A telecommunication fraud security federation detection method integrating homogeneous graph and bipartite graph

Abstract

The present invention relates to a secure federal telecommunication fraud detection method integrating homogeneous graph and bipartite graph, belonging to the field of big data analysis and mining, S1: based on the user service data of telecommunication operators, extracting and preprocessing the user's voice call data, short message communication data and mobile phone application access data; S2: constructing a telecommunication user social network homogeneous graph and a user mobile phone application bipartite graph data set; S3: constructing a homogeneous graph embedding network for the social network homogeneous graph, constructing a bipartite graph embedding network for the user access mobile phone application bipartite graph, sampling user nodes to obtain neighbor node co-occurrence sequences, iteratively training to obtain embedding representations of each node, and integrating them as the user's embedding representation; S4: different participants extract local telecommunication user features according to local data characteristics, adopt a secure federal gradient boosting tree classification model to jointly train local data of different institutions, and output the final prediction result of fraudulent numbers.

Description

Technical Field

[0001] The present invention belongs to the field of big data analysis and mining, and relates to a telecommunications fraud security federation detection method that integrates a homogeneous graph and a bipartite graph. Background Art

[0002] With the development of mobile communications and the popularization of various network applications, the global telecommunications network fraud situation has become increasingly serious, and there is a trend of gradually moving towards high technology and transforming into network fraud. With the rapid development of Internet technology today, telecommunications network fraud has increasingly become one of the "chronic diseases" of society in countries around the world. At present, the implementation of global telecommunications network fraud is still mainly based on telephone contacts, and it is increasingly showing new characteristics and new problems such as intelligence, industrialization, and homogeneity. The targets of fraud are also gradually changing from casting a wide net to precise fraud. The fraud methods are also gradually spreading from phone calls, text messages, and e-mails to social networking sites and mobile phone applications. Various fraud methods are constantly being updated, and technical confrontation continues to increase. Fraud scripts keep up with social hot spots and personal privacy, and the fraud model is gradually changing from domestic fraud to cross-border fraud.

[0003] At present, there are two main solutions for fraud number detection in the industry: rule-based expert systems and machine learning-based model systems. Rule-based expert systems require anti-fraud experts to manually analyze a large amount of normal and abnormal telecommunications data, accurately identify the fraudulent behavior of fraudsters, find important features that can effectively distinguish whether it is fraud, and write expert rules to detect fraudulent behavior. Therefore, rule-based expert systems strongly rely on the professional knowledge and business knowledge of anti-fraud experts. If experts cannot detect increasingly complex fraud patterns in a timely and sensitive manner, it will cause huge losses.

[0004] With the continuous expansion of data scale and the continuous enhancement of machine computing power, model systems based on machine learning have emerged. Models based on machine learning usually perform feature analysis based on historical transaction data, and then use machine learning classification algorithms to train and evaluate the model on the feature data set, and then apply it to fraud number detection. Whether it is a rule-based expert system or a model system based on machine learning, both discover recurring individual behavior patterns in transaction fraud from historical data. With the increasing professionalization of telecommunications fraud, fraudsters can evade fraud detection by changing their own fraudulent methods, but it is difficult for fraudsters to change all their associations. When the association network covers a large area, fraudsters will reveal clues even if they are careful. Therefore, in the context of large-scale data, how to mine effective features to improve the effect of model fraud detection is a new direction currently explored by scientific researchers.

[0005] As data security is increasingly valued, it is often difficult to directly use telecom big data. There are difficulties in data integration between operators and related companies, and even between different business departments of the same organization. Therefore, joint training of telecom user feature data extracted from different departments is also a current research focus. Summary of the invention

[0006] In view of this, in order to make full use of the communication business data of each operator and the fraud number label data to identify fraud numbers, the present invention proposes a fraud number feature extraction and classification method based on the voice and SMS social graph and the mobile phone application access bipartite graph based on graph embedding learning.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] A telecommunication fraud security federation detection method integrating homogeneous graph and bipartite graph comprises the following steps:

[0009] S1: Based on the user service data of telecom operators, extract the user's voice call data, SMS communication data and mobile application access data, and perform pre-processing;

[0010] S2: Use the preprocessed data to construct a telecom user social network homogeneous graph and a user mobile application bipartite graph dataset. The graph dataset includes a voice social network homogeneous graph, a text message social network homogeneous graph, and a mobile application access bipartite graph. Figure 3 Types of weighted graphs, where edge weights are set based on the characteristics of different businesses to extract statistical features and aggregate weights;

[0011] S3: Construct a homogeneous graph embedding network for the homogeneous graph of social networks, and a bipartite graph embedding network for the bipartite graph of users visiting mobile applications. Use graph embedding learning to sample user nodes to obtain the co-occurrence sequence of neighbor nodes, and then reconstruct the embedding function and iteratively train the co-occurrence information negative sampling to obtain the embedding representation of each node; fuse the embedded features obtained by training as the user's embedding representation;

[0012] S4: Different participants extract local telecom user features based on local data characteristics, and use a secure federated gradient boosting tree classification model to jointly train local data from different institutions; sample data between different institutions are encrypted through a reliable third-party server for data sample alignment and encryption model parameter exchange, thereby achieving multi-party model joint training. A two-stage training method is used in the training process, in which the first stage of training is used to screen features, and the second stage of training is used to classify the screened features and output the final prediction results of fraudulent numbers.

[0013] Further, step S1 specifically includes: constructing a fraud number detection data set using different business data of users collected from telecom operators; dividing the data into the following four categories according to different business data characteristics: user basic information data, voice call data, SMS communication data, and mobile application access data; performing data cleaning operations on the collected data, including outlier processing, missing value processing, and normalization processing; and at the same time, labeling the extracted telecom users according to the telecom fraud reporting information that has been mastered, with fraud users labeled as 1 and non-fraud users labeled as 0.

[0014] Further, in step S2, the process of constructing the homogeneous graphs of voice and SMS social networks and the bipartite graph of user access to mobile applications includes: for voice and SMS data, extracting the telecommunications user voice social graph G1 according to the caller and callee relationship of voice calls; constructing the SMS social graph G2 according to the uplink and downlink sending and receiving relationships of SMS communications; for user Internet log data, aggregating and merging the data according to the records of user access to mobile applications to obtain the mobile application access bipartite graph G3; the three types of graph data are all in the form of weighted graphs, wherein the edge weights of the voice social graph are weighted and evaluated according to the communication relationship characteristics between the caller and the callee, the edge weights of the SMS social graph are weighted and evaluated according to the communication relationship characteristics of the sending and receiving users, and the edge weights of the user access to mobile application bipartite graph are weighted and evaluated according to the Internet situation characteristics of the user accessing the mobile application.

[0015] Further, the step S2 uses the preprocessed data to construct a telecom user social network homogeneous graph and a user mobile phone application bipartite graph dataset, specifically including:

[0016] Voice social network graph G1 = (U1, E1) and SMS social network G2 = (U2, E2), where U i is the set of user nodes, E i is a set of user-user communication relationships; each edge (i, j)∈E in the edge set has a pair of user nodes (u i ,u j ), and has a weight w ij ≥0, represents the interaction between two users;

[0017] For the user pair (u i ,u j ) By extracting (u i ,u j ) call feature set The feature set F1 includes the call count feature f1 (1) , Total call duration characteristics Average call duration characteristics Call time characteristics Whether long distance call feature Characteristics of caller online time The called party's online time feature f7 (1) ; Then, the weight of the edge is obtained by weighted summing of all elements in the set. The weight calculation formula is as follows:

[0018]

[0019] where α i is the weighting coefficient, n is the total number of voice call features extracted;

[0020] For the directed edge weights of the SMS social network graph G2 By extracting (u i ,u j ) call feature set Feature set F2 includes the sending times feature f1 (2) 、Characteristics of total number of SMS bytes Characteristics of average number of bytes of SMS SMS sending time characteristics Is it a verification code SMS feature? Characteristics of the sender's online time Characteristics of the receiver's online time Then, the weight of the edge is obtained by weighted summing of all elements in the set. The weight calculation formula is as follows:

[0021]

[0022] where β i is the weighting coefficient, m is the total number of SMS communication features extracted;

[0023] Mobile application access bipartite graph G3 = (U3, V3, E3), where U3 represents the user node set and V3 represents the mobile application node set; Represents the set of edges that relate users to mobile applications, each edge has a non-negative weight w ij ≥0, indicating the Internet usage of users accessing mobile applications; for the user-mobile application relationship pair (u i ,v j ) By extracting (u i ,v j ) Feature set F3 includes visit count feature f1 (3) , total visit duration characteristics Average visit duration characteristics Access total traffic consumption characteristics Average consumption flow characteristics User online time characteristics Mobile Application Category Characteristics Then, the weight of the edge is obtained by weighted summing of all elements in the set. The weight calculation formula is as follows:

[0024]

[0025] where γ i is the weighting coefficient, and k is the total number of features extracted from the user access APP data.

[0026] Further, step S3 specifically includes the following steps:

[0027] S31: according to the constructed social network homogeneous graph, SMS social network homogeneous graph and mobile application access bipartite graph, corresponding graph embedding models are used to perform graph embedding training on user nodes;

[0028] S32: Find the neighbor sequence set of the user node according to the first-order and second-order neighbor similarities between the nodes of the homogeneous graph, and find the neighbor sequence set of the user node according to the explicit relationship and implicit relationship of the bipartite graph;

[0029] S33: The node embedding obtained by the first-order similarity training and the node embedding obtained by the second-order training are concatenated to obtain the embedding vector of the user node of the homogeneous graph, and the explicit relationship and the implicit relationship are jointly optimized and trained to obtain the embedding vector of the user node of the bipartite graph.

[0030] Furthermore, in step S3, for a homogeneous graph, the user node is mapped from the graph domain to the embedding domain, that is, when the user node index i is given, the node u is directly obtained. i Embedded i , the mapping function is expressed as:

[0031]

[0032] Among them, e i ∈{0,1} N Represents user node u i One-hot encoding, where N = |U| represents the number of user nodes; e i Represents the corresponding i-th element e in the vector i [i] is 1, and the other elements are 0; W N×d is the embedding parameter matrix to be learned, where d is the dimension of the embedding; the i-th row of the matrix W is the node u i Embedded representation of ;

[0033] For the bipartite graph, since there are two types of node sets in the original bipartite graph G3, considering that the fraud number detection task only needs to focus on the user node features, it is necessary to split the homogeneous graph based on user nodes G U As an implicit relationship, feature extraction is performed, and then each node of the bipartite graph is mapped from the graph domain to the embedding domain, using u i With v i Represents user node u i ∈U3 and mobile application node v i ∈V3 embedding vector;

[0034] Extract key structural information of user nodes in the graph domain The homogeneous graph network reconstructs the domain information of nodes based on the first-order and second-order similarities of nodes. The bipartite graph network is based on the explicit and implicit relationships between the nodes in the graph domain to model and extract the key structural information of the user nodes in the graph domain.

[0035] Reconstruct the extracted graph-domain co-occurrence information using the embedded representation of the embedded domain and The reconstructed information is represented as and

[0036] Based on co-occurrence information and reconstruction information Optimize the objective function and learn all the parameters involved in the mapping function and the reconstructor;

[0037] For homogeneous graphs, the objective function that needs to be optimized for first-order similarity is:

[0038]

[0039] The objective function that needs to be optimized for the second-order similarity is:

[0040]

[0041] For the bipartite graph G3, the optimization objective function for explicit relationship modeling is:

[0042]

[0043] The optimization objective function for implicit relationship modeling is:

[0044]

[0045] Based on co-occurrence information and reconstruction information The objective function O5 is optimized to learn all the parameters involved in the mapping function and the reconstructor. The final joint optimization overall objective function of the bipartite graph is:

[0046] maximize O5=-μO3+ηO4

[0047] Among them, μ and η are hyperparameters to be specified to combine different components in the joint optimization.

[0048] Further, step S4 specifically includes the following steps:

[0049] S41: The final node embedding features obtained by concatenating the embedding vectors of the homogeneous graph and the bipartite graph are input into the secure federated gradient boosting tree classification model for initial training in combination with the user basic features and label information;

[0050] S42: Sort the features obtained from the first stage of training by importance, select the top n features, and distribute them to different participants for feature selection;

[0051] S43: After different participants have performed feature screening, two-stage federated gradient boosting tree classification training is performed again, and the fraud number prediction results are output;

[0052] S44: Process the final classification result of the user and output a list of suspected fraud numbers.

[0053] Furthermore, the two-stage training process of the secure federated gradient boosting tree model includes encrypted sample alignment and encrypted model training; during the training process, the intermediate calculation results and parameters of the model are encrypted and exchanged through the central server to finally obtain the optimal model parameter combination; the encryption method is based on the RSA algorithm and hash function; during the training process, local data is only calculated locally, and the calculation results are encrypted and transmitted to the central server, and other participants cannot obtain local data details. Therefore, the security of local data can be guaranteed.

[0054] The beneficial effect of the present invention is that the present invention solves the problem of extracting features from the interactive features of the historical call bills and online data of telecommunications users in the fraudulent user detection task, and combines the basic information features of users collected by feature engineering for classification prediction of machine learning models. A more diverse data feature extraction method is provided for the traditional fraud number detection task. The present invention can be integrated and supplemented with other traditional fraud number detection models, and has good generalization ability in the fraud number detection task. In addition, the data required to be collected by the present invention can be processed in the form of anonymized encrypted data, and the same feature extraction effect can also be achieved. To a certain extent, it has positive practical significance for the protection of user privacy and security. The present invention can combine the data of different telecommunications operators and other relevant institutions as model input for joint training, and the secure federated machine learning model used can ensure that the data of each participant will not be leaked to each other. It can ensure data security while making full use of multi-party data for telecommunications fraud detection. For the current scenario where the use of privacy data is becoming more and more stringent, this solution can well solve the problems of data isolation and data fragmentation. The present invention adopts a two-stage training method in multi-party joint modeling, which can perform feature screening on multi-party data features, and can improve the generalization ability of the model to a certain extent. This method belongs to a mode of model optimization and can be applied to different training models.

[0055] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0057] Figure 1 It is a schematic diagram of the steps of the method of the present invention;

[0058] Figure 2 It is a schematic diagram of the overall process of the method of the present invention;

[0059] Figure 3 is a schematic diagram of a voice SMS social graph embedding module used in the present invention;

[0060] Figure 4 It is a schematic diagram of a mobile phone application accessing a bipartite graph embedding module adopted by the present invention;

[0061] Figure 5 is a schematic diagram of a local machine learning classification module adopted by the present invention;

[0062] Figure 6 is a schematic diagram of a secure federated multi-party training model used in the present invention;

[0063] Figure 7 It is a schematic diagram of secure federated encryption training in the present invention. DETAILED DESCRIPTION

[0064] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0065] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0066] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0067] The present invention proposes a telecommunication fraud security federation detection method that integrates homogeneous graphs and bipartite graphs. Figure 1 As shown, the specific steps include:

[0068] The fraud number detection dataset is constructed from different business data of users collected from telecom operators. First, the data is divided into the following four categories according to the characteristics of different business data: user information data, voice call data, SMS communication data, and mobile application access data. The collected multivariate data is cleaned by outlier processing, missing value processing, and normalization. At the same time, the extracted telecom users are labeled according to the telecom fraud reporting information that has been mastered. Fraud users are labeled as 1 and non-fraud users are labeled as 0.

[0069] The preprocessed data is used to construct a telecom user social network homogeneous graph and a user mobile application bipartite graph dataset. The dataset contains user label information for fraud number binary classification training and testing. The specific construction process is as follows:

[0070] Voice social network graph G1 = (U1, E1) and SMS social network G2 = (U2, E2), where U i is the set of user nodes, E i is a set of user-user communication relationships. Each edge (i, j)∈E in the edge set has a pair of user nodes (u i ,u j ), and has a weight, namely w ij ≥0, represents the interaction between two users. For the user pair (u i ,u j ) By extracting (u i ,u j ) call feature set The feature set F1 includes the call count feature f1 (1) , total call duration characteristics Average call duration characteristics Call time characteristics Whether long distance call feature Characteristics of caller online time Characteristics of the called party's online time Etc., then perform weighted summation on all elements in the set to get the weight of the edge. The weight calculation formula is as follows:

[0071]

[0072] where α i is the weighting coefficient, and n is the total number of extracted voice call features. Similarly, for the directed edge weights of the SMS social network graph G2 By extracting (u i ,u j ) call feature set Feature set F2 includes the sending times feature f1(2) , total number of SMS bytes characteristics Characteristics of average number of bytes of SMS SMS sending time characteristics Is it a verification code SMS feature? Characteristics of the sender's online time Characteristics of the receiver's online time Etc., then perform weighted summation on all elements in the set to get the weight of the edge. The weight calculation formula is as follows:

[0073]

[0074] where β i is the weighting coefficient, and m is the total number of SMS communication features extracted.

[0075] The mobile application access bipartite graph G3 = (U3, V3, E3), where U3 represents the user node set and V3 represents the mobile application node set. Represents the set of edges that relate users to mobile applications, each edge has a non-negative weight w ij ≥0, indicating the Internet usage of users accessing mobile applications. For the user-APP relationship pair (u i ,v j ) By extracting (u i ,v j ) Feature set F3 includes visit count feature f1 (3) , total visit duration feature Average visit duration characteristics Access total traffic consumption characteristics Average consumption flow characteristics User online time characteristics Mobile Application Category Characteristics Etc., then perform weighted summation on all elements in the set to get the weight of the edge. The weight calculation formula is as follows:

[0076]

[0077] where γ i is the weighting coefficient, and k is the total number of features extracted from the user access APP data.

[0078] A homogeneous graph embedding network is constructed for the voice and SMS social graph, and a bipartite graph embedding network is constructed for the mobile application access bipartite graph. Unsupervised learning is used to sample user nodes to obtain the co-occurrence sequence of neighbor nodes, and then the embedding representation of each node is obtained by reconstructing the embedding function and iterative training of co-occurrence information negative sampling.

[0079] The node embedding features output by each embedding model are spliced, and the sample data with label data is screened out. According to the label attribute, it is divided into training set and test set in proportion as the input of the classification model. Through iterative training of the model on the training set and test set, the optimal model is finally obtained for the classification prediction of fraudulent numbers. Finally, the model is used to predict other user data, and the prediction results are output to the suspected fraudulent number database for reference by operators.

[0080] The present invention also provides a telecommunication fraud security federation detection device that integrates homogeneous graphs and bipartite graphs, such as Figure 2 , including:

[0081] The original data collection module first connects to the operator's data warehouse, periodically extracts user communication data and user access to mobile application data through HiveSQL, and merges and summarizes the data records according to the time period to obtain three user communication tables and save them to the storage module. The three tables are voice call data, SMS communication data and mobile application traffic usage data.

[0082] The graph data preprocessing module periodically reads the voice call data table, SMS communication data table and mobile application traffic usage data table stored in the memory, extracts the interaction relationship between users and users and users and mobile applications in each table by merging and summarizing, and stores the three types of interaction graph data in the form of adjacency lists.

[0083] The graph embedding feature extraction module extracts features from the three types of graph structure data after the above processing into two types. The first type is the homogeneous graphs G1 and G2 of telecom user social networks based on voice and SMS data. The second type is the mobile application access bipartite graph G3 based on mobile application traffic usage.

[0084] Figure 3 Schematic diagram of the feature embedding network of homogeneous graphs. The specific steps for embedding feature extraction of homogeneous graphs G1 and G2 include:

[0085] Step 1: Node embedding mapping module is used to map user nodes from the graph domain to the embedding domain. That is, when the user node index i is given, the node u can be directly obtained. i Embedded i , the mapping function can be expressed as:

[0086]

[0087] Among them, e i ∈{0,1} N Represents user node u iOne-hot encoding of , where N = |U| represents the number of user nodes. i Represents the corresponding i-th element e in the vector i [i] is 1, and the other elements are 0. N×d is the embedding parameter matrix to be learned, where d is the dimension of the embedding. The i-th row of the matrix W is the node u i The embedded representation of .

[0088] Step 2: Graph domain co-occurrence information extraction module, used to extract key structural information of user nodes in the graph domain That is, reconstruct the domain information of the node based on the first-order and second-order similarities of the node

[0089] Among them, the first-order similarity refers to the local pairwise similarity between user nodes in the network, which is formally described as i with u j If there is a direct edge between them, the weight of the direct edge is w ij It is the similarity between two vertices; if there is no direct edge, the first-order similarity is 0. i with u j The undirected edges between them have a similarity joint probability distribution defined as:

[0090]

[0091] In the embedding domain, the empirical distribution between nodes is defined as follows:

[0092]

[0093] Among them, v i ∈R d Represents node u i A d-dimensional vector representation in the embedding domain.

[0094] The second-order similarity refers to the similarity between the neighboring nodes of the user node in the network. The formal definition is: let p u =(w u,1 ,w u,2 ,…,w u,|V| ) represents the first-order similarity between node u and all other nodes, then the second-order similarity between node u and v can be expressed as p u With p v If there is no common neighbor node between nodes u and v, the second-order similarity between u and v is 0. The second-order similarity can express the global characteristics of the graph.

[0095] For the second-order similarity, two embedding vectors need to be introduced for each node to represent it. One is the embedding vector representing the node itself, that is, the central node embedding u cen ; The other is the embedding vector of the context node of other nodes, that is, the neighborhood node embedding u con . Therefore, in the graph domain, for any edge (u i ,u j )∈E, the joint distribution of the two is defined as:

[0096]

[0097] Among them, w ij For node u i with u j The edge weight, d i For vertex u i The number of neighbor nodes, N(u i ) is the node u i The domain node collection.

[0098] In the embedded domain, the conditional probability between nodes is u i When u exists j The probability of existence is defined as:

[0099]

[0100] in, Represents node u i The central node embedding of Represents node u i Neighborhood node embedding, |V| represents the number of domain nodes.

[0101] Step 3: Embedding domain information reconstruction module, using the embedding representation of the embedded domain to reconstruct the extracted graph domain co-occurrence information The reconstructed information is represented as

[0102] Step 4: Objective function optimization module, based on co-occurrence information and reconstruction information The objective function is optimized to learn all the parameters involved in the mapping function and the reconstructor.

[0103] Among them, the first-order similarity uses KL divergence to measure the difference between two probability distributions. After ignoring the constant term, the optimization objective function of the first-order similarity is:

[0104]

[0105] The second-order similarity also uses KL divergence to calculate the differences between different distributions. After ignoring the constant term, the optimization objective function of the second-order similarity is:

[0106]

[0107] Figure 4 This is a schematic diagram of the network architecture for bipartite graph embedding. The specific steps for embedding feature extraction of the bipartite graph G3 include:

[0108] Step 1: Bipartite graph reconstruction module. There are two types of node sets in the original bipartite graph G3. Considering that the fraud number detection task only needs to focus on the user node features, in this module, only the homogeneous graph based on user nodes needs to be split out G U Feature extraction as implicit relations.

[0109] Step 2: Node embedding mapping module is used to map each node of the bipartite graph from the graph domain to the embedding domain, using u i With v i Represents user node u i ∈U3 and mobile application node v i ∈V3 is the embedding vector.

[0110] Step 3: Graph domain co-occurrence information extraction module, used to extract key structural information of user nodes in the graph domain

[0111] Step 4: Embedding domain information reconstruction module, using the embedding representation of the embedded domain to reconstruct the extracted graph domain co-occurrence information The reconstructed information is represented as

[0112] To model the explicit relationship of the bipartite graph G3, given a node pair (u i ,v j )∈E3, where u i ∈U3 and v3∈V3, the joint probability between the two nodes in the graph domain is:

[0113]

[0114] The empirical distribution of nodes in the embedded domain is:

[0115]

[0116] For explicit relations, KL divergence is used to measure the difference between the distribution of the graph domain and the embedded domain, so the objective function is:

[0117]

[0118] After ignoring the constant term, the final objective function is:

[0119]

[0120] For the implicit relation homogeneous graph G of the bipartite graph U , using homogeneous graph embedding based on first-order similarity for training optimization. The joint probability distribution of user nodes, the empirical distribution of embedded domain nodes, and the objective function to be optimized are as follows:

[0121]

[0122]

[0123]

[0124] Step 4: Objective function optimization module, based on co-occurrence information and reconstruction information The objective function O5 is optimized to learn all the parameters involved in the mapping function and the reconstructor. The final joint optimization overall objective function is:

[0125] maximize O5=-μO3+ηO4

[0126] Among them, O3 is the explicit relationship objective function of the bipartite graph nodes, O4 is the implicit relationship objective function of the bipartite graph nodes, μ and η are hyperparameters to be specified, which are used to combine different components in the joint optimization.

[0127] Through iterative optimization of the above graph embedding module, three types of embedded vector feature representations X1, X2, and X3 of users are obtained.

[0128] Figure 5 It is the local classification model architecture for fraud user detection adopted by the present invention. Figure 6 A joint training model architecture for joint multi-party local models for secure federated learning. For the local models of multiple participants, first, through the fraud user detection module, the user basic information feature X0 organized by the data processing module and the user embedded features X1, X2, and X3 are spliced ​​to obtain a telecommunications user feature combination table, and the telecommunications user label data obtained by combining the actual alarm information is combined to form a fraud user detection data set. For multiple participants, the same method is used to construct a sample data set. After that, each participant encrypts the sample entity alignment of the operation process through the central server as the coordinator, and encrypts and exchanges the operation results of the local data models of each party. Through continuous iterative optimization, the optimal model parameters are finally obtained for the result prediction of fraud numbers, and the users predicted as fraud numbers are exported to the suspicious user list for further research and use. In this module, the local classification models used by various institutions include logistic regression, decision trees, deep learning networks, ensemble learning, etc.

[0129] Figure 7The diagram is a diagram of the secure federation multi-party joint encryption training. The training process uses a secondary training method, in which the first training is used for feature screening. After the first training is completed, the features of each participant are given feature importance weights, and the features are sorted according to the values ​​to select the top 50 features. Then, the participants with these features are asked to conduct secondary joint modeling, and the results of the secondary training are provided as output to the label owner operator. The operator extracts the list of fraudulent numbers from the prediction results as a reference.

[0130] In a preferred embodiment, when a new type of telecommunications fraud emerges, the new fraud samples are classified and labeled, and sample data of normal users and new fraud users are selected and input into the trained model. The model parameters are iteratively optimized so that the model can adapt to the detection of new types of fraud.

[0131] The embodiment of the present invention can implement a telecommunication user fraud detection method based on a voice and SMS social graph and a mobile phone application access bipartite graph by selecting data sets of different types and different numbers in different processes, and detect and identify fraudulent users among telecommunication users.

[0132] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. A telecommunication fraud security federation detection method integrating homogeneous graph and bipartite graph, characterized by: The following steps are involved: S1: Based on the user service data of telecom operators, extract the user's voice call data, SMS communication data and mobile application access data, and perform pre-processing; S2: Use the preprocessed data to construct a telecom user social network homogeneous graph and a user mobile application bipartite graph dataset. The graph dataset includes three types of weighted graphs: voice social network homogeneous graph, SMS social network homogeneous graph, and mobile application access bipartite graph. The edge weights are set according to the characteristics of different services to extract statistical features and aggregate weights. S3: Construct a homogeneous graph embedding network for the homogeneous graph of social networks, and a bipartite graph embedding network for the bipartite graph of users visiting mobile applications. Use graph embedding learning to sample user nodes to obtain the co-occurrence sequence of neighbor nodes, and then reconstruct the embedding function and iteratively train the co-occurrence information negative sampling to obtain the embedding representation of each node; fuse the embedded features obtained by training as the user's embedding representation; S4: Different participants extract local telecom user features based on local data characteristics, and use a secure federated gradient boosting tree classification model to jointly train local data from different institutions. Sample data from different institutions are encrypted for data sample alignment and encryption model parameter exchange through a reliable third-party server, thereby achieving multi-party model joint training. A two-stage training method is used in the training process, in which the first stage of training is used to screen features, and the second stage of training is used to classify the screened features and output the final prediction results of fraudulent numbers. Step S3 specifically includes the following steps: S31: according to the constructed social network homogeneous graph, SMS social network homogeneous graph and mobile application access bipartite graph, corresponding graph embedding models are used to perform graph embedding training on user nodes; S32: Find the neighbor sequence set of the user node according to the first-order and second-order neighbor similarities between the nodes of the homogeneous graph, and find the neighbor sequence set of the user node according to the explicit relationship and implicit relationship of the bipartite graph; S33: respectively concatenate the node embedding obtained by the first-order similarity training and the node embedding obtained by the second-order training to obtain the embedding vector of the user node of the homogeneous graph, and jointly optimize the explicit relationship and the implicit relationship to obtain the embedding vector of the user node of the bipartite graph; In step S3, for a homogeneous graph, the user node is mapped from the graph domain to the embedding domain, that is, when the user node index i is given, the node u is directly obtained i Embedded i , the mapping function is expressed as: Among them, e i ∈{0,1} N Represents user node u i One-hot encoding, where N = |U| represents the number of user nodes; W N×d is the embedding parameter matrix to be learned, where d is the dimension of the embedding; the i-th row of the matrix W is the node u i Embedding representation of ; For bipartite graphs, split the homogeneous graph based on user nodes into G U As an implicit relationship, feature extraction is performed, and then each node of the bipartite graph is mapped from the graph domain to the embedding domain, using u i With v i Represents user node u i ∈U3 and mobile application node v i ∈V3 embedding vector; Extract key structural information of user nodes in the graph domain The homogeneous graph network reconstructs the domain information of nodes based on the first-order and second-order similarities of nodes. The bipartite graph network is based on the explicit and implicit relationships between the nodes in the graph domain to model and extract the key structural information of the user nodes in the graph domain. Reconstruct the extracted graph-domain co-occurrence information using the embedded representation of the embedded domain and The reconstructed information is represented as and Based on co-occurrence information and reconstruction information Optimize the objective function and learn all the parameters involved in the mapping function and the reconstructor; For homogeneous graphs, the objective function that needs to be optimized for first-order similarity is: The objective function that needs to be optimized for the second-order similarity is: For the bipartite graph G3, the optimization objective function for explicit relationship modeling is: The optimization objective function for implicit relationship modeling is: Based on co-occurrence information and reconstruction information The objective function O5 is optimized to learn all the parameters involved in the mapping function and the reconstructor; the final joint optimization overall objective function of the bipartite graph is: maximize O5=-μO3+ηO4 Among them, μ and η are hyperparameters to be specified to combine different components in the joint optimization.

2. The telecommunication fraud security federation detection method integrating homogeneous graph and bipartite graph according to claim 1 is characterized by: Step S1 specifically includes: constructing a fraud number detection data set using different user service data collected from telecom operators; dividing the data into the following four categories according to different service data characteristics: user basic information data, voice call data, SMS communication data, and mobile application access data; performing data cleaning operations on the collected data, including outlier processing, missing value processing, and normalization processing; and marking the extracted telecom users according to the telecom fraud reporting information that has been mastered, with fraud users marked as 1 and non-fraud users marked as 0.

3. The telecommunication fraud security federation detection method integrating homogeneous graph and bipartite graph according to claim 1 is characterized by: In step S2, the process of constructing the homogeneous graphs of voice and SMS social networks and the bipartite graph of user access to mobile applications includes: for voice and SMS data, extracting the telecommunications user voice social graph G1 according to the caller and callee relationship of voice calls; constructing the SMS social graph G2 according to the uplink and downlink sending and receiving relationships of SMS communications; for user Internet log data, aggregating and merging the data according to the records of user access to mobile applications to obtain the mobile application access bipartite graph G3; the three types of graph data are all in the form of weighted graphs, wherein the edge weights of the voice social graph are weighted and evaluated according to the communication relationship characteristics between the caller and the callee, the edge weights of the SMS social graph are weighted and evaluated according to the communication relationship characteristics of the sending and receiving users, and the edge weights of the user access to mobile application bipartite graph are weighted and evaluated according to the Internet situation characteristics of the user accessing the mobile application.

4. The telecommunication fraud security federation detection method integrating homogeneous graph and bipartite graph according to claim 3 is characterized by: The step S2 uses the preprocessed data to construct a telecom user social network homogeneous graph and a user mobile application bipartite graph dataset, which specifically includes: Voice social network graph G1 = (U1, E1) and SMS social network G2 = (U2, E2), where U i is the set of user nodes, E i is a set of user-user communication relationships; each edge (i, j)∈E in the edge set has a pair of user nodes (u i ,u j ), and has a weight w ij ≥0, represents the interaction between two users; For the user pair (u i ,u j ) By extracting (u i ,u j ) call feature set F1 = {f1 (1) ,f2 (1) ,…,f n (1) }, feature set F1 includes call count feature f1 (1) , total call duration feature f2 (1) , average call duration feature f3 (1) 、Talk time feature f4 (1) 、Whether long distance call feature f5 (1) 、F6 Characteristics of the calling party's online time (1) 、F7: The called party's online time characteristics (1) ; Then, the weight of the edge is obtained by weighted summing of all elements in the set. The weight calculation formula is as follows: where α i is the weighting coefficient, n is the total number of voice call features extracted; For the directed edge weights of the SMS social network graph G2 By extracting (u i ,u j ) call feature set Feature set F2 includes the sending times feature f1 (2) 、SMS total bytes feature f2 (2) 、SMS average byte count feature f3 (2) 、SMS sending time period characteristics f4 (2) 、Is it a verification code SMS feature f5 (2) 、Sender's online time characteristics f6 (2) 、The receiver's online time characteristics f7 (2) ; Then, the weight of the edge is obtained by weighted summing of all elements in the set. The weight calculation formula is as follows: where β i is the weighting coefficient, m is the total number of SMS communication features extracted; Mobile application access bipartite graph G3 = (U3, V3, E3), where U3 represents the user node set and V3 represents the mobile application node set; Represents the set of edges that relate users to mobile applications, each edge has a non-negative weight w ij ≥0, indicating the Internet usage of users accessing mobile applications; for the user-mobile application relationship pair (u i ,v j ) By extracting (u i ,v j ) between the Internet access feature set F3 = {f1 (3) ,f2 (3) ,…,f k (3) }, feature set F3 includes visit count feature f1 (3) , total visit duration feature f2 (3) , average visit duration feature f3 (3) , visit total consumption flow feature f4 (3) , average consumption flow characteristic f5 (3) 、User online time characteristics f6 (3) 、Mobile application category features f7 (3) ; Then, the weight of the edge is obtained by weighted summing of all elements in the set. The weight calculation formula is as follows: where γ i is the weighting coefficient, and k is the total number of features extracted from the user access APP data.

5. The telecommunication fraud security federation detection method integrating homogeneous graph and bipartite graph according to claim 1 is characterized by: Step S4 specifically includes the following steps: S41: The final node embedding features obtained by concatenating the embedding vectors of the homogeneous graph and the bipartite graph are input into the secure federated gradient boosting tree classification model for initial training in combination with the user basic features and label information; S42: Sort the features obtained from the first stage of training by importance, select the top n features, and distribute them to different participants for feature selection; S43: After different participants have performed feature screening, two-stage federated gradient boosting tree classification training is performed again, and the fraud number prediction results are output; S44: Process the final classification result of the user and output a list of suspected fraud numbers.

6. The telecommunication fraud security federation detection method integrating homogeneous graph and bipartite graph according to claim 1 is characterized by: The two-stage training process of the secure federated gradient boosted tree model includes encrypted sample alignment and encrypted model training; During the training process, the intermediate calculation results and parameters of the model are encrypted and exchanged through the central server to finally obtain the optimal model parameter combination; the encryption method is based on the RSA algorithm and hash function; during the training process, local data is only calculated locally, and the calculation results are encrypted and transmitted to the central server. Other participants cannot obtain local data details.

Images