Method for establishing risk identification model, method for risk identification and corresponding device

Abstract

Embodiments of the present specification provide a method for establishing a risk identification model, a method for risk identification, and corresponding devices. The method includes: obtaining N heterogeneous network graphs at N time points constructed using network behavior data of a user at the N time points, part of the nodes being labeled with a label indicating whether a preset type of risk exists; training the risk identification model using the N heterogeneous network graphs, wherein the risk identification model includes a graph neural network, a spiking neural network, a concatenation network, and a mapping network; and the training target includes minimizing the difference between the risk identification result of the risk identification model for a node and the label. The present application combines the graph neural network with the spiking neural network, proposes a risk identification model based on the spiking neural network to capture the structure and timing information of dynamic graph data, so as to make the risk identification based on the network behavior data of the user more accurate.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the technical field of artificial intelligence, and in particular to a method for establishing a risk identification model, a method for risk identification, and corresponding apparatuses. BACKGROUND

[0002] With the development of Internet technology, various risks occur in various behaviors of users using the Internet, and the requirement for network security is increasingly high. In actual risk control scenarios, a graph neural network model is a kind of deep neural network model that is widely used at present. The graph neural network shows strong learning and representation ability in modeling the association relationship between nodes in a graph structure. However, the current representation learning based on the graph neural network is limited to processing static graph data, while in real scenarios, graph data mostly changes in structure and nature over time. Taking the financial risk control scenario as an example, the transaction data continuously generates, resulting in the continuous change of the graph structure over time. Therefore, the existing risk identification based on the graph neural network model cannot capture the structure and time sequence information of dynamic graph data, resulting in low accuracy of risk identification. SUMMARY

[0003] Therefore, one or more embodiments of the present specification disclose a method for establishing a risk identification model, a method for risk identification, and corresponding apparatuses, so as to improve the accuracy of risk identification.

[0004] According to a first aspect, the present disclosure provides a method for establishing a risk identification model, comprising:

[0005] obtaining N heterogeneous network graphs at N time points constructed by using network behavior data of a user at the N time points, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, the edges being determined according to the behavior relationship between the behavior subjects and the behavior objects, the N being a positive integer greater than 1; part of the nodes being labeled with a label indicating whether a preset type of risk exists or not;

[0006] The risk identification model is trained by using the heterogeneous network graphs of the N time points, and the risk identification model comprises a graph neural network, a spiking neural network, a concatenation network and a mapping network; the graph neural network obtains first feature vectors of each node at the N time points by using the heterogeneous network graphs of the N time points; the spiking neural network accumulates and updates membrane voltage by using the first feature vectors of each node at the N time points to obtain a spiking sequence of each node at the N time points; the concatenation network concatenates the spiking sequence of each node at the N time points to obtain a second feature vector of the node; and the mapping network is used to determine a risk identification result of each node by using the second feature vector of the node; and the training target comprises minimizing the difference between the risk identification result of the node and a label by using the risk identification model.

[0007] According to an implementable manner in the embodiments of the present application, the graph neural network adopts a graph sampling and aggregation GraphSAGE network.

[0008] For each time point t in the N time points, the GraphSAGE network samples neighbor nodes of a node v from the heterogeneous network graph at the time point t and samples neighbor nodes of the node v from updated graph data at the time point t compared with the time point t-1; and the GraphSAGE determines a first feature vector of the node v at the time point t by using information of the node v and the sampled neighbor nodes.

[0009] According to an implementable manner in the embodiments of the present application, the spiking neural network accumulates and updates membrane voltage by using the first feature vectors of each node at the N time points to obtain a spiking sequence of each node at the N time points, which comprises:

[0010] The spiking neural network accumulates membrane voltage by using the first feature vector of the node v at the time point t and the membrane voltage at the time point t-1, and leaks part of the membrane voltage based on a leakage parameter to obtain the membrane voltage at the time point t;

[0011] If the membrane voltage at the time point t reaches a voltage threshold value at the time point t, a spike is generated and the membrane voltage is set to an initial value;

[0012] Information of whether the node v generates a spike at the N time points constitutes a spiking sequence of the node v at the N time points.

[0013] According to an implementable manner in the embodiments of the present application, the voltage threshold value at the time point t is obtained from the voltage threshold value at the time point t-1 and whether a spike is generated at the time point t.

[0014] According to an implementable manner in the embodiments of the present application, in the training process, the model parameters of the risk identification model are updated by using the value of the loss function in each round of iteration until a preset training end condition is met, and the model parameters include the leakage parameter.

[0015] According to an implementable manner in the embodiments of the present application, when updating the model parameters in the training process, an approximate step function is used to replace the step function used by the spiking neural network to perform gradient calculation, and the approximate step function includes a Sigmoid function.

[0016] In a second aspect, a risk identification method is provided, and the method includes:

[0017] obtaining N heterogeneous network graphs at N time points constructed by using network behavior data of a user at the N time points, the heterogeneous network graph including nodes and edges, the nodes including behavior subjects and behavior objects, the edges being determined according to a behavior relationship between the behavior subjects and the behavior objects, and N being a positive integer greater than 1;

[0018] inputting the N heterogeneous network graphs at the N time points and information of a target node into a risk identification model to obtain a risk identification result of the target node by the risk identification model;

[0019] The risk identification model is pre-established by using the method in the first aspect.

[0020] In a third aspect, a device for establishing a risk identification model is provided, and the device includes:

[0021] a graph obtaining unit configured to obtain N heterogeneous network graphs at N time points constructed by using network behavior data of a user at the N time points, the heterogeneous network graph including nodes and edges, the nodes including behavior subjects and behavior objects, the edges being determined according to a behavior relationship between the behavior subjects and the behavior objects, and N being a positive integer greater than 1; and part of the nodes are labeled with a label indicating whether a preset type of risk exists;

[0022] The model training unit is configured to train the risk identification model by using the N heterogeneous network graphs at the N time points, wherein the risk identification model comprises a graph neural network, a spiking neural network, a concatenation network and a mapping network; the graph neural network obtains first feature vectors of each node at the N time points by using the N heterogeneous network graphs at the N time points; the spiking neural network accumulates and updates membrane voltage by using the first feature vectors of each node at the N time points to obtain a spiking sequence of each node at the N time points; the concatenation network concatenates the spiking sequence of each node at the N time points to obtain a second feature vector of the node; the mapping network is used to determine a risk identification result of each node by using the second feature vector of the node; and the training target comprises minimizing the difference between the risk identification result of each node by the risk identification model and a label.

[0023] In a fourth aspect, a risk identification device is provided, which comprises:

[0024] The graph obtaining unit is configured to obtain N heterogeneous network graphs at N time points constructed by using network behavior data of a user at the N time points, wherein the N heterogeneous network graphs comprise nodes and edges, the nodes comprise behavior subjects and behavior objects, the edges are determined according to behavior relationships between the behavior subjects and the behavior objects, and N is a positive integer greater than 1.

[0025] The risk identification unit is configured to input the N heterogeneous network graphs and information of a target node into a risk identification model to obtain a risk identification result of the target node by the risk identification model.

[0026] The risk identification model is pre-established by using the device of the third aspect.

[0027] According to the fourth aspect, the present disclosure provides a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first aspect or the second aspect.

[0028] According to the embodiments provided in the present application, the present application can have the following technical effects:

[0029] 1) The present application combines the graph neural network with the spiking neural network, proposes a risk identification model based on the spiking neural network to capture the structure and timing information of the dynamic graph data, so as to make the risk identification based on the user network behavior data more accurate.

[0030] 2) The graph neural network in the application adopts the GraphSAGE network, and improves the sampling method of the GraphSAGE network. For each node v, the neighbor nodes of the node v are sampled from the heterogeneous network graph at time t, and the neighbor nodes of the node v are sampled from the updated graph data at time t compared with time t-1, so as to adapt to dynamic graph data and better capture the dynamic evolution information of the node under the graph structure.

[0031] 3) The pulse neural network has few model parameters and a simple calculation process, and only involves simple voltage charging and discharging, so the calculation efficiency is greatly improved compared with the RNN architecture.

[0032] 4) The representation vector of the node output by the pulse neural network is a coefficient-discrete pulse sequence, so the calculation and storage efficiency is greatly improved compared with real number storage.

[0033] 5) The pulse neural network in the application adopts the leakage integral discharge method, and the voltage threshold can be dynamically adjusted, and the leakage parameter can be learned, so as to enhance the ability of the pulse neural network to capture timing information, and make the pulse neural network better converge in the training process. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings described below are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0035] Figure 1 An exemplary system architecture diagram to which embodiments of the present disclosure can be applied is shown;

[0036] Figure 2 A method flowchart for establishing a risk identification model provided by the embodiments of the present disclosure is provided;

[0037] Figure 3 A principle schematic diagram of a risk identification model provided by the embodiments of the present application is provided;

[0038] Figure 4 A device structure diagram for establishing a risk identification model provided by the embodiments of the present application is provided;

[0039] Figure 5 A structure diagram of a risk identification device provided by the embodiments of the present application is provided. DETAILED DESCRIPTION

[0040] The schemes provided in the present specification will be described below with reference to the drawings.

[0041] The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the description of the application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0042] It should be understood that the term "and / or" as used herein merely describes associated objects in association, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " herein generally represents that the front and rear associated objects are in an "or" relationship.

[0043] Depending on the context, the word "if" as used herein can be interpreted as meaning "when" or "while" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if it is determined" or "if (a stated condition or event) is detected" can be interpreted as meaning "when it is determined" or "in response to determining" or "when (a stated condition or event) is detected" or "in response to detecting (a stated condition or event)".

[0044] Based on the dynamic graph data scene, dynamic graph representation learning has become an important research direction in recent years. Dynamic graph representation learning adds a time dimension on the basis of static graph data modeling to be able to represent the structure and timing information of dynamic graph data at the same time.

[0045] The existing implementation of dynamic graph representation learning mainly improves the static graph neural network model and applies it to the dynamic graph scene, and additionally considers the time dimension. The typical way is to combine the graph neural network with the RNN (Recurrent Neural Network, recurrent neural network) architecture, and model the graph structure and time information at the same time. But this way has the following defects:

[0046] 1) The RNN model has large number of parameters and complex calculation, which is difficult to apply to large-scale dynamic graph data scenes such as risk identification.

[0047] 2) The representation vector of each node obtained by RNN is a real number, which has high storage requirements.

[0048] In view of this, the present application proposes a new modeling idea of risk identification model. In order to facilitate the understanding of the present application, first, the system architecture based on the present application is introduced. Figure 1An exemplary system architecture to which embodiments of the present disclosure can be applied is shown. The system mainly comprises a device for establishing a risk identification model and a risk identification device. The device for establishing a risk identification model obtains a batch of user network behavior data from a data warehouse, analyzes the user network behavior data, and establishes a risk identification model.

[0049] The risk identification device uses the trained risk identification model to perform risk identification on a target node in the graph data.

[0050] The device for establishing a risk identification model and the risk identification device in the above system can be implemented on a server side. The server side can be a single server, a server group composed of multiple servers, or a cloud server. The cloud server, also known as a cloud computing server or a cloud host, is a host product in a cloud computing service system, which solves the defects of large management difficulty and weak business scalability in traditional physical hosts and virtual private server (VPs, Virtual Private Server) services. In addition to being implemented on the server side, it can also be implemented on a computer terminal with strong computing power.

[0051] It should be understood that Figure 1 The number of devices for establishing a risk identification model, risk identification devices, and data warehouses in the above system is only illustrative. According to the implementation needs, there can be any number of devices for establishing a risk identification model, risk identification devices, and data warehouses.

[0052] Figure 2 A method flowchart for establishing a risk identification model is provided for embodiments of the present disclosure. It can be understood that the method can be executed by the device for establishing a risk identification model in the system shown in Figure 1 Referring to Figure 2 The method comprises the following steps.

[0053] Step 202: Obtain an N-time heterogeneous network graph constructed using user network behavior data at N times, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, the edges being determined according to the behavior relationship between the behavior subjects and the behavior objects, N being a positive integer greater than 1; part of the nodes are labeled with a label indicating whether a preset type of risk exists.

[0054] Step 204: training a risk identification model by using the heterogeneous network graphs at N time points, wherein the risk identification model comprises a graph neural network, a spiking neural network, a concatenation network and a mapping network; the graph neural network is used to obtain first representation vectors of each node at N time points by using the heterogeneous network graphs at N time points; the spiking neural network is used to accumulate and update membrane voltage by using the first representation vectors of each node at N time points, to obtain a spiking sequence of each node at N time points; the concatenation network is used to concatenate the spiking sequence of each node at N time points to obtain a second representation vector of the node; the mapping network is used to determine a risk identification result of each node by using the second representation vector of the node; and the training target comprises minimizing the difference between the risk identification result of the node and a label by using the risk identification model.

[0055] As can be seen from the technical content provided by the above embodiments, the present application combines the graph neural network with the spiking neural network, and proposes a risk identification model based on the spiking neural network to capture the structure and timing information of dynamic graph data, so as to make the risk identification based on user network behavior data more accurate.

[0056] In addition, the spiking neural network has few model parameters and a simple calculation process, and only involves simple voltage charging and discharging, so the calculation efficiency is greatly improved compared with the RNN architecture.

[0057] The representation vector of the node output by the spiking neural network is a sparse and discrete spiking sequence, so the calculation and storage efficiency is greatly improved compared with real number storage.

[0058] It should be noted that the "first", "second" and the like involved in the present application do not have the limitations of size, order and quantity, and are only used to distinguish in name, for example, "first representation vector" and "second representation vector" are used to distinguish two representation vectors.

[0059] The following describes each step shown in FIG. 2. Figure 2

[0060] First, the above step 202, i.e., "obtaining N heterogeneous network graphs constructed by using user network behavior data at N time points", is described in detail in combination with embodiments.

[0061] A large amount of network behavior data of the user is recorded by the server side in the process of using the network, and the network behavior data is usually recorded in a data warehouse, reflecting the association between a large number of behavior subjects and behavior objects. At the same time, the behavior data of the user changes over time, so the user network behavior data at each time point can be obtained, and the network heterogeneous graph at each time point can be constructed based thereon.

[0062] ​The risk identification is usually performed for a specific scenario, and the behavior subject, behavior object and network behavior type to be focused and analyzed in the specific scenario are also specific. Therefore, the behavior subject, behavior object and network behavior of the behavior subject type, behavior object type and network behavior type corresponding to the target scenario can be obtained from the data warehouse to construct a heterogeneous network graph. This way of constructing a heterogeneous network graph based on a specific scenario can greatly reduce the size of the graph data. The heterogeneous network graph includes nodes and edges, the nodes include behavior subjects and behavior objects, and the edges are determined according to the network behavior relationship between the behavior subjects and the behavior objects.

[0063] The subject type, behavior object type and network behavior type corresponding to the target scenario can be pre-set according to experience.

[0064] Taking network transaction risk as an example, the behavior subject can be an account, a bank card, etc. The behavior object can also be an account, a bank card, etc., and can also be a red envelope id, etc. That is, the behavior subject and the behavior object are subjects and objects related to finance. The edge between the nodes can be a payment behavior, a deposit and withdrawal behavior, a signing and binding behavior, a red envelope sending and receiving behavior, and other behavior relationships related to finance between the behavior subjects and the behavior objects.

[0065] Taking network friend-making fraud risk as an example, the behavior subject can be a social network account, a real-time communication tool account, a financial account, a host address, a client identifier, etc. The edge between the nodes can be a behavior of sending a friend request, a behavior of adding a friend, a chat behavior, a transfer behavior, a red envelope sending and receiving behavior, a link sending behavior, etc.

[0066] In the embodiment of the application, the heterogeneous network graphs of N time points used when establishing the risk identification model are all pre-constructed in the above manner. N is a positive integer greater than 1, that is, a plurality of continuous time point heterogeneous network graphs need to be constructed. Since the risk identification model is established in the embodiment of the application in a supervised learning manner, part of the nodes in the heterogeneous network graph need to be labeled, and the labeled part of the nodes are used as sample nodes. The content of the labeling is a label of whether there is a preset type of risk, for example, a risk user labeled as fraud, a non-risk user.

[0067] For example, some users are frequently complained, and the user can be considered as a known risk user, and the corresponding node in the heterogeneous network graph is determined and labeled. For another example, some users are detected as risk users by some existing high-accuracy detection tools, or some risk users can be identified by manual identification, and the corresponding nodes in the heterogeneous network are determined and labeled.

[0068] Similarly, some users are clearly non-risky. For example, official sources may reveal that some users are highly recommended or praised, or have high credibility, such as those who engage in extensive charitable activities, contribute to urban development, or are selected as role models. These users are identified as known safe users, and their corresponding nodes are identified and labeled in the heterogeneous network. For another example, existing high-accuracy detection tools can be used to identify some users as safe, or they can be manually identified, and their corresponding nodes are identified and labeled in the heterogeneous network.

[0069] The above step 204, namely "obtaining a risk identification model by training heterogeneous network graphs at N moments", is described in detail below with reference to an embodiment.

[0070] like Figure 3 As shown in , the risk identification model provided in the embodiments of the present application mainly includes graph neural networks, pulse neural networks, splicing networks and mapping networks.

[0071] The input to the graph neural network is a heterogeneous network graph at N time points. After inputting the heterogeneous network graph at a time point into the graph neural network, the graph neural network can output the first representation vector of each node at that time point. Then, for each of the N time points, the graph neural network uses the heterogeneous network graph at each of the N time points to obtain the first representation vector of each node at that time point.

[0072] As one of the feasible ways, the graph neural network used in the embodiment of the present application can be a GraphSAGE (Graph Sample and aggregate) network, but in addition to this, it can also be other graph neural networks such as a graph convolutional network, a graph attention network, a graph Transformer network, etc.

[0073] The GraphSAGE network uses the connection information between nodes to sample neighbors, and then continuously fuses the information of adjacent nodes together through aggregation functions. Traditional GraphSAGE networks are only applicable to static graph data. In order to better adapt to dynamic graph data structures, the embodiment of the present application improves the sampling method of the GraphSAGE network and adopts dynamic neighbor sampling based on time series. Specifically, for each moment t in N moments, the GraphSAGE network samples the neighbor nodes of node v from the heterogeneous network graph at moment t and samples the neighbor nodes of node v from the updated graph data of the heterogeneous network graph at moment t compared with moment t-1 for each node v; then Using the information of node v and its sampled neighbor nodes, the first characterization vector of node v at time t is determined.

[0074] For example, the neighbor set of node v at time t is The following formula can be used to represent this:

[0075]

[0076] where SAMPLER represents the function used for sampling, is the heterogeneous network graph at time t, is the update graph data of the heterogeneous network graph at time t compared with that at time t-1. For the initial time,

[0077] The above sampling method can better capture the dynamic evolution information of the node under the graph structure.

[0078] Based on the neighbor set of node v sampled, the GraphSAGE network performs aggregation processing to obtain the first representation vector of node v.

[0079] The spiking neural network accumulates and updates the membrane voltage of each node at N time points using the first representation vector to obtain the spike sequence of each node at N time points.

[0080] The spiking neural network is a new generation of artificial neural network inspired by biology, which is different from the traditional artificial neural network using real number calculation. The spiking neural network exchanges and processes information through discrete pulse signals. The spiking neural network is a computationally efficient neural network, in which the neuron is only active when it receives or transmits a pulse signal, and the neuron is in an inhibited state most of the time, thus significantly improving the network computing efficiency and reducing energy consumption. In addition, the spiking neural network can capture the changes of pulses at different time points, and is therefore naturally suitable for modeling time series data. The present application first applies it to dynamic graph data.

[0081] As one of the implementable ways, the spiking neural network used in the embodiments of the present application can be a leaky integrate-and-fire network. For the convenience of understanding, the principle of the leaky integrate-and-fire network is first introduced. The main idea is to simulate the charging and discharging process of the neuron with a capacitor connected in parallel with a resistor. The membrane voltage dynamic process of the leaky integrate-and-fire network includes three parts:

[0082] 1) Charging. When an external current enters the model at each time point, the neuron starts to accumulate charge, while releasing (leaking) part of the membrane voltage.

[0083] 2) Discharge. When the membrane voltage reaches the voltage threshold, the neuron generates a pulse.

[0084] 3) Reset. After the neuron generates a pulse, the membrane voltage enters the reset state or the initial state.

[0085] The membrane voltage dynamic process of the leaky integrate-and-fire model can be described by the following differential equation:

[0086]

[0087] where V is the membrane voltage, C is the capacitance, R is the resistance, V reset is the reset voltage or initial voltage, and I(t) is the current input to the leaky integrate-and-fire network at time t.

[0088] The integral term is the leak term of the leaky integrate-and-fire network, which is used to control the leakage process of the current at each time to better simulate the dynamic membrane voltage process of the real neuron. Since the above formula is a discrete differential equation, it cannot be simulated and solved by a neural network, so it is converted into a continuous form by using the Euler method, as shown in the following formula:

[0089]

[0090] where τ m = RC is a hyperparameter that can be used to control the fast / slow degree of membrane voltage decay / growth. V t is the membrane voltage at time t.

[0091] In the embodiments of the present application, the first feature vector of node v at time t is equivalent to I(t) above, that is, the spiking neural network uses the first feature vector of node v at time t and the membrane voltage at time t-1 to accumulate the membrane voltage, while leaking part of the membrane voltage based on the leak parameter, to obtain the membrane voltage at time t; if the membrane voltage at time t reaches the voltage threshold at time t, a spike is generated and the membrane voltage is set to the initial value; the information of whether the node v generates a spike at N times constitutes the spike sequence of the node v at N times.

[0092] The traditional leaky integrate-and-fire model only considers the charging and discharging of the voltage and the reset process, and although the voltage decay term is added, it is still difficult to accurately simulate the dynamic changes of the real neuron.

[0093] Based on the above problems, the traditional leaky integrate-and-fire model is improved in the embodiments, not only considering the dynamic changes of the leak parameter, but also considering the dynamic adjustment of the voltage threshold of the membrane voltage, so as to give the risk identification model better fitting ability and generalization ability. After considering the above process, the dynamic process of the leaky integrate-and-fire network can be represented as:

[0094]

[0095] where f is the charging function as shown in formula (3), and the leak parameter τ m can be updated and optimized with model training. Θ is the discharge function, which adopts a step function; O tis the pulse generated by the model at time t, which takes value 0 or 1, indicating whether a pulse is generated or not. τ th is a parameter factor dynamically adjusted with the control voltage threshold. is the voltage threshold at time t-1.

[0096] By optimizing the spiking neural network as described above, the risk identification model can have better dynamic timing capturing ability and generalization ability.

[0097] The above process can be represented as follows:

[0098]

[0099] wherein, is the representation vector output by node v at time t in the k-th layer, and W is a learnable weight matrix. AGG() is an aggregation function used by the graph neural network, which can be an average, summation, or other aggregation function. δ() is a function of the spiking neural network, whose input is the output of the graph neural network and whose output is the generated pulse.

[0100] Considering that the output of the spiking neural network is a discrete Boolean value, the above formula (5) can be further simplified to improve computational efficiency:

[0101]

[0102] wherein, W[·] is a Masked Summation calculation operation. W[h] means that the vector h is used to mask the matrix W, and then the vectors obtained after the mask processing are added. For example:

[0103] h = [0 1 0 1]

[0104]

[0105] The vector h is used to mask the matrix W, that is, the row vectors in the matrix W corresponding to the positions of the elements 0 in the vector h are masked, and only the row vectors in the matrix W corresponding to the positions of the elements 1 in the vector h are retained. Masking processing obtains two vectors: [0.5 0.1 0.8 1.0] and [0.2 0.1 0.3 0.2], and the sum of the two vectors is [0.7 0.2 1.1 2]. It can be seen that the result of the mask summation processing is consistent with the result of hW (vector and matrix multiplication). However, since the mask summation processing only involves matrix addition and Boolean mask operation, the computational efficiency is much higher than that of matrix multiplication, which can greatly reduce the operation time.

[0106] The splicing network is configured to splice the pulse sequence of each node at N time points to obtain a second feature vector of the node. For example, the second feature vector of node v can be expressed as:

[0107]

[0108] wherein z v is the second feature vector of node v, and K is the total number of layers of the spiking neural network. CONCAT() is a splicing process.

[0109] The mapping network is configured to determine the risk identification result of each node by using the second feature vector of each node. The mapping network can be a classification network or a regression network. The risk identification result is a label indicating whether a preset type of risk exists, for example, a fraudulent risk user indicating that a fraudulent risk exists, or a non-fraudulent risk user indicating that no fraudulent risk exists.

[0110] The training target of the above model includes minimizing the difference between the risk identification result of the risk identification model for the node and the label. A loss function can be constructed according to the training target. For example, if the mapping network adopts a classification network, a cross-entropy loss function can be used, and if the mapping network adopts a regression network, a mean square error loss function can be used. In each iteration, the value of the loss function is used to update the model parameters by using methods such as gradient descent until a preset training end condition is met. The training end condition can include, for example, the value of the loss function being less than or equal to a preset loss function threshold, the number of iterations reaching a preset number threshold, and the like.

[0111] Since the spiking neural network uses a non-differentiable step function during model training, the gradient descent method cannot be directly used to update the parameters of the spiking neural network. To solve this problem, the embodiments of the present application can use an approximate step function to replace the step function used by the spiking neural network to calculate the gradient. That is, the gradient of the approximate step function is calculated during backpropagation to update the parameters, and the step function is still used during forward propagation.

[0112] As one of the implementable ways, the above approximate step function can use a Sigmoid function, which is expressed as:

[0113] σ(αx)=1 / (1+exp(-αx)) (8)

[0114] During backpropagation, the reciprocal calculation formula used when calculating the gradient is:

[0115] σ(αx)′=α·σ(αx)·(1-σ(αx)) (9)

[0116]

[0117] wherein x is the membrane voltage. a is a hyperparameter used to control the smoothness of the function. When a is larger, the approximated step function is smoother, and the approximation is worse. When a is smaller, the approximated step function is sharper, and the approximation is better, but it is prone to gradient explosion and vanishing at both ends. Therefore, a suitable a needs to be selected, which can be an empirical value or a trial value.

[0118] In addition, the updated model parameters include the parameters of the graph neural network, the spiking neural network and the mapping network, and in particular, the leakage parameter in the spiking neural network is updated and optimized during the model training process, so that the model has better dynamic timing capturing capability and generalization capability.

[0119] It should be noted that in the process of training the risk identification model, the adjacency matrix and the node feature matrix of the heterogeneous network graph are input into the risk identification model. The node feature data used in the node feature matrix can be, for example, node type, registration duration, relevant attribute information of the corresponding user, etc. The edge features can be, for example, behavior type, behavior time, behavior location, behavior frequency, etc. Since the present application does not make any changes to this part, it will not be described in detail here.

[0120] After the training of the above risk identification model is completed, the trained risk identification model can be used for risk identification, i.e., for risk identification of a target node in a dynamic heterogeneous network graph. For example, after obtaining N heterogeneous network graphs constructed using the network behavior data of a user at N time points, the information of the target node and the information of the N heterogeneous network graphs are input into the risk identification model, and the risk identification model outputs the risk identification result for the target node, such as whether it has a preset type of risk.

[0121] Taking network transaction risk as an example, the heterogeneous network graph obtained according to the user network behavior data includes nodes such as accounts, bank cards, red envelope ids, etc. The edges between the nodes are payment behavior, deposit and withdrawal behavior, signing and binding behavior, and sending and receiving red envelope behavior between accounts, bank cards, red envelope ids, etc. and other behavior relationships related to finance. N heterogeneous network graphs at N time points are obtained respectively, and the N heterogeneous network graphs at N time points reflect the dynamic changes of the graph data in time sequence. Then, the nodes in the heterogeneous network graph that are explicitly non-risk users and risk users are labeled. The above risk identification model is trained using the labeled heterogeneous network graph. The risk identification model based on the combination of graph neural network and spiking neural network can capture the structure and timing information of dynamic graph data, and can make the risk identification model more accurately identify risks.

[0122] After the risk identification model is obtained at the end of the training, the risk identification model can utilize the heterogeneous network graphs at the N time points and the information of the target node to perform risk identification on the target node to determine whether the target node is a non-risk user.

[0123] The above is a detailed description of the method provided by the present disclosure, and the above describes specific embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different than the order in which they are recited in the embodiments and still achieve desirable results. In addition, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or necessary.

[0124] The device provided by the present disclosure is described in detail below. Figure 4 A device structure diagram for establishing a risk identification model according to one embodiment of the present disclosure is shown, as shown in the figure, the device 400 can include a graph obtaining unit 401 and a model training unit 402. The main functions of each component unit are as follows: Figure 4

[0125] The graph obtaining unit 401 is configured to obtain N heterogeneous network graphs at N time points constructed by using network behavior data of a user at N time points, the heterogeneous network graph includes nodes and edges, the nodes include behavior subjects and behavior objects, and the edges are determined according to the behavior relationship between the behavior subjects and the behavior objects, N is a positive integer greater than 1; part of the nodes are labeled with a label indicating whether a preset type of risk exists.

[0126] The model training unit 402 is configured to train a risk identification model by using the N heterogeneous network graphs, wherein the risk identification model includes a graph neural network, a spiking neural network, a splicing network, and a mapping network; the graph neural network obtains first feature vectors of each node at N time points by using the N heterogeneous network graphs; the spiking neural network accumulates and updates membrane voltage by using the first feature vectors of each node at N time points to obtain a spiking sequence of each node at N time points; the splicing network splices the spiking sequence of each node at N time points for each node to obtain a second feature vector of the node; the mapping network is used to determine a risk identification result of each node by using the second feature vector of each node; and the training target includes minimizing the difference between the risk identification result of each node by the risk identification model and the label.

[0127] As one of the implementable ways, the graph neural network adopts a GraphSAGE network;

[0128] ​For each of the N time points t, the GraphSAGE network samples neighbor nodes of each node v from the heterogeneous network graph at time t and samples neighbor nodes of the node v from the updated graph data of the heterogeneous network graph at time t compared with time t-1; the GraphSAGE determines a first feature vector of the node v at time t by using information of the node v and the sampled neighbor nodes. Through the above sampling mode, dynamic evolution information of the node under the graph structure can be better captured.

[0129] As one of the implementable modes, the spiking neural network adopts a leaky integrate-and-fire model, that is, the membrane voltage at time t is accumulated by using the first feature vector of the node v at time t and the membrane voltage at time t-1, and a part of the membrane voltage is leaked based on a leakage parameter to obtain the membrane voltage at time t; when the membrane voltage at time t reaches a voltage threshold value at time t, a spike is generated and the membrane voltage is set to an initial value; information of whether the node v generates a spike at the N time points constitutes a spike sequence of the node v at the N time points.

[0130] As one of the implementable modes, the voltage threshold value at time t is obtained from the voltage threshold value at time t-1 and whether a spike is generated at time t.

[0131] As one of the implementable modes, the model training unit 402 updates the model parameters of the risk identification model by using the value of the loss function in each iteration during the training process until a preset training end condition is met, and the model parameters include the leakage parameter.

[0132] It can be seen that the traditional leaky integrate-and-fire model is improved in the embodiment of the present application, not only the dynamic change of the leakage parameter is considered, but also the voltage threshold value of the membrane voltage is dynamically adjusted, so that the risk identification model is given better fitting ability and generalization ability.

[0133] As one of the implementable modes, when updating the model parameters during the training process, the model training unit 402 uses an approximate step function to replace the step function used by the spiking neural network to calculate the gradient, and the approximate step function includes a Sigmoid function.

[0134] Based on the above established risk identification model, Figure 5 A structural diagram of a risk identification device according to one embodiment of the present disclosure is shown, as shown in the figure, Figure 5 The device 500 can include a graph acquisition unit 501 and a risk identification unit 502. The main functions of each component unit are as follows:

[0135] The graph acquisition unit 501 is configured to acquire N time point heterogeneous network graphs constructed by using network behavior data of a user at N time points, the heterogeneous network graphs including nodes and edges, the nodes including behavior subjects and behavior objects, and the edges being determined according to behavior relationships between the behavior subjects and the behavior objects, and N being a positive integer greater than 1.

[0136] The risk identification unit 502 is configured to input the N time point heterogeneous network graphs and information of the target node into a risk identification model, and obtain a risk identification result of the target node by the risk identification model.

[0137] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts of each of the embodiments can be referred to each other. Each of the embodiments mainly describes differences from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the related parts can be referred to the part of the method embodiments.

[0138] The system and system embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment. Those skilled in the art can understand and implement without creative labor.

[0139] Those skilled in the art should realize that, in one or more of the examples described above, the functions described by the present application can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0140] The computer storage medium described above can adopt any combination of one or more computer readable media, including but not limited to: portable computer disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

[0141] The above detailed description of the specific embodiments of the present application is provided for the purpose of further explaining the objects, technical solutions and advantages of the present application, and it should be understood that the above is only a specific embodiment of the present application and is not used to limit the protection scope of the present application, and any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A method for establishing a risk identification model, characterized in that: The method includes: Obtaining a heterogeneous network graph at N moments constructed using the user's network behavior data at N moments, the heterogeneous network graph comprising nodes and edges, the nodes comprising a behavior subject and a behavior object, the edges being determined based on the behavior relationship between the behavior subject and the behavior object, where N is a positive integer greater than 1; some of the nodes are labeled with a label indicating whether they have a preset risk type; The risk identification model is obtained by training the heterogeneous network graph at the N moments, wherein the risk identification model includes a graph neural network, a spiking neural network, a splicing network and a mapping network; the graph neural network uses the heterogeneous network graph at the N moments to obtain the first representation vector of each node at the N moments; the spiking neural network uses the first representation vector of each node at the N moments to accumulate and update the membrane voltage to obtain the pulse sequence of each node at the N moments; the splicing network splices the pulse sequence of each node at the N moments to obtain the second representation vector of the node; the mapping network is used to determine the risk identification result of each node using the second representation vector of each node; the training objectives include: minimizing the difference between the risk identification result of the node by the risk identification model and the label; The graph neural network adopts graph sampling and aggregation GraphSAGE network; For each time t among the N time moments, the GraphSAGE network samples the neighbor nodes of node v from the heterogeneous network graph at time t and samples the neighbor nodes of node v from the updated graph data at time t-1 compared with the heterogeneous network graph at time t for each node v; the GraphSAGE uses the information of node v and its sampled neighbor nodes to determine the first representation vector of node v at time t.

2. The method according to claim 1, characterized in that The spiking neural network accumulates and updates the membrane voltage using the first representation vector of each node at the N moments, and obtains the pulse sequence of each node at the N moments, including: The spiking neural network uses the first representation vector of node v at time t and the membrane voltage at time t-1 to accumulate the membrane voltage, and at the same time leaks part of the membrane voltage based on the leakage parameter to obtain the membrane voltage at time t; If the membrane voltage at time t reaches the voltage threshold at time t, a pulse is generated and the membrane voltage is set to the initial value; The information of whether node v generates a pulse at N moments constitutes the pulse sequence of node v at N moments.

3. The method according to claim 2, characterized in that The voltage threshold at time t is obtained by the voltage threshold at time t-1 and whether a pulse is generated at time t.

4. The method according to claim 2, characterized in that During the training process, each round of iteration uses the value of the loss function to update the model parameters of the risk identification model until the preset training end condition is met, and the model parameters include the leakage parameter.

5. The method according to any one of claims 1 to 4, characterized in that When updating the model parameters during the training process, an approximate step function is used to replace the step function used by the pulse neural network for gradient calculation, and the approximate step function includes a Sigmoid function.

6. A method for risk identification, characterized in that: The method includes: Obtaining a heterogeneous network graph at N moments constructed using the user's network behavior data at N moments, wherein the heterogeneous network graph includes nodes and edges, wherein the nodes include behavior subjects and behavior objects, and the edges are determined based on the behavior relationship between the behavior subjects and the behavior objects, where N is a positive integer greater than 1; Inputting the heterogeneous network graphs at N moments and information of the target node into a risk identification model to obtain a risk identification result of the risk identification model for the target node; Wherein, the risk identification model is pre-established using the method according to any one of claims 1 to 5.

7. A device for establishing a risk identification model, characterized in that: The device includes: a graph acquisition unit configured to acquire a heterogeneous network graph at N moments constructed using network behavior data of a user at N moments, wherein the heterogeneous network graph includes nodes and edges, wherein the nodes include a behavior subject and a behavior object, and the edges are determined based on the behavior relationship between the behavior subject and the behavior object, and wherein N is a positive integer greater than 1; and wherein some of the nodes are labeled with a label indicating whether they have a preset type of risk; The model training unit is configured to train the risk identification model using the heterogeneous network graphs at the N moments, wherein the risk identification model includes a graph neural network, a spiking neural network, a splicing network, and a mapping network; the graph neural network uses the heterogeneous network graphs at the N moments to obtain a first representation vector of each node at the N moments; the spiking neural network uses the first representation vector of each node at the N moments to accumulate and update the membrane voltage to obtain a pulse sequence of each node at the N moments; the splicing network splices the pulse sequence of each node at the N moments to obtain a second representation vector of the node; the mapping network is used to determine a risk identification result of each node using the second representation vector of each node; the training objectives include: minimizing the difference between the risk identification result of the node by the risk identification model and the label; The graph neural network adopts graph sampling and aggregation GraphSAGE network; For each time t among the N time moments, the GraphSAGE network samples the neighbor nodes of node v from the heterogeneous network graph at time t and samples the neighbor nodes of node v from the updated graph data at time t-1 compared with the heterogeneous network graph at time t for each node v; the GraphSAGE uses the information of node v and its sampled neighbor nodes to determine the first representation vector of node v at time t.

8. A risk identification device, characterized in that: The device includes: A graph acquisition unit is configured to acquire a heterogeneous network graph at N moments constructed using network behavior data of a user at N moments, wherein the heterogeneous network graph includes nodes and edges, wherein the nodes include behavior subjects and behavior objects, and the edges are determined based on the behavior relationship between the behavior subjects and the behavior objects, and wherein N is a positive integer greater than 1; a risk identification unit configured to input the heterogeneous network graphs at the N moments and information of the target node into a risk identification model to obtain a risk identification result of the risk identification model for the target node; Wherein, the risk identification model is pre-established using the device as described in claim 7.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 6.

Images