Telecommunication fraud detection method, system and storage medium based on graph neural network

Abstract

The present invention discloses a telecommunication fraud detection method, system and storage medium based on graph neural network, which belongs to the field of communication information security technology. The present invention obtains a node feature matrix representing user information in a call network, and uses the node feature as the original signal of the node; the original signal of the node is filtered by a parallel high-pass graph filter and a low-pass graph filter to obtain a filtered high-frequency signal and a low-frequency signal; for each node, the high- and low-frequency signals in its neighborhood are aggregated to obtain a high- and low-frequency representation of each node, and the attention score is calculated based on the attention mechanism to obtain the final representation of the node; the classification result of the final representation of the node is obtained by using a classifier, and telecommunication fraud users are identified according to abnormal nodes. The present invention is based on user call data network and graph sequence modeling, analyzes the relationship between node type and high- and low-frequency signals in the call network, and accurately identifies abnormal nodes in the graph data by capturing high- and low-frequency signals in the graph.

Description

Technical Field

[0001] The present invention relates to the field of communication information security technology, and in particular to a telecommunications fraud detection method, system and storage medium based on graph neural network. Background Art

[0002] There are interdependencies between data in the real world, and more attention needs to be paid to anomaly detection technology on graph structures. Graph structures can be used to dig out fraudsters in the user's call network. Although there are anomaly detection methods based on deep learning in traditional graph algorithms, they are black box operations and lack interpretability. Therefore, in order to overcome the difficulties in performance and interpretability, graph neural networks (GNNs) have emerged. Recently, GNNs have become a very effective method for solving graph structure data problems, and have been applied in many fields, such as recommendation systems, financial risk control, and network attack detection. Representative methods include graph convolutional neural networks (GCNs) and graph attention networks (GATs).

[0003] However, the unique characteristics of graph-structured data also bring other challenges. First, the interrelationships between data make it challenging to identify abnormal nodes from the graph structure. From a microscopic perspective, most nodes connected by edges are more similar than other nodes, which means that adjacent nodes are more likely to have similar features and the same labels. From the perspective of graph representation, two nodes connected by edges or with more common neighbors are more similar, so their distance in the representation space should be closer; while nodes that are not connected by edges or have no common neighbors and are farther apart in the graph are considered to have fewer common features, so their distance in the representation space should also be farther. Anomaly detection in the telecommunications fraud graph structure is to mine data in the data set that is significantly different from other normal patterns.

[0004] In actual scenarios, if an abnormal node has an edge with a normal node, based on the assumption that most nodes connected by edges are more similar than other nodes, the detection results are prone to deviation, resulting in failure to detect abnormal events in a timely manner. Secondly, compared with traditional outlier detection, the definition of anomalies in graph structures is very different. In traditional non-graph structure outlier detection, outliers and normal nodes belong to two distributions with no correlation. In the graph structure, abnormal nodes are those nodes that may be associated with normal nodes but do not conform to the expected behavior pattern (of the normal class).

[0005] Existing GNN models perform convolution operations based on the assumption that the nodes in the graph are highly similar, and propagate similar information between nodes. However, relevant studies have shown that GNN models show lower accuracy on data sets that do not meet the above assumptions. In anomaly detection scenarios, the presence of abnormal nodes will destroy the above assumptions. The convolution operation of GNN will reduce the difference in representation between abnormal nodes and normal nodes, and may even cause the representation learned by the model to converge to a fixed value, making it impossible for the GNN model to identify abnormal fraud nodes in the call network. Summary of the invention

[0006] In order to solve the problems of poor model interpretability and low detection accuracy of telecommunications fraud detection methods in the prior art, the present invention proposes a telecommunications fraud detection method, system and storage medium based on graph neural network, which are used to accurately identify fraudulent users in user call data networks.

[0007] The present invention adopts the following technical solution:

[0008] In a first aspect, the present invention provides a telecommunications fraud detection method based on a graph neural network, comprising:

[0009] Obtain a node feature matrix representing user information in the call network, and use the node features as the original signal of the node;

[0010] The original signal of the node is filtered by a parallel high-pass graph filter and a low-pass graph filter to obtain a filtered high-frequency signal and a filtered low-frequency signal;

[0011] For each node, aggregate the high-frequency and low-frequency signals in its neighborhood to obtain the low-frequency and high-frequency representations of each node, and calculate the attention scores of the high-frequency and low-frequency signals based on the attention mechanism, and use the weighted result of the high-frequency and low-frequency signals as the final representation of the node;

[0012] The classifier is used to obtain the classification results of the final representation of the node, and telecommunications fraud users are identified based on abnormal nodes.

[0013] In a second aspect, the present invention provides a telecommunications fraud detection system based on a graph neural network, which is used to implement the above-mentioned telecommunications fraud detection method based on a graph neural network.

[0014] In a third aspect, the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, is used to implement the above-mentioned telecommunications fraud detection method based on graph neural network.

[0015] Compared with the prior art, the present invention has the following beneficial effects: the present invention is based on user call data network and graph sequence modeling, extracts multi-band graph signals through the attention mechanism, analyzes the relationship between node types in the call network and high and low frequency signals in the graph, and accurately identifies abnormal nodes in the graph data by capturing high and low frequency signals in the graph. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a schematic diagram of a graph anomaly detection method based on a graph neural network according to an exemplary embodiment;

[0017] Figure 2 It is a schematic diagram of a Bernstein polynomial function image (4th order) according to an exemplary embodiment. DETAILED DESCRIPTION

[0018] The present invention is further described below in conjunction with the accompanying drawings and embodiments. The accompanying drawings are only schematic diagrams of the present invention, and some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities, and these functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0019] The goal of the present invention is to accurately identify specific user groups (such as fraudulent users) based on user call data networks and graph sequence modeling. Specifically, the present invention designs an end-to-end graph neural network to perform graph node classification (target group, such as fraudulent users). In the present invention, the graph anomaly detection method based on graph neural network is based on a deep framework of spectral domain graph neural network that can extract multi-band graph signals through an attention mechanism, and mainly includes two parts: parallel filters and attention layers.

[0020] Figure 1 The figure shows the overall framework of the present invention. The input of the model is a graph structure, and also includes a feature matrix of nodes and real labels of some nodes, such as abnormal node labels, normal node labels, and node labels that need to be predicted.

[0021] In the present invention, the presence of abnormal nodes will increase the frequency of the graph signal, disturb the signal on the entire graph, and change the frequency of the signal on the graph. However, for unknown data sets, it is impossible to determine which frequency bands of signals are helpful for node identification. Therefore, based on observations on the data set and graph signal processing technology, the present invention uses a parallel filter and an attention layer to achieve accurate identification of abnormal nodes in graph data.

[0022] First, it is obtained from the input node feature matrix (such as user features in a call network), and the node feature is used as the original signal of the node in the graph, and then the original signal is filtered using a parallel filter.

[0023] In this embodiment, the call network is obtained based on user information and the call relationship between users. Each user is regarded as a node in the call network. If there is a call relationship between two users, an edge is built between the nodes corresponding to the two users to obtain the call network. The ultimate goal of the present invention is to predict the identity of an unknown user based on the identity of a known user in the network.

[0024] The parallel filters are initialized as low-pass graph filters and high pass image filter The graph filter here is in the form of It is a frequency response function, which is used to increase or suppress the signal strength of certain frequency bands. In the process of continuous learning of the subsequent model, the gradient feedback is used to adjust in parallel and The original signal of the node is passed and The filtering obtains low-frequency signals and high-frequency signals respectively. The essence is that the node aggregates the low-frequency information and high-frequency information in its neighborhood to obtain the low-frequency representation. and high frequency representation This allows each node to be represented by two nodes that focus on signals in different frequency bands.

[0025] Afterwards, the attention mechanism is used to adaptively determine the importance of signal representations in different frequency bands for the node.

[0026] In this embodiment, the attention layer designs a node-level attention mechanism, which not only considers the original signal of the node, but also considers the signal after filtering, so that the importance of signals in different frequency bands for different nodes can be learned. For example, abnormal nodes may be more inclined to pay attention to high-frequency signals, and normal nodes may be more inclined to pay attention to low-frequency signals. Because there is a gap between the signal of the abnormal node and the signal of the surrounding normal nodes, and this gap needs to be widened and emphasized in the subsequent downstream tasks, the abnormal node should pay more attention to the high-frequency signal; and the normal node is not a target that needs to be paid attention to in the abnormal detection scenario, so it is necessary to reduce the signal difference between them and smooth their graph signals, so the normal node should pay more attention to the low-frequency signal. In the attention layer, each node learns a normalized importance score for the two different frequency band signal representations obtained after filtering. After obtaining the score, the linear combination of the two representations is used as the final representation.

[0027] Finally, the recombined final representation is passed through a multi-layer perceptron MLP to output the prediction results of the nodes marked with the node labels to be predicted.

[0028] In a specific implementation of the present invention, in order to avoid the eigendecomposition of the Laplace matrix, this embodiment uses a polynomial function to approximate the graph filter. The essence of graph filter learning is the learning of a function. If there is no restriction, it will be a completely free learning task, and this method is obviously not feasible. Therefore, in this embodiment, the present invention designs filters based on Bernstein polynomials. It is only necessary to learn the coefficients of these basic polynomials and combine them to fit any function. When fitting the function, this embodiment uses polynomials as the basis function because polynomials are easy to calculate, perform well, are smooth, and have sufficient expressive power. However, there are certain problems with polynomial interpolation, such as oscillation phenomena and high sensitivity to the number of interpolation points. In order to design a better basis function for interpolation, this embodiment introduces the basis function of Bernstein polynomials. The image of the Bernstein polynomial function (4th order) is as follows Figure 2 shown.

[0029] Finally, the graph filter is designed as follows:

[0030]

[0031] in, is the coefficient vector of the Bernstein polynomial, θ i is the coefficient of the ith Bernstein polynomial, B i is the ith Bernstein polynomial, Λ is the diagonal matrix obtained by arranging the eigenvalues ​​of the graph Laplace matrix, g θ (.) represents a graph filter The frequency response function of , K is the degree of the Bernstein polynomial.

[0032] Based on the above graph filter form, we further design different graph filters to obtain filtered signals in different frequency bands. At the time of initialization, according to the characteristics of Bernstein polynomials, the coefficient vector θ = (θ1, ..., θ K ) are assigned initial values ​​to obtain the initialized low-pass image filter and high-pass image filter, and then the two filters are allowed to continuously update the image filter form during the model learning process to capture signals in different frequency bands.

[0033] In this embodiment, the node feature is defined as X = {x1, ..., x n}∈R n×d , where d is the dimension of the node feature, x i is the i-th node feature, and n represents the number of nodes.

[0034] The low-pass image filter is denoted as The high-pass image filter is denoted by The filtered low-frequency signal and high frequency signals It can represent:

[0035]

[0036]

[0037] Where L is the graph Laplace matrix, and U represents the matrix obtained by eigendecomposing L, satisfying UΛU T =L, the superscript T indicates transposition, x i is the i-th node feature, K is the degree of the Bernstein polynomial, B j represents the jth Bernstein polynomial, are the learnable parameters in the low-pass graph filter and the high-pass graph filter, respectively. As shown in the above two equations, the model simultaneously and concurrently learns two filters that focus on different frequency bands.

[0038] Finally, the model calculates the relative weights of high-frequency and low-frequency signals by using the attention mechanism:

[0039]

[0040]

[0041] Among them, W1 and W2 are learnable parameter matrices, q is a learnable attention parameter vector, the superscript T represents transpose, and tanh represents the activation function. The final attention score is obtained by normalizing the relative weights:

[0042]

[0043]

[0044] Final representation of node i By high frequency signal With low frequency signal Combining the attention scores:

[0045]

[0046] The application of the attention mechanism effectively emphasizes the contrast difference between the signals of normal and abnormal nodes, making this difference easier to be captured by the multi-layer perceptron MLP layer, and obtaining better anomaly detection results. The final representation of the obtained node is put into the MLP, and the classification result can be obtained through the MLP layer, that is, predicting whether each node is an abnormal node in the graph.

[0047] In summary, the present invention, through a given call network between users and analyzing the relationship between abnormal nodes in the graph and high-frequency signals in the graph, trains an end-to-end spectral domain graph neural network classification framework, captures high and low frequency signals in the graph, and can accurately identify abnormal nodes in the graph data.

[0048] Telecommunication fraud detection method, system and storage medium based on graph neural network

[0049] In this embodiment, a telecommunications fraud detection system based on a graph neural network is also provided, which is used to implement the above-mentioned embodiments, and will not be repeated hereafter. The terms "module", "unit", etc. used below can implement a combination of software and / or hardware for a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible.

[0050] The system comprises:

[0051] A call network data acquisition module is used to obtain a node feature matrix representing user information in the call network, and use the node features as the original signal of the node;

[0052] A low-pass graph filter module is used to filter the original signal of the node to obtain a filtered low-frequency signal;

[0053] A high-pass graph filter module is used to filter the original signal of the node to obtain a filtered high-frequency signal;

[0054] The attention module is used to aggregate the high-frequency and low-frequency signals in the neighborhood of each node, obtain the low-frequency and high-frequency representations of each node, calculate the attention scores of the high-frequency and low-frequency signals, and use the weighted result of the high-frequency and low-frequency signals as the final representation of the node;

[0055] The classifier module is used to classify the final representation of the node and identify telecommunications fraud users based on the abnormal node classification results.

[0056] In this embodiment, it also includes:

[0057] A training module is used to perform end-to-end training on a low-pass graph filter module, a high-pass graph filter module, an attention module, and a classifier module according to a node feature matrix with normal node and abnormal node labels.

[0058] The implementation process of the functions and effects of each module in the above-mentioned system is specifically detailed in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here. For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The system embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative labor. An embodiment of the present invention also provides a computer-readable storage medium, on which a program is stored, and when the program is executed by a processor, the above-mentioned method of identifying fraudulent users in a call network using a human-in-loop graph neural network is implemented.

[0059] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0060] This embodiment verifies the implementation effect of the present invention through a specific experiment.

[0061] (1) Data description

[0062] The dataset used in this experiment is provided by China Telecom. The application scenario is mainly that fraudsters forge identities and fabricate information to defraud money through the Internet, text messages, or phone calls. The dataset consists of 340,751 nodes and 1,575,498 edges, as well as the attribute characteristics of each call, including the business type, call duration, geographic location, etc. Each node represents a mobile phone number (also a telecom user), and the edge connecting two nodes means that there is at least one communication between the two users. Among all the users in this dataset, there are 15,755 fraud users, and the corresponding label is defined as 1, and other users are marked as 0.

[0063] (2)Comparative experiment

[0064] In order to fully verify the effectiveness of the model of the present invention, this experiment compared it with several different types of baseline models. The baseline models compared with the model of the present invention include:

[0065] Feature engineering method: Based on the specific analysis of the data set and the scenario, feature engineering processing is performed and logistic regression is used to detect abnormal nodes.

[0066] Graph Convolutional Network (GCN): GCN is a direct inference semi-supervised machine learning algorithm based on graph structure data. It is the application of deep neural network algorithm on graphs. GCN starts from the framework of spectral graph convolution. The main operation of graph neural network is graph convolution operation, and the filter parameters of convolution are usually shared in all positions in the graph structure.

[0067] Graph Attention Network (GAT): GAT assigns different weights to the neighbors of a node by calculating the attention score value. This does not require knowing the entire network structure or performing matrix multiplication operations like the Laplace matrix calculation-based method.

[0068] DOMINANT[Ding 2019]: The DOMINANT model uses a graph convolutional network (GCN) to model attribute networks. Through the synergy between GCN and autoencoders, it can detect abnormal instances by measuring the reconstruction errors of nodes from the perspective of structure and attributes. The core idea is that the error caused by the reconstruction of graph structure and attributes of abnormal nodes is greater than that caused by the reconstruction of normal nodes.

[0069] The test results are shown in Table 1.

[0070] Table 1 Test results of the data set (%)

[0071]

[0072] As can be seen from Table 1, the present invention performs better than other compared methods in telecommunications fraud anomaly detection, with an F1 score improvement of 6%. This result verifies the effectiveness of the present invention in telecommunications fraud detection on the call network, while taking into account the recall rate and accuracy of telecommunications fraud detection, and can achieve a good effect.

[0073] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A telecommunications fraud detection method based on graph neural network, characterized in that: include: Obtain a node feature matrix representing user information in the call network, and use the node features as the original signal of the node; The original signal of the node is filtered by a parallel high-pass graph filter and a low-pass graph filter to obtain a filtered high-frequency signal and a filtered low-frequency signal; For each node, aggregate the high-frequency and low-frequency signals in its neighborhood to obtain the low-frequency and high-frequency representations of each node, and calculate the attention scores of the high-frequency and low-frequency signals based on the attention mechanism, and use the weighted result of the high-frequency and low-frequency signals as the final representation of the node; The classifier is used to obtain the classification results of the final representation of the node, and telecommunications fraud users are identified based on abnormal nodes.

2. The method for detecting telecommunication fraud based on graph neural network according to claim 1 is characterized in that: The call network is obtained based on user information and the call relationship between users. Each user is regarded as a node in the call network. If there is a call relationship between two users, an edge is built between the nodes corresponding to the two users to obtain the call network.

3. The telecommunication fraud detection method based on graph neural network according to claim 1 is characterized in that: The low-pass image filter and the high-pass image filter are frequency response functions based on Bernstein polynomials, which are expressed as follows: Where θ=(θ1,…,θ K ) is the coefficient vector of the Bernstein polynomial, θ j is the coefficient of the j-th Bernstein polynomial, B j is the jth Bernstein polynomial, Λ is the diagonal matrix obtained by arranging the eigenvalues ​​of the graph Laplace matrix, g θ (.) represents a graph filter The frequency response function of , K is the degree of Bernstein polynomial; Image filter The coefficient vector of the Bernstein polynomial θ=(θ1,…,θ K ) is initialized to obtain the initialized low-pass image filter and high pass image filter The two filters continuously update parameters during the model learning process to capture signals in different frequency bands.

4. The method for detecting telecommunication fraud based on graph neural network according to claim 3 is characterized in that: The original signal of the node is filtered by the parallel high-pass image filter and the low-pass image filter to obtain the filtered high-frequency signal and low-frequency signal. The calculation formula is: Where L is the graph Laplace matrix, and U represents the matrix obtained by eigendecomposing L, satisfying UΛU T =L, the superscript T indicates transposition, x i is the i-th node feature, K is the degree of the Bernstein polynomial, B j represents the jth Bernstein polynomial, are the learnable parameters in the low-pass graph filter and the high-pass graph filter, respectively. is the low-frequency signal corresponding to the feature of the i-th node, is the high-frequency signal corresponding to the feature of the i-th node.

5. The method for detecting telecommunication fraud based on graph neural network according to claim 1 is characterized in that: The relative weights of high-frequency signals and low-frequency signals are calculated based on the attention mechanism, specifically: Among them, W1 and W2 are learnable parameter matrices, q is a learnable attention parameter vector, the superscript T represents the transpose, and tanh represents the activation function; is the relative weight of the high-frequency signal corresponding to the i-th node feature, is the relative weight of the low-frequency signal corresponding to the i-th node feature; is the low-frequency signal corresponding to the feature of the i-th node, is the high-frequency signal corresponding to the feature of the i-th node; The relative weights are normalized to get the attention score: in, is the high-frequency signal attention score corresponding to the i-th node feature, is the low-frequency signal attention score corresponding to the i-th node feature.

6. The method for detecting telecommunication fraud based on graph neural network according to claim 5 is characterized in that: The final representation of the node is expressed as: in, is the final representation of the i-th node.

7. The method for detecting telecommunication fraud based on graph neural network according to claim 1 is characterized in that: The classifier adopts a multi-layer perceptron.

8. A telecommunications fraud detection system based on graph neural network, characterized in that: For implementing the method according to claim 1, the system comprises: A call network data acquisition module is used to obtain a node feature matrix representing user information in the call network, and use the node features as the original signal of the node; A low-pass graph filter module is used to filter the original signal of the node to obtain a filtered low-frequency signal; A high-pass graph filter module is used to filter the original signal of the node to obtain a filtered high-frequency signal; The attention module is used to aggregate the high-frequency and low-frequency signals in the neighborhood of each node, obtain the low-frequency and high-frequency representations of each node, calculate the attention scores of the high-frequency and low-frequency signals, and use the weighted result of the high-frequency and low-frequency signals as the final representation of the node; The classifier module is used to classify the final representation of the node and identify telecommunications fraud users based on the abnormal node classification results.

9. The telecommunications fraud detection system based on graph neural network according to claim 8 is characterized in that: Also includes: A training module is used to perform end-to-end training on a low-pass graph filter module, a high-pass graph filter module, an attention module, and a classifier module according to a node feature matrix with normal node and abnormal node labels.

10. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, it is used to implement the telecommunications fraud detection method based on graph neural network as described in any one of claims 1-7.

Images