Method for identifying fraudulent behavior in a network transaction system, server and storage medium

Abstract

The embodiment of the application discloses a kind of identification method of fraudulent behavior in network transaction system, server and storage medium, belong to computer technical field.The method comprises: obtaining the meta-path instance corresponding to target object from the heterogeneous network of network transaction system;Temporal feature extraction is carried out to each meta-path instance, and the instance temporal feature of each meta-path instance is obtained;Based on the instance temporal feature of each meta-path instance, determine the target temporal feature corresponding to target object;Fraudulent behavior identification is carried out to target object based on target temporal feature, and identification result is obtained.Target temporal feature embodies the topological relationship and time sequence feature of object and object relationship, expands the monitoring dimension of fraudulent behavior, can fully exploit the difference between the object and other objects that exist fraudulent behavior, improve network transaction security;Business party can define meta-path according to the business characteristics of actual application scene, applicable to various different business scenarios.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, server, and storage medium for identifying fraudulent activities in an online transaction system. Background Technology

[0002] With the rise of online models such as e-commerce, fintech, and third-party payment, people can conduct online transactions with others via the internet. However, this has also led to phenomena such as online fraud, causing serious losses to users and businesses. Therefore, developers need to analyze and monitor the interaction behavior of each account in order to identify abnormal accounts and improve network security.

[0003] In related technologies, business users typically use online strategies and expert rules to monitor user interaction behavior, or use graph theory to leverage the network topology relationships between accounts, aggregate the features of neighboring nodes to form the characteristics of the account itself, and then use a classifier to classify and identify abnormal accounts.

[0004] However, using expert rules for supervision heavily relies on the business experience of policymakers. The graph theory-based feature aggregation method can only reflect the topological characteristics between accounts and usually cannot be directly applied to downstream tasks. It lacks the ability to transfer scenarios, and the above methods are all difficult to capture complex and new types of transaction fraud. Summary of the Invention

[0005] This application provides a method, server, and storage medium for identifying fraudulent behavior in a network transaction system. It leverages the temporal characteristics of meta-paths to fully uncover the differences between objects exhibiting fraudulent behavior and those not, and is applicable to various business scenarios. The technical solution is as follows:

[0006] On the one hand, embodiments of this application provide a method for identifying fraudulent behavior in an online transaction system, the method comprising:

[0007] Obtain the meta-path instance corresponding to the target object from the heterogeneous network of the online transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the online transaction system. The meta-path instance is a path formed by the object relationships between adjacent path nodes with objects as path nodes. The starting point of the path in the meta-path instance is the path node corresponding to the target object, and the node order of the path nodes in the meta-path instance is the order in which the object relationships are formed.

[0008] Temporal features are extracted from each of the meta-path instances to obtain instance temporal features of each meta-path instance;

[0009] Based on the instance temporal characteristics of each of the meta-path instances, the target temporal characteristics corresponding to the target object are determined;

[0010] Based on the target time-series characteristics, fraud behavior is identified in the target object to obtain an identification result, which is used to indicate whether the target object has engaged in fraudulent behavior in online transactions.

[0011] On the other hand, embodiments of this application provide a method for identifying fraudulent activities in an online transaction system, the method comprising:

[0012] Sample meta-path instances of sample objects are obtained from the heterogeneous network of the online transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the online transaction system. The sample meta-path instance is a path formed by the sample object relationship between adjacent path nodes, with the sample object as the path node. The starting point of the path in the sample meta-path instance is the path node corresponding to the sample object, and the node order of the path nodes in the sample meta-path instance is the formation order of the sample object relationship.

[0013] Temporal features are extracted from each of the sample element path instances to obtain the sample instance temporal features of each of the sample element path instances.

[0014] Based on the temporal features of each of the sample metapath instances, the temporal features of the sample objects corresponding to the sample objects are determined.

[0015] The sample time-series features are input into the fraud behavior identification model to obtain the sample identification result output by the fraud behavior identification model. The sample identification result is used to indicate whether the sample object has engaged in fraudulent behavior in online transactions.

[0016] The fraud behavior identification model is trained using the sample labels corresponding to the sample objects as supervision of the sample identification results. The sample labels are used to indicate whether the sample objects have engaged in fraudulent behavior in online transactions.

[0017] On the other hand, embodiments of this application provide a device for identifying fraudulent activities in an online transaction system, the device comprising:

[0018] The first acquisition module is used to acquire the meta-path instance corresponding to the target object from the heterogeneous network of the online transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the online transaction system. The meta-path instance is a path formed by the object relationship between adjacent path nodes with the object as the path node. The starting point of the path of the meta-path instance is the path node corresponding to the target object, and the node order of the path nodes in the meta-path instance is the order in which the object relationship is formed.

[0019] The first feature extraction module is used to extract temporal features from each of the meta-path instances to obtain instance temporal features of each of the meta-path instances.

[0020] The first determining module is used to determine the target time sequence features corresponding to the target object based on the instance time sequence features of each of the meta-path instances;

[0021] The first identification module is used to identify fraudulent behavior of the target object based on the target time-series characteristics and obtain an identification result. The identification result is used to indicate whether the target object has engaged in fraudulent behavior in online transactions.

[0022] On the other hand, embodiments of this application provide a device for identifying fraudulent activities in an online transaction system, the device comprising:

[0023] The second acquisition module is used to acquire sample meta-path instances of sample objects from the heterogeneous network of the online transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the online transaction system. The sample meta-path instance is a path formed by the sample object relationship between adjacent path nodes, with the sample object as the path node. The starting point of the path of the sample meta-path instance is the path node corresponding to the sample object, and the node order of the path nodes in the sample meta-path instance is the formation order of the sample object relationship.

[0024] The second feature extraction module is used to extract temporal features from each of the sample element path instances to obtain the sample instance temporal features of each of the sample element path instances.

[0025] The second determining module is used to determine the sample time series features corresponding to the sample object based on the sample instance time series features of each of the sample element path instances.

[0026] The second identification module is used to input the temporal features of the sample into the fraud behavior identification model to obtain the sample identification result output by the fraud behavior identification model. The sample identification result is used to indicate whether the sample object has engaged in fraudulent behavior in online transactions.

[0027] The model training module is used to train the fraud behavior identification model by using the sample labels corresponding to the sample objects as supervision for the sample identification results. The sample labels are used to indicate whether the sample objects have engaged in fraudulent behavior in online transactions.

[0028] On the other hand, embodiments of this application provide a server, the server including a processor and a memory; the memory stores at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement the method for identifying fraudulent activities in the online transaction system as described above.

[0029] On the other hand, embodiments of this application provide a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the method for identifying fraudulent activities in a network transaction system as described above.

[0030] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A server's processor reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the server to perform the fraud identification method in a network transaction system provided in various alternative implementations of the above aspect.

[0031] The beneficial effects of the technical solutions provided in this application include at least the following:

[0032] In this embodiment, meta-path instances corresponding to target objects in the heterogeneous network of the network transaction system are extracted according to the formation order of object relationships. Temporal features are extracted from the meta-path instances so that the target temporal features can reflect the topological relationship and temporal characteristics of objects and object relationships. Compared with traditional fraud behavior identification methods, this expands the amount of information and the monitoring dimensions of fraud behavior, and can fully explore the differences between objects with and without fraud behavior. Fraud behavior identification is based on business meta-paths. Business parties can define meta-paths according to the business characteristics of actual application scenarios to obtain meta-path instances suitable for the corresponding business scenarios. Therefore, the method has universality and is applicable to various different business scenarios. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of an implementation environment provided by an exemplary embodiment of this application;

[0034] Figure 2This is a flowchart of a method for identifying fraudulent activities in an online transaction system provided in an exemplary embodiment of this application;

[0035] Figure 3 This is a flowchart of a method for identifying fraudulent activities in a network transaction system provided in another exemplary embodiment of this application;

[0036] Figure 4 This is a schematic diagram of the structure of an online transaction network provided in an exemplary embodiment of this application;

[0037] Figure 5 This is a block diagram of a Long-Short Term Memory (LSTM) network model provided in an exemplary embodiment of this application;

[0038] Figure 6 This is a structural block diagram of an LSTM model provided in another exemplary embodiment of this application;

[0039] Figure 7 This is a structural block diagram of the attention mechanism provided in an exemplary embodiment of this application;

[0040] Figure 8 This is a flowchart of a method for identifying fraudulent activities in a network transaction system provided in another exemplary embodiment of this application;

[0041] Figure 9 This is a system framework diagram of a method for identifying fraudulent activities in a network transaction system provided in an exemplary embodiment of this application;

[0042] Figure 10 This is a flowchart of a method for identifying fraudulent activities in an online transaction system provided in an exemplary embodiment of this application;

[0043] Figure 11 This is a structural block diagram of a fraud identification device in a network transaction system provided in an exemplary embodiment of this application;

[0044] Figure 12 This is a structural block diagram of a fraud identification device in a network transaction system provided in an exemplary embodiment of this application;

[0045] Figure 13 This is a structural block diagram of a server provided in an exemplary embodiment of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0047] In this article, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0048] Figure 1 A schematic diagram of an implementation environment provided in one embodiment of this application is shown. This implementation environment may include: a first terminal 110, a server 120, and a second terminal 130.

[0049] The first terminal 110 has a first client 111 installed and running, which is an online transaction application. The first user 112 logs into the first client 111 through the first terminal 110 and establishes relationships with other users through the first client 111, such as adding contacts, transferring funds, and making commercial payments. The server 120 identifies fraudulent activities by identifying the first user 112 and the first terminal 110 based on the object relationships between the first user 112, the first terminal 110, and other devices or users.

[0050] Accordingly, the second terminal 130 has a second client 131 installed and running, which is an online transaction application. The second user 132 logs into the second client 131 through the second terminal 130 and establishes relationships with other users through the second client 131, such as adding contacts, transferring funds, and making commercial payments. The server 120 identifies fraudulent activities by identifying the second user 132 and the second terminal 130 based on the object relationships between the second user 132, the second terminal 130, and other devices or users.

[0051] Figure 1 Only two terminals are shown in the illustration, but in different embodiments, multiple other terminals may be available to access the server 120. Optionally, the first terminal 110 and the second terminal 130 may be of the same or different device types, including at least one of the following: smartphone, tablet computer, e-book reader, MP3 player, MP4 player, laptop computer, and desktop computer.

[0052] The first terminal 110 and the second terminal 130 are connected to the server 120 via a wireless network or a wired network.

[0053] Server 120 is the backend server for clients 111 and 131. Server 120 includes memory 121, processor 122, database 123, fraud behavior detection module 124, and user-facing input / output interface (I / O interface) 125. The processor 122 is used to load instructions stored in the server 120 and process data in the database 123 and the fraud behavior identification module 124. The database 123 is used to store data on user accounts used by the first terminal 110, the second terminal 130, and other terminals, as well as device data corresponding to each terminal, such as the time when a user account logs into the device, the user account corresponding to the same device, the transaction type, transaction amount, and transaction time between user accounts, etc. The fraud behavior identification module 124 is used to identify fraudulent behavior of various objects in the transaction network corresponding to the online transaction application. The fraud behavior identification module 124 obtains the meta-path instance corresponding to the target object from the database 123 and determines whether the target object has engaged in fraudulent behavior in the online transaction based on the meta-path instance. It is worth mentioning that the objects identified by the server 120 include not only users such as the first user 112 and the second user 132, but also devices such as the first terminal 110 and the second terminal 130 that have installed and run online transaction applications. The user-facing I / O interface 125 is used to establish communication and exchange data with the first terminal 110 and / or the second terminal 130 through a wireless network or a wired network.

[0054] Server 120 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0055] As an example, the program instructions in the fraud identification method in the online transaction system can be deployed and executed on one server, or on multiple servers located in one location, or on multiple servers distributed in multiple locations and interconnected through a communication network. Multiple servers distributed in multiple locations and interconnected through a communication network can form a blockchain system.

[0056] Figure 2 A flowchart illustrating a method for identifying fraudulent activities in an online transaction system according to an exemplary embodiment of this application is shown. This embodiment uses this method for... Figure 1 Taking server 120 in the implementation environment shown as an example, the method includes the following steps:

[0057] Step 201: Obtain the meta-path instance corresponding to the target object from the heterogeneous network of the network transaction system. The meta-path instance is a path formed by the object relationship between adjacent path nodes, with the object as the path node.

[0058] In this context, a heterogeneous network contains object relationships between different objects, which are generated based on the objects' behavior within the online transaction system. The heterogeneous network in this embodiment is composed of objects and the object relationships between them. Compared to a homogeneous network (e.g., a social network containing only one type of network node (i.e., object) and one type of edge (i.e., object relationship), which contains only one type of network node (i.e., object) and / or one type of edge (i.e., object relationship), heterogeneity refers to a network containing different types of network nodes (i.e., objects) and / or different types of edges (i.e., object relationships). Since the transaction network contains different types of objects such as customers and merchants, and different types of object relationships such as friend relationships and commercial payment relationships, the transaction network corresponding to the online transaction system in this embodiment is a heterogeneous network.

[0059] The starting point of a metapath instance is the path node corresponding to the target object, and the order of the path nodes in the metapath instance is the order in which the object relationships are formed. A metapath is a path defined as a sequence of relationships between different vertices. A metapath instance is the concrete manifestation of a metapath in a business scenario (such as a transaction network, social network, etc.). The server obtains metapath instances based on user interactions in the application. For example, based on user a's login account through device A, the metapath instance "User a (login) Device A" is obtained; based on user b's transfer of funds to user a, the metapath instance "User b (transfer) User a" is obtained. When there are at least two object relationships in a metapath instance, the order of the path nodes in the metapath instance is the order in which the object relationships are formed, allowing the metapath instance to reflect the temporal order between objects and between object relationships. For example, after user a initiates a transfer to user b, user b initiates a commercial payment to merchant c, then the server obtains the metapath instance "User a (transfer) User b (commercial payment) Merchant c" based on the order of these two operations.

[0060] For ease of description, this application uses the object (object relationship) object approach to describe metapaths and metapath instances. For example, in an online transaction network composed of ordinary user accounts, merchant accounts, and devices, the business party can define metapaths including user (login) device, user (friend) user (login) device, user (commercial payment) merchant (transfer) user, etc.; user a (friend) user b (login) device 1 is a metapath instance of the metapath user (friend) user (login) device.

[0061] In one possible implementation, when the server performs fraud detection on a target object, it obtains the metapath instance corresponding to the target object, that is, the metapath instance with the path node corresponding to the target object as the starting point of the path. For example, if the server performs fraud detection on user a, it obtains the metapath instances of user a based on the preset metapath type: user a (login) device 2, user a (friend) user b (login) device 1, user a (commercial payment) merchant c (transfer) user d, etc.

[0062] Furthermore, to reflect the temporal sequence of target user interactions, the node order of path nodes in the metapath instance follows the order in which the object relationships are formed. For example, in the metapath instance User a (commercial payment) Merchant c (transfer) User d, the time when User a makes a commercial payment to Merchant c occurs is earlier than the time when Merchant c transfers money to User d.

[0063] Step 202: Extract temporal features from each metapath instance to obtain the instance temporal features of each metapath instance.

[0064] In real-world business scenarios, especially in online financial transaction networks, there are certain temporal characteristics between objects and their relationships within meta-path instances formed based on specific interactive behaviors. For example, users participating in online gambling tend to make large transactions at night, and accounts frequently used for "coupon hunting" often exhibit a group control scale effect in terms of both time and amount. Therefore, the server first extracts the temporal characteristics of each meta-path instance, removing less important information to obtain the instance temporal characteristics of each meta-path instance.

[0065] Step 203: Based on the instance temporal characteristics of each metapath instance, determine the target temporal characteristics corresponding to the target object.

[0066] Since the instance timing features of a single metapath instance can only represent one metapath instance, and the interaction operations of objects are complex and varied, a single instance timing feature is one-sided and accidental, and cannot be used as a basis for detecting object behavior. In one possible implementation, the business party pre-defines multiple metapath types based on the business characteristics of the actual scenario. The server extracts the metapath instances of the target object from the business scenario according to each metapath type, and after obtaining the instance timing features of each metapath instance, further determines the target timing features of the target object to make the target timing features more closely match the behavior of the target object.

[0067] Step 204: Based on the target time-series features, identify fraudulent behavior of the target object and obtain the identification result. The identification result is used to indicate whether the target object has engaged in fraudulent behavior in online transactions.

[0068] In one possible implementation, the server inputs the target temporal features into a classification model and uses the model to determine whether the target object exhibits fraudulent behavior. The underlying data of the fraud identification method in the online transaction system in this application embodiment does not depend on the type of the interactive network. It is applicable to both homogeneous networks (containing only one type of network node and one type of edge) and heterogeneous networks (containing different types of network nodes and / or different types of edges), such as anti-fraud business scenarios for mobile payment, e-commerce, and online banking companies, and can assess the fraud risk in their online environment.

[0069] By extracting meta-path instances and obtaining the target temporal characteristics of the target object, the server can detect fraudulent behavior from four perspectives: business statistics agenda, network topology anomalies, heterogeneous multi-objects, and temporal mining. It can also provide auditors with ideas for new fraud techniques.

[0070] In summary, in this embodiment, meta-path instances corresponding to target objects in the heterogeneous network of the network transaction system are extracted according to the formation order of object relationships, and temporal features are extracted from the meta-path instances. This allows the target temporal features to reflect the topological relationships and temporal characteristics of objects and their relationships. Compared with traditional fraud behavior identification methods, this expands the amount of information and the monitoring dimensions of fraud behavior, and can fully explore the differences between objects that exhibit fraudulent behavior and those that do not. Based on business meta-paths for fraud behavior identification, business parties can define meta-paths according to the business characteristics of actual application scenarios to obtain meta-path instances suitable for the corresponding business scenarios. Therefore, the method has universality and is applicable to various different business scenarios.

[0071] A metapath instance is composed of objects and object relationships. Objects have object attributes, and object relationships have relationship attributes. In terms of temporal features, objects and object relationships each have different characteristics. In this embodiment, the server first splits the metapath instance into an object sequence and a relationship sequence, extracts features from each, and then concatenates the features to obtain the instance temporal features of the metapath instance, so that the instance temporal features include both the temporal features of objects and the temporal features of object relationships. Figure 3 A flowchart illustrating a method for identifying fraudulent activities in a network transaction system provided in another exemplary embodiment of this application is shown. This embodiment uses this method for... Figure 1 Taking server 120 in the implementation environment shown as an example, the method includes the following steps:

[0072] Step 301: Obtain the meta-path instance corresponding to the target object from the heterogeneous network of the network transaction system. The meta-path instance is a path formed by the object relationship between adjacent path nodes, with the object as the path node.

[0073] The specific implementation of step 301 can be referred to step 201 above, and will not be repeated here in the embodiments of this application.

[0074] Step 302: Generate an object sequence and a relation sequence based on the metapath instance. The object sequence contains each object in the metapath instance, and the relation sequence contains the relations between each object in the metapath instance.

[0075] In one possible implementation, the objects include at least one of accounts (e.g., user accounts of online payment applications, bank card accounts, mobile phone numbers, etc.) and devices (e.g., terminal devices such as smartphones, tablets, laptops, and desktop computers). The object relationships include at least one of the relationships between accounts and the relationships between accounts and devices. The relationships between accounts include at least one of being contacts (e.g., friends in applications, colleagues in real life, relatives, etc.) and transaction relationships (e.g., transfers, commercial payments, etc.). The relationships between accounts and devices include login relationships.

[0076] Figure 4 This diagram illustrates a typical third-party payment transaction scenario. As shown, the transaction system includes three types of objects: users, merchants, and devices. Object relationships encompass four types: friends, transfers, business payments, and logins. Each object has different attributes based on its type (e.g., user's age, gender), and object relationships also have different attributes based on their type (e.g., payment amount and transaction time for business payments). These diverse objects and relationships form a heterogeneous network within the transaction system, providing ample information for the anti-fraud system.

[0077] Metapath P is used to represent a path sequence, in the form of Where V i E represents objects in a heterogeneous graph (such as users, merchants, and devices). i To connect the relationships between two objects (such as being friends, transferring money, or logging in), the metapath contains both an object sequence and a relationship sequence. After refinement, we can obtain the object sequence V1→V2→V3→...V k+1 And the relation sequence E1→E1→E1→···→E k+1 The object sequence and relation sequence are key inputs for fraud detection in this application.

[0078] Since both objects and object relationships have their own attribute information, the server generates object sequences and relationship sequences based on meta-path instances, and performs encoding and temporal feature fusion on each to more fully explore the temporal features of the two sequences. For example, for the meta-path instance User a (business payment) Merchant c (transfer) User d, the server extracts the object sequence User a-Merchant c-User d and the relationship sequence Business payment-transfer.

[0079] Step 303: Encode the meta-path instance based on the object sequence and relation sequence to obtain the object temporal features and relation temporal features corresponding to the meta-path instance.

[0080] After the server obtains the object sequence and the relation sequence, it first needs to encode the two sequence instances to extract temporal features respectively. In one possible implementation, step 303 includes the following steps:

[0081] Step 303a: Obtain the object attribute information of each object in the object sequence and the relationship attribute information of each object relationship in the relationship sequence. The object attribute information includes the object type, and the relationship attribute information includes the object relationship type.

[0082] Temporal feature extraction from meta-path instances essentially involves extracting features from the attribute information of each object within the meta-path instance, the attribute information of each object relationship, and the temporal relationships between them. After obtaining the object sequence and relationship sequence based on the meta-path instance, the server queries the database to retrieve the corresponding attribute information for each specific object or object relationship within the sequence. For example, in an online transaction network, user object attribute information includes age, gender, and financial status; merchant object attribute information includes merchant type, establishment date, and revenue; and commercial payment relationship attribute information includes payment amount, transaction time, and transaction method.

[0083] Step 303b: Encode the object sequence based on object attribute information to obtain object temporal features, and encode the relation sequence based on relation attribute information to obtain relation temporal features.

[0084] In one possible implementation, the server utilizes an LSTM model to encode and extract features from the object sequence and relation sequence, respectively. The architecture diagram of LSTM is shown below. Figure 5 and Figure 6 As shown, LSTM uses the concept of "gates" to control the influence of previous output signals on subsequent signals, effectively capturing the relationships between entities in the main sequence / relational sequence. For each time slice, LSTM accepts object attribute information or relation attribute information from the sequence, and outputs the features of the previous time slice after one transformation.

[0085] Optionally, the LSTM model in this application embodiment can also be replaced by a neural network model with temporal coding function, such as a Gate Recurrent Unit (GRU). This application embodiment does not limit this.

[0086] Step 303b includes the following steps:

[0087] Step 1: Input the object sequence containing object attribute information into the first LSTM model, and input the relation sequence containing relation attribute information into the second LSTM model.

[0088] The server inputs the output ht of the first LSTM model at each time slice into the attention mechanism. Similarly, the server inputs the output ht of the second LSTM model at each time slice into the attention mechanism. In one possible implementation, to improve the efficiency of feature extraction, the server inputs the output of the first LSTM model into the object attention mechanism and the output of the second LSTM model into the relationship attention mechanism.

[0089] Step 2: Use the attention mechanism to perform feature fusion on the output vector of the first LSTM model to obtain the temporal features of the object, and use the attention mechanism to perform feature fusion on the output vector of the second LSTM model to obtain the temporal features of the relationship.

[0090] In this embodiment, the outputs of the LSTM at each time slice are fused through an attention mechanism. The principle of the attention mechanism can be expressed by three formulas:

[0091] e i =a(u,v i (1)

[0092]

[0093] c=∑α i v i (3)

[0094] Formula (1) is the output v of a certain time slice. i Interacting with parameter u yields the unnormalized attention score e. i Formula (2) uses the normalized Attention Score to obtain the parameter α. i Formula (3) is based on Attention Score and feature sequence v i Calculate the attention value feature representation c of the object sequence / relation sequence. Wherein, e in formula (1) i There are usually several calculation methods:

[0095] 1. Multiplication

[0096] u T v (4)

[0097] u T wv (5)

[0098] 2. Additive

[0099]

[0100] 3. Multilayer Neural Networks

[0101]

[0102] Where w, w1, and w2 are the trained model parameters, and b1 and b2 are preset parameters.

[0103] Indicative Figure 7 This is a visual explanation of the attention mechanism and formulas (1) to (7), where query is equivalent to u in formula (4), key is equivalent to the output of LSTM in each time slice, and value is equivalent to α in formula (3). i v i .

[0104] Step 304: Perform feature fusion on object temporal features and relational temporal features to obtain instance temporal features.

[0105] After obtaining the object temporal features and relation temporal features, the server performs feature fusion by concatenating the object temporal features and relation temporal features to obtain the instance temporal features. It is worth noting that the server needs to concatenate the object temporal features of object sequences and the relation temporal features of relation sequences belonging to the same metapath instance. When there are multiple (m) metapath instances, the server obtains multiple (m) instance temporal features accordingly.

[0106] Step 305: Based on the instance temporal characteristics of each metapath instance, determine the target temporal characteristics corresponding to the target object.

[0107] Step 306: Based on the target time-series features, identify fraudulent behavior of the target object and obtain the identification result. The identification result is used to indicate whether the target object has engaged in fraudulent behavior in online transactions.

[0108] The specific implementation of steps 305 and 306 can be referred to steps 203 and 204 above, and will not be repeated here in the embodiments of this application.

[0109] In this embodiment, the server first splits the metapath instance into an object sequence and a relation sequence, extracts features from each, and obtains object temporal features and relation temporal features. Then, the object temporal features and relation temporal features belonging to the same metapath instance are concatenated to obtain the instance temporal features of the metapath instance. This ensures that the instance temporal features include both object temporal features and object relation temporal features, thereby enabling the final target temporal features to better reflect the behavioral characteristics of the target object and improve the accuracy of fraud identification.

[0110] Since a single metapath instance is one-sided and accidental in relation to the behavior of the target object, in order to improve the accuracy of fraud behavior identification, the server needs to analyze more data. In this embodiment, the server obtains metapath instances of different metapath types, and obtains multiple metapath instances for each metapath type. Figure 8 A flowchart illustrating a method for identifying fraudulent activities in a network transaction system provided in another exemplary embodiment of this application is shown. This embodiment uses this method for... Figure 1 Taking server 120 in the implementation environment shown as an example, the method includes the following steps:

[0111] Step 801: Obtain the meta-path instance corresponding to the target object from the heterogeneous network of the network transaction system. The meta-path instance is a path formed by the object relationship between adjacent path nodes, with the object as the path node.

[0112] Step 802: Extract temporal features from each metapath instance to obtain the instance temporal features of each metapath instance.

[0113] The specific implementation of steps 801 and 802 can be referred to steps 201 and 202 above, and will not be repeated here in the embodiments of this application.

[0114] Step 803: Determine the meta-path timing features corresponding to the meta-path type based on the instance timing features of the meta-path instances corresponding to the same meta-path type.

[0115] In one possible implementation, the business party pre-sets the types and quantities of metapath instances required for fraud detection. For example, it sets that the target object corresponds to n metapath types, and each metapath type corresponds to m metapath instances. The metapath instances of different metapath types contain objects of different types and / or object relationships of different types, where n and m are positive integers. The server obtains the metapath instances of the target object from the interactive network according to the pre-set metapath types and the number of metapath instances corresponding to each metapath type.

[0116] To illustrate, the server pre-stores five metapath types: user (transfer) user, user (friend relationship) user (transfer) user, user (friend relationship) user (friend relationship) user, user (login) device (login) user, and user (login) device (login) merchant. The server sequentially obtains five metapath instances of the target object (user a) according to each metapath type, and finally obtains 25 metapath instances of user a.

[0117] When the server retrieves m metapath instances for each metapath type, the same metapath type corresponds to m instance timing characteristics. The server needs to determine the metapath timing characteristics of the target object for each metapath type based on these m instance timing characteristics. In one possible implementation, step 803 includes the following steps:

[0118] For the same metapath type, max pooling is performed on the instance time series features corresponding to each metapath instance to obtain the metapath time series features corresponding to the metapath type.

[0119] After the server completes the encoding and feature extraction of n*m metapath instances, it needs to process the instance temporal features c corresponding to each metapath type. i Perform max pooling to obtain the meta-path time series features P corresponding to each meta-path type. i :

[0120] P i =Max(c1,c2…c j (8) i∈(1,n) j∈(1,m)

[0121] Meta-path temporal features P i It can reflect the interactive behavior characteristics of the target object corresponding to the i-th meta-path type.

[0122] Step 804: Determine the target time series features based on the time series features of each time series path type.

[0123] After the server obtains the meta-path timing features of each meta-path type corresponding to the target object through max pooling operation, it needs to combine the meta-path timing features of each meta-path type to obtain the target timing features of the target object. These target timing features can reflect the interactive behavior characteristics of the target object in the interactive network corresponding to the meta-path instance, thereby enabling the server to detect whether the target object has fraudulent behavior based on the target timing features.

[0124] In one possible implementation, step 804 includes the following steps:

[0125] The attention mechanism is used to fuse the meta-path temporal features corresponding to each meta-path type to obtain the target temporal features.

[0126] Formula (8) above generates the feature representation P of the metapath type i through max pooling operation. i To fuse n different meta-path feature representations, an attention mechanism is used again here:

[0127] o i =a(u,P i (9)

[0128]

[0129] s=∑ i β i o i (11)

[0130] Formulas (9) to (11) describe the process of fusing n meta-path temporal features s based on the attention mechanism. Formula (9) is the process of fusing the meta-path temporal features P corresponding to a certain meta-path type. i Interacting with parameter u yields the unnormalized Attention Score. i Formula (10) uses the normalized Attention Score to obtain the parameter β. i Formula (11) is based on Attention Score and meta-path temporal features P. i The target temporal features s of the target object are calculated. At this point, the encoding and feature transformation of the metapath instance are complete.

[0131] Step 805: Input the target time-series features into the fraud behavior recognition model to obtain the recognition result.

[0132] Among them, the fraud behavior identification model is a classification model, and the fraud behavior identification model is trained based on the sample identification results of the sample objects and the sample labels corresponding to the sample objects. The sample labels are used to indicate whether the sample objects have fraudulent behavior in online transactions.

[0133] In one possible implementation, the server utilizes a trained multi-layer perceptron (MLP) model for fraud detection. The server inputs the target object's temporal features into the MLP model to obtain the detection result. The MLP detection process is illustrated in Equation 12, where the activation function is a rectified linear unit (ReLU):

[0134] z = Relu(W k…Relu(Relu(W1s+b1)+b2)+b k (12)

[0135] The model contains k layers of activation functions, and the server determines whether the target object is engaging in fraudulent behavior based on the output feature z.

[0136] Optionally, the server may use the hyperbolic tangent function (Tanh function), ELU function, or MaxOut function as the activation function, but this application embodiment does not limit this.

[0137] Specifically, if the identification result indicates that the target object has engaged in fraudulent behavior in online transactions, the server will intercept the transaction request initiated by the target object when such a request is made, preventing the abnormal user from continuing to conduct transactions, thereby reducing losses for other users and business parties and improving the security of the transaction network.

[0138] In this embodiment, the server obtains meta-path instances of different meta-path types, and for each meta-path type, obtains multiple meta-path instances. Based on the instance temporal characteristics of multiple meta-path instances, the server obtains the path temporal characteristics of each meta-path type. Then, based on the path temporal characteristics of different meta-path types, the server obtains the target temporal characteristics of the target object, making the target temporal characteristics more closely match the behavior of the target object and improving the accuracy of fraud behavior identification. In addition, the server performs fraud risk detection in real time. When it detects that an object with fraudulent behavior initiates a transaction request, it intercepts the request, prevents the transaction behavior of the abnormal object, reduces the losses of other objects and business parties, and improves the security of network transactions.

[0139] Figure 9 This is a system framework diagram of the fraud identification method in the online transaction system provided in the embodiments of this application. For example... Figure 9As shown, the server pre-stores n meta-path types. When identifying fraudulent behavior targeting a target object, the server sequentially retrieves m meta-path instances of the target object from the transaction network based on the preset meta-path types, resulting in a total of n*m meta-path instances. For each meta-path instance, the server extracts it into an object sequence and a relation sequence. The server then sequentially inputs the object attribute information of each object in the object sequence and the relation attribute information of each object relationship in the relation sequence into an LSTM model. Combining object attention and relation attention mechanisms, the model performs encoding and feature fusion. The resulting relational temporal features and object temporal features are then concatenated to obtain the instance temporal features of that meta-path instance. After obtaining the instance temporal features of all meta-path instances of the same meta-path type, the server performs max pooling to obtain the path temporal features of the target object relative to that meta-path type. After obtaining the path temporal features of the target object relative to all meta-path types, the server inputs each path temporal feature into the meta-path attention mechanism to obtain the target temporal features of the target object. Finally, the server inputs the target temporal features into a multi-layer neural network model to obtain the identification result of the target object.

[0140] The above embodiments illustrate the flow of a method for identifying fraudulent behavior in an online transaction system, namely, the application stage of the fraud behavior identification model. Before applying the fraud behavior identification model in actual business scenarios, it is first necessary to train the model. Figure 10 The diagram illustrates a flowchart of a method for identifying fraudulent activities in a network transaction system according to an exemplary embodiment of this application. This embodiment uses this method for... Figure 1 Taking server 120 in the implementation environment shown as an example, the method includes the following steps:

[0141] Step 1001: Obtain sample meta path instances of sample objects from the heterogeneous network of the network transaction system. A sample meta path instance is a path formed by the relationship between sample objects and adjacent path nodes, with sample objects as path nodes.

[0142] In heterogeneous networks, there are object relationships between different objects, which are generated based on the behavior of objects in the network transaction system.

[0143] The starting point of a sample meta path instance is the path node corresponding to the sample object, and the node order of the path nodes in the sample meta path instance is the order in which the sample object relationship is formed.

[0144] In one possible implementation, before model training, the server first needs to construct a sample dataset for model training. This dataset contains sample metapath instances of positive samples and sample metapath instances of negative samples, where positive samples are objects where no fraudulent behavior is identified, and negative samples are objects where fraudulent behavior is identified. To improve the diversity of sample metapath instances and enable the trained model to identify diverse and complex fraudulent behaviors, the server obtains sample metapath instances of n different sample metapath types for each sample object, and for each sample metapath type, obtains m sample metapath instances to expand the data sources and data richness.

[0145] Step 1002: Extract temporal features from each sample element path instance to obtain the sample instance temporal features of each sample element path instance.

[0146] In one possible implementation, the server generates a sequence of sample objects and a sequence of sample relationships based on sample meta-path instances. The sample object sequence contains each sample object within the sample meta-path instance, and the sample relationship sequence contains the relationships between each sample object within the sample meta-path instance. The server performs sequence encoding and feature extraction on the sample object sequence and sample relationship sequence respectively to obtain temporal features of the sample objects and temporal features of the sample relationships. Then, it concatenates features from the same sample meta-path instance to obtain the temporal features of that sample instance. By extracting the temporal features from the sample object sequence and sample relationship sequence separately and then concatenating them, the temporal features of the sample instances are obtained, ensuring that they encompass the temporal relationships between the sample object and other objects in its transaction behavior, as well as the temporal relationships between various transaction behaviors.

[0147] Step 1003: Based on the temporal features of each sample instance path instance, determine the temporal features of the sample objects.

[0148] The server obtains sample metapath instances for each sample object, which include sample metapath instances belonging to different sample metapath types. Therefore, the server first performs max pooling on the temporal features of sample instances belonging to the same sample metapath type to obtain the temporal features of that sample metapath type. Then, based on the temporal features of the sample paths corresponding to each sample metapath type, the server obtains the temporal features of the sample object.

[0149] Step 1004: Input the sample time series features into the fraud behavior identification model to obtain the sample identification result output by the fraud behavior identification model. The sample identification result is used to indicate whether the sample object has engaged in fraudulent behavior in online transactions.

[0150] In one possible implementation, the fraud behavior recognition model in this application embodiment adopts the MLP model. The server uses the MLP model to make the sample time series feature set pass through k layers of activation functions to finally obtain the sample recognition result.

[0151] Optionally, the server trains the model using an S-shaped growth curve (sigmoid function) as the activation function, and maps the feature z obtained using formula (12) to the interval of 0-1 through the sigmoid function:

[0152]

[0153] Step 1005: Using the sample labels corresponding to the sample objects as supervision for the sample identification results, the fraud behavior identification model is trained. The sample labels are used to indicate whether the sample objects have engaged in fraudulent behavior in online transactions.

[0154] When developers identify sample objects, they add sample labels to them. These labels indicate whether the sample object is involved in fraudulent activities in online transactions. After the server obtains the sample identification result of the sample object based on the sample metapath instance, it uses the sample labels as supervision to perform backpropagation training on the MLP model, LSTM model, and attention mechanism, updating the model parameters until the model converges.

[0155] As an illustration, the server uses cross-entropy as the loss function for binary classification to update the model parameters:

[0156]

[0157] Formula (14) is the loss function used by the fraud behavior identification model in this embodiment. To prevent overfitting, the 2-norm constraint is added to the loss function. The model can be updated using the gradient descent method. After training the model, it can be deployed online, ultimately realizing the monitoring of transaction fraud.

[0158] In summary, in this embodiment of the application, by obtaining sample meta-path instances of sample objects and using an attention mechanism to fuse sample instance temporal features of multiple different types of sample meta-path instances to form feature vectors of sample pairs, i.e. sample temporal features, the data sources for model training are enriched, making the trained fraud behavior recognition model universal and applicable to different fraud recognition scenarios.

[0159] Figure 11 This is a structural block diagram of a fraud identification device in an online transaction system provided in an exemplary embodiment of this application. The device includes:

[0160] The first acquisition module 1101 is used to acquire the meta-path instance corresponding to the target object from the heterogeneous network of the network transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the network transaction system. The meta-path instance is a path formed by the object relationship between adjacent path nodes with the object as the path node. The starting point of the path of the meta-path instance is the path node corresponding to the target object, and the node order of the path nodes in the meta-path instance is the formation order of the object relationship.

[0161] The first feature extraction module 1102 is used to extract temporal features from each of the meta-path instances to obtain instance temporal features of each of the meta-path instances.

[0162] The first determining module 1103 is used to determine the target time sequence features corresponding to the target object based on the instance time sequence features of each of the meta-path instances;

[0163] The first identification module 1104 is used to identify fraudulent behavior of the target object based on the target time-series characteristics and obtain an identification result. The identification result is used to indicate whether the target object has engaged in fraudulent behavior in online transactions.

[0164] Optionally, the first feature extraction module 1102 includes:

[0165] A generation unit is configured to generate an object sequence and a relation sequence based on the metapath instance, wherein the object sequence contains each object in the metapath instance, and the relation sequence contains the relations between each object in the metapath instance;

[0166] The first acquisition unit is used to encode the meta-path instance based on the object sequence and the relation sequence to obtain the object temporal features and relation temporal features corresponding to the meta-path instance;

[0167] The second acquisition unit is used to perform feature fusion on the object temporal features and the relation temporal features to obtain the instance temporal features.

[0168] Optionally, the first acquisition unit is further configured to:

[0169] Obtain object attribute information for each object in the object sequence, and relation attribute information for each object relationship in the relation sequence, wherein the object attribute information includes object type, and the relation attribute information includes object relationship type;

[0170] The object sequence is encoded based on the object attribute information to obtain the object temporal features, and the relation sequence is encoded based on the relation attribute information to obtain the relation temporal features.

[0171] Optionally, the first acquisition unit is further configured to:

[0172] The object sequence containing the object attribute information is input into the first LSTM model, and the relation sequence containing the relation attribute information is input into the second LSTM model;

[0173] The output vector of the first LSTM model is fused using an attention mechanism to obtain the temporal features of the object, and the output vector of the second LSTM model is fused using an attention mechanism to obtain the temporal features of the relationship.

[0174] Optionally, the target object corresponds to n meta-path types, and each meta-path type corresponds to m meta-path instances, wherein meta-path instances of different meta-path types contain objects of different types and / or object relationships of different types, and n and m are positive integers;

[0175] The first determining module 1103 includes:

[0176] The first determining unit is used to determine the meta-path timing features corresponding to the meta-path type based on the instance timing features of meta-path instances corresponding to the same meta-path type.

[0177] The second determining unit is used to determine the target time series features based on the time series features of the meta-paths corresponding to each meta-path type.

[0178] Optionally, the first determining unit is further configured to:

[0179] For the same metapath type, max pooling is performed on the instance time-series features corresponding to each metapath instance to obtain the metapath time-series features corresponding to the metapath type.

[0180] Optionally, the second determining unit is further configured to:

[0181] The target temporal features are obtained by using an attention mechanism to fuse the temporal features of the metapaths corresponding to each metapath type.

[0182] Optionally, the first identification module 1104 includes:

[0183] The first identification unit is used to input the target time-series features into the fraud behavior identification model to obtain the identification result. The fraud behavior identification model is a classification model, and the fraud behavior identification model is trained based on the sample identification result of the sample object and the sample label corresponding to the sample object. The sample label is used to indicate whether the sample object has fraudulent behavior in online transactions.

[0184] Optionally, the identification result indicates that the target object has engaged in fraudulent activities in online transactions;

[0185] The device further includes:

[0186] The request interception module is used to intercept the transaction request in response to the existence of a transaction request initiated by the target object.

[0187] Optionally, the object includes at least one of an account and a device, the object relationship includes at least one of the relationship between accounts and the relationship between an account and a device, the relationship between accounts includes at least one of being contacts of each other and a transaction relationship, and the relationship between an account and a device includes a login relationship.

[0188] In summary, in this embodiment, meta-path instances corresponding to target objects in the heterogeneous network of the network transaction system are extracted according to the formation order of object relationships, and temporal features are extracted from the meta-path instances. This allows the target temporal features to reflect the topological relationships and temporal characteristics of objects and their relationships. Compared with traditional fraud behavior identification methods, this expands the amount of information and the monitoring dimensions of fraud behavior, and can fully explore the differences between objects that exhibit fraudulent behavior and those that do not. Based on business meta-paths for fraud behavior identification, business parties can define meta-paths according to the business characteristics of actual application scenarios to obtain meta-path instances suitable for the corresponding business scenarios. Therefore, the method has universality and is applicable to various different business scenarios.

[0189] Figure 12 This is a structural block diagram of a fraud identification device in an online transaction system provided in an exemplary embodiment of this application. The device includes:

[0190] The second acquisition module 1201 is used to acquire sample meta-path instances of sample objects from the heterogeneous network of the online transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the online transaction system. The sample meta-path instance is a path formed by the sample object relationship between adjacent path nodes, with the sample object as the path node. The starting point of the path of the sample meta-path instance is the path node corresponding to the sample object, and the node order of the path nodes in the sample meta-path instance is the formation order of the sample object relationship.

[0191] The second feature extraction module 1202 is used to extract temporal features from each of the sample element path instances to obtain the sample instance temporal features of each of the sample element path instances.

[0192] The second determining module 1203 is used to determine the sample time series features corresponding to the sample object based on the sample instance time series features of each sample element path instance.

[0193] The second identification module 1204 is used to input the sample time series features into the fraud behavior identification model to obtain the sample identification result output by the fraud behavior identification model. The sample identification result is used to indicate whether the sample object has engaged in fraudulent behavior in online transactions.

[0194] The model training module 1205 is used to train the fraud behavior identification model by using the sample labels corresponding to the sample objects as supervision of the sample identification results. The sample labels are used to indicate whether the sample objects have engaged in fraudulent behavior in online transactions.

[0195] In summary, in this embodiment of the application, by obtaining sample meta-path instances of sample objects and using an attention mechanism to fuse sample instance temporal features of multiple different types of sample meta-path instances to form feature vectors of sample pairs, i.e. sample temporal features, the data sources for model training are enriched, making the trained fraud behavior recognition model universal and applicable to different fraud recognition scenarios.

[0196] Please refer to Figure 13 This illustration shows a schematic diagram of the structure of a computer device provided in one embodiment of this application. Specifically:

[0197] The computer device 1300 includes a central processing unit (CPU) 1301, a system memory 1304 including random access memory (RAM) 1302 and read-only memory (ROM) 1303, and a system bus 1305 connecting the system memory 1304 and the CPU 1301. The computer device 1300 also includes a basic input / output (I / O) controller 1306 that facilitates information transfer between various components within the computer, and a mass storage device 1307 for storing the operating system 1313, application programs 1314, and other program modules 1315.

[0198] The basic input / output system 1306 includes a display 1308 for displaying information and an input device 1309 for user input, such as a mouse or keyboard. Both the display 1308 and the input device 1309 are connected to the central processing unit 1301 via an input / output controller 1310 connected to the system bus 1305. The basic input / output system 1306 may also include the input / output controller 1310 for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 1310 also provides output to a display screen, printer, or other types of output devices.

[0199] The mass storage device 1307 is connected to the central processing unit 1301 via a mass storage controller (not shown) connected to the system bus 1305. The mass storage device 1307 and its associated computer-readable media provide non-volatile storage for the computer device 1300. That is, the mass storage device 1307 may include computer-readable media (not shown) such as a hard disk or a compact disc read-only memory (CD-ROM) drive.

[0200] Without loss of generality, the computer-readable medium may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include RAM, ROM, erasable programmable read-only memory (EPROM), flash memory or other solid-state storage technologies, CD-ROM, digital video disc (DVD) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that the computer storage media are not limited to the above-mentioned types. The system memory 1304 and mass storage device 1307 described above can be collectively referred to as memory.

[0201] According to various embodiments of this application, the computer device 1300 can also be connected to a remote computer on a network, such as the Internet. That is, the computer device 1300 can be connected to a network 1312 via a network interface unit 1311 connected to the system bus 1305, or the network interface unit 1311 can be used to connect to other types of networks or remote computer systems (not shown).

[0202] The memory also includes at least one instruction, at least one program, code set, or instruction set, which are stored in the memory and configured to be executed by one or more processors to implement the fraud identification method in the above-mentioned online transaction system.

[0203] This application also provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the method for identifying fraudulent activities in a network transaction system as described in the above embodiments.

[0204] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A server's processor reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the server to perform the fraud identification method in a network transaction system provided in various alternative implementations of the above aspect.

[0205] Those skilled in the art will recognize that the functions described in the embodiments of this application in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable storage medium or transmitted as one or more instructions or code on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.

[0206] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for identifying fraudulent activities in an online transaction system, characterized in that, The method includes: Meta-path instances of various meta-path types corresponding to the target object are obtained from the heterogeneous network of the online transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the online transaction system. The meta-path instance is a path formed by the object relationship between adjacent path nodes with the object as the path node. The starting point of the path of the meta-path instance is the path node corresponding to the target object, and the node order of the path nodes in the meta-path instance is the order in which the object relationship is formed. The metapath instance is split to obtain an object sequence and a relation sequence. The object sequence contains each object in the metapath instance that conforms to the node order, and the relation sequence contains each object relation in the metapath instance that conforms to the formation order. Encode the object sequence and the relation sequence to obtain the object temporal features and relation temporal features corresponding to the meta-path instance; The temporal features of the object and the temporal features of the relationship are fused to obtain the instance temporal features of the meta-path instance; Based on the instance temporal characteristics of the metapath instances corresponding to various metapath types, the target temporal characteristics corresponding to the target object are determined. Based on the target time-series characteristics, fraud behavior is identified in the target object to obtain an identification result, which is used to indicate whether the target object has engaged in fraudulent behavior in online transactions.

2. The method according to claim 1, characterized in that, The process of encoding the object sequence and the relation sequence to obtain the object temporal features and relation temporal features corresponding to the meta-path instance includes: Obtain object attribute information for each object in the object sequence, and relation attribute information for each object relationship in the relation sequence, wherein the object attribute information includes object type, and the relation attribute information includes object relationship type; The object sequence is encoded based on the object attribute information to obtain the object temporal features, and the relation sequence is encoded based on the relation attribute information to obtain the relation temporal features.

3. The method according to claim 2, characterized in that, The process of encoding the object sequence based on the object attribute information to obtain the object temporal features, and encoding the relation sequence based on the relation attribute information to obtain the relation temporal features, includes: The object sequence containing the object attribute information is input into a first long short-term memory network (LSTM) model, and the relation sequence containing the relation attribute information is input into a second LSTM model. The output vector of the first LSTM model is fused using an attention mechanism to obtain the temporal features of the object, and the output vector of the second LSTM model is fused using an attention mechanism to obtain the temporal features of the relationship.

4. The method according to any one of claims 1 to 3, characterized in that, The target object corresponds to n meta-path types, and each meta-path type corresponds to m meta-path instances. The meta-path instances of different meta-path types contain objects of different types and / or object relationships of different types, where n and m are positive integers. The determination of the target time series features corresponding to the target object based on the instance time series features of the metapath instances corresponding to various metapath types includes: Based on the instance timing characteristics of metapath instances corresponding to the same metapath type, the metapath timing characteristics corresponding to the metapath type are determined. The target time series features are determined based on the time series features of the meta-paths corresponding to each meta-path type.

5. The method according to claim 4, characterized in that, The determination of the meta-path timing features corresponding to the meta-path type based on the instance timing features of meta-path instances corresponding to the same meta-path type includes: For the same metapath type, max pooling is performed on the instance time-series features corresponding to each metapath instance to obtain the metapath time-series features corresponding to the metapath type.

6. The method according to claim 4, characterized in that, The step of determining the target time series features based on the time series features corresponding to each meta-path type includes: The target temporal features are obtained by using an attention mechanism to fuse the temporal features of the metapaths corresponding to each metapath type.

7. The method according to any one of claims 1 to 3, characterized in that, The process of identifying fraudulent behavior in the target object based on the target's temporal features, and obtaining the identification result, includes: The target time-series features are input into the fraud behavior identification model to obtain the identification result. The fraud behavior identification model is a classification model, and it is trained based on the sample identification result of the sample object and the sample label corresponding to the sample object. The sample label is used to indicate whether the sample object has fraudulent behavior in online transactions.

8. The method according to any one of claims 1 to 3, characterized in that, The identification result indicates that the target entity has engaged in fraudulent activities in online transactions; After identifying fraudulent behavior of the target object based on the target time-series features and obtaining the identification result, the method further includes: In response to the existence of a transaction request initiated by the target object, the transaction request is intercepted.

9. The method according to any one of claims 1 to 3, characterized in that, The objects include at least one of accounts and devices, the object relationships include at least one of relationships between accounts and relationships between accounts and devices, the relationships between accounts include at least one of being contacts of each other and transaction relationships, and the relationships between accounts and devices include login relationships.

10. A method for identifying fraudulent activities in an online transaction system, characterized in that, The method includes: Sample meta-path instances of various meta-path types corresponding to sample objects are obtained from the heterogeneous network of the online transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the online transaction system. The sample meta-path instance is a path formed by the sample object relationship between adjacent path nodes with the sample object as the path node. The starting point of the path of the sample meta-path instance is the path node corresponding to the sample object, and the node order of the path nodes in the sample meta-path instance is the formation order of the sample object relationship. The sample metapath instance is split to obtain a sample object sequence and a sample relationship sequence. The sample object sequence contains each sample object in the sample metapath instance that conforms to the node order, and the sample relationship sequence contains each sample object relationship in the sample metapath instance that conforms to the formation order. Encode the sample object sequence and the sample relationship sequence to obtain the sample object temporal features and sample relationship temporal features corresponding to the sample meta-path instance; The temporal features of the sample objects and the temporal features of the sample relationships are fused to obtain the temporal features of the sample meta-path instances. Based on the temporal features of the sample instances corresponding to the sample metapath instances of various metapath types, the temporal features of the sample objects corresponding to the sample objects are determined. The sample time-series features are input into the fraud behavior identification model to obtain the sample identification result output by the fraud behavior identification model. The sample identification result is used to indicate whether the sample object has engaged in fraudulent behavior in online transactions. The fraud behavior identification model is trained using the sample labels corresponding to the sample objects as supervision of the sample identification results. The sample labels are used to indicate whether the sample objects have engaged in fraudulent behavior in online transactions.

11. A device for identifying fraudulent activities in an online transaction system, characterized in that, The device includes: The first acquisition module is used to acquire meta-path instances of multiple meta-path types corresponding to the target object from the heterogeneous network of the network transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the network transaction system. The meta-path instance is a path formed by the object relationship between adjacent path nodes with the object as the path node. The starting point of the path of the meta-path instance is the path node corresponding to the target object, and the node order of the path nodes in the meta-path instance is the formation order of the object relationship. The first feature extraction module is used to split the meta-path instance to obtain an object sequence and a relation sequence. The object sequence contains each object in the meta-path instance that conforms to the node order, and the relation sequence contains each object relation in the meta-path instance that conforms to the formation order. The object sequence and the relation sequence are encoded to obtain object temporal features and relation temporal features corresponding to the meta-path instance. The object temporal features and the relation temporal features are fused to obtain instance temporal features of the meta-path instance. The first determining module is used to determine the target time series features corresponding to the target object based on the instance time series features of the meta-path instances corresponding to various meta-path types. The first identification module is used to identify fraudulent behavior of the target object based on the target time-series characteristics and obtain an identification result. The identification result is used to indicate whether the target object has engaged in fraudulent behavior in online transactions.

12. The apparatus according to claim 11, characterized in that, The first feature extraction module is used to obtain object attribute information of each object in the object sequence and relation attribute information of each object relationship in the relation sequence. The object attribute information includes object type, and the relation attribute information includes object relationship type. The object sequence is encoded based on the object attribute information to obtain the object temporal feature, and the relation sequence is encoded based on the relation attribute information to obtain the relation temporal feature.

13. The apparatus according to claim 12, characterized in that, The first feature extraction module is used to input the object sequence containing the object attribute information into a first long short-term memory network (LSTM) model, and input the relation sequence containing the relation attribute information into a second LSTM model; to perform feature fusion on the output vector of the first LSTM model using an attention mechanism to obtain the object temporal features, and to perform feature fusion on the output vector of the second LSTM model using an attention mechanism to obtain the relation temporal features.

14. The apparatus according to any one of claims 11 to 13, characterized in that, The target object corresponds to n meta-path types, and each meta-path type corresponds to m meta-path instances. The meta-path instances of different meta-path types contain objects of different types and / or object relationships of different types, where n and m are positive integers. The first determining module is used to determine the meta-path timing features corresponding to the meta-path type based on the instance timing features of the meta-path instances corresponding to the same meta-path type; and to determine the target timing features based on the meta-path timing features corresponding to each meta-path type.

15. The apparatus according to claim 14, characterized in that, The first determining module is used to perform max pooling operation on the instance time-series features corresponding to each meta-path instance for the same meta-path type to obtain the meta-path time-series features corresponding to the meta-path type.

16. The apparatus according to claim 14, characterized in that, The first determining module is used to perform feature fusion on the meta-path temporal features corresponding to each meta-path type using an attention mechanism to obtain the target temporal features.

17. The apparatus according to any one of claims 11 to 13, characterized in that, The first identification module is used to input the target time-series features into the fraud behavior identification model to obtain the identification result. The fraud behavior identification model is a classification model, and the fraud behavior identification model is trained based on the sample identification result of the sample object and the sample label corresponding to the sample object. The sample label is used to indicate whether the sample object has fraudulent behavior in online transactions.

18. The apparatus according to any one of claims 11 to 13, characterized in that, The identification result indicates that the target entity has engaged in fraudulent activities in online transactions; The device further includes: The request interception module is used to intercept the transaction request in response to the existence of a transaction request initiated by the target object.

19. The apparatus according to any one of claims 11 to 13, characterized in that, The objects include at least one of accounts and devices, the object relationships include at least one of relationships between accounts and relationships between accounts and devices, the relationships between accounts include at least one of being contacts of each other and transaction relationships, and the relationships between accounts and devices include login relationships.

20. A device for identifying fraudulent activities in an online transaction system, characterized in that, The device includes: The second acquisition module is used to acquire sample meta-path instances of various meta-path types corresponding to sample objects from the heterogeneous network of the online transaction system. The heterogeneous network contains object relationships between different objects. The object relationships are generated based on the behavior of the objects in the online transaction system. The sample meta-path instance is a path formed by the sample object relationship between adjacent path nodes, with the sample object as the path node. The starting point of the path of the sample meta-path instance is the path node corresponding to the sample object, and the node order of the path nodes in the sample meta-path instance is the formation order of the sample object relationship. The second feature extraction module is used to split the sample meta-path instance to obtain a sample object sequence and a sample relationship sequence. The sample object sequence contains each sample object in the sample meta-path instance that conforms to the node order, and the sample relationship sequence contains each sample object relationship in the sample meta-path instance that conforms to the formation order. The sample object sequence and the sample relationship sequence are encoded to obtain the sample object temporal features and sample relationship temporal features corresponding to the sample meta-path instance. The sample object temporal features and the sample relationship temporal features are fused to obtain the sample instance temporal features of the sample meta-path instance. The second determining module is used to determine the sample time series features corresponding to the sample object based on the sample instance time series features of the sample meta path instances corresponding to various meta path types. The second identification module is used to input the temporal features of the sample into the fraud behavior identification model to obtain the sample identification result output by the fraud behavior identification model. The sample identification result is used to indicate whether the sample object has engaged in fraudulent behavior in online transactions. The model training module is used to train the fraud behavior identification model by using the sample labels corresponding to the sample objects as supervision for the sample identification results. The sample labels are used to indicate whether the sample objects have engaged in fraudulent behavior in online transactions.

21. A server, characterized in that, The server includes a processor and a memory; the memory stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the method for identifying fraudulent activities in a network transaction system as described in any one of claims 1 to 9, or the method for identifying fraudulent activities in a network transaction system as described in claim 10.

22. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the method for identifying fraudulent activities in a network transaction system as described in any one of claims 1 to 9, or the method for identifying fraudulent activities in a network transaction system as described in claim 10.

23. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium. The processor of the server reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the server to perform the method for identifying fraudulent activities in a network transaction system as described in any one of claims 1 to 9, or the method for identifying fraudulent activities in a network transaction system as described in claim 10.

Images