Method, system and storage medium for identifying fraudulent users in a call network using a human-in-the-loop graph neural network

Abstract

The present invention discloses a method, system and storage medium for identifying fraudulent users in a call network using a human-in-the-loop graph neural network, and belongs to the field of communication information security technology. User information and the call relationship between users are obtained, and each user is regarded as a node in the call network. If there is a call relationship between two users, an edge is built between the nodes of the two users. The call network is modeled using a graph neural network model that integrates node features and edge features. During the modeling process, the model training process is guided by a human-in-the-loop method, and the training is completed in combination with the known node types in the call network. The trained graph neural network model is used to obtain unknown node types in the call network; the node types include normal users and fraudulent users. Based on the distribution and characteristic characteristics of fraudsters in the call network, the present invention combines graph neural network technology and human-in-the-loop learning technology to achieve accurate prediction of fraudsters in the call network.

Description

Technical Field

[0001] The present invention relates to the field of communication information security technology, and in particular to a method, system and storage medium for identifying fraudulent users in a call network by using a human-in-loop graph neural network. Background Art

[0002] With the development of the telecommunications industry and the popularization of telecommunications equipment, the task of detecting telecommunications fraud users has become a hot topic for many scholars and people in related fields. Tseng [Tseng 2015] constructed a network with weighted edges to represent the call duration and call frequency between users and executed the weighted HITS algorithm [Kleinberg 1999] on the network to learn the trust value of the phone number and detect fraudulent calls based on the trust value. Yang [Yang 2019] used factor graphs to construct the factor relationship between call networks and used the factor graphs to identify fraudulent users in the call network.

[0003] The graph structure in the call network is widely used to help identify fraudulent users. In recent years, deep learning has been rapidly applied to graphs, and graph neural networks (GNNs) have achieved excellent results in tasks such as node classification and link prediction. By treating users as nodes on the call network, we can regard the task of detecting telecommunications fraud users as a node classification problem on the call network. The general paradigm of GNN is to alternately transform node features and aggregate neighboring node features. Kipf [Kipf 2017] and Li [Li 2016] proposed a method of averaging and aggregating the features of surrounding neighboring nodes to smooth the embedding vectors of adjacent nodes so that adjacent nodes are more similar. [ 2018], Thekumparampil[Thekumparampil 2018], Brody[Brody 2021] and Kim[Kim 2020] introduced attention mechanisms when aggregating neighbor node features to selectively aggregate effective information. These methods only aggregate node features and cannot effectively process edge features. Gong[Gong 2019] and Jiang[Jiang 2019] respectively proposed to fuse edge features while aggregating node features. However, on large-scale graphs such as call networks, the complexity of these two methods of fusing node features and edge features will be very high, resulting in low efficiency. At the same time, in the call network scenario containing fraudulent users, since the fraudulent users are scattered and hidden among ordinary users, traditional GNNs are very easy to smooth the features between normal users and abnormal users when aggregating features. Therefore, it is difficult to achieve good performance in this scenario using traditional GNNs.

[0004] Telecom fraud detection requires interpretability as a necessary evidence for conviction. However, the traditional learning process of GNN is purely to estimate the model parameters that achieve the best performance, while ignoring the goal of interpretability. The human-in-the-loop method [Li 2017, Zhang 2018] meets human expectations in specific tasks by involving humans in the learning process of deep learning models, so that the model has excellent performance while satisfying the interpretability of the reasoning process. There are some previous works that have studied the human-in-the-loop method in fields such as recommendation, image, and medicine, but lack of application in telecommunication fraud detection. The present invention aims to combine human-in-the-loop and GNN to make the prediction process interpretable. Summary of the invention

[0005] In order to solve the problems of poor model interpretability and low detection accuracy of telecommunications fraud detection methods in the prior art, the present invention proposes a method, system and storage medium for identifying fraudulent users in a call network using a human-in-the-loop graph neural network, based on the distribution and characteristics of fraudsters in the call network, combining graph neural network technology and human-in-the-loop learning technology, to achieve accurate prediction of fraudsters in the call network.

[0006] The present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a method for identifying fraudulent users in a call network using a human-in-loop graph neural network, comprising:

[0008] Obtain user information and the call relationship between users, and treat each user as a node in the call network. If there is a call relationship between two users, build an edge between the nodes corresponding to the two users; obtain the initial features of each node and edge, and build a call network G = (V, E, X, S), where V represents the node set, E represents the edge set, X represents the node initial feature set, and S represents the edge initial feature set;

[0009] The call network is modeled using a graph neural network model that integrates node features and edge features. During the modeling process, the model training process is guided by a human-in-the-loop method, and the training is completed in combination with known node types in the call network. The trained graph neural network model is used to obtain unknown node types in the call network; the node types include normal users and fraudulent users.

[0010] In a second aspect, the present invention provides a system for identifying fraudulent users in a call network using a human-loop graph neural network, which is used to implement the above-mentioned method for identifying fraudulent users in a call network using a human-loop graph neural network.

[0011] In a third aspect, the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, is used to implement the above-mentioned method of identifying fraudulent users in a call network using a human-in-loop graph neural network.

[0012] Compared with the prior art, the present invention has the following beneficial effects: the present invention combines graph neural networks and human-in-the-loop learning methods to model an identification framework for fraudulent user behavior characteristics, which can realize the node characteristics, edge characteristics and network structure of users in a given call network, and output the probability of whether each user is a fraudster by modeling user characteristics, thereby achieving accurate prediction of fraudsters. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a schematic diagram of the overall structure of a method for identifying fraudulent users in a call network by using a human-in-loop graph neural network according to an exemplary embodiment;

[0014] Figure 2 is an ablation experiment result shown according to an exemplary embodiment;

[0015] Figure 3 is a schematic diagram of parameter analysis of a human-in-the-loop learning framework according to an exemplary embodiment. DETAILED DESCRIPTION

[0016] The present invention is further described below in conjunction with the accompanying drawings and embodiments. The accompanying drawings are only schematic diagrams of the present invention, and some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities, and these functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0017] In this embodiment, the model used in the method of identifying fraudulent users in the call network using a human-in-the-loop graph neural network is denoted as "GTF", which is a deep learning framework based on graph neural networks and human-in-the-loop learning. The overall framework of the present invention consists of four main modules: a local adaptive node aggregation module that aggregates node features, a masked attention edge aggregation module that aggregates edge features, a prediction module, and a subgraph-level human-in-the-loop training module. Specifically, the present invention first analyzes the fraudsters and ordinary users in the call network to obtain the characteristics of the fraudsters; then, the users are regarded as nodes, and the users are modeled in combination with the designed graph neural network that integrates node features and edge features; at the same time, in the learning process of the model, the subgraph learning direction is guided by the human-in-the-loop method to improve the interpretability of the model; finally, the trained model is used to give the prediction results of fraudulent users.

[0018] Figure 1 The overall structural diagram of the method for identifying fraudulent users in a call network using a human-in-the-loop neural network is shown. Figure 1 (a) shows the specific structure of the call network. Each node in the call network represents a user. The network builds edges based on the calls between users. Each node and each edge contains features. The ultimate goal of the present invention is to predict the identity of unknown users based on the identities of known users in the network. Figure 1 (b) and (c) are respectively the graph neural network classification model (including a local adaptive node aggregation module for aggregating node features, a masked attention edge aggregation module for aggregating edge features, and a prediction module) and a subgraph-level human-in-the-loop training module in the present invention that contains fused point-edge features. Specifically, the present invention designs a local adaptive attention mechanism in the node aggregation module to effectively aggregate neighbor node features for each node; and designs a masked attention mechanism in the edge aggregation module to selectively aggregate neighbor edge features for each node, and finally connects the two obtained representations to make the final prediction. In the subgraph-level human-in-the-loop training module, experts annotate the local subgraphs of fraudulent users that are difficult to judge during the training process, and feed back to the graph neural network classification model that integrates point-edge features for iterative training, guiding the learning process of the model so that people can understand it, and finally making the model interpretable.

[0019] The four modules are described below.

[0020] (A) Local adaptive node aggregation module.

[0021] The present invention designs a local awareness node to adaptively aggregate each specific neighborhood, thereby encoding the local context into the node embedding. In order to adaptively aggregate different neighbors for each node, a unique weight vector is generated specifically for each user's egocentric network, and the calculation formula is as follows:

[0022]

[0023] in, is node v j Node embeddings in layer l-1 in the local adaptive node aggregation module, is node v i The set of neighbor nodes including itself, MLP(·) is a multi-layer perceptron, is node v i The weight vector in the lth layer. For different local contexts of the node, a specific weight vector for each node can be obtained. In addition, different weight vectors are used to calculate the attention coefficient, and the formula is as follows:

[0024]

[0025] Among them, ω (l) is the weight parameter matrix of the lth layer, and is node v i and v j In the node embedding of layer l-1, LeakyReLU(·) represents the activation function, is the node v in layer l i and v j The attention coefficient between is the user node-level aggregation weight; || represents the concatenation operation. In order to obtain the aggregation weight, the softmax function is used to normalize the attention coefficient as follows:

[0026]

[0027] Then, the node information of the neighbors is aggregated using the above aggregation weights as follows:

[0028]

[0029] in, The embedded representation of node information representing the aggregated neighbors at the lth layer;

[0030] Since there may be a lack of target neighbors in the neighborhood, resulting in an over-smoothing problem, in this embodiment, the node embedding and the aggregation results of the neighborhood are connected to avoid the over-smoothing problem, as shown below:

[0031]

[0032] Finally, we get That is, node v i The node embeddings at the lth layer are used as node-level features.

[0033] It should be noted that the egocentric network is composed of a single central node and the neighboring nodes of the central node, and the edges only include the edges between the central node and the neighboring nodes, and between the neighboring nodes.

[0034] (ii) Masked attention edge aggregation module.

[0035] The present invention first calculates the attention weights of different call behaviors of each user. Then, several representative call behaviors with high coefficients are selected to encode the call information into edge embeddings. Therefore, some calls made by fraudsters in order to disguise their call behaviors as normal behaviors can be masked (discarded), and the model of the present invention can avoid aggregating misleading features brought by these disguised fraudsters to extract distinguishable features.

[0036] More specifically, in order to obtain the initialized edge embedding, the present invention first pre-trains the call log (time series) corresponding to each edge into the edge embedding s through the CPC model i , and then aggregate the side information. In order to avoid the influence of disguised call behavior on feature aggregation, disguised call behavior needs to be identified first. The present invention proposes that disguised abnormal call behavior can be detected by referring to the overall call pattern in each user's egocentric network.

[0037] In this embodiment, first, by aggregating the edge embedding s of users j to capture the embedding of the overall calling pattern To capture the interactive information in the call behavior, as shown in the following formula:

[0038]

[0039] Among them, s j It is edge j edge embedding, ε(i) represents the edge embedding with node v i The set of connected edges. Embedding based on the initial features of the nodes and the overall call pattern The significant coefficients for calculating edge embedding are as follows:

[0040]

[0041] Where a is the shared learnable attention weight vector, ω n is the weight parameter matrix of node features, ω e is the weight parameter matrix of edge embedding, x i is the initial feature of the node, || represents the concatenation operation, LeakyReLU(.) is the activation function, and the superscript T is the transposition. is the node v i The connected edge j The important coefficient of edge embedding of .

[0042] With node v i The edge embeddings of connected edges get higher importance coefficients It means that the edge is an important edge. The lower the importance coefficient, the lower the importance of the edge. Therefore, the important coefficients of all edges of each node constitute the important coefficient set of the node. Sort in descending order as r i , then for each node v i Select r i The first k edges, that is, each node gets a set Indicates the jth selected k Since it may be a fake call, the other edges outside k edges are covered.

[0043] Afterwards, we normalize the selected importance coefficient of each node as the attention mechanism:

[0044]

[0045] Among them, α i,j is the node v i The connected edge j The attention score of , i.e., the user edge-level aggregation weight;

[0046] Finally, according to the attention score α i,j Aggregate the selected edges as follows:

[0047] z i =∑ j∈Ω(i) α i,j ω e e j

[0048] Among them, z i is node v i The edge features.

[0049] (iii) Prediction module

[0050] Given a call network G = (V, E, X, S) as input, V represents the node set, E represents the edge set, X represents the node initial feature set, and S represents the edge initial feature (edge ​​embedding) set. The user node-level embedding is obtained by passing through L layers of local adaptive node aggregation modules and masked attention edge aggregation modules respectively. and user edge-level embedding Z = (z1,…,z m ), m represents the number of nodes representing users in the call network. In order to make full use of these two aspects of information, these two embeddings are concatenated for the final prediction as follows:

[0051]

[0052] Among them, i is node v i The final embedding.

[0053] In order to identify fraudsters, the final embedding is sent to the prediction module for classification. In this embodiment, the prediction module is composed of a linear transformation layer and a softmax layer. The calculation formula of the prediction module is as follows:

[0054]

[0055] in, is node v i The predicted value of represents the probability that the user represented by the node is a fraudster; ωf , b f are the learnable matrix and bias respectively.

[0056] During training, the loss function is defined as the cross entropy loss with regularization:

[0057]

[0058] Among them, y i Is user v i The label of , θ is the set of learnable parameters of the model, λ1 is the regularization parameter, is the training set.

[0059] (iv) Sub-graph level human-in-the-loop training module.

[0060] Telecom fraud is a criminal activity that requires evidence for conviction. Therefore, the fraud detection task requires the interpretability of the prediction results. In order to present the detection process, a natural way is to show the subgraph aggregation decision process of each node, that is, the higher the aggregation weight, the more likely it is that the node or edge will be selected for aggregation and provide useful information. Therefore, the aggregation weight of each subgraph is a key indicator of the interpretability of the model of the present invention. However, although GNN can achieve good performance with a large amount of data, the aggregation weight of each egocentric network trained by GNN can be confusing. In other words, a large number of combinations of all aggregation weights can bring satisfactory performance, but few can be close to human intuition. In order to solve the above problems, the present invention introduces a subgraph-level human-in-the-loop training module in the training process of the model. Unlike most human in-the-loop methods, the present invention combines the aggregation weights of the user's egocentric network predicted by the graph neural network model that fuses point-edge features. α i,j Provided to domain experts. To help human experts understand, this embodiment discretizes the aggregation weights so that experts only get information about whether to aggregate specific nodes or edges. In this way, experts can guide the module to predict the aggregation strategy of user identities based on domain knowledge. The trained model is able to use a more interpretable strategy to aggregate subgraphs and make predictions. The details are introduced below.

[0061] During the training process, from the training set Some nodes (users) are extracted from the graph for annotation. In the prediction of the graph neural network model that integrates point-edge features, the probability of a node being sampled is proportional to its information entropy, that is, users with more uncertain identities are favored. After sampling, the egocentric networks of these fraudsters are fed back to the experts. For the egocentric network, each node (and edge) connected to the central node is marked with a binary symbol to indicate whether the aggregation weight of the node (edge) is above a predefined threshold. The experts are then asked to flip some binary symbols that they think are incorrect. For example, abnormal calls from neighbors marked as fraudulent tend to provide information. If the edge is marked as "useless" by the model, that is, the user edge-level aggregation weight α i,j With a value of 0, the expert can provide his advice by simply flipping the label of the edge.

[0062] The egocentric network with the adjusted tags is then sent back to the model of the present invention to improve its interpretability, i.e., the modified aggregation weights are returned α i,j In order to make the aggregation mode closer to human intuition, these markers M are calculated sample The aggregation weight P obtained by the model sample The similarity between them is used to define a loss function as follows:

[0063]

[0064] Among them, M i is the label of the egocentric network of the i-th sampled user, P i is the aggregate weight of the egocentric network of the i-th sampled user, |V sample | represents the number of sampled users, ‖.‖ represents the 2-norm, Indicates a loss of man in the loop.

[0065] Finally, combining the graph neural network model that integrates vertex-edge features and the subgraph-level human-in-the-loop training module, the loss function of the entire training process is as follows:

[0066]

[0067] After the training is completed, only the graph neural network model that integrates the point-edge features is needed to predict whether the unknown users in the call network are fraudulent users. In this embodiment, the prediction process is as follows: given a call network, for unknown users in the call network G = (V, E, X, S), the local adaptive node aggregation module obtains the user node-level features, and the masked attention edge aggregation module obtains the user edge-level features. The prediction module combines the user node-level features and edge-level features to output the probability of whether the user is a fraudster, thereby achieving accurate prediction of fraudsters.

[0068] In a specific implementation of the present invention, a method for identifying fraudulent users in a call network using a human-in-the-loop graph neural network includes the following steps:

[0069] Step 1: Obtain user information and the call relationship between users, and take each user as a node in the call network. If there is a call relationship between two users, build an edge between the nodes corresponding to the two users; obtain the initial features of each node and edge, and build a call network G = (V, E, X, S), where V represents the node set, E represents the edge set, X represents the node initial feature set, and S represents the edge initial feature set;

[0070] Step 2: Model the call network using a graph neural network model that integrates node features and edge features. During the modeling process, the model training process is guided by a human-in-the-loop method, and the training is completed in combination with known node types in the call network. The trained graph neural network model is used to obtain unknown node types in the call network; the node types include normal users and fraudulent users.

[0071] Step 2 is the focus of the present invention. In step 2, the graph neural network model used includes a local adaptive node aggregation network, a masked attention edge aggregation network and a prediction network. The local adaptive node aggregation network is used to obtain user node-level features, the masked attention edge aggregation network is used to obtain user edge-level features, and the prediction network is used to predict node types and their probabilities based on user node-level features and user edge-level features. The local adaptive node aggregation network and the masked attention edge aggregation network are two branches in the graph neural network model, and both are calculated simultaneously.

[0072] In this step, the local adaptive node aggregation network is an L-layer structure, and the calculation process of each layer includes: first, calculating the attention coefficient between nodes; then calculating the user node-level aggregation weight according to the attention coefficient, and aggregating neighbor node information; the embedded representation of the node information of the aggregated neighbors in the lth layer is recorded as Then the user node level features are:

[0073]

[0074] in, is node v i Embed the nodes in the lth layer and embed the nodes in the last layer As user node-level features.

[0075] The calculation process of the masked attention edge aggregation network includes: firstly, calculating the importance coefficient of each edge according to the initial features of the nodes and edges Sort the importance coefficients of all edges in the edge set connected to each node, select the top k edges with the highest importance, and normalize the importance coefficients by α i,j ; According to the normalized important coefficients, aggregate the edges in the Ω(i) set as the edge-level features of the node:

[0076] z i =∑ j∈Ω(i) α i,j ω e e j

[0077] Among them, z i is the user edge-level feature, Ω(i) is the node v i The corresponding set of k edges with the highest importance, α i,j is the node v i The connected edge j The attention score, i.e., the user edge-level aggregation weight, ω e is the weight parameter matrix of edge features.

[0078] In the modeling process, the model training process is guided by the human-in-the-loop method, including: randomly extracting some nodes representing users from the call network for sampling, and the probability of the node being sampled is proportional to its information entropy; correcting the node-level aggregation weight and edge-level aggregation weight of each layer corresponding to the sampled nodes, and feeding the corrected aggregation weights back to the local adaptive node aggregation network and the masked attention edge aggregation network, respectively, so that the local adaptive node aggregation network and the masked attention edge aggregation network calculate the user node-level features and user edge-level features according to the corrected aggregation weights.

[0079] In this embodiment, a system for identifying fraudulent users in a call network using a human-in-loop graph neural network is also provided. The system is used to implement the above-mentioned embodiment, and the descriptions that have been made will not be repeated. The terms "module", "unit", etc. used below can be a combination of software and / or hardware that implements a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, it is also possible to implement hardware, or a combination of software and hardware.

[0080] The system comprises:

[0081] The call network module is used to obtain user information and the call relationship between users. Each user is regarded as a node in the call network. If there is a call relationship between two users, an edge is built between the nodes corresponding to the two users. The initial features of each node and edge are obtained to build a call network.

[0082] A graph neural network model module, which is used to model the call network using a graph neural network model that integrates node features and edge features, complete training in combination with known node types in the call network, and use the trained graph neural network model to obtain unknown node types in the call network; the node types include normal users and fraudulent users;

[0083] The sub-graph level human-in-the-loop training module is used to guide the model training process of the graph neural network model module during the modeling process.

[0084] In this embodiment, the graph neural network model module can be further divided into a local adaptive node aggregation module, a masked attention edge aggregation module and a prediction module. The local adaptive node aggregation module is used to obtain user node-level features, the masked attention edge aggregation module is used to obtain user edge-level features, and the prediction module is used to predict node types and their probabilities based on user node-level features and user edge-level features.

[0085] The implementation process of the functions and effects of each module in the above-mentioned system is specifically detailed in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here. For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The system embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative labor. An embodiment of the present invention also provides a computer-readable storage medium, on which a program is stored, and when the program is executed by a processor, the above-mentioned method of identifying fraudulent users in a call network using a human-in-loop graph neural network is implemented.

[0086] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0087] This embodiment verifies the implementation effect of the present invention through a specific experiment.

[0088] (1) Data collection.

[0089] The dataset for this experiment consists of telecommunication records from September 1 to September 30, 2016, provided by China Telecom, a major mobile service provider in China. Each record contains an anonymous calling number, an anonymous called number, a start time, an end time, etc. Since a user can only have one China Telecom phone number, one phone number is considered as one user. At the same time, this experiment also accessed some personal information of all phone number owners, such as gender, age, birthplace, etc. Afterwards, users were marked as scammers and ordinary users based on the abnormal phone numbers provided by Baidu and Qihoo 360. Specifically, given a phone number, the number can be checked to see if it is abnormal based on the services provided by Baidu and Qihoo 360. Because these services are obtained from a large number of user feedback, they have a high degree of confidence.

[0090] This experiment constructs a directed graph based on these records and personal information. Each node represents a user, and each edge represents at least one call between two users. The initial features of each node represent the user's personal information processed by feature engineering. Accordingly, the features of each edge are extracted from all call records between two users.

[0091] The overall statistics of the dataset are summarized in Table 1. The features in the graph are based on users’ personal information and call information, so the graph can be generalized to a general telecommunication network without considering the influence of mobile operators.

[0092] Table 1 Dataset statistics

[0093] index Statistics Number of users 290499 Number of call relationships 1575701 Number of calls 9599878 User feature dimensions 261 Call feature dimensions 37 Fraudster ratio 4.9％

[0094] (2) Data preprocessing.

[0095] In order to meet the needs of actual scenarios, 60% of ordinary users and scammers are selected for training, and the remaining users are tested. This experiment also uses 1 / 3 of the users in the training set as the validation set to avoid overfitting. The ratio of scammers to ordinary users is the same in the training set, validation set, and test set. The following evaluation indicators for imbalanced classification tasks are used: Precision, Recall, and F1score. Considering the imbalance of labels, this experiment pays more attention to the F1score evaluation indicator.

[0096] (3)Comparative experiment

[0097] In order to fully verify the effectiveness of the proposed model, this experiment compared it with several different types of baseline models.

[0098] The baseline models compared with the present invention model include:

[0099] Traditional classifiers include MLP and XGBoost, among which MLP N and XGBoost N Taking personal information as input to identify fraudsters, MLP E and XGBoost E The call information of each user is uniformly aggregated as input.

[0100] The basic graph neural network GNN evenly aggregates the personal information of neighbors, including three classic models: GCN[Kipf 2017], SGC[Wu 2019] and GIN[Xu 2018].

[0101] The graph neural network GNN based on the attention mechanism calculates the attention coefficient to aggregate with the weight, including three classic models: GAT[ 2018], GATv2 [Brody 2021] and AGNN [Thekumparaampil 2018].

[0102] Graph neural networks (GNNs) that solve heterogeneity are graph neural networks with heterogeneous graphs. GraphSage [Hamilton 2017], FAGCN [Bo 2021], and H2GCN [Zhu 2020] are selected. These methods attempt to alleviate the smoothing of node features by neighbors with different labels.

[0103] Graph neural network GNN with edge features, select GAT with edge features.

[0104] Telecommunication fraud detection model,select the existing telecommunication fraud detection method FFD[Yang 2019].

[0105] The test results are shown in Table 2.

[0106] Table 2 Performance of identifying fraudsters

[0107]

[0108] As shown in Table 2, the proposed model achieves better performance than all baseline methods and improves the F1 score by 1.32. Simple personal feature classification methods, including MLP and XGBoost, perform well, which shows that personal features extracted by observation are very effective in distinguishing fraudsters from ordinary users. In addition, although the classification performance of user average call features is not as good as personal features, in an unbalanced dataset where fraudsters only account for a small proportion of the total users, the F1 score of distinguishing fraudsters using call information can reach about 40, which shows that call information is an important feature for detecting fraudsters.

[0109] Basic GNN models including GCN, SGC, and GIN perform poorly because the neighbors of fraudsters are mostly ordinary users and average aggregation will over-smooth the personal characteristics of fraudsters.

[0110] Attention-based GNNs, including GAT, GATv2, and AGNN, achieve better performance (F1 average improvement of +4.51) through the attention mechanism because they can selectively aggregate valid neighbor information. However, in terms of F1, the performance is still 5.91 lower than the results obtained by the model of the present invention on average. The reason is that global attention cannot adaptively aggregate the neighbors of the fraudsters for each fraudster because there is mutual disguise between the fraudsters.

[0111] GraphSage, FAGCN, and H2GCN consider processing neighbor information instead of direct aggregation, which alleviates the over-smoothing of node features by neighbor nodes. These methods achieve higher performance than basic GNNs. Among them, H2GCN is a method that connects multiple layers of aggregate information instead of direct aggregation, and obtains the highest F1 score among all baselines. However, H2GCN does not consider the different importance of neighbors.

[0112] The GNN with aggregated edge features utilizes edge features during aggregation and its performance is worse than that of the ordinary GAT (F1 average decrease of -5.3), which shows that randomly putting personal information and call information together to calculate the aggregation weights may even lead to learning wrong weights.

[0113] As a traditional telecommunications fraud detection method, FFD is not as good as GNN because it manually extracts graph structure features and its performance is difficult to further improve.

[0114] (4) Ablation experiment

[0115] This example conducts ablation experiments to verify the effectiveness of each main module in the model. More specifically, each module is trained separately under the subgraph-level human-in-the-loop training module to see how they affect the performance respectively: the local adaptive node aggregation module and the masked attention edge aggregation module.

[0116] like Figure 2 As shown in Figure 2, the local adaptive node aggregation module has some performance degradation compared to the entire model, which proves that the edge features have a significant improvement in model performance. In addition, the local adaptive node aggregation module achieves the best performance compared to all other GNN baselines. The masked attention edge aggregation module has the best performance compared to all other baselines that only use edge features in Table 2. It proves that the node and edge aggregation method of the present invention can aggregate more effective information.

[0117] (5) Human-in-the-loop framework

[0118] This embodiment performs parameter analysis on the subgraph-level human-in-the-loop training module to verify its effectiveness. Experiments are conducted with different values ​​of the parameter λ2 of the human-in-the-loop loss function. Figure 3 As shown in the figure, the human-in-the-loop framework does improve the performance of the model (F1 average improvement of +0.34). As λ2 gradually increases, the F1 of the model continues to increase, reaching a maximum value when λ2 is 0.1. When the λ2 value is greater than 0.2, the performance of the model decreases instead. This may be caused by the increase in the value of the human-in-the-loop loss function, which affects the optimizer's optimization of the cross entropy loss.

[0119] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for identifying fraudulent users in a call network using a human-in-loop graph neural network, characterized in that: include: Obtain user information and the call relationship between users, and treat each user as a node in the call network. If there is a call relationship between two users, build an edge between the nodes corresponding to the two users; obtain the initial features of each node and edge, and build a call network G = (V, E, X, S), where V represents the node set, E represents the edge set, X represents the node initial feature set, and S represents the edge initial feature set; The call network is modeled using a graph neural network model that integrates node features and edge features. During the modeling process, the model training process is guided by a human-in-the-loop method, and the training is completed in combination with known node types in the call network. The trained graph neural network model is used to obtain unknown node types in the call network; the node types include normal users and fraudulent users; The graph neural network model includes a local adaptive node aggregation network, a masked attention edge aggregation network and a prediction network. The local adaptive node aggregation network is used to obtain user node-level features, the masked attention edge aggregation network is used to obtain user edge-level features, and the prediction network is used to predict node types and their probabilities based on user node-level features and user edge-level features. The model training process is guided by the human-in-the-loop method during the modeling process, including: randomly sampling some nodes representing users from the call network, and the probability of the node being sampled is proportional to its information entropy; The node-level aggregation weight and edge-level aggregation weight of each layer corresponding to the sampled nodes are corrected, and the corrected aggregation weights are fed back to the local adaptive node aggregation network and the masked attention edge aggregation network respectively, so that the local adaptive node aggregation network and the masked attention edge aggregation network calculate the user node-level features and user edge-level features according to the corrected aggregation weights.

2. A method for identifying fraudulent users in a call network using a human-in-loop graph neural network according to claim 1, characterized in that: The local adaptive node aggregation network and the masked attention edge aggregation network are two branches in the graph neural network model, and both are calculated simultaneously.

3. A method for identifying fraudulent users in a call network using a human-in-loop graph neural network according to claim 1, characterized in that: The local adaptive node aggregation network is an L-layer structure, and the calculation process of each layer includes: Calculate the attention coefficient between nodes: in, is the node v in layer l i and v j The attention coefficient between are nodes v i 、v j Node embeddings in layer l-1 in a locally adaptive node aggregation network, is node v i The set of neighbor nodes including itself, MLP(·) is a multi-layer perceptron, is node v i The weight vector in layer l; ω (l) is the weight parameter matrix of the lth layer, LeakyReLU(·) represents the activation function, and the superscript T represents the transpose; Calculate the user node-level aggregation weight and aggregate neighbor node information: in, Represents the node v in the lth layer i and v j The attention coefficient between them is the node-level aggregation weight of two users at layer l; It is the embedded representation of the node information of the aggregated neighbors at the lth layer; Calculate user node-level features: in, is node v i Embed the nodes in the lth layer and embed the nodes in the last layer As user node-level features.

4. The method for identifying fraudulent users in a call network using a human-in-loop graph neural network according to claim 1, characterized in that: The computation process of the masked attention edge aggregation network includes: Calculate the importance coefficient of each edge based on the initial features of the nodes and edges: in, Represents node v i The connected edge j The important coefficient, s j Represents edge e j The initial features of node v i The set of connected edges, is the embedding of the node initial features and the overall call pattern, a is the shared learnable attention weight vector, the superscript T indicates transposition, ω n is the weight parameter matrix of node features, ω e is the weight parameter matrix of edge features, x i is the initial feature of the node, || represents the concatenation operation, and LeakyReLU(.) is the activation function; Sort the importance coefficients of all edges in the edge set connected to each node, select the top k edges with the highest importance, and normalize the importance coefficients: Among them, α i,j is the node v i The connected edge j The attention score of node v is the user edge-level aggregation weight; Ω(i) is the i The corresponding set of k edges with the highest importance; According to the normalized important coefficients, the edges in the Ω(i) set are aggregated as edge-level features of the nodes: z i =∑ j∈Ω(i) a i,j oh e e j Among them, z i It is a user-level feature.

5. The method of identifying fraudulent users in a call network using a human-in-loop graph neural network according to claim 1, characterized in that: The prediction network concatenates the user node-level features and the user edge-level features as input, and sequentially passes through a linear transformation layer and a softmax layer to obtain the probability that the user represented by the node is a fraudster.

6. A method for identifying fraudulent users in a call network using a human-in-loop graph neural network according to claim 1, characterized in that: Introducing human-in-the-loop loss into the human-in-the-loop method, taking the weighted sum of the loss of the training module and the human-in-the-loop loss as the final loss for model training; The human in-loop loss is: Among them, M i is the label of the egocentric network of the i-th sampled user, P i is the aggregate weight of the egocentric network of the i-th sampled user, |V sample | represents the number of sampled users, ||.|| represents the 2-norm, Indicates a loss of man in the loop.

7. A system for identifying fraudulent users in a call network using a human-in-loop graph neural network, characterized in that: For implementing the method according to claim 1, the system comprises: The call network module is used to obtain user information and the call relationship between users. Each user is regarded as a node in the call network. If there is a call relationship between two users, an edge is built between the nodes corresponding to the two users. The initial features of each node and edge are obtained to build a call network. A graph neural network model module, which is used to model the call network using a graph neural network model that integrates node features and edge features, complete training in combination with known node types in the call network, and use the trained graph neural network model to obtain unknown node types in the call network; the node types include normal users and fraudulent users; The sub-graph level human-in-the-loop training module is used to guide the model training process of the graph neural network model module during the modeling process.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, it is used to implement the method of identifying fraudulent users in a call network using a human-in-loop graph neural network as described in any one of claims 1-6.

Images