Method for establishing a risk identification model and corresponding device

Abstract

Embodiments of the present specification provide a method and a corresponding device for establishing a risk identification model. The method comprises: obtaining a heterogeneous network graph constructed using network behavior data of a user, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, and the edges being determined according to behavior relationships between the behavior subjects and the behavior objects; performing mask processing on the edges in the heterogeneous network graph to obtain a mask subgraph and a remaining subgraph; training a graph autoencoder using the remaining subgraph and the mask subgraph; wherein the graph autoencoder comprises an encoding network and a first decoding network; the encoding network obtains a representation vector of each node using the input remaining subgraph, and the first decoding network predicts the masked edges using the representation vectors of the nodes; a training target comprises minimizing the difference between the prediction results and the mask subgraph; and the encoding network in the trained graph autoencoder is used to construct a risk identification model. The present application can improve the identification effect of the risk identification model.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the technical field of artificial intelligence, and in particular, to a method for establishing a risk identification model and a corresponding device. BACKGROUND

[0002] With the development of Internet technology, various risks occur in various behaviors of users using the Internet. For example, there may be various fraud forms such as network transaction fraud, false part-time fraud, network dating fraud, and the like. There may also be risk forms such as money laundering, cheating, and the like. In actual risk control scenarios, a graph neural network model is a kind of deep neural network model that is widely used at present. The graph neural network shows strong learning and representation ability in modeling the association relationship between nodes in a graph structure. However, the current representation learning based on the graph neural network adopts a supervised or semi-supervised manner, which makes the representation learning effect of the graph neural network largely dependent on the labeled data. However, in the risk control scenario, the labeled data is scarce, difficult to obtain and high in cost, which easily causes the representation learning effect of the graph neural network to be poor, and further affects the identification effect of the risk identification model. SUMMARY

[0003] Therefore, one or more embodiments of the present specification disclose a method for establishing a risk identification model and a corresponding device to improve the identification effect of the risk identification model.

[0004] According to a first aspect, the present disclosure provides a method for establishing a risk identification model, the method comprising:

[0005] obtaining a heterogeneous network graph constructed using network behavior data of a user, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, and the edges being determined according to behavior relationships between the behavior subjects and the behavior objects;

[0006] masking the edges in the heterogeneous network graph to obtain a masked subgraph and a remaining subgraph;

[0007] training the graph autoencoder using the remaining subgraph and the masked subgraph; wherein the graph autoencoder comprises an encoding network and a first decoding network; the encoding network obtains a representation vector of each node using the input remaining subgraph, and the first decoding network predicts the masked edges using the representation vectors of the nodes; and a training target comprises minimizing the difference between the prediction result and the masked subgraph;

[0008] constructing a risk identification model using the encoding network in the trained graph autoencoder.

[0009] According to an implementable manner in the embodiments of the present application, the mask processing on the edges in the heterogeneous network graph comprises:

[0010] randomly sampling the edges in the heterogeneous network graph, constructing a mask subgraph with M edges sampled, and performing mask processing on the M edges sampled in the heterogeneous network graph to obtain a residual subgraph; or

[0011] randomly sampling the edges in the heterogeneous network graph, taking M1 edges sampled as root nodes; performing path random walk with each root node as a starting point to obtain a plurality of paths, the plurality of paths constituting a mask subgraph, and performing mask processing on M2 edges contained in the plurality of paths to obtain a residual subgraph;

[0012] wherein, M, M1 and M2 are positive integers.

[0013] According to an implementable manner in the embodiments of the present application, the graph autoencoder further comprises a second decoding network, and the second decoding network is configured to predict the degrees of the nodes by using the representation vectors of the nodes.

[0014] The training target further comprises minimizing the difference between the prediction results of the second decoding network and the degrees of the nodes in the heterogeneous network graph.

[0015] According to an implementable manner in the embodiments of the present application, training the graph autoencoder by using the residual subgraph and the mask subgraph comprises:

[0016] determining a total training loss in each iteration, the total training loss being determined by a first training loss and a second training loss, the first training loss being obtained from the difference between the prediction results of the first decoding network and the mask subgraph, and the second training loss being obtained from the difference between the prediction results of the second decoding network and the degrees of the nodes in the heterogeneous network graph; and updating the model parameters of the graph autoencoder by using the value of the total training loss until a preset training end condition is reached.

[0017] According to an implementable manner in the embodiments of the present application, the risk identification model is configured to perform risk identification on a target node, a target edge or a target subgraph in the heterogeneous network graph.

[0018] According to an implementable manner in the embodiments of the present application, constructing a risk identification model by using the encoding network in the trained graph autoencoder comprises:

[0019] obtaining training data of the risk identification model;

[0020] performing transfer learning of the risk identification model on the encoding network in the trained graph autoencoder by using the training data, wherein the risk identification model comprises the encoding network and a classification network.

[0021] According to an implementable manner in embodiments of the present application, the training data of the risk identification model comprises at least one of the following:

[0022] obtaining, as the training data, nodes labeled as risk users and non-risk users from the heterogeneous network graph; or,

[0023] obtaining, as the training data, edges labeled as risk behaviors and non-risk behaviors from the heterogeneous network graph; or,

[0024] obtaining, as the training data, subgraphs labeled as risk user sets and non-risk user sets from the heterogeneous network graph.

[0025] In a second aspect, a device for establishing a risk identification model is provided, and the device comprises:

[0026] a graph obtaining unit configured to obtain a heterogeneous network graph constructed by using network behavior data of a user, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, and the edges being determined according to behavior relationships between the behavior subjects and the behavior objects;

[0027] a graph mask unit configured to perform mask processing on the edges in the heterogeneous network graph to obtain a mask subgraph and a remaining subgraph;

[0028] a graph training unit configured to train the graph autoencoder by using the remaining subgraph and the mask subgraph; wherein the graph autoencoder comprises an encoding network and a first decoding network; the encoding network is configured to obtain a representation vector of each node by using the input remaining subgraph, and the first decoding network is configured to predict the masked edges by using the representation vectors of the nodes, and a training target comprises minimizing a difference between a prediction result and the mask subgraph;

[0029] a model constructing unit configured to construct a risk identification model by using the encoding network in the trained graph autoencoder, the risk identification model being used to perform risk identification on a target node, a target edge or a target subgraph in an input network graph to be identified.

[0030] According to a third aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed in a computer, the computer program causes the computer to execute the method described above.

[0031] According to a fourth aspect, the present disclosure provides a computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described above is implemented.

[0032] According to the specific embodiments provided in the application, the application can have the following technical effects:

[0033] 1) The application obtains a mask subgraph and a residual subgraph by performing mask processing on the edges in the heterogeneous network graph, and the graph autoencoder predicts the mask subgraph using the residual subgraph to perform self-supervised learning, thereby ensuring the representation ability of the encoding network obtained by training, and further improving the recognition effect of the risk identification model, compared with the traditional contrast learning method which does not need to be limited by the number of labeled data.

[0034] 2) In the application, the edge mask is performed at the path level by the path random walk, which can realize learning at the path level, the graph autoencoder can capture the long-distance features of the nodes, avoid overfitting, and make the representation vector obtained by the encoding network more general and robust.

[0035] 3) The application adopts an asymmetric graph autoencoder structure, realizes edge reconstruction and node degree information reconstruction through the first decoding network and the second decoding network, performs graph representation learning using the two reconstruction tasks, improves the representation ability of the encoding network, and further improves the recognition effect of the risk identification model. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0037] Figure 1 An exemplary system architecture diagram to which embodiments of the present disclosure can be applied is shown;

[0038] Figure 2 A method flowchart for establishing a risk identification model provided by the embodiments of the present disclosure is provided;

[0039] Figure 3 A construction principle schematic diagram of a risk identification model provided by the embodiments of the present disclosure is provided;

[0040] Figure 4 A device structure diagram for establishing a risk identification model provided by the embodiments of the present disclosure is provided. DETAILED DESCRIPTION

[0041] The schemes provided in the present specification will be described below in conjunction with the drawings.

[0042] The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the description of the application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0043] It should be understood that the term "and / or" as used herein merely describes associated objects, which can exist in three relationships, for example, A and / or B can represent three cases: A exists alone, A and B exist together, and B exists alone. In addition, the character " / " herein generally represents an "or" relationship between the front and rear associated objects.

[0044] Depending on the context, the word "if" as used herein can be interpreted as meaning "when" or "while" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if it is determined" or "if (a stated condition or event) is detected" can be interpreted as meaning "when it is determined" or "in response to determining" or "when (a stated condition or event) is detected" or "in response to detecting (a stated condition or event)".

[0045] In view of the problem that labeled data is difficult to obtain, graph self-supervised learning is proposed and becomes a new way of graph representation learning. Graph self-supervised learning can reduce the excessive dependence of graph representation models on labeled data, and provides a new idea for training on a large amount of unlabeled data.

[0046] The existing graph self-supervised learning mainly takes contrastive learning as a representative, and constructs multiple contrast views of graph data through data augmentation. The training target used in the training process is to minimize the distance of positive sample pairs in different views as much as possible, and maximize the distance of negative sample pairs in different views. However, this method mainly has the following two defects:

[0047] 1) The effect of the graph representation model depends on the data augmentation algorithm and the selection of positive and negative sample pairs, and often needs human intervention to select to ensure the performance of the model.

[0048] 2) Multiple contrast views need to be constructed through graph data augmentation, and a large additional computational overhead is required when generating representations under different views of the model in the training process.

[0049] The present application provides a new way of graph self-supervised learning to improve the graph representation capability. In order to facilitate the understanding of the present application, first, the system architecture based on the present application is introduced. Figure 1An exemplary system architecture to which embodiments of the present disclosure can be applied is shown. The system mainly comprises a device for establishing a risk identification model and a risk identification device. Among them, the device for establishing a risk identification model obtains a batch of user network behavior data from a data warehouse, analyzes the user network behavior data, and thereby establishes a risk identification model.

[0050] The risk identification device utilizes the trained risk identification model to perform risk identification on a target node, a target edge, or a target subgraph in the graph data.

[0051] The device for establishing a risk identification model and the risk identification device in the above system can be implemented on a server side. The server side can be a single server, a server group composed of multiple servers, or a cloud server. The cloud server, also known as a cloud computing server or a cloud host, is a host product in the cloud computing service system, which solves the defects of large management difficulty and weak business scalability in traditional physical hosts and virtual private server (VPs, Virtual Private Server) services. In addition to being implemented on the server side, it can also be implemented on a computer terminal with strong computing power.

[0052] It should be understood that Figure 1 The number of devices for establishing a risk identification model, risk identification devices, and data warehouses in the above system is only illustrative. According to the needs of implementation, there can be any number of devices for establishing a risk identification model, risk identification devices, and data warehouses.

[0053] Figure 2 A method flowchart for establishing a risk identification model is provided for embodiments of the present disclosure. It can be understood that the method can be executed by the device for establishing a risk identification model in the system shown in Figure 1 . Referring to Figure 2 , the method comprises:

[0054] Step 202: Obtain a heterogeneous network graph constructed using user network behavior data, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, and the edges being determined according to behavior relationships between the behavior subjects and the behavior objects.

[0055] Step 204: Perform mask processing on the edges in the heterogeneous network graph to obtain a mask subgraph and a residual subgraph.

[0056] Step 206: Train a graph autoencoder using the residual subgraph and the mask subgraph; wherein the graph autoencoder comprises an encoding network and a first decoding network; the encoding network obtains a representation vector of each node using the input residual subgraph, the first decoding network predicts the masked edges using the representation vectors of the nodes, and the training target comprises minimizing the difference between the prediction results and the mask subgraph.

[0057] Step 208: using the encoding network in the trained graph autoencoder, a risk identification model is constructed.

[0058] As can be seen from the technical content provided by the above embodiments, the present application obtains a mask subgraph and a residual subgraph by performing mask processing on the edges in the heterogeneous network graph, and the graph autoencoder uses the residual subgraph to predict the mask subgraph for self-supervised learning. Compared with the traditional contrast learning method, the present application does not need to be limited by the amount of labeled data, thereby ensuring the representation ability of the trained encoding network and improving the identification effect of the risk identification model.

[0059] The following describes each step shown in the flowchart. Figure 2

[0060] First, the above step 202, i.e., "obtaining a heterogeneous network graph constructed using user network behavior data", is described in detail in combination with the embodiments.

[0061] A large amount of network behavior data of the user is recorded by the server side in the process of using the network, and these network behavior data are usually recorded in a data warehouse, reflecting the association between a large number of behavior subjects and behavior objects.

[0062] The risk identification usually performed is for a specific scenario, and the behavior subjects, behavior objects, and network behaviors to be focused on and analyzed in the specific scenario are also specific. Therefore, the behavior subjects, behavior objects, and network behaviors of the behavior subject type, behavior object type, and network behavior type corresponding to the target scenario can be obtained from the data warehouse to construct a heterogeneous network graph. This way of constructing a heterogeneous network graph based on a specific scenario can greatly reduce the size of the graph data. The heterogeneous network graph includes nodes and edges, the nodes include behavior subjects and behavior objects, and the edges are determined according to the network behavior relationship between the behavior subjects and the behavior objects.

[0063] Among them, the subject type, behavior object type, and network behavior type corresponding to the target scenario can be set according to experience in advance.

[0064] Taking network transaction risk as an example, the behavior subject can be an account, a bank card, etc. The behavior object can also be an account, a bank card, etc., and can also be a red packet id, etc. That is, the behavior subject and the behavior object are subjects and objects related to finance. The edges between the nodes can be payment behavior, deposit behavior, signing and binding behavior, sending and receiving red packet behavior, and other behavior relationships related to finance between the behavior subjects and the behavior objects.

[0065] ​Taking the risk of online friend-making fraud as an example, the behavior subject can be a social network account, a real-time communication tool account, a financial account, a host address, a client identifier, and the like. The edges between the nodes can be the behavior of sending a friend request, the behavior of adding a friend, the behavior of chatting, the behavior of transferring money, the behavior of sending and receiving a red envelope, the behavior of sending a link, and the like.

[0066] The step 204, i.e., "masking the edges in the heterogeneous network graph to obtain a mask subgraph and a residual subgraph", will be described in detail below in combination with embodiments.

[0067] As one of the implementable manners, the edges in the heterogeneous network graph G are randomly sampled in the masking (Mask) processing of the edges in the heterogeneous network graph in this step. The sampled edges constitute a mask subgraph, denoted as After the mask processing of the sampled edges in the heterogeneous network graph, a residual subgraph G' is obtained. In the field of artificial intelligence, masking means shielding. In the embodiments of the present application, the sampled edges in the heterogeneous network graph are shielded, so that they are considered as non-existent edges in the residual subgraph. This strategy actually regards each edge in the heterogeneous network graph as an independent sample, randomly samples M edges for mask processing to obtain a residual subgraph, and the residual subgraph contains the structure of the edges remaining after masking. The mask subgraph contains the structure of the masked edges. M is a positive integer, which can be an empirical value or a trial value.

[0068] The relationship between the residual subgraph G' and the mask subgraph can be expressed as:

[0069]

[0070] The above edge-level masking method cannot capture the information of long-distance in the graph structure of the heterogeneous network graph, and it is also difficult to learn the correlation between different edges. Therefore, the present application also provides another implementable manner, i.e., mask processing based on a path level. M1 edges in the heterogeneous network graph G are randomly sampled as root nodes. Then, random walks are performed from each root node as a starting point, and each path obtained constitutes a mask subgraph After the mask processing of the M2 edges contained in each path, a residual subgraph G' is obtained. M1 and M2 are positive integers, which can be empirical values or trial values.

[0071] Random walk (Random Walk) is a mathematical statistical model that generates a series of paths, and each path generated by each walk is random. The process of generating a mask subgraph by random walk can be expressed as:

[0072]

[0073] Here, RandomWalk() represents the function used in the random walk model, R is the root node, n is the number of paths, and l is the path length. The number of paths and the path length can be determined empirically or experimentally, depending on the sparsity of the heterogeneous network graph. If the heterogeneous network graph is relatively sparse, n and l can be taken as smaller values; if the heterogeneous network graph is relatively dense, n and l can be taken as larger values.

[0074] The random walk described above can be an unbiased random walk or a biased random walk (Node2VecWalk). Since random walk is an existing technology, this application only utilizes it in the embodiments and therefore will not describe it in detail.

[0075] Similar to edge-level masking, the remaining subgraph G′ and the mask subgraph The relationship can still be represented by formula (1). Path-level masking can better construct mask subgraphs, enabling the model to learn the correlation between node representations on the mask path through the remaining subgraph and capture the long-distance features of the nodes. Furthermore, path learning can also enhance the generalization and robustness of the representations learned by the model.

[0076] The following describes step 206, namely "training a graph autoencoder using the remaining subgraph and mask subgraph", in detail with reference to the embodiments.

[0077] Graph autoencoders also employ a self-supervised learning approach, the idea of ​​which is to reconstruct input data to learn effective graph representations. The structure of the graph autoencoder in this embodiment can be as follows: Figure 3 As shown, it mainly includes an encoding network and a first decoding network.

[0078] The encoding network is used to obtain the representation vector Z of each node from the input residual subgraph G′. The encoding network can be a graph neural network, including but not limited to graph convolutional neural networks, graph attention networks, etc.

[0079] Taking a two-layer graph convolutional neural network as an example, the working principle of this encoding network can be represented as follows:

[0080]

[0081] Where f() is the processing function used by the encoder, ReLU() is a linear rectified function, which is a type of activation function. X is the node feature matrix, W (l) Let be the parameter matrix of the l-th layer. The adjacency matrix of graph G′ after degree regularization can be determined using the following formula:

[0082]

[0083] wherein, is a matrix obtained by adding self-loops to the adjacency matrix A of G', i.e., A plus a unit matrix is a matrix obtained by adding self-loops to the degree matrix of G'. The degree matrix is a diagonal matrix, and the elements on the diagonal are the degrees of the nodes in the graph G', where the degree of a node represents the number of edges connected to the node.

[0084] The first decoding network is used to predict the masked edges by using the feature vectors of the nodes, which is equivalent to reconstructing the masked subgraph. The first decoding network can be implemented by a classification network, which is equivalent to predicting whether there is a masked edge between the nodes by using the feature vectors of the nodes. After the heterogeneous network graph is processed by masking in step 204, the masked subgraph is actually formed, which forms a natural positive sample, and the edges that do not originally exist between the nodes form a natural negative sample, without the need for artificial construction and labeling of samples. The first decoding network can be implemented by a classification network.

[0085] The prediction result output by the first decoding network should be as close as possible to the masked subgraph Figure 1 Therefore, the training target of the graph autoencoder can include minimizing the difference between the prediction result of the first decoding network and the masked subgraph.

[0086] As one of the implementable ways, the first training loss L structure , for example, a cross-entropy loss function, as shown in the following formula:

[0087]

[0088] wherein, z i represents node i, i.e., the subscript of z is the node identifier. (i,j) represents the edge between node i and node j.

[0089] wherein, h() is a processing function adopted by the first decoding network, which can be represented as:

[0090] h(x,y)=σ(x T y) (6)

[0091] or,

[0092] h(x,y)=σ(MLP(x·y)) (7)

[0093] wherein, σ() is a sigmoid activation function. MLP() is a function of a fully connected network, which can be represented as:

[0094] MLP(x·y)=ReLU(ReLU((x·y)W(0) )W (1) )…W (l-1) (8)

[0095] As an implementable manner, the value of the first training loss can be used in each iteration to update the parameters of the model (graph autoencoder) in a manner such as gradient descent until a preset training end condition is met. The training end condition can include, for example, that the value of the training loss is less than or equal to a preset training loss threshold, the number of iterations reaches a preset number threshold, and the like.

[0096] Further, the graph autoencoder can further include a second decoding network. The second decoding network is configured to predict the degree of each node using the representation vector of each node. Since the degree of some nodes changes after the edges are masked, the second decoding network is used to reconstruct the degree information of the nodes. The second decoding network can be implemented by a regression network (e.g., a fully connected network).

[0097] The prediction result output by the second decoding network should be consistent with the degree of each node in the heterogeneous network graph as much as possible. Therefore, the training target of the graph autoencoder can further include minimizing the difference between the prediction result of the second decoding network and the degree of each node in the heterogeneous network graph.

[0098] As one of the implementable manners, a second training loss L degree , for example, a mean square error loss function, as shown in the following formula:

[0099]

[0100] where di represents the degree of node i in the heterogeneous network graph, i and di represents the degree of node i predicted by the second decoding network.

[0101] As another implementable manner, the value of the total training loss L can be determined in each iteration to update the parameters of the model (graph autoencoder) in a manner such as gradient descent until a preset training end condition is met. The training end condition can include, for example, that the value of the training loss is less than or equal to a preset training loss threshold, the number of iterations reaches a preset number threshold, and the like.

[0102] where the total training loss can be obtained by L structure and L degree , for example, the following formula can be used:

[0103] L = L structure + aL degree (10)

[0104] ​Where α is a hyperparameter used to control L degree The weight.

[0105] As can be seen, this application adopts an asymmetric graph autoencoder structure, and realizes the reconstruction of edges and the degree information of nodes through the first decoding network and the second decoding network. The graph representation learning is carried out by the two reconstruction tasks to improve the representation ability of the encoding network and further improve the recognition effect of the risk identification model.

[0106] After training the graph autoencoder, the encoding network within it is obtained. This encoding network can output the representation vectors of each node given the input graph data. By connecting this encoding network to downstream tasks, a specific risk identification model can be constructed.

[0107] The following describes step 208, namely "constructing a risk identification model using the encoding network in the trained graph autoencoder," in detail with reference to an embodiment.

[0108] The main structure of the risk identification model includes the encoding network and classification network in the graph autoencoder trained through the above steps. The encoding network outputs the representation vectors of each node in the heterogeneous network graph as input. The classification network uses these representation vectors to identify risks. The objects of risk identification mainly include, but are not limited to, three types: identifying whether a target node in the heterogeneous network graph is a risky user, identifying whether a target edge in the heterogeneous network graph represents a risky behavior, and identifying whether a target subgraph in the heterogeneous network graph is a set of risky users.

[0109] like Figure 3 As shown, when constructing a risk identification model, it is necessary to perform transfer learning on the already trained encoding network using labeled training data. The training process corresponding to transfer learning is a supervised learning process. First, training data for the risk identification model is obtained, which is actually obtained by labeling the aforementioned heterogeneous network graph. Then, the risk identification model is transferred and learned on the encoding network of the trained graph autoencoder using this training data. During the transfer learning process, since the encoding network has already learned the representation vectors of each node, only the classification network needs to be learned, thus the learning speed is very fast.

[0110] If the risk identification model identifies target nodes, then when acquiring training data, nodes labeled as risky users and non-risky users can be obtained from the heterogeneous network graph as training data, and the labeled nodes are samples.

[0111] For example, messages indicating that some users are illegal users, rule-breaking users, low-credit users, etc. can be obtained from databases of official agencies such as public security agencies, courts, etc. These users indicated by the messages can be determined as known-risk users, and corresponding nodes in the heterogeneous network graph are determined and labeled. For another example, some users are frequently complained about, and the users can be considered as known-risk users, and corresponding nodes in the heterogeneous network graph are determined and labeled. For another example, some users are detected as risk users by some existing high-accuracy detection tools, or some risk users can be identified by manual identification, and corresponding nodes in the heterogeneous network are determined and labeled.

[0112] Similarly, there are also some users that are explicitly non-risk users. For example, messages indicating that some users are highly recommended or praised, or are high-credit users, such as users with a large number of charitable behaviors, users who promote urban construction, model users, etc. These users are determined as known-safe users, and corresponding nodes in the heterogeneous network are determined and labeled. For another example, some users are detected as safe users by some existing high-accuracy detection tools, or some safe users can be identified by manual identification, and corresponding nodes in the heterogeneous network are determined and labeled.

[0113] If the risk identification model is to identify target edges, when obtaining training data, edges labeled as risk behaviors and non-risk behaviors in the heterogeneous network graph can be obtained as training data, and the labeled edges are samples.

[0114] For example, messages indicating that some user behaviors are illegal, rule-breaking, etc. or result in illegal, rule-breaking, etc. can be obtained from databases of official agencies such as public security agencies, courts, etc. These user behaviors indicated by the messages can be determined as known-risk behaviors, and corresponding edges in the heterogeneous network are determined and labeled. For another example, some user behaviors are complained about, and the user behaviors can be considered as known-risk behaviors, and corresponding edges in the heterogeneous network are determined and labeled. For another example, some user behaviors are detected as risk behaviors by some existing high-accuracy detection tools, or some risk behaviors can be identified by manual identification, and corresponding edges in the heterogeneous network are determined and labeled.

[0115] Similarly, there are also some user behaviors that are explicitly non-risk behaviors. For example, it is indicated from some official channels that some user behaviors are highly recommended or praised, such as charitable behaviors, investment behaviors that promote urban construction, and the like, which are determined as known safe behaviors, and the corresponding edges in the heterogeneous network are determined. For another example, some user behaviors can be detected as safe behaviors by some existing high-accuracy detection tools, or some safe behaviors can be identified by manual identification, and the corresponding edges in the heterogeneous network graph are determined and labeled.

[0116] If the risk identification model is to identify a target subgraph, when obtaining training data, a subgraph labeled as a risk user set and a non-risk user set in the heterogeneous network graph can be obtained as training data, and the labeled subgraph is taken as a sample. A typical risk user set is a fraud gang, and the fraud gang in the heterogeneous network graph is actually a subgraph composed of nodes corresponding to users in the fraud gang and edges.

[0117] For example, messages indicating that some user sets are fraud gangs can be obtained from databases of official agencies such as public security and courts, and the user sets indicated by these messages can be determined as risk user sets, and the corresponding subgraphs in the heterogeneous network graph are determined and labeled. For another example, some users are detected as fraud gangs by some detection techniques, and the corresponding subgraphs in the heterogeneous network graph are determined and labeled.

[0118] It should be noted that in the process of training the risk identification model, the input of the risk identification model is mainly the adjacency matrix and the node feature matrix of the heterogeneous network graph. The node feature data used in the above node feature matrix can be, for example, node type, registration duration, relevant attribute information of the corresponding user, and the like. The features of the edges can be, for example, behavior type, behavior time, behavior location, behavior frequency, and the like. Since the present application does not make any changes to this part, no further description is given here.

[0119] After the training of the above risk identification model is completed, the trained risk identification model can be used for risk identification, i.e., for risk identification of a target node, a target edge, or a target subgraph in the heterogeneous network graph. For example, the information of the target node, the graph adjacency matrix and the node feature matrix of the above heterogeneous network graph are input into the risk identification model, and the risk identification result of the target node is output by the risk identification model, such as whether it has a preset type of risk.

[0120] Taking online transaction risk as an example, the heterogeneous network graph obtained based on user online behavior data includes nodes such as accounts, bank cards, and red envelope IDs. The edges between nodes represent financial-related behavioral relationships such as payment, deposit and withdrawal, contract binding, and sending and receiving red envelopes between accounts, bank cards, and red envelope IDs. First, the edges in the heterogeneous network graph are masked to obtain masked subgraphs and residual subgraphs. Then, the residual subgraphs and masked subgraphs are used to train a graph autoencoder.

[0121] After training to obtain the graph autoencoder, a classification network is constructed using the encoding network within the graph autoencoder. Then, nodes in the heterogeneous network graph that are clearly identified as non-risk and risk users are labeled. The labeled heterogeneous network graph is then used to train the aforementioned risk identification model.

[0122] After training, the risk identification model is obtained. This model can then identify the risk of a target node in the heterogeneous network graph to determine whether the target node is a non-risk user.

[0123] In the training process of the aforementioned risk identification model, the training objective is to minimize the difference between the output of the classification network for a sample and the corresponding labeled result. This is a supervised learning process. A loss function can be constructed based on the training objective. In each iteration, the model parameters are updated using methods such as gradient descent, based on the value of the loss function, until a preset training termination condition is met. The training termination condition may include, for example, the value of the loss function being less than or equal to a preset loss function threshold, or the number of iterations reaching a preset threshold. The parameters can be updated only for the classification network, or the parameters of both the encoding and classification networks can be updated.

[0124] The foregoing is a detailed description of the method provided in this disclosure, and specific embodiments of this specification have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0125] The apparatus provided in this disclosure will now be described in detail. Figure 4 This diagram illustrates a structural diagram of an apparatus for establishing a risk identification model according to an embodiment of the present disclosure, as shown below. Figure 4 As shown, the device 400 may include: a graph acquisition unit 401, a graph masking unit 402, a graph training unit 403, and a model building unit 404. The main functions of each component are as follows:

[0126] The graph obtaining unit 401 is configured to obtain a heterogeneous network graph constructed by using network behavior data of a user, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, and the edges being determined according to behavior relationships between the behavior subjects and the behavior objects.

[0127] The graph mask unit 402 is configured to perform mask processing on the edges in the heterogeneous network graph to obtain a mask subgraph and a residual subgraph.

[0128] The graph training unit 403 is configured to train a graph autoencoder by using the residual subgraph and the mask subgraph; wherein the graph autoencoder comprises an encoding network and a first decoding network; the encoding network is configured to obtain a representation vector of each node by using the input residual subgraph; the first decoding network is configured to predict the masked edges by using the representation vectors of the nodes; and the training target comprises minimizing the difference between the prediction result and the mask subgraph.

[0129] The model constructing unit 404 is configured to construct a risk identification model by using the encoding network in the trained graph autoencoder, the risk identification model being used to perform risk identification on a target node, a target edge or a target subgraph in an input network graph to be identified.

[0130] As one of the implementable manners, the graph mask unit 402 can be specifically configured to perform random sampling on the edges in the heterogeneous network graph, to form a mask subgraph by using M edges sampled, and to obtain a residual subgraph by performing mask processing on the M edges sampled in the heterogeneous network graph; wherein M is a positive integer.

[0131] As one of the implementable manners, the graph mask unit 402 can be specifically configured to perform random sampling on the edges in the heterogeneous network graph, to use M1 edges sampled as root nodes; to perform path random walk by taking each root node as a starting point, to form a mask subgraph by using each path obtained, and to obtain a residual subgraph by performing mask processing on M2 edges contained in each path; wherein M1 and M2 are positive integers.

[0132] The random walk can be an unbiased random walk or a biased random walk (Node2VecWalk).

[0133] Further, the graph autoencoder can further comprise a second decoding network, the second decoding network being configured to predict the degrees of the nodes by using the representation vectors of the nodes; and the training target further comprises minimizing the difference between the prediction result of the second decoding network and the degrees of the nodes in the heterogeneous network graph.

[0134] As one of the implementable manners, the graph training unit 403 determines a total training loss in each iteration, the total training loss being determined by a first training loss and a second training loss, the first training loss being obtained by a difference between the prediction result of the first decoding network and the mask subgraph, and the second training loss being obtained by a difference between the prediction result of the second decoding network and the degrees of the nodes in the heterogeneous network graph; and the model parameters of the graph autoencoder are updated by using the value of the total training loss until a preset training end condition is reached.

[0135] The risk identification model constructed above is used for risk identification of a target node, a target edge or a target subgraph in the heterogeneous network graph.

[0136] As one of the implementable manners, the model construction unit 404 can be specifically configured to: obtain training data of the risk identification model; and perform transfer learning of the risk identification model on the encoding network in the trained graph autoencoder by using the training data, wherein the risk identification model comprises the encoding network and a classification network.

[0137] When obtaining the training data of the risk identification model, the model construction unit 404 can perform at least one of the following:

[0138] obtaining nodes labeled as risk users and non-risk users from the heterogeneous network graph as the training data; or,

[0139] obtaining edges labeled as risk behaviors and non-risk behaviors from the heterogeneous network graph as the training data; or,

[0140] obtaining subgraphs labeled as a risk user set and a non-risk user set from the heterogeneous network graph as the training data.

[0141] Each of the embodiments in the specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.

[0142] The systems and system embodiments described above are only schematic, and the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment. Those skilled in the art can understand and implement it without creative labor.

[0143] Those skilled in the art should be aware that, in one or more examples described above, functions described by the present application can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.

[0144] The computer storage medium described above can take any combination of one or more computer readable media, including but not limited to: a portable computer diskette, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), an optical fiber, a portable compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0145] The above detailed description is further detailed for the purpose of the present application, technical solutions and beneficial effects, and it should be understood that the above is only a specific embodiment of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A method of building a risk identification model, characterized by, The method comprises: acquiring a heterogeneous network graph constructed by using network behavior data of a user, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, and the edges being determined according to behavior relationships between the behavior subjects and the behavior objects; masking the edges in the heterogeneous network graph to obtain a mask subgraph and a residual subgraph; training a graph autoencoder by using the residual subgraph and the mask subgraph; wherein the mask subgraph formed after the masking of the heterogeneous network graph is used as a positive sample for training the graph autoencoder, and edges that do not originally exist between nodes are used as negative samples for training the graph autoencoder, so as to reduce artificial construction and labeling of samples; the graph autoencoder comprises an encoding network and a first decoding network; the encoding network obtains a representation vector of each node by using the input residual subgraph, and the first decoding network predicts the masked edges by using the representation vectors of the nodes; and a training target comprises minimizing a difference between a prediction result and the mask subgraph; constructing a risk identification model by using the encoding network in the trained graph autoencoder; the masking of the edges in the heterogeneous network graph comprises: randomly sampling the edges in the heterogeneous network graph, using M edges obtained by the sampling to form the mask subgraph, and obtaining the residual subgraph by masking the M edges sampled from the heterogeneous network graph; or randomly sampling the edges in the heterogeneous network graph, using M1 edges obtained by the sampling as root nodes, performing path random walk by taking each root node as a starting point, using each path obtained by the path random walk to form the mask subgraph, and obtaining the residual subgraph by masking M2 edges contained in the paths; wherein M, M1 and M2 are positive integers; wherein the masking is occlusion; the residual subgraph contains a structure of edges remaining after the occlusion of the heterogeneous network graph.

2. The method of claim 1, wherein, The graph autoencoder further comprises a second decoding network, the second decoding network being configured to predict a degree of each node by using the representation vectors of the nodes. The training target further comprises minimizing a difference between a prediction result of the second decoding network and the degrees of the nodes in the heterogeneous network graph.

3. The method of claim 2, wherein, The training of the graph autoencoder by using the residual subgraph and the mask subgraph comprises: determining a total training loss in each iteration, the total training loss being determined by a first training loss and a second training loss, the first training loss being obtained by a difference between a prediction result of the first decoding network and the mask subgraph, and the second training loss being obtained by a difference between a prediction result of the second decoding network and the degrees of the nodes in the heterogeneous network graph; and updating model parameters of the graph autoencoder by using a value of the total training loss until a preset training end condition is reached.

4. The method of claim 1, wherein, The risk identification model is used to perform risk identification on a target node, a target edge or a target subgraph in the heterogeneous network graph.

5. The method according to any one of claims 1 to 4, characterized in that, The construction of the risk identification model by using the encoding network in the trained graph autoencoder comprises: acquiring training data of the risk identification model; The training data is used for transfer learning of the risk identification model on an encoding network in the trained graph autoencoder, wherein the risk identification model comprises the encoding network and a classification network.

6. The method of claim 5, wherein, The training data for obtaining the risk identification model comprises at least one of the following: obtaining nodes labeled as risk users and non-risk users from the heterogeneous network graph as the training data; or, obtaining edges labeled as risk behaviors and non-risk behaviors from the heterogeneous network graph as the training data; or, obtaining subgraphs labeled as a risk user set and a non-risk user set from the heterogeneous network graph as the training data.

7. An apparatus for building a risk identification model, the apparatus comprising: The device comprises: a graph obtaining unit configured to obtain a heterogeneous network graph constructed using network behavior data of a user, the heterogeneous network graph comprising nodes and edges, the nodes comprising behavior subjects and behavior objects, and the edges being determined according to behavior relationships between the behavior subjects and the behavior objects; a graph mask unit configured to perform mask processing on the edges in the heterogeneous network graph to obtain a mask subgraph and a remaining subgraph; a graph training unit configured to train a graph autoencoder using the remaining subgraph and the mask subgraph; wherein the mask subgraph formed after the mask processing on the heterogeneous network graph is used as a positive sample for training the graph autoencoder, and edges that do not originally exist between nodes are used as negative samples for training the graph autoencoder, thereby reducing artificial construction and labeling of samples; the graph autoencoder comprises an encoding network and a first decoding network; the encoding network obtains a representation vector of each node using the input remaining subgraph, and the first decoding network predicts the masked edges using the representation vectors of the nodes; and a training target comprises minimizing the difference between the prediction result and the mask subgraph; a model constructing unit configured to construct a risk identification model using the encoding network in the trained graph autoencoder, the risk identification model being used for risk identification on a target node, a target edge, or a target subgraph in an input network graph to be identified; The graph mask unit is specifically configured to: randomly sample edges in the heterogeneous network graph, form a mask subgraph using M edges sampled, and obtain a remaining subgraph by performing mask processing on the M edges sampled from the heterogeneous network graph; or randomly sample edges in the heterogeneous network graph, use M1 edges sampled as root nodes; perform path random walk from each root node as a starting point, and form a mask subgraph using each path obtained, and obtain a remaining subgraph by performing mask processing on M2 edges contained in each path; wherein M, M1, and M2 are positive integers. The mask is: shielding; and the remaining subgraph contains the structure of the edges remaining after the heterogeneous network graph is shielded.

8. A computer-readable storage medium having a computer program stored thereon, the computer program causing a computer to execute the method of any one of claims 1 to 6 when the computer program is executed in the computer.

9. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and the processor executes the executable code to implement the method of any one of claims 1 to 6. The memory stores executable code, and the processor executes the executable code to implement the method of any one of claims 1 to 6.

Images