Method, apparatus and electronic device for obtaining graph node category

Abstract

The present disclosure discloses a method and device for obtaining a class of a graph node and an electronic device, and relates to the field of artificial intelligence, in particular to the field of deep learning. The specific implementation scheme is: performing neighbor sampling on a network graph according to a target node to generate at least one subgraph; grouping nodes in the subgraph according to labels of the nodes to generate node groups; extracting features of the nodes in the node groups to obtain a first feature vector; obtaining a class feature vector of the target node according to position information of the nodes in the node groups and the first feature vector, and determining a class of the target node. The embodiment of the present disclosure can group nodes in a subgraph according to label and order information, extract features of each node group, and obtain a class of a target node. The embodiment of the present disclosure can alleviate the problem of neighbor class imbalance, and improve the accuracy of node class recognition.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence, and more particularly to the field of deep learning. Background Technology

[0002] With the rapid development of internet finance, various forms of fraud have emerged, such as financial fraud and fake job scams. However, the increasing number of fraudulent activities poses a serious threat to the market, and identifying fraudulent activities is extremely difficult. Fraud detection has become a pressing issue in the mobile internet landscape. Due to its strong representation capabilities and robustness to structured data, graph analysis methods based on graph-structured data are applied to anomaly and fraud detection, identifying nodes that categorize fraud.

[0003] However, current technologies for node category detection are inefficient and have a high error rate. Summary of the Invention

[0004] This disclosure provides a method, apparatus, device, and storage medium for obtaining graph node categories.

[0005] According to a first aspect of this disclosure, a method for obtaining graph node categories is provided, comprising:

[0006] Neighbor sampling is performed on the network graph based on the target node to generate at least one subgraph;

[0007] The nodes are grouped according to their labels in the subgraph to generate node groups;

[0008] Extract the features of the node group to obtain the first feature vector;

[0009] The category of the target node is determined based on the location information of the node group and the first feature vector.

[0010] Optionally, determining the category of the target node based on the location information of the node group and the first feature vector includes:

[0011] Generate the category feature vector of the target node based on the location information of the node group and the first feature vector;

[0012] The category of the target node is determined based on its category feature vector.

[0013] Optionally, the network graph includes multiple nodes and multiple edges, and the multiple nodes are connected by the multiple edges. The step of sampling neighbors of the network graph based on the target node to generate at least one subgraph includes:

[0014] obtaining at least one first-order neighbor node of the target node, wherein the first-order neighbor node is connected to the target node through a corresponding edge;

[0015] determining at least one node connected to the first-order neighbor node through a corresponding edge as a second-order neighbor node;

[0016] generating the subgraph according to the target node, the first-order neighbor node and the second-order neighbor node.

[0017] Optionally, the grouping of the nodes in the subgraph according to the labels of the nodes to generate the node groups comprises:

[0018] obtaining the labels of the nodes in the subgraph, and generating the node groups according to the nodes with the same label and the same order.

[0019] Optionally, the labels comprise one or more of a fraud label, a benign label and an unknown label.

[0020] Optionally, the extracting of the features of the node groups to obtain the first feature vector comprises:

[0021] aggregating the features of the nodes in the node groups to obtain a second feature vector;

[0022] linearly mapping the second feature vector to generate the first feature vector.

[0023] Optionally, the generating of the category feature vector of the target node according to the position information of the node groups and the first feature vector comprises:

[0024] obtaining a position information vector according to the position information of the nodes in the node groups;

[0025] fusing the position information vector and the first feature vector to generate a third feature vector;

[0026] obtaining the category feature vector according to the third feature vector.

[0027] Optionally, the position information vector comprises a first position information vector, a second position information vector and a third position information vector, and the obtaining of the position information vector according to the position information of the nodes in the node groups comprises:

[0028] obtaining the first position information vector according to the properties of the edges in the subgraph corresponding to the node groups;

[0029] obtaining the second position information vector according to the orders of the nodes in the node groups;

[0030] obtaining the third position information vector according to the labels of the nodes in the node groups.

[0031] Optionally, the fusing the position information vector with the first feature vector comprises:

[0032] adding the first feature vector and the position information vector.

[0033] Optionally, the obtaining the category feature vector according to the third feature vector comprises:

[0034] encoding the third feature vector to generate at least one category feature sub-vector;

[0035] splicing the category feature sub-vectors to generate the category feature vector.

[0036] According to a second aspect of the present disclosure, a device for obtaining a category of a graph node is provided, comprising:

[0037] a sampling module configured to perform neighbor sampling on a network graph according to a target node to generate at least one subgraph;

[0038] a grouping module configured to group nodes in the subgraph according to labels of the nodes to generate a node group;

[0039] a feature extraction module configured to extract features of the node group to obtain a first feature vector;

[0040] a category obtaining module configured to determine a category of the target node according to position information of the node group and the first feature vector.

[0041] Optionally, the category obtaining module comprises:

[0042] a category feature vector obtaining submodule configured to generate a category feature vector of the target node according to the position information of the node group and the first feature vector;

[0043] a category obtaining submodule configured to determine the category of the target node according to the category feature vector of the target node.

[0044] Optionally, the network graph comprises a plurality of nodes and a plurality of edges, and the plurality of nodes are connected through the plurality of edges, and the sampling module comprises:

[0045] a first sampling submodule configured to obtain at least one first-order neighbor node of the target node, wherein the first-order neighbor node is connected to the target node through a corresponding edge;

[0046] a second sampling submodule configured to determine at least one node connected to the first-order neighbor node through a corresponding edge as a second-order neighbor node;

[0047] The subgraph generation sub-module is configured to generate the subgraph according to the target node, the first-order neighbor node and the second-order neighbor node.

[0048] Optionally, the grouping module comprises:

[0049] The grouping sub-module is configured to obtain labels of nodes in the subgraph, and generate the node group according to nodes with the same label and the same order.

[0050] Optionally, the label comprises one or more of a fraud label, a benign label and an unknown label.

[0051] Optionally, the feature extraction module comprises:

[0052] The first feature extraction sub-module is configured to aggregate features of nodes in the node group, and obtain a second feature vector.

[0053] The feature mapping module is configured to perform linear mapping on the second feature vector to generate the first feature vector.

[0054] Optionally, the category feature vector acquisition sub-module comprises:

[0055] The position information vector acquisition unit is configured to obtain a position information vector according to position information of nodes in the node group.

[0056] The feature fusion unit is configured to fuse the position information vector and the first feature vector to generate a third feature vector.

[0057] The category feature acquisition unit is configured to obtain the category feature vector according to the third feature vector.

[0058] Optionally, the position information vector comprises a first position information vector, a second position information vector and a third position information vector, and the position information vector acquisition unit comprises:

[0059] The first position information acquisition sub-unit is configured to obtain a first position information vector according to properties of edges in the subgraph corresponding to the node group.

[0060] The second position information acquisition sub-unit is configured to obtain a second position information vector according to orders of nodes in the node group.

[0061] The third position information acquisition sub-unit is configured to obtain a third position information vector according to labels of nodes in the node group.

[0062] Optionally, the feature fusion unit comprises:

[0063] The feature fusion sub-unit is configured to add the first feature vector and the position information vector.

[0064] Optionally, the category feature acquisition unit comprises:

[0065] an encoding subunit configured to encode the third feature vector to generate at least one category feature subvector;

[0066] a vector splicing subunit configured to splice the category feature subvectors to generate the category feature vector.

[0067] According to a third aspect of the present disclosure, an electronic device is provided, comprising:

[0068] at least one processor; and

[0069] a memory connected to the at least one processor in communication; wherein

[0070] the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of the first aspect.

[0071] According to a fourth aspect of the present disclosure, a non-transitory computer readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to perform the method of any one of the first aspect.

[0072] According to a fifth aspect of the present disclosure, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the method of any one of the first aspect.

[0073] The present disclosure has the following beneficial effects compared with the prior art:

[0074] By dividing nodes of different labels into different node groups, the features of fraudulent label nodes can be extracted more effectively, and the problem that fraudulent node information is weakened due to unbalanced number of different label nodes can be avoided.

[0075] By adding the position information of the node group to the first feature vector, the information for judging the category features of nodes is enriched, and the accuracy of judging the category of target nodes is improved.

[0076] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present disclosure, nor to limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0077] The accompanying drawings are used to better understand the present scheme and do not limit the present disclosure. Among them:

[0078] Figure 1 is a flow diagram of a method for obtaining a graph node category according to an embodiment of the present disclosure;

[0079] Figure 2 is a flow diagram of a method for obtaining a graph node category according to an embodiment of the present disclosure;

[0080] Figure 3 is a flow diagram of a method for obtaining a graph node category according to an embodiment of the present disclosure;

[0081] Figure 4 is a flow diagram of a method for obtaining a graph node category according to an embodiment of the present disclosure;

[0082] Figure 5 is a flow diagram of a method for obtaining a graph node category according to an embodiment of the present disclosure;

[0083] Figure 6 is a flow diagram of a method for obtaining a graph node category according to an embodiment of the present disclosure;

[0084] Figure 7 is a flow diagram of a method for obtaining a graph node category according to an embodiment of the present disclosure;

[0085] Figure 8 is a flow diagram of a method for obtaining a graph node category according to an embodiment of the present disclosure;

[0086] Figure 9 is a structural diagram of an apparatus for obtaining a graph node category according to an embodiment of the present disclosure;

[0087] Figure 10 is a block diagram of an electronic device for implementing a method for obtaining a graph node category according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0088] Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, which include various details of the embodiments of the present disclosure to help the understanding of the present disclosure. These should be considered in the context of the overall description and they should not be taken in a limiting sense. Thus, one of ordinary skill in the art will understand that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. Also, for the sake of brevity and clarity, descriptions of well-known functions and constructions are omitted herein.

[0089] In recent years, due to the outstanding performance of Graph Neural Networks (GNN) technology in many fields, many anti-fraud researches have incorporated popular GNN-based technology into fraud detection tasks by constructing a graph to connect nodes through multiple edges, extracting features in the graph through GNN, and determining whether a node is fraudulent. Compared with manual fraud detection, the efficiency is higher. Although existing GNN-based fraud detectors have achieved significant performance improvement, there are still problems such as neighbor class imbalance and multi-hop information decay.

[0090] The information aggregation of the GNN model is based on the assumption that the target neighbors share similar features and labels, that is, the feature information of the neighbor nodes of the target node is aggregated to obtain the features of the target node, and further predict the class of the target node. In the fraud detection graph, the proportion of fraudulent nodes and benign nodes is excessively imbalanced, with fewer fraudulent nodes and more benign nodes. This problem makes the information of fraudulent nodes may be submerged in the neighbor node feature information aggregation process, resulting in poor anti-fraud performance. At the same time, the recursive message passing mechanism weakens the information of multi-hop neighbors, which makes the high-order neighbor interaction between fraudulent entities not fully utilized.

[0091] To solve the above problems, the embodiment of the disclosure provides a method for obtaining a graph node class. Figure 1 is a flowchart of a method for obtaining a graph node class according to an embodiment of the disclosure, as Figure 1 shown, the method comprises:

[0092] Step 101, according to the target node, the neighbor sampling of the network graph is performed to generate at least one subgraph;

[0093] In the embodiment of the disclosure, the object to be detected is the node in the network graph, the graph contains a plurality of nodes and a plurality of edges, the nodes are connected through the edges, and the edges represent the relationship between the two nodes connected thereto. The graph neural network can extract the features in the network graph. However, there are many nodes and edges in the graph data. If the entire network graph is directly extracted for features, the amount of calculation is too large, the computing resources of the computing unit are relatively small, and it is difficult to perform calculation. In order to reduce the calculation burden of the computing unit, the neighbor sampling of the network graph is performed to generate a subgraph centered on the target node. Only the subgraph is calculated to extract the features, reducing the amount of calculation and improving the operation efficiency.

[0094] In an embodiment of the present application, a node generally refers to information that can be used to uniquely identify a user, such as an account, a device, a mobile phone number, etc., and an edge can represent a call relationship, a follow relationship, a comment relationship, a geographical location relationship, etc. The entity corresponding to the node and the relationship corresponding to the edge can be determined based on the actual application scenario, and are not limited herein. In a possible embodiment, the network graph is a user relationship graph, the nodes represent users, and the edges between the nodes represent user relationships, including friend relationships, comment relationships, etc.

[0095] In a possible embodiment, the network graph is a financial transaction information graph, the nodes represent financial subjects, and the edges between the nodes represent transaction relationships of the financial subjects, including transfer relationships, lending relationships, etc. between the financial subjects. Optionally, the network graph can be a heterogeneous graph or a homogeneous graph.

[0096] In step 102, the nodes in the subgraph are grouped according to the labels of the nodes to generate node groups.

[0097] In an embodiment of the present disclosure, the label of the node represents the category of the node, and the target node in the subgraph is a node whose category needs to be predicted, so the label of the target node is unknown. In fraud detection, the labels of the nodes in the network graph can be fraud labels, benign labels, and unknown labels. In order to avoid the information of the fraud label nodes being overwhelmed and weakened in the feature extraction process, the present disclosure groups the nodes in the subgraph according to the labels, and divides the nodes corresponding to the fraud labels, i.e., the fraud nodes, into the same node group, thereby enhancing the features of the fraud nodes.

[0098] In a possible embodiment, the network graph is a financial transaction information graph, the nodes represent financial subjects, and the node attributes of the nodes include financial subject registration information, legal person information, account information, etc.; the edges between the nodes represent transaction relationships of the financial subjects, including transfer relationships, lending relationships, etc. between the financial subjects. The nodes corresponding to the fraud labels are defined as financial subjects that exist financial fraud, and the node labels of the benign labels indicate that the corresponding financial subjects have no financial fraud behavior. The network graph contains a certain number of fraud label nodes, which are obtained based on user complaint data. High-dimensional features are extracted from the node attributes of the fraud label nodes and the transaction relationships of the corresponding edges by using the graph neural network, which are used to learn how to distinguish fraud nodes.

[0099] In step 103, features of the node groups are extracted to obtain first feature vectors.

[0100] In this embodiment, nodes corresponding to fraudulent labels, benign labels, and unknown labels are assigned to corresponding node groups, enhancing the features corresponding to different labels. Extracting features from each node group separately can more effectively highlight the features of nodes corresponding to fraudulent labels, and the first feature vector can more effectively reflect the features of the fraudulent nodes.

[0101] Step 104: Determine the category of the target node based on the location information of the node group and the first feature vector.

[0102] In this embodiment of the disclosure, the corresponding feature vector is obtained based on the location information of the node group and added to the first feature vector, which increases the richness of information. This results in higher accuracy and reliability of the target node category obtained.

[0103] In one possible embodiment, the category of the target node can be determined based on the location information of the node group and the first feature vector. If the target node is a fraud-labeled node, it indicates that the financial entity corresponding to the target node has engaged in financial fraud and needs to be strictly controlled. If the target node is a benign-labeled node, it indicates that the financial entity corresponding to the target node has good financial behavior and a low risk of financial fraud.

[0104] Figure 2 This is a flowchart illustrating a method for obtaining graph node categories according to an embodiment of this disclosure, as shown below. Figure 2 As shown, Figure 1 Step 104 specifically includes:

[0105] Step 201: Generate the category feature vector of the target node based on the location information of the node group and the first feature vector;

[0106] In this embodiment of the disclosure, the position information is obtained based on the position of the nodes in the node group within the subgraph. The position information reflects the position of the node group within the subgraph, and the position includes order, node category, etc. Based on the position information and the first feature vector, a category feature vector of the target node can be generated.

[0107] Step 202: Determine the category of the target node based on the category feature vector of the target node.

[0108] In this embodiment, the category feature vector includes location information features, node information features, and edge information features. It has high information richness, and the category of the target node, i.e., the label of the target node, can be determined more accurately based on the category feature vector.

[0109] Figure 3is a flowchart of a method for obtaining a graph node category according to an embodiment of the present disclosure, as shown in Figure 3 Figure 1 The step 101 in the method for obtaining a graph node category according to an embodiment of the present disclosure specifically includes:

[0110] In step 301, at least one first-order neighbor node of the target node is obtained, wherein the first-order neighbor node is connected to the target node through a corresponding edge.

[0111] In the present disclosure, the network graph includes a plurality of nodes and a plurality of edges, and the plurality of nodes are connected through the plurality of edges. The network graph is sampled by using a neighbor sampling method, and the node connected to the target node through an edge is a first-order neighbor node of the target node.

[0112] In step 302, at least one node connected to the first-order neighbor node through a corresponding edge is determined as a second-order neighbor node.

[0113] In the present disclosure, the information obtained from the first-order neighbor node is less, and the second-order neighbor node is collected in order to enrich the information of the nodes and edges and improve the information richness. The node connected to the first-order neighbor node through an edge is determined as a second-order neighbor node. It should be noted that the second-order neighbor node does not include the first-order neighbor node and the target node.

[0114] In step 303, the subgraph is generated according to the target node, the first-order neighbor node, and the second-order neighbor node.

[0115] In the present disclosure, the target node, the first-order neighbor node, and the second-order neighbor node are connected through corresponding edges in the network graph to generate the subgraph.

[0116] Optionally, the nodes in the subgraph are grouped according to the labels of the nodes to generate node groups, including:

[0117] The labels of the nodes in the subgraph are obtained, and the node groups are generated according to the nodes with the same label and the same order.

[0118] In the present disclosure, in order to highlight the characteristics of the nodes corresponding to each label, the nodes with the same label in each order of nodes are aggregated to generate the node groups.

[0119] Optionally, the order of the target node is 0, the order of the first-order neighbor node is 1, and the order of the second-order neighbor node is 2.

[0120] Optionally, the labels include one or more of a fraud label, a benign label, and an unknown label.

[0121] ​In the embodiments of the present disclosure, since the 0-order node is the target node and the target node label is a position label, the node with an order of 0 is divided into one node group. The 1-order and 2-order neighbor nodes may contain nodes corresponding to a fraud label, a benign label and an unknown label, so three node groups can be divided from the 1-order and 2-order nodes. Even if the 1-order neighbor does not contain a node corresponding to one of the labels, a corresponding node group needs to be generated.

[0122] Figure 4 is a flowchart of a method for obtaining a category of a graph node according to an embodiment of the present disclosure, as shown in Figure 4 , step 103 in Figure 1 specifically includes:

[0123] Step 401: aggregate features of nodes in the node group to obtain a second feature vector corresponding to the node group;

[0124] In the embodiments of the present disclosure, the features of the nodes in each node group are aggregated.

[0125] Optionally, a mean aggregation function is used for aggregation, the vectors of the nodes are spliced, and then a mean operation is performed on each dimension of the vector to generate the second feature vector.

[0126] Step 402: perform linear mapping on the second feature vector to generate a first feature vector.

[0127] In the embodiments of the present disclosure, the second feature vector is linearly mapped by a linear mapping function to generate a first feature vector corresponding to each second feature vector.

[0128] Figure 5 is a flowchart of a method for obtaining a category of a graph node according to an embodiment of the present disclosure, as shown in Figure 5 , step 201 in Figure 2 specifically includes:

[0129] Step 501: obtain a position information vector according to position information of nodes in the node group;

[0130] In the embodiments of the present disclosure, the position information of the nodes in the node group is obtained according to the position of the nodes in the subgraph, the position information reflects the position of the node group in the subgraph, and the position includes an order, a node category and the like. The category feature vector of the target node can be generated according to the position information and the first feature vector.

[0131] Step 502: fuse the position information vector and the first feature vector to generate a third feature vector;

[0132] In this embodiment of the disclosure, the position information vector is fused with the first feature vector to obtain the third feature vector, which contains both the position information of the nodes in the node group in the subgraph and the parameter information of each dimension of the nodes in the node group, resulting in high information richness.

[0133] Step 503: Obtain the category feature vector based on the third feature vector.

[0134] In this embodiment of the disclosure, the third feature vector is encoded to more deeply interact with the features of different relationships, different orders, and different node groups, thereby enabling the features of the target node to be better represented.

[0135] Figure 6 This is a flowchart illustrating a method for obtaining graph node categories according to an embodiment of this disclosure, as shown below. Figure 6 As shown, Figure 5 Step 501 specifically includes:

[0136] Step 601: Obtain the first position information vector based on the properties of the edges in the subgraph corresponding to the node group;

[0137] In this embodiment of the disclosure, edges within the same subgraph represent the same relationships, i.e., the properties of the edges are the same. To identify the properties of the target node based on richer relationships, this embodiment of the disclosure extracts at least one subgraph. Edges in different subgraphs represent different relationships, i.e., the properties of the edges are different. The first position information vector is the same for node groups corresponding to the same subgraph.

[0138] Step 602: Obtain the second position information vector based on the order of the nodes in the node group;

[0139] Step 603: Obtain the third position information vector based on the labels of the nodes in the node group.

[0140] Optionally, fusing the location information vector with the first feature vector includes:

[0141] Add the first feature vector to the location information vector.

[0142] Figure 7 This is a flowchart illustrating a method for obtaining graph node categories according to an embodiment of this disclosure, as shown below. Figure 7 As shown, Figure 5 Step 503 specifically includes:

[0143] Step 701: Encode the third feature vector to generate at least one category feature sub-vector;

[0144] In the embodiments of the present disclosure, the third feature vector is encoded by migrating the Transformer neural network, and different relationships, different orders, and different node groups are interacted in depth, so that the features of the target node are better represented. The category feature sub-vector is obtained. One sub-graph corresponds to one category feature sub-vector. In a possible embodiment, two sub-graphs are obtained by sampling the network graph, and two category feature sub-vectors can be obtained.

[0145] In step 702, the category feature sub-vectors are spliced to generate the category feature vector.

[0146] In the embodiments of the present disclosure, the category feature sub-vector represents the features of the target node under different edge properties, and the category feature sub-vectors are spliced to fuse the features. The category feature vector contains rich feature information.

[0147] Figure 8 FIG. 1 is a flowchart of a method for obtaining a graph node category according to an embodiment of the present disclosure, as shown in FIG. 1, the method comprises the following steps. Figure 8

[0148] In the first step, given a heterogeneous graph data and a target node v, multi-hop neighbor sampling is performed according to different relationships (Relation-1 and Relation-2). Two sub-graphs centered on v are obtained by sampling in two relationships. In a possible embodiment, the heterogeneous graph data is a financial transaction information graph, the nodes represent financial subjects, and the edges between the nodes represent the transaction relationship between the financial subjects, including the transfer relationship, the lending relationship, etc.

[0149] In the second step, the nodes are divided into multiple node groups according to different neighbor labels, wherein the fraud label nodes, the benign label nodes, and the unknown label nodes are as shown in the figure. For example, in the first-hop neighbor (hop-1), nodes of the same type are placed in the same group. Here, a two-class task is shown, so the nodes are divided into three groups. The same is true for the second-hop neighbor (hop-2), which is also divided into three groups. In addition to the group to which the target node v itself belongs, seven groups can be obtained under the Relation-1 relationship. Similarly, seven groups can also be obtained under the Relation-2 relationship, and a total of fourteen groups can be obtained. The features in each group are aggregated to obtain a single vector. In a possible embodiment, the financial subject corresponding to the fraud label node has financial fraud behavior, the financial subject corresponding to the benign label node does not have financial fraud behavior, and the financial subject corresponding to the unknown label node is uncertain whether it has financial fraud behavior.

[0150] ​Thirdly, linear mapping is performed on the vectors of the fourteen groups.

[0151] Fourthly, three position information vectors are introduced. The first one is X_r, which is set according to different relations. The second one is X_h, which is set according to different orders. The third one is X_g, which is set according to different group orders. Finally, the three position information vectors are added to the feature vectors. The introduction of the three position information vectors can help the model distinguish different information and improve the effect of the model.

[0152] Fifthly, the feature vectors obtained in the fourth step are encoded through the transformer architecture, so that the features of different relations, different orders and different groups can be interacted in depth, thereby obtaining a better representation of the target node.

[0153] Sixthly, the representation of the target node v is extracted, Figure 8 wherein two relations are included, so that two vectors z r1 and z r2 can be extracted. The two vectors z r1 and z r2 are connected together to obtain the final representation of the target node v, and then the prediction result Y is directly output. In a possible embodiment, according to Y, it can be determined that the type of the target node is a fraud label node, which indicates that the financial subject corresponding to the target node has a financial fraud behavior and needs to be strictly controlled. According to Y, it can be determined that the type of the target node is a benign label node, which indicates that the financial behavior of the financial subject corresponding to the target node is good and the risk of financial fraud is small.

[0154] Figure 9 is a structural schematic diagram of a device for obtaining a graph node category according to an embodiment of the present disclosure, as shown in Figure 9 the device 900 comprises:

[0155] a sampling module 910 configured to perform neighbor sampling on a network graph according to a target node to generate at least one subgraph;

[0156] a grouping module 920 configured to group nodes in the subgraph according to labels of the nodes to generate node groups;

[0157] a feature extraction module 930 configured to extract features of the node groups to obtain a first feature vector;

[0158] a category acquisition module 940 configured to determine a category of the target node according to position information of the node groups and the first feature vector.

[0159] Optionally, the category obtaining module comprises:

[0160] a category feature vector obtaining submodule, configured to generate a category feature vector of the target node according to the position information of the node group and the first feature vector;

[0161] a category obtaining submodule, configured to determine the category of the target node according to the category feature vector of the target node.

[0162] Optionally, the heterogeneous network graph comprises a plurality of nodes and a plurality of edges, and the plurality of nodes are connected through the plurality of edges, and the sampling module comprises:

[0163] a first sampling submodule, configured to obtain at least one first-order neighbor node of the target node, wherein the first-order neighbor node is connected to the target node through a corresponding edge;

[0164] a second sampling submodule, configured to determine at least one node connected to the first-order neighbor node through a corresponding edge as a second-order neighbor node;

[0165] a subgraph generating submodule, configured to generate the subgraph according to the target node, the first-order neighbor node and the second-order neighbor node.

[0166] Optionally, the grouping module comprises:

[0167] a grouping submodule, configured to obtain labels of nodes in the subgraph, and generate the node group according to nodes with the same label and the same order.

[0168] Optionally, the label comprises one or more of a fraud label, a benign label and an unknown label.

[0169] Optionally, the feature extraction module comprises:

[0170] a first feature extraction submodule, configured to aggregate features of nodes in the node group to obtain a second feature vector;

[0171] a feature mapping module, configured to perform linear mapping on the second feature vector to generate the first feature vector.

[0172] Optionally, the category feature vector obtaining submodule comprises:

[0173] a position information vector obtaining unit, configured to obtain a position information vector according to position information of nodes in the node group;

[0174] a feature fusion unit, configured to fuse the position information vector and the first feature vector to generate a third feature vector;

[0175] The category feature acquisition unit is configured to acquire the category feature vector according to the third feature vector.

[0176] Optionally, the position information vector includes a first position information vector, a second position information vector and a third position information vector, and the position information vector acquisition unit includes:

[0177] The first position information acquisition subunit is configured to acquire a first position information vector according to the properties of edges in the subgraph corresponding to the node group.

[0178] The second position information acquisition subunit is configured to acquire a second position information vector according to the degrees of nodes in the node group.

[0179] The third position information acquisition subunit is configured to acquire a third position information vector according to the labels of nodes in the node group.

[0180] Optionally, the feature fusion unit includes:

[0181] The feature fusion subunit is configured to add the first feature vector and the position information vector.

[0182] Optionally, the category feature acquisition unit includes:

[0183] The encoding subunit is configured to encode the third feature vector to generate at least one category feature subvector.

[0184] The vector splicing subunit is configured to splice the category feature subvectors to generate the category feature vector.

[0185] As to the apparatus in the above-described embodiments, specific manners in which various modules perform operations have been described in details in the embodiments about the method, and thus will not be described in details here.

[0186] According to embodiments of the present disclosure, the present disclosure further provides an electronic device, a readable storage medium and a computer program product.

[0187] Figure 10 A schematic block diagram of an example electronic device 1000 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present disclosure described and / or claimed in this document.

[0188] like Figure 10 As shown, device 1000 includes a computing unit 1001, which can perform various appropriate actions and processes according to a computer program stored in read-only memory (ROM) 1002 or a computer program loaded from storage unit 1008 into random access memory (RAM) 1003. The RAM 1003 may also store various programs and data required for the operation of device 1000. The computing unit 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Input / output (I / O) interface 1005 is also connected to bus 1004.

[0189] Multiple components in device 1000 are connected to I / O interface 1005, including: input unit 1006, such as keyboard, mouse, etc.; output unit 1007, such as various types of monitors, speakers, etc.; storage unit 1008, such as disk, optical disk, etc.; and communication unit 1009, such as network card, modem, wireless transceiver, etc. Communication unit 1009 allows device 1000 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0190] The computing unit 1001 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1001 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1001 performs the various methods and processes described above, such as the method for obtaining graph node categories. For example, in some embodiments, the method for obtaining graph node categories may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 1008. In some embodiments, part or all of the computer program may be loaded and / or installed on device 1000 via ROM 1002 and / or communication unit 1009. When the computer program is loaded into RAM 1003 and executed by the computing unit 1001, one or more steps of the method for obtaining graph node categories described above may be performed. Alternatively, in other embodiments, the computing unit 1001 may be configured to perform the method of obtaining the graph node category by any other suitable means (e.g., by means of firmware).

[0191] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, specially designed application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0192] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / acts specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0193] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0194] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0195] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0196] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service ("Virtual Private Server", or simply "VPS"). The server can also be a server of a distributed system, or a server combined with a blockchain.

[0197] It should be understood that various forms of flow shown above can be used, with steps reordered, added, or removed. For example, the steps recited in the present disclosure can be performed in parallel, in series, or in a different order, without limitation herein, as long as the desired results of the technical solutions of the present disclosure can be achieved.

[0198] The above detailed description does not limit the scope of the disclosure. Various modifications, combinations, sub-combinations and alternatives can be made to the detailed description. Any modification, equivalent replacement and improvement etc. made within the spirit and principle of the disclosure shall be included in the scope of the disclosure.

Claims

1. A method of graph node class acquisition, wherein, Comprise: According to the target node, the network graph is sampled to generate at least one subgraph; wherein, the network graph comprises a financial transaction information graph, the node in the financial transaction information graph represents a financial subject, and the edge in the financial transaction information graph represents the transaction relationship of the financial subject; According to the label of the node in the subgraph, the node is grouped to generate a node group; wherein, the label comprises a fraud label and a benign label; Extract the features of the node group to obtain a first feature vector; According to the position information of the node group in the subgraph, the position information of the node group is obtained, the position information vector is obtained according to the position information, the position information vector is fused with the first feature vector, the third feature vector is generated, the category feature vector of the target node is obtained according to the third feature vector, and the category of the target node is determined according to the category feature vector.

2. The method of claim 1, wherein, The network graph contains a plurality of nodes and a plurality of edges, and the plurality of nodes are connected through the plurality of edges, and the network graph is sampled according to the target node to generate at least one subgraph, comprising: At least one first-order neighbor node of the target node is obtained, wherein the first-order neighbor node is connected with the target node through a corresponding edge; At least one node connected with the first-order neighbor node through a corresponding edge is determined as a second-order neighbor node; The subgraph is generated according to the target node, the first-order neighbor node and the second-order neighbor node.

3. The method of claim 2, wherein, The label of the node in the subgraph is obtained, and the node group is generated according to the nodes with the same label and the same order. The label comprises one or more of a fraud label, a benign label and an unknown label.

4. The method of claim 3, wherein, The features of the nodes in the node group are aggregated to obtain a second feature vector; 5. The method of claim 1, wherein, The second feature vector is linearly mapped to generate the first feature vector. The position information vector comprises a first position information vector, a second position information vector and a third position information vector, and the position information vector is obtained according to the position information of the node in the node group, comprising: The first position information vector is obtained according to the properties of the edges in the subgraph corresponding to the node group; 6. The method of claim 1, wherein, The second position information vector is obtained according to the order of the nodes in the node group; The third position information vector is obtained according to the label of the node in the node group. The position information vector is fused with the first feature vector, comprising: The first feature vector is added to the position information vector.

7. The method of claim 6, wherein, The category feature vector is obtained according to the third feature vector, comprising: The third feature vector is encoded to generate at least one category feature subvector; 8. The method of claim 1, wherein, The category feature subvectors are spliced to generate the category feature vector. Comprise: A sampling module is arranged for sampling a network graph according to a target node to generate at least one subgraph; wherein, the network graph comprises a financial transaction information graph, the node in the financial transaction information graph represents a financial subject, and the edge in the financial transaction information graph represents the transaction relationship of the financial subject; 9. An apparatus for graph node class acquisition, wherein, ​ ​ grouping modules configured to group nodes in the sub-graph according to labels of the nodes to generate node groups, wherein the labels comprise fraud labels and benign labels; feature extraction modules configured to extract features of the node groups to obtain first feature vectors; category obtaining modules configured to obtain position information of the node groups according to positions of nodes in the node groups in the sub-graph, obtain a position information vector according to the position information, fuse the position information vector with the first feature vectors to generate third feature vectors, obtain a category feature vector of the target node according to the third feature vectors, and determine a category of the target node according to the category feature vector. 10.An electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-8.

11. A non-transitory computer readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to perform the method of any one of claims 1-8. 12.A computer program product comprising a computer program which, when executed by a processor, implements the method of any one of claims 1-8.

Images