Abnormal account detection method, graph neural network model construction method and device

Abstract

This paper relates to the financial field, and specifically provides a method for detecting abnormal accounts, a method for constructing a graph neural network model, and an apparatus. The method for detecting abnormal accounts includes: acquiring attribute information of a target account; feeding the attribute information of the target account into a pre-constructed graph neural network model, wherein the graph neural network model is constructed based on a transaction graph generated from the account's transaction information; calculating an anomaly score for the target account based on the graph neural network model; and determining whether the target account is a normal account or an abnormal account based on the anomaly score. This paper can improve the efficiency and accuracy of abnormal account detection.

Description

Technical Field

[0001] This invention relates to the financial field, and in particular to an abnormal account detection method, a method for constructing a graph neural network model, and an apparatus. Background Technology

[0002] Because online transactions are a non-face-to-face form of online transaction, banks cannot verify whether the individual conducting the online transaction is indeed the account holder. This uncertainty and the confidentiality of the transactions significantly reduce the effectiveness of anti-money laundering measures such as identity verification implemented by banks. Furthermore, the 24 / 7 availability, high speed, and cross-regional fund transfer capabilities of online transactions expose banks to a certain degree of money laundering risk. At the same time, while accumulating basic information and transaction records of transaction accounts is relatively easy with the development of big data technology, labeling each transaction as normal or abnormal consumes enormous human and material resources, and may even be impossible.

[0003] Currently, mainstream machine learning technologies still have shortcomings in detecting anomalies in fund transactions. In this scenario, the number of fund transactions is enormous, and traditional supervised machine learning requires constructing label information for each transaction for the machine learning model to learn from, which undoubtedly consumes a lot of human and material resources.

[0004] Therefore, there is an urgent need for an abnormal account detection method that can improve the detection efficiency and accuracy of abnormal accounts. Summary of the Invention

[0005] The purpose of this embodiment is to provide an abnormal account detection method, a graph neural network model construction method, and an apparatus to improve the detection efficiency and accuracy of abnormal accounts.

[0006] To achieve the above objectives, this embodiment provides an abnormal account detection method, including:

[0007] Obtain the attribute information of the target account;

[0008] The attribute information of the target account is fed into a pre-built graph neural network model, wherein the graph neural network model is constructed based on the transaction graph generated by the account's transaction information;

[0009] Based on the graph neural network model, the anomaly score of the target account is calculated;

[0010] Based on the abnormal score, the target account is determined to be a normal account or an abnormal account.

[0011] Preferably, the step of calculating the anomaly score of the target account based on the graph neural network model further includes:

[0012] Based on the graph neural network model, the local anomaly score and global anomaly score of the target account are calculated.

[0013] The local anomaly score and the global anomaly score of the target account are linearly added together to obtain the anomaly score of the target account.

[0014] Preferably, calculating the local anomaly score and global anomaly score of the target account based on the graph neural network model further includes:

[0015] Using the graph neural network model, the embedding matrix of the target node corresponding to the target account is obtained;

[0016] The embedding vector of the target node is calculated using the graph neural network model.

[0017] Based on the embedding matrix and embedding vector of the target node, the local anomaly score and global anomaly score of the target node are obtained.

[0018] Preferably, obtaining the local anomaly score of the target node based on the embedding matrix and embedding vector of the target node further includes:

[0019] Hide the attribute information of the target account in the transaction graph;

[0020] Based on the embedding matrix of the target node, the local embedding vector of the target node after hiding is calculated;

[0021] The local anomaly score of the target node is calculated based on the local embedding vector of the target node after it is hidden, the local embedding vectors of other nodes in the transaction subgraph of the target node after they are hidden, and the embedding vector of the target node.

[0022] Preferably, obtaining the global anomaly score of the target node based on the embedding matrix and embedding vector of the target node further includes:

[0023] Hide the attribute information of the target account in the transaction graph;

[0024] Based on the embedding matrix of the target node, the global embedding vector of the target node after hiding is calculated;

[0025] The global anomaly score of the target node is calculated based on the hidden global embedding vector of the target node, the hidden global embedding vectors of other nodes in the transaction subgraph of the target node (excluding the target node), and the embedding vector of the target node.

[0026] Preferably, the method for constructing the graph neural network model includes:

[0027] A transaction graph is obtained based on the transaction information between accounts, and the nodes in the transaction graph are used to represent the attribute information of the accounts;

[0028] Based on the transaction graph, a transaction subgraph is generated for each node;

[0029] The initial graph neural network model is used to process the transaction subgraph of each node to obtain the objective function;

[0030] The objective function is trained to obtain a graph neural network model.

[0031] Preferably, the step of processing the transaction subgraph of each node using the initial graph neural network model to obtain the objective function further includes:

[0032] The initial embedding matrix of each node is obtained by encoding the transaction subgraph of each node using an initial graph neural network model.

[0033] The initial embedding vector of each node is calculated using the initial graph neural network model;

[0034] Based on the initial embedding matrix and initial embedding vector of each node, the local contrastive learning term and global contrastive learning term of each node are obtained.

[0035] The objective function is obtained based on the local and global contrastive learning terms for each node.

[0036] Preferably, obtaining the local contrastive learning term for each node based on the initial embedding matrix and initial embedding vector of each node further includes:

[0037] Hide the attribute information of the account corresponding to each node in the transaction graph;

[0038] Based on the initial embedding matrix of each node, the initial local embedding vector of each node after hiding is calculated.

[0039] Using the initial local embedding vector of each node after hiding and the initial embedding vector of each node, construct positive sample pairs for each node based on local contrast.

[0040] Using the initial local embedding vector of each node after hiding all other nodes in the transaction subgraph of each node and the initial embedding vector of each node, a negative sample pair based on local contrast is constructed for each node;

[0041] By utilizing the positive and negative sample pairs based on local contrast for each node, a local contrast learning term for each node is constructed.

[0042] Preferably, obtaining the global contrastive learning term for each node based on the initial embedding matrix and initial embedding vector of each node further includes:

[0043] Hide the attribute information of the account corresponding to each node in the transaction graph;

[0044] Based on the initial embedding matrix of each node, the initial global embedding vector of each node after hiding is calculated.

[0045] Using the initial global embedding vector of each node after it is hidden and the initial embedding vector of each node, construct positive sample pairs for each node based on global comparison;

[0046] Using the initial global embedding vector of each node after hiding all other nodes in the transaction subgraph of each node and the initial embedding vector of each node, construct a negative sample pair for each node based on global comparison;

[0047] By utilizing the positive and negative sample pairs of each node based on global comparison, a global comparison learning term for each node is constructed.

[0048] On the other hand, this embodiment also provides a method for constructing a graph neural network model, which is applied to any of the above-described abnormal account detection methods, including:

[0049] A transaction graph is obtained based on the transaction information between accounts, and the nodes in the transaction graph are used to represent the attribute information of the accounts;

[0050] Based on the transaction graph, a transaction subgraph is generated for each node;

[0051] The initial graph neural network model is used to process the transaction subgraph of each node to obtain the objective function;

[0052] The objective function is trained to obtain a graph neural network model.

[0053] On the other hand, this embodiment provides an abnormal account detection device, including:

[0054] The acquisition module is used to obtain the attribute information of the target account;

[0055] The input module is used to input the attribute information of the target account into a pre-built graph neural network model, wherein the graph neural network model is constructed based on the transaction graph generated by the account's transaction information;

[0056] The calculation module is used to calculate the anomaly score of the target account based on the graph neural network model.

[0057] The determination module is used to determine whether the target account is a normal account or an abnormal account based on the abnormal score.

[0058] In another aspect, embodiments of this document also provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the computer program, when executed by the processor, performs instructions of any of the methods described above.

[0059] In another aspect, the embodiments herein also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of a computer device, performs instructions for any of the methods described above.

[0060] As can be seen from the technical solutions provided in the embodiments above, the embodiments of this paper can use graph neural network models to detect abnormal accounts. The abnormal score of the target node can be obtained according to the graph neural network model. The abnormal score can be used to further determine whether the target account is a normal account or an abnormal account, thereby improving the detection efficiency and accuracy of abnormal accounts.

[0061] To make the above and other objects, features and advantages of this document more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments or prior art described herein, the accompanying drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this article. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 A flowchart illustrating an abnormal account detection method provided in this embodiment is shown.

[0064] Figure 2 This document illustrates a flowchart illustrating how an initial graph neural network model is used to process the transaction subgraph of each node to obtain the objective function, as provided in the embodiments of this paper.

[0065] Figure 3 A schematic diagram of the process for obtaining the local contrastive learning term for each node, as provided in the embodiments of this paper, is shown.

[0066] Figure 4 A schematic diagram of the process for obtaining the global contrastive learning term for each node, as provided in the embodiments of this paper, is shown.

[0067] Figure 5This document illustrates a flowchart for calculating the anomaly score of a target account, as provided in the embodiments herein.

[0068] Figure 6 The flowchart illustrating the process for calculating the local anomaly score and global anomaly score of a target account, as provided in the embodiments of this article, is shown.

[0069] Figure 7 A schematic diagram of the process for obtaining the local anomaly score of a target node, as provided in the embodiments of this article, is shown.

[0070] Figure 8 This document illustrates a flowchart of the process for obtaining the global anomaly score of a target node, as provided in the embodiments herein.

[0071] Figure 9 This document shows a schematic diagram of the module structure of an abnormal account detection device provided in an embodiment of the invention;

[0072] Figure 10 A schematic diagram of the structure of the computer device provided in the embodiments of this article is shown.

[0073] Explanation of symbols in the attached drawings:

[0074] 100. Acquisition Module;

[0075] 200. Input module;

[0076] 300. Calculation module;

[0077] 400. Determine the module;

[0078] 1002. Computer equipment;

[0079] 1004, Processor;

[0080] 1006. Memory;

[0081] 1008. Drive mechanism;

[0082] 1010. Input / Output Module;

[0083] 1012. Input devices;

[0084] 1014. Output devices;

[0085] 1016. Presentation device;

[0086] 1018. Graphical User Interface;

[0087] 1020. Network interface;

[0088] 1022. Communication link;

[0089] 1024. Communication bus. Detailed Implementation

[0090] The technical solutions in the embodiments described below will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments described herein, and not all of the embodiments. Based on the embodiments described herein, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this document.

[0091] Currently, mainstream machine learning technologies still have shortcomings in detecting anomalies in fund transactions. In this scenario, the number of fund transactions is enormous, and traditional supervised machine learning requires constructing label information for each transaction for the machine learning model to learn from, which undoubtedly consumes a lot of human and material resources.

[0092] To address the aforementioned issues, this paper provides a method for constructing a graph neural network model. Figure 1 This is a flowchart illustrating a method for constructing a graph neural network model provided in this embodiment. This specification provides the operational steps of the method described in the embodiments or flowchart, but based on conventional or non-inventive labor, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only possible execution order. In actual system or device products, the methods shown in the embodiments or accompanying drawings can be executed sequentially or in parallel.

[0093] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings herein are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0094] Reference Figure 1 This paper discloses a method for detecting abnormal accounts, including:

[0095] S101: Obtain the attribute information of the target account;

[0096] S102: Input the attribute information of the target account into a pre-built graph neural network model, wherein the graph neural network model is constructed based on the transaction information of the account to generate a transaction graph;

[0097] S103: Calculate the anomaly score of the target account based on the graph neural network model;

[0098] S104: Based on the abnormal score, determine whether the target account is a normal account or an abnormal account.

[0099] The target account is the account that needs to be detected for anomalies. The account's attribute information can include multiple dimensions, such as transaction information, customer information, and account status. Transaction information can include: the number of transactions, transaction amount, number of payments, payment amount, number of receipts, receipt amount, number of interbank transfers, number of withdrawals, number of purchases, and number of third-party payments within a historical period. Customer information can include: customer gender, age, marital status, education level, employment status, etc. Account status information can include: account opening date, current account status, etc.

[0100] The method for constructing the graph neural network model includes:

[0101] Step 1.1: Based on the transaction information between accounts, obtain a transaction graph, where the nodes in the transaction graph are used to represent the attribute information of the accounts;

[0102] Step 1.2: Based on the transaction graph, generate a transaction subgraph for each node;

[0103] Step 1.3: Process the transaction subgraph of each node using the initial graph neural network model to obtain the objective function;

[0104] Step 1.4: Train the objective function to obtain the graph neural network model.

[0105] Reference Figure 2 The step of processing the transaction subgraph of each node using the initial graph neural network model to obtain the objective function further includes:

[0106] S201: Encode the transaction subgraph of each node using the initial graph neural network model to obtain the initial embedding matrix of each node.

[0107] S202: Calculate the initial embedding vector for each node using the initial graph neural network model;

[0108] S203: Based on the initial embedding matrix and initial embedding vector of each node, obtain the local contrastive learning term and the global contrastive learning term of each node;

[0109] S204: Obtain the objective function based on the local and global contrastive learning terms for each node.

[0110] In this transaction graph, if there is transaction information between account A and account B, it means that there is a transaction relationship between account A and account B. The transaction relationship between the two corresponding accounts is represented by the edge between the two nodes. If there is a transaction relationship between the two accounts, there is an edge between the two corresponding nodes. If there is no transaction relationship between the two accounts, there is no edge between the two corresponding nodes. The nodes in the transaction graph are used to represent the attribute information of the accounts.

[0111] The resulting transaction chart can be represented as follows:

[0112] G={A,X}(1)

[0113] Where G is the transaction graph, X∈R s×d Let X be a node in the transaction graph, s be the number of nodes in the transaction graph, d be the number of dimensions of the account's attribute information, A∈{0,1}, and A be the adjacency matrix of the graph. p,q =1 indicates that there is an edge between node p and node q, A p,q =0 indicates that there is no edge between node p and node q.

[0114] Based on the transaction graph, a transaction subgraph for each node can be generated. Centered on each target node, the transaction graph is sampled by a fixed number of samples (k) to generate its surrounding context, thus obtaining the transaction subgraph for each node.

[0115] G i ={A i ,X i} (2)

[0116] Where i represents the i-th node, G i Let A represent the transaction subgraph of the i-th node. i X is the adjacency matrix of the transaction subgraph of the i-th node. i ∈R k×d Let k be a node in the transaction subgraph of the i-th node, k be the number of nodes in the transaction subgraph of the i-th node, and d be the number of dimensions of the attribute information of the account corresponding to the i-th node.

[0117] Furthermore, the initial graph neural network model can be used to encode the transaction subgraph of each node, resulting in the initial embedding matrix for each node, as follows:

[0118] H i =f(A i ,X i (3)

[0119] Among them, H i Let f be the initial embedding matrix of the i-th node, and f() be the initial neural network model.

[0120] Then, the initial embedding vector for each node is calculated using the initial graph neural network model, as follows:

[0121] z i =f(x) i (4)

[0122] Among them, z i Let be the initial embedding vector of the i-th node.

[0123] Finally, the consistency between each node and its transaction subgraph is used to reflect the node's abnormal situation. Specifically, based on the initial embedding matrix and initial embedding vector of each node, local contrastive learning terms and global contrastive learning terms for each node are obtained. The local contrastive learning terms are used to locally compare the local consistency between the embedding of each node in its transaction subgraph and the embedding of each node itself. The global contrastive learning terms are used to globally compare the global consistency between the embedding of each node in its transaction subgraph and the embedding of each node itself.

[0124] By minimizing the local and global contrastive learning terms of each node through the objective function, an optimized graph neural network model is obtained. This model can be used for abnormal account detection. The abnormal score of each node can be obtained from the graph neural network model, and the abnormal score can be used to further determine whether the account corresponding to each node is a normal account or an abnormal account, thereby improving the detection efficiency and accuracy of abnormal accounts.

[0125] In the embodiments described herein, reference is made to Figure 3 The step of obtaining the local contrastive learning term for each node based on the initial embedding matrix and initial embedding vector of each node further includes:

[0126] S301: Hide the attribute information of the account corresponding to each node in the transaction graph;

[0127] S302: Calculate the initial local embedding vector of each node after hiding based on the initial embedding matrix of each node;

[0128] S303: Using the initial local embedding vector of each node after hiding and the initial embedding vector of each node, construct a positive sample pair for each node based on local comparison;

[0129] S304: Using the initial local embedding vector of each other node in the transaction subgraph of each node after hiding and the initial embedding vector of each node, construct a negative sample pair for each node based on local comparison;

[0130] S305: Using the positive and negative sample pairs based on local contrast of each node, a local contrast learning term for each node is constructed.

[0131] Each node in the transaction graph represents the attribute information of an account. To prevent information leakage of the attribute information of the account corresponding to the node during the construction of the graph neural network model, the attribute information of the account corresponding to each node can be hidden.

[0132] A specific method for hiding the data could be to treat each node as the starting node in its transaction subgraph, and use that starting node as the zero vector, i.e.: Where X i Let X be the transaction subgraph of the i-th node. i [1,:] is the starting node in the transaction subgraph of the i-th node, which is the i-th node. The starting node in the transaction subgraph of the i-th node is the zero vector.

[0133] For all nodes in the transaction graph, the attribute information of the account corresponding to each node is hidden.

[0134] Based on the initial embedding matrix of each node, the initial local embedding vector of each node after hiding can be calculated as follows:

[0135]

[0136] in, H is the initial local embedding vector after hiding the i-th node. i Let [i, y] be the initial embedding matrix of the i-th node, and [1,:] represent the starting node in the transaction subgraph of the i-th node.

[0137] This leads to the positive sample pair of the i-th node based on local comparison:

[0138] For all nodes in the transaction subgraph of the i-th node (including the i-th node v) i and except v i Other nodes v j For example, given that j = 1…k and j ≠ i, and k is the number of nodes in the transaction subgraph of the i-th node, the i-th node v i The nodes were hidden except for the i-th node v. i Other nodes v j The corresponding account's attribute information was also hidden.

[0139] It needs to be explained that node v i and node v j They are all nodes in the transaction graph, only at node v i In the transaction subgraph, node vj In contrast, other nodes are considered. For example, in a transaction graph, there are multiple nodes, including two nodes A and B that have a transaction relationship. Both nodes have their own transaction subgraphs. In node A's transaction subgraph, node B is considered an "other node," and in node B's transaction subgraph, node A is considered an "other node." For nodes A and B, both have corresponding initial embedding matrices and initial embedding vectors, and the attribute information of their corresponding accounts is hidden. The hiding method is to use node A or B as the starting node in that node's transaction subgraph and set that starting node as the zero vector.

[0140] Since every node in the transaction graph (including node v) has already been generated i and relative to node v i In other words, it is the node v of other nodes. j The transaction subgraph and initial embedding matrix, and the nodes (including node v) in the transaction graph that have been processed in S201 and S202 i and relative to node v i In other words, it is the node v of other nodes. j The attribute information of the corresponding account is hidden, and the attribute information of each node (including node v) is calculated. i and relative to node v i In other words, it is the node v of other nodes. j The initial local embedding vector after hiding.

[0141] Although node v i With node v j The initial local embedding vector after hiding can be obtained through the above formula (5), but in order to obtain the initial local embedding vector for node v, the following steps are needed. i With node v j To differentiate, node v can be... i The hidden initial local embedding vector is obtained through This means that relative to node v i In other words, it is the node v of other nodes. j The hidden initial local embedding vector is obtained through To express.

[0142] This leads to the negative sample pair of the i-th node based on local contrast.

[0143] Furthermore, using the positive and negative sample pairs based on local contrast for each node, a local contrast learning term for each node is constructed. Specifically, the local contrast learning term for each node is obtained using the following formula:

[0144]

[0145] in, Let be the local contrastive learning term for the i-th node, and θ(m,n) be the similarity metric function used to measure the similarity between m and n. For the i-th node, a positive sample pair based on local comparison. For the i-th node, a negative sample pair based on local contrast. Let z be the initial local embedding vector after hiding the i-th node. i Let be the initial embedding vector of the i-th node. This is the initial local embedding vector after hiding the j-th other node.

[0146] In the embodiments described herein, reference is made to Figure 4 The step of obtaining the global contrastive learning term for each node based on the initial embedding matrix and initial embedding vector of each node further includes:

[0147] S401: Hide the attribute information of the account corresponding to each node in the transaction graph;

[0148] S402: Calculate the initial global embedding vector of each node after hiding based on the initial embedding matrix of each node;

[0149] S403: Using the initial global embedding vector of each node after hiding and the initial embedding vector of each node, construct a positive sample pair for each node based on global comparison;

[0150] S404: Using the initial global embedding vector of each node after hiding all other nodes in the transaction subgraph of each node and the initial embedding vector of each node, construct a negative sample pair for each node based on global comparison;

[0151] S405: Using the positive and negative sample pairs of each node based on global comparison, construct the global comparison learning term for each node.

[0152] The parts of S401 to S405 that overlap with S301 to S305 above will not be repeated here. Based on the initial embedding matrix of each node, the initial global embedding vector of each node in the transaction graph after hiding can be calculated, as follows:

[0153]

[0154] in, Let H be the initial global embedding vector after hiding the i-th node, k be the number of nodes in the transaction subgraph of the i-th node, and H be the initial global embedding vector after hiding the i-th node. i Let be the initial embedding matrix for the i-th node, and [u,:] represent the u-th node in the transaction subgraph of the i-th node. It is the sum of the vectors of all nodes in the transaction subgraph of node i.

[0155] This leads to the positive sample pair of the i-th node based on global comparison:

[0156] In order to analyze node v i With node v j To differentiate, node v can be... i The hidden initial global embedding vector is obtained through This means that relative to node v i In other words, it is the node v of other nodes. j The hidden initial global embedding vector is obtained through To express.

[0157] This leads to the negative sample pair of the i-th node based on global comparison.

[0158] Furthermore, using the positive and negative sample pairs based on global contrast for each node, a global contrastive learning term for each node is constructed. Specifically, the global contrastive learning term for each node is obtained using the following formula:

[0159]

[0160] in, Let be the global comparison learning term for the i-th node, and θ(m,n) be the similarity metric function used to measure the similarity between m and n. For the i-th node, a positive sample pair based on global comparison. For the i-th node, the negative sample pair is based on global comparison. Let z be the initial global embedding vector after hiding the i-th node. i Let be the initial embedding vector of the i-th node. This is the initial global embedding vector after hiding the j-th other node.

[0161] Based on the local and global contrastive learning terms for each node, the objective function is obtained as follows:

[0162]

[0163] Where L is the objective function and s is the number of nodes in the transaction graph.

[0164] The objective function can be minimized using optimization methods, such as gradient descent, to obtain the optimized graph neural network model.

[0165] Specifically, refer to Figure 5 The step of calculating the anomaly score of the target account based on the graph neural network model further includes:

[0166] S501: Based on the graph neural network model, calculate the local anomaly score and global anomaly score of the target account;

[0167] S502: Linearly add the local anomaly score and the global anomaly score of the target account to obtain the anomaly score of the target account.

[0168] Reference Figure 6 The step of calculating the local anomaly score and global anomaly score of the target account based on the graph neural network model further includes:

[0169] S601: Using the graph neural network model, obtain the embedding matrix of the target node corresponding to the target account;

[0170] S602: Calculate the embedding vector of the target node using the graph neural network model;

[0171] S603: Based on the embedding matrix and embedding vector of the target node, obtain the local anomaly score and global anomaly score of the target node.

[0172] According to the above formula (3), the relationship between the graph neural network model and the embedding matrix can be obtained as follows:

[0173] H i' =f'(A i ,X i (10)

[0174] Among them, H i' Let f' be the embedding matrix of the i-th node, and f'() be the graph neural network model.

[0175] According to the above formula (4), the relationship between the graph neural network model and the embedding vector can be obtained as follows:

[0176] z i' =f'(x i (11)

[0177] Among them, z i' Let be the embedding vector of the i-th node.

[0178] Using the above formulas (10) and (11), the embedding matrix and embedding vector of the target node corresponding to the target account can be obtained.

[0179] In the embodiments described herein, reference is made to Figure 7 The step of obtaining the local anomaly score of the target node based on the embedding matrix and embedding vector of the target node further includes:

[0180] S701: Hide the attribute information of the target account in the transaction graph;

[0181] S702: Calculate the local embedding vector of the target node after it is hidden, based on the embedding matrix of the target node;

[0182] S703: Calculate the local anomaly score of the target node based on the local embedding vector of the target node after it is hidden, the local embedding vectors of other nodes in the transaction subgraph of the target node after they are hidden, and the embedding vector of the target node.

[0183] The methods S701 to S702 are similar to those described above and will not be repeated here. After obtaining the local embedding vector of the hidden target node, in order to... i With other nodes v besides this node j To differentiate, node v can be... i The hidden local embedding vector is obtained through This means that relative to node v i In other words, it is the node v of other nodes. j The hidden local embedding vector is obtained through To express.

[0184] For S703, the local anomaly score of the target node is specifically calculated using the following formula:

[0185]

[0186] in, Let θ(m,n) be the local anomaly score for the target node, and let θ(m,n) be the similarity metric function used to measure the similarity between m and n. This is the local embedding vector after hiding the target node. z is the local embedding vector after hiding other nodes. i' is the embedding vector of the target node.

[0187] In the embodiments described herein, reference is made to Figure 8 The step of obtaining the global anomaly score of the target node based on the embedding matrix and embedding vector of the target node further includes:

[0188] S801: Hide the attribute information of the target account in the transaction graph;

[0189] S802: Calculate the global embedding vector of the target node after it is hidden, based on the embedding matrix of the target node;

[0190] S803: Calculate the global anomaly score of the target node based on the hidden global embedding vector of the target node, the hidden global embedding vectors of other nodes in the transaction subgraph of the target node excluding the target node, and the embedding vector of the target node.

[0191] The methods S801 to S802 are similar to those described above and will not be repeated here. After obtaining the global embedding vector of the hidden target node, in order to... i With other nodes v besides this node j To differentiate, node v can be... i The hidden global embedding vector is obtained through This means that relative to node v i In other words, it is the node v of other nodes. j The hidden local embedding vector is obtained through To express.

[0192] For S803, the global anomaly score for each node is calculated using the following formula:

[0193]

[0194] in, Let θ(m,n) be the global anomaly score for the target node, and let θ(m,n) be the similarity metric function used to measure the similarity between m and n. This is the global embedding vector after the target node is hidden. z is the global embedding vector after hiding other nodes. i' is the embedding vector of the node.

[0195] Furthermore, the local anomaly score and the global anomaly score of the target node are linearly added together using the following formula to obtain the anomaly score of the target node:

[0196]

[0197] Among them, y i Let α be the anomaly score of the target node, and let α be a hyperparameter that takes any number between 0 and 1.

[0198] The higher the anomaly score of a target node, the greater the degree of anomaly. When the anomaly score exceeds a set threshold, the account corresponding to that node can be identified as an abnormal account. This paper utilizes a graph neural network model for abnormal account detection. The anomaly score of the target node can be obtained from the graph neural network model, and this score can be used to further determine whether the target account is a normal account or an abnormal account, thereby improving the efficiency and accuracy of abnormal account detection.

[0199] Based on the abnormal account detection method described above, this embodiment also provides a method for constructing a graph neural network model, wherein the graph neural network model is applied to the abnormal account detection method, including:

[0200] A transaction graph is obtained based on the transaction information between accounts, and the nodes in the transaction graph are used to represent the attribute information of the accounts;

[0201] Based on the transaction graph, a transaction subgraph is generated for each node;

[0202] The initial graph neural network model is used to process the transaction subgraph of each node to obtain the objective function;

[0203] The objective function is trained to obtain a graph neural network model.

[0204] The construction method of this graph neural network model is the same as that of steps 1.1-1.4 above, so the repeated parts will not be described again.

[0205] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the acquisition, storage, use, and processing of data in the technical solutions described in the embodiments of this application all comply with the relevant provisions of national laws and regulations.

[0206] Based on the above-described method for constructing a graph neural network model, this embodiment also provides an abnormal account detection device. The device may include a system (including a distributed system), software (application), module, component, server, client, etc., using the method described in this embodiment, combined with necessary hardware implementation. Based on the same innovative concept, the devices in one or more embodiments provided in this embodiment are as described in the following embodiments. Since the implementation schemes and methods for solving the problem are similar, the implementation of the specific device in this embodiment can refer to the implementation of the aforementioned method, and repeated details will not be repeated. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0207] Specifically, Figure 9 This is a schematic diagram of the module structure of one embodiment of the abnormal account detection device provided in this article, with reference to... Figure 9 As shown in the embodiment of this article, an abnormal account detection device includes: an acquisition module 100, an input module 200, a calculation module 300, and a determination module 400.

[0208] Module 100 is used to obtain the attribute information of the target account;

[0209] The input module 200 is used to input the attribute information of the target account into a pre-built graph neural network model, wherein the graph neural network model is constructed based on the transaction information of the account to generate a transaction graph;

[0210] The calculation module 300 is used to calculate the anomaly score of the target account based on the graph neural network model.

[0211] The determination module 400 is used to determine whether the target account is a normal account or an abnormal account based on the abnormal score.

[0212] Reference Figure 10 As shown, based on the graph neural network model construction method or abnormal account detection method described above, one embodiment of this document also provides a computer device 1002, wherein the above method runs on the computer device 1002. The computer device 1002 may include one or more processors 1004, such as one or more central processing units (CPUs) or graphics processing units (GPUs), each processing unit may implement one or more hardware threads. The computer device 1002 may also include any memory 1006 for storing any kind of information such as code, settings, data, etc. In one specific embodiment, a computer program on the memory 1006 and executable on the processor 1004, when run by the processor 1004, can execute instructions according to the above method. Non-limitingly, for example, the memory 1006 may include any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 1002. In one scenario, when processor 1004 executes associated instructions stored in any memory or combination of memories, computer device 1002 can perform any operation of the associated instructions. Computer device 1002 also includes one or more drive mechanisms 1008 for interacting with any memory, such as hard disk drive mechanisms, optical disk drive mechanisms, etc.

[0213] Computer device 1002 may further include an input / output module 1010 (I / O) for receiving various inputs (via input device 1012) and providing various outputs (via output device 1014). A specific output mechanism may include a presentation device 1016 and an associated graphical user interface 1018 (GUI). In other embodiments, the input / output module 1010 (I / O), input device 1012, and output device 1014 may be omitted, and the device may function solely as a computer device within a network. Computer device 1102 may also include one or more network interfaces 1020 for exchanging data with other devices via one or more communication links 1022. One or more communication buses 1024 couple the components described above together.

[0214] The communication link 1022 can be implemented in any way, such as via a local area network, a wide area network (e.g., the Internet), a point-to-point connection, or any combination thereof. The communication link 1022 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0215] Corresponding to Figures 1-8 In addition to the methods described above, this embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the above-described methods.

[0216] This embodiment also provides a computer-readable instruction, wherein when a processor executes the instruction, the program therein causes the processor to perform the following: Figures 1 to 8 The method shown.

[0217] It should be understood that in the various embodiments of this document, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this document.

[0218] It should also be understood that, in the embodiments herein, the term "and / or" is merely a description of the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following associated objects have an "or" relationship.

[0219] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this document.

[0220] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0221] In the embodiments provided herein, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or units, or they may be electrical, mechanical, or other forms of connection.

[0222] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments described herein, depending on actual needs.

[0223] Furthermore, the functional units in the various embodiments of this document can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0224] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this paper, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this paper. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0225] This document uses specific embodiments to illustrate the principles and implementation methods of this document. The descriptions of the embodiments above are only for the purpose of helping to understand the methods and core ideas of this document. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this document. Therefore, the content of this specification should not be construed as a limitation of this document.

Claims

1. A method for detecting abnormal accounts, characterized in that, include: Obtain the attribute information of the target account; The attribute information of the target account is fed into a pre-built graph neural network model, wherein the graph neural network model is constructed based on the transaction graph generated by the account's transaction information; Based on the graph neural network model, the anomaly score of the target account is calculated; Based on the abnormal score, the target account is determined to be a normal account or an abnormal account; The step of calculating the anomaly score of the target account based on the graph neural network model further includes: Based on the graph neural network model, the local anomaly score and global anomaly score of the target account are calculated. The local anomaly score and the global anomaly score of the target account are linearly added together to obtain the anomaly score of the target account. The step of calculating the local anomaly score and global anomaly score of the target account based on the graph neural network model further includes: Using the graph neural network model, the embedding matrix of the target node corresponding to the target account is obtained; The embedding vector of the target node is calculated using the graph neural network model. Based on the embedding matrix and embedding vector of the target node, the local anomaly score and global anomaly score of the target node are obtained; The step of obtaining the local anomaly score of the target node based on the embedding matrix and embedding vector of the target node further includes: Hide the attribute information of the target account in the transaction graph; Based on the embedding matrix of the target node, the local embedding vector of the target node after hiding is calculated; The local anomaly score of the target node is calculated based on the local embedding vector of the target node after it is hidden, the local embedding vectors of other nodes in the transaction subgraph of the target node after they are hidden, and the embedding vector of the target node. Based on the embedding matrix and embedding vector of the target node, the global anomaly score of the target node is further obtained by including: Hide the attribute information of the target account in the transaction graph; Based on the embedding matrix of the target node, the global embedding vector of the target node after hiding is calculated; The global anomaly score of the target node is calculated based on the hidden global embedding vector of the target node, the hidden global embedding vectors of other nodes in the transaction subgraph of the target node (excluding the target node), and the embedding vector of the target node.

2. The abnormal account detection method according to claim 1, characterized in that, The method for constructing the graph neural network model includes: A transaction graph is obtained based on the transaction information between accounts, and the nodes in the transaction graph are used to represent the attribute information of the accounts; Based on the transaction graph, a transaction subgraph is generated for each node; The initial graph neural network model is used to process the transaction subgraph of each node to obtain the objective function; The objective function is trained to obtain a graph neural network model.

3. The abnormal account detection method according to claim 2, characterized in that, The step of processing the transaction subgraph of each node using the initial graph neural network model to obtain the objective function further includes: The initial embedding matrix of each node is obtained by encoding the transaction subgraph of each node using an initial graph neural network model. The initial embedding vector of each node is calculated using the initial graph neural network model; Based on the initial embedding matrix and initial embedding vector of each node, the local contrastive learning term and global contrastive learning term of each node are obtained. The objective function is obtained based on the local and global contrastive learning terms for each node.

4. The abnormal account detection method according to claim 3, characterized in that, The step of obtaining the local contrastive learning term for each node based on the initial embedding matrix and initial embedding vector of each node further includes: Hide the attribute information of the account corresponding to each node in the transaction graph; Based on the initial embedding matrix of each node, the initial local embedding vector of each node after hiding is calculated. Using the initial local embedding vector of each node after hiding and the initial embedding vector of each node, construct positive sample pairs for each node based on local contrast. Using the initial local embedding vector of each node after hiding all other nodes in the transaction subgraph of each node and the initial embedding vector of each node, a negative sample pair based on local contrast is constructed for each node; By utilizing the positive and negative sample pairs based on local contrast for each node, a local contrast learning term for each node is constructed.

5. The abnormal account detection method according to claim 3, characterized in that, The step of obtaining the global contrastive learning term for each node based on the initial embedding matrix and initial embedding vector of each node further includes: Hide the attribute information of the account corresponding to each node in the transaction graph; Based on the initial embedding matrix of each node, the initial global embedding vector of each node after hiding is calculated. Using the initial global embedding vector of each node after it is hidden and the initial embedding vector of each node, construct positive sample pairs for each node based on global comparison; Using the initial global embedding vector of each node after hiding all other nodes in the transaction subgraph of each node and the initial embedding vector of each node, construct a negative sample pair for each node based on global comparison; By utilizing the positive and negative sample pairs of each node based on global comparison, a global comparison learning term for each node is constructed.

6. A method for constructing a graph neural network model, characterized in that, The graph neural network model is applied to the abnormal account detection method according to any one of claims 1-5, including: A transaction graph is obtained based on the transaction information between accounts, and the nodes in the transaction graph are used to represent the attribute information of the accounts; Based on the transaction graph, a transaction subgraph is generated for each node; The initial graph neural network model is used to process the transaction subgraph of each node to obtain the objective function; The objective function is trained to obtain a graph neural network model.

7. An abnormal account detection device, characterized in that, include: The acquisition module is used to obtain the attribute information of the target account; The input module is used to input the attribute information of the target account into a pre-built graph neural network model, wherein the graph neural network model is constructed based on the transaction graph generated by the account's transaction information; The calculation module is used to calculate the anomaly score of the target account based on the graph neural network model. The determination module is used to determine whether the target account is a normal account or an abnormal account based on the abnormal score; The step of calculating the anomaly score of the target account based on the graph neural network model further includes: Based on the graph neural network model, the local anomaly score and global anomaly score of the target account are calculated. The local anomaly score and the global anomaly score of the target account are linearly added together to obtain the anomaly score of the target account. The step of calculating the local anomaly score and global anomaly score of the target account based on the graph neural network model further includes: Using the graph neural network model, the embedding matrix of the target node corresponding to the target account is obtained; The embedding vector of the target node is calculated using the graph neural network model. Based on the embedding matrix and embedding vector of the target node, the local anomaly score and global anomaly score of the target node are obtained; The step of obtaining the local anomaly score of the target node based on the embedding matrix and embedding vector of the target node further includes: Hide the attribute information of the target account in the transaction graph; Based on the embedding matrix of the target node, the local embedding vector of the target node after hiding is calculated; The local anomaly score of the target node is calculated based on the local embedding vector of the target node after it is hidden, the local embedding vectors of other nodes in the transaction subgraph of the target node after they are hidden, and the embedding vector of the target node. Based on the embedding matrix and embedding vector of the target node, the global anomaly score of the target node is further obtained by including: Hide the attribute information of the target account in the transaction graph; Based on the embedding matrix of the target node, the global embedding vector of the target node after hiding is calculated; The global anomaly score of the target node is calculated based on the hidden global embedding vector of the target node, the hidden global embedding vectors of other nodes in the transaction subgraph of the target node (excluding the target node), and the embedding vector of the target node.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, When the computer program is run by the processor, it executes the instructions of the method according to any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor of the computer device, it executes the instructions of the method according to any one of claims 1-6.

Images