism hidden layer.

[0057] Based on the embedding matrix obtained in the previous step, the adjacency matrix and the corresponding feature matrix corresponding to the micro-event graph can be obtained, so as to obtain the hidden layer representation and event representation of each node in the graph through the graph neural network.

[0058] In this paper, the hidden layer of the attention-based graph neural network consists of two parts: a neighbor information attention mechanism and a self-information retention mechanism. In the neighbor information attention mechanism, it is assumed that different relationships in the micro-event graph contribute differently to a node. In the self-information retention mechanism, it is assumed that the hidden layer representation of a node is an aggregate of the node's own information and the information of each of its neighboring nodes.

[0059] Given a node v in the micro-event graph i ∈G (G represents the microscopic event map), let x 0 i ∈R d Represents the initial vector obtained from the original embedding matrix X, where d is the dimension of the initial embedding vector. i ) is the node v i The set of neighbor nodes in G through the relationship r. The hidden layer representation of the node embedded in the l+1 layer is recorded as Then the hidden layer representation of the l+1th layer can be expressed as:

[0060]

[0061] The neighbor information is transmitted through the relevant attention weight α and the hidden network weight matrix W, σ() represents a hidden layer of the graph neural network, α ij is node v i and v j The attention weight of the corresponding edge between can be calculated by the following formula:

[0062]

[0063] in h is the number of hidden layers in the graph neural network.

[0064] Next, the information carried by the node itself is aggregated with the information of each neighboring node, as shown in the following formula:

[0065]

[0066] Since events in reality occur in a sequential order, it is necessary to learn the sequence correlation between events. This paper proposes a temporal self-attention mechanism hidden layer to generate event representations with time information. Given the hidden layer representation of a series of events that occur to subject u in the time period [a:b] in the subject layer, denoted as V u a：b =[v a , v a+1 ,…,v b ], where v t ∈R d , a≤t≤b, d is the embedding dimension of the hidden layer representation. The output of the hidden layer of the temporal self-attention mechanism is the event representation matrix containing temporal information, denoted as Z u a：b =[z a , z a+1 ,…,z b ], where z t ∈R d The main goal of the hidden layer of the temporal self-attention mechanism is to simulate how events in different time periods in the current event sequence affect future events differently. For each event segment t, the embedding v t , let all events that occurred before time period t participate in the process of transmitting information to it, but do not allow v t For future time period events v t+1 , v t+2 ,…,v b Transfer information. We use scaled dotproduct attention (a commonly used attention function mechanism) to generate sequential event embeddings, where queries, keys, and values ​​are the initial embedding vectors.

[0067] First learn three linear projection matrices W que ∈R d×d , W key ∈R d×d , and W val ∈R d×d , convert queries, keys and values ​​into their respective spaces. For each t-th item embedding v t ∈V u a：b (a≤t≤b), all events before time t (including time t) are included in the calculation, but v is not allowed t In the future time period, the event is involved in the calculation at time t+1, t+2, ..., b. For the sequence event embedding matrix V u a：b , learn its attention weight matrix β ua：b ∈R T×T , where T = a-b+1 is the number of events in time period a to b. Output event embedding matrix Z u a：b ∈R T×d The calculation is as follows:

[0068]

[0069]

[0070]

[0071] in, Is a mask matrix, the elements in the matrix are negative infinity or zero, when a≤t i ≤t j The mask matrix is ​​used to capture the order of events in historical events.

[0072] The anti-fraud detection model constructed above is trained based on historical data to obtain the optimal model parameters.

[0073] 4. Fraud Prediction

[0074] Based on the above anti-fraud detection model, we can obtain the hidden layer representation corresponding to the main layer of the event to be detected, which is denoted as x u , and the updated event representation, denoted as x z By performing a dot product between the hidden layer representation corresponding to the subject layer and the event representation to be detected, the resulting dot product is transformed by sigmoid, and then the fraud label y' is obtained according to the set threshold. The specific calculation method is as follows:

[0075] y′=κ(sigmoid(x u ·x z )),

[0076] where κ() is the threshold function.

[0077] In a specific implementation, the threshold value may be set to 0.5, a value greater than 0.5 may be set to 1, and a value less than or equal to 0.5 may be set to 0.

[0078] The above method was verified and tested on a real telecommunications network fraud dataset, and the recall rate (True Positive Rate) and the F1-score indicator were obtained when the disturbance rate (False Positive Rate) was less than 1%, 0.5%, 0.1% and 0.05%, respectively, to comprehensively evaluate the anti-fraud performance of the present invention. This method outperformed previous studies in this anti-fraud performance indicator and had good robustness.

[0079] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0080] The above describes in detail the preferred embodiments of the present invention. It should be understood that those skilled in the art can make numerous modifications and variations based on the concepts of the present invention without inventive effort. Therefore, any technical solutions that can be derived by those skilled in the art through logical analysis, reasoning, or limited experimentation based on the concepts of the present invention and the prior art should be within the scope of protection defined by the claims.

Claims

1. A fine-grained telecommunication network anti-fraud detection method based on micro-event graph, characterized in that: The method comprises the following steps: Obtain telecommunication network data corresponding to the event to be detected and construct the corresponding micro-event graph; Convert the nodes in the micro-event graph into initial embedding vectors; The embedding vector is used as input to an anti-fraud detection model, the anti-fraud detection model is constructed based on a graph neural network, a hidden layer based on an attention mechanism is used to obtain a hidden layer representation based on the embedding vector, and a hidden layer using a temporal self-attention mechanism is used to update the hidden layer representation to obtain an event representation; Performing a dot product between the hidden layer representation and the event representation, performing a sigmoid transform on the resulting dot product, and comparing the result with a set threshold to obtain a fraud label; Based on the completeness subspace partitioning method, a three-layer network structure including the subject layer, event layer and attribute layer is constructed, and the intra-layer associations of each layer and the inter-layer associations centered on events are designed to construct the micro-event map. The completeness subspace partitioning method is specifically as follows: The subject space is divided into a virtual subject sublayer and a real subject sublayer, the event space is divided into a behavior event sublayer and a state event sublayer, and the attribute space is divided into an identification attribute sublayer and a description attribute sublayer; The intra-layer association includes subject prior association, event temporal association and attribute co-occurrence association, and the inter-layer association includes subject event mapping association and event attribute mapping association; The hidden layer based on the attention mechanism includes two parts: the neighbor information attention mechanism and the own information retention mechanism; The event representation is obtained by using the temporal self-attention mechanism hidden layer based on the hidden layer representation update: Get the hidden layer representation of a series of events that occurred to subject u in the time period [a:b], denoted as Vu a:b =[v a ,v a+1 ,…,v b ], using the scaled dotproduct attention function to generate sequential event embeddings and obtain event representations, where for v t ∈V ua:b , allowing the v t Participate in the calculation of all events before and including time t, but v is not allowed t Participate in the calculation of events in the future time period of time t.

2. The fine-grained telecommunication network anti-fraud detection method based on microscopic event graph according to claim 1 is characterized in that: The telecommunications network data includes user online behavior data and user social network data.

3. The fine-grained telecommunication network anti-fraud detection method based on micro-event graph according to claim 1 is characterized in that: The embedding vector is obtained by performing corresponding processing based on the modality of telecommunications network data. For structured data, it is discretized into attribute values, and then the corresponding word vector is queried from the prior pre-trained word vector as the initial embedding vector; for text data, the natural language analysis tool set CoreNLP is used to convert the corresponding text information into the initial embedding vector; for audio data, its Mel-frequency cepstral coefficient MFCC features are extracted as the initial embedding vector; for image data, a convolutional neural network is used to convert its corresponding pixel matrix into the initial embedding vector.

4. The fine-grained telecommunication network anti-fraud detection method based on micro-event graph according to claim 1 is characterized in that: The hidden layer representation is expressed as: in, is the node v in the micro-event graph i The hidden layer representation of the l+1th and lth hidden layers, is the node v in the micro-event graph j The hidden layer representation of the lth hidden layer, α ij is node v i and v j The attention weight of the corresponding edge between them, σ() represents a hidden layer of the graph neural network, Γr(v i ) is the node v i The set of neighbor nodes through relationship r, W is the hidden layer network weight matrix.

5. The fine-grained telecommunication network anti-fraud detection method based on micro-event graph according to claim 1 is characterized in that: The threshold value is set to 0.5.

Images