An abnormal user identification method

Abstract

The application discloses an abnormal user identification method, and specifically comprises the following steps: S1, extracting feature data of a user sample, and constructing a user feature matrix X, wherein the feature data comprises a transaction object, gender, age and a user's location; S2, constructing an adjacency matrix based on transaction data of the user sample; S3, inputting the user feature matrix X and the adjacency matrix into a graph convolutional neural network, and outputting a user feature matrix X' from the graph convolutional neural network, and then obtaining a feature vector of the user; and S4, inputting the feature vector of the user into a linear classifier, and outputting a predicted label of the user, wherein the label is an abnormal user or a normal user. Based on the feature separation model of the abnormal point distribution description, the feature set important for classifying the node user can resist the negative influence caused by the distribution out generalization, and the prediction effect and the robustness of the model are improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of user identification, and more particularly, the present application relates to an abnormal user identification method. BACKGROUND

[0002] The Internet+ opens up business modules for financial companies and injects new vitality. What protects the safety of business is various anti-fraud algorithms. In recent years, with the continuous development of social network platforms, anti-fraud technology will fully utilize social graph information, and the development of anti-fraud technology has also caused the vigilance of lawbreakers. They have also figured out some ways to deceive artificial intelligence, such as lawbreakers can obtain contact with high-quality users by actively contacting high-quality users, participating in high-quality user circle topic discussions, or participating in high-quality user group activities. These contacts are captured by algorithms and taken into account, causing the characteristics of high-quality users to be shared by lawbreakers, ultimately achieving the purpose of 'diluting' the degree of abnormality on their own. In graph neural networks, we call this problem "heterophily". When heterophily is strong, it will cause difficulties for human experts to label, and when lawbreakers are surrounded by high-quality users, it is difficult to label and identify them. Users who interact with more lawbreakers are more likely to be labeled as abnormal, while users who interact with more high-quality users are more likely to be labeled as normal, which can easily cause user labeling obstacles, resulting in different distributions of data samples in the labeling space and the real space, which is called the out-of-distribution generalization problem. However, machine learning models are often data-driven models and largely depend on sample labeling. SUMMARY

[0003] The present application provides an abnormal user identification method, which aims to improve the above problems.

[0004] The present application is implemented as follows: an abnormal user identification method, which specifically comprises the following steps:

[0005] S1, extracting feature data of user samples to construct a user feature matrix X, the feature data including: transaction object, gender, age, and user location;

[0006] S2, constructing an adjacency matrix based on transaction data of user samples;

[0007] S3, inputting the user feature matrix X and the adjacency matrix into a graph convolutional neural network, and outputting a user feature matrix X' from the graph convolutional neural network to obtain a feature vector of the user;

[0008] S4, inputting the feature vector of the user into a linear classifier to output a predicted label of the user, the label being an abnormal user or a normal user.

[0009] Further, the method for obtaining the user feature matrix X' is specifically as follows:

[0010] S31, obtaining a hidden matrix H based on the output of the last layer in the current iteration (L) to classify the sample features, and putting sample features with large contributions to the sample anomaly determination into a feature subset C, and putting the remaining sample features into a feature subset S;

[0011] S32, calculating the KL divergence between the abnormal user and the current abnormal prototype vector and the KL divergence between the abnormal user and the normal prototype vector , and taking the difference between the two as L tC ;

[0012] S34, calculating the average KL divergence between all users and s neighbors and the average KL divergence between all users and s random non-neighbors based on the feature subset S, and taking the difference between the two as L tS ;

[0013] S35, calculating the loss value corresponding to the current model parameters based on the divergence difference L tC , the divergence difference L tS and the cross-entropy loss L GNN , and selecting the model parameters with the smallest loss value;

[0014] S36, detecting whether the number of current iterations reaches a number threshold, if the detection result is yes, the hidden matrix H (L) in step S31 is the user feature matrix X', and if the detection result is no, performing the first iteration, that is, performing step S31.

[0015] Further, the loss value is calculated based on a loss function, and the calculation formula of the loss function is specifically as follows:

[0016] L t = L GNN + λ (L tC + L tS )

[0017] Wherein, λ is a balance parameter, balancing the loss of the cross-entropy loss L GNN of the graph neural network and the loss of the constraint term (L tC + L tS ).

[0018] Further, the calculation formula of the cross-entropy loss L GNN is specifically as follows:

[0019] L GNN = ∑ n -log (y n · σ (z nL))

[0020] Among them, the last hidden matrix H (L) Each row forms a hidden vector z nL , z nL H represents the hidden matrix (L) The feature vector of the nth sample is composed of four features.

[0021] Furthermore, the classification hidden matrix H of the sample features (L) The specific method is as follows:

[0022] S311. In the current iteration, the hidden matrix H output by the last layer... (L) The contribution of various features of user samples to label classification is calculated using the following formula:

[0023]

[0024] in, This represents the contribution weight of the feature of the k-th sample to the true class c, where c is the true class of the node. The label represents the sample's annotation, and k represents the label of the sample's feature dimension. H represents the hidden matrix (L) The feature of the k-th sample in the n-th user sample;

[0025] S312, Based on weight values The sample features are segmented, and Features with large weights are placed into feature subset C, and the remaining features are placed into feature subset S.

[0026] Furthermore, the hidden matrix H in the current t-th iteration process (L) The specific formation method is as follows:

[0027] The hidden matrix H of the l-th layer (l) and the weight matrix W of the l-th layer (l) After multiplication, the result is nonlinearized using the ReLU activation function to obtain the next layer's hidden matrix H. (l+1) Hidden matrix H (l+1) The rows in the table represent the four features of each sample in the l-th layer, and the specific calculation formula is as follows:

[0028] H (l+1) =σ(A n H (l) W (l) );

[0029] H (0) =X;

[0030] Where σ is the activation function, W (l)W represents the guiding model parameter at the lth iteration (0) is randomly initialized;

[0031] The hidden matrix output by the Lth layer is the hidden matrix H (L) .

[0032] Further, the updating method of the normal prototype vector and the abnormal prototype vector in the tth iteration is as follows:

[0033] In the tth iteration, if the n th sample updated in the current iteration is a positive sample, the cosine similarity between the sample feature and the prototype vector formed in the last iteration is calculated If the n th sample updated in the current iteration is a negative sample, the cosine similarity between the sample feature and the prototype vector at the last moment is calculated

[0034] Based on the cosine similarity or the cosine similarity The sample weight of the sample in the current iteration is updated, and the weight update formula of the sample is as follows:

[0035] If the n th sample is a positive sample, the weight

[0036] If the n th sample is a negative sample, the weight

[0037] Where, exp(·) is an exponential function; τ is a temperature coefficient, which controls the smoothness of the function.

[0038] Based on the sample weight and the sample feature in the current iteration, the prototype vector in the current iteration is updated, and the updating formula is as follows:

[0039] Normal prototype vector:

[0040] Abnormal prototype vector:

[0041] Further, the initial value obtaining method of the normal prototype vector and the abnormal prototype vector is as follows:

[0042] The average value of the sample feature vector is taken as the initialization of the sample distribution, and the sample set is denoted as​​​​​​​​​​​​n If n = 1, 2,..., n, then the initial prototype vector of positive samples is:

[0043]

[0044] wherein, represents the initial prototype vector of positive samples, the label y of positive samples n = 1, the label y of abnormal samples n = 1, that is, the initial value of the abnormal prototype vector; represents the initial prototype vector of negative samples, the label y of negative samples n = 0, the label y of normal samples n = 0, that is, the initial value of the normal prototype vector, |K| and |M| are the sizes of the positive sample set and the negative sample set respectively, |K| + |M| = |N|.

[0045] Further, the formation process of the adjacency matrix is as follows:

[0046] If there is a transaction between the user sample x i and the user sample x j , then the element a ij in the adjacency matrix A is 1, if there is no transaction between the user sample x i and the user sample x j , then the element a ij in the adjacency matrix A is 0, in addition, the element a ii on the diagonal line in the adjacency matrix A is 1, the adjacency matrix A is normalized to form a new adjacency matrix A n .

[0047]

[0048] wherein, D is the degree matrix of the element corresponding node, and the element in the degree matrix D represents the number of users who have transactions with the user corresponding to the node.

[0049] The application obtains the contribution of each node (user) feature to the final classification, and divides the features into two mutually exclusive sets on this basis; the prototype vectors of abnormal nodes and normal nodes are estimated and stored in the memory buffer, and are updated in each new iteration period; meanwhile, the KL divergence between the samples and the prototype vectors is calculated to make different constraints on the abnormal nodes and the normal nodes to resist the negative effects of distribution out-generalization, and to strengthen the relevant connection relationship between the nodes, and the scheme can achieve good results in the fraud scene with strong heterogeneity. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 The flowchart of the abnormal user identification method provided by the embodiment of the application. DETAILED DESCRIPTION

[0051] The specific embodiments of the present application will be further described in details below with reference to the drawings and the embodiments, to help the skilled in the art have a more complete, accurate and in-depth understanding of the inventive concept and technical solutions of the present application.

[0052] The present application uses a graph convolutional neural network as a base model to aggregate the features of neighbor nodes, based on the gradient of each dimension feature of the final loss, the aggregated node feature vector is divided into two parts: a feature set C representing the classification effective, and a feature set S absorbing the neighbor node signal. At the same time, the prototype vectors of fraudsters and normal users are adaptively estimated. Each fraudster will calculate the KL divergence with the obtained prototype vector in C, and the divergence will be used as a constraint to make the fraudsters as close as possible to the fraudster distribution, while far away from the normal user distribution, in order to resist the influence of out-of-distribution generalization. In addition, the present application hopes to retain and strengthen the connectivity between users during the learning process, so the KL divergence between neighbor nodes in S is calculated and made as similar as possible.

[0053] Figure 1 The flowchart of the abnormal user identification method provided by the embodiment of the present application, the method specifically comprises the following steps:

[0054] S1, extracting the feature data of the user sample, constructing a user feature matrix X, a row in the user feature matrix X represents the features of a to-be-identified user sample, the user feature matrix X includes the features of all user samples, and the feature data includes: transaction object, gender, age and user location;

[0055] S2, constructing an adjacency matrix A based on the transaction data of the user sample;

[0056] If the user sample x i has a transaction with the user sample x j , the element a ij in the adjacency matrix A is 1, if the user sample x i has no transaction with the user sample x j , the element a ij in the adjacency matrix A is 0, in addition, the element a ii on the diagonal of the adjacency matrix A is 1, the adjacency matrix A is normalized to form a new adjacency matrix A n :

[0057]

[0058] Wherein, D is the degree matrix of the node, the element in the degree matrix D represents the number of edges connected to the corresponding node, and the number of edges connected to the corresponding node is the number of users who have transactions with the user corresponding to the node.

[0059] S3, input the user feature matrix X and the adjacency matrix A into the graph convolutional neural network, and the graph convolutional neural network outputs a user feature matrix X', so as to obtain a feature vector of each to-be-identified user.

[0060] S4, input the feature vector of each user into a linear classifier (such as a logistic regression), and output a predicted label of the user, which is an abnormal user or a normal user.

[0061] In the embodiment of the application, the forming method of the user feature matrix X' is specifically as follows:

[0062] S31, based on the hidden matrix H output by the last layer in the current iteration (L) to classify the sample features, put the sample features with large contribution to the sample anomaly determination into the feature subset C, and put the remaining sample features into the feature subset S;

[0063] S32, calculate the KL divergence between the abnormal user and the current abnormal prototype vector and the KL divergence between the abnormal user and the normal prototype vector , and take the difference between the two as L tC .

[0064] S34, based on the feature subset S, calculate the average KL divergence between all users and s neighbors and the average KL divergence between all users and random s non-neighbors, and take the difference between the two as L tS .

[0065] S35, based on the divergence difference L tC , the divergence difference L tS and the cross-entropy loss L GNN , calculate the loss value corresponding to the model parameters of the current model, and select the model parameters with the minimum loss value;

[0066] The loss value is calculated based on the following loss function,

[0067] L t = L GNN + λ (L tC + L tS )

[0068] Wherein, λ is a balance parameter, balancing the loss of the cross-entropy loss L GNN of the graph neural network and the loss of the constraint term (L tC + L tS ), wherein the cross-entropy loss L GNNLoss of the graph convolutional neural network model, the calculation formula is as follows:

[0069] L GNN =∑ n -log(y n ·σ(z nL ))

[0070] Wherein, the last layer hidden matrix H (L) Each row forms a hidden vector z nL , z nL Indicates that the hidden matrix H (L) The feature vector composed of four features of the nth sample.

[0071] S36, detect whether the number of current iterations reaches the number threshold, if the detection result is yes, the hidden matrix H (L) In step S31 is user feature matrix X', if the detection result is no, execute the first iteration, that is, execute step S31.

[0072] In the embodiment of the application, the classification method of sample features is as follows:

[0073] S311, in the current iteration, the hidden matrix H (L) Calculate the contribution of each feature of the user sample to the label classification, and the calculation formula is as follows:

[0074]

[0075] Wherein, Indicates the contribution weight of the kth sample feature to the real category c, c is the real category of the node, if the sample is a positive sample (fraud user), c takes the value 1, if the sample is a negative sample (normal user), c takes the value 0; Indicates the labeled label of the sample, k indicates the label of the sample feature dimension, and takes the value 1 to 4; Indicates the kth sample feature of the nth user sample in the hidden matrix H (L) .

[0076] S312, based on the weight value Split the sample features, put several features with large weight values into the feature subset C, and put the remaining features into the feature subset S.

[0077] In the embodiment of the application, in the current tth iteration process, the formation method of the hidden matrix H (L) As follows:

[0078] The hidden matrix H (l) Of the lth layer and the weight matrix W (l) ​After multiplication, the next layer hidden matrix H is obtained through ReLU activation function nonlinear processing (l+1) , the row in hidden matrix H (l+1) represents four features of each sample in the lth layer, and the calculation formula is as follows:

[0079] H (l+1) =σ(A n H (l) W (l) );

[0080] H (0) =X;

[0081] Wherein, sigma is an activation function, W (l) represents the guiding model parameters in the lth iteration, and W (0) is randomly initialized.

[0082] In the embodiment of the application, the updating method of normal prototype vector and abnormal prototype vector in the tth iteration process is as follows:

[0083] In the tth iteration, if the updated nth sample in the current iteration is a positive sample, the cosine similarity between the sample feature and the prototype vector formed in the last iteration is calculated. If the updated nth sample in the current iteration is a negative sample, the cosine similarity between the sample feature and the prototype vector at the last moment is calculated.

[0084] Based on the cosine similarity or the cosine similarity , the sample weight of sample in the current iteration is updated, and the weight updating formula of sample is as follows:

[0085] If the nth sample is a positive sample, the weight

[0086] If the nth sample is a negative sample, the weight

[0087] Wherein, exp(·) is an exponential function; tau is a temperature coefficient, which controls the smoothness of the function.

[0088] The prototype vector in the current iteration is updated based on the sample weight and sample feature in the current iteration, and the update formula is specifically as follows:

[0089] Normal prototype vector:

[0090] Abnormal prototype vector:

[0091] In the embodiments of the present application, the initial value acquisition method of the normal prototype vector and the abnormal prototype vector is specifically as follows:

[0092] The average value of the sample feature vector is taken as the initialization of the sample distribution, assuming that the sample set {x n |n=1,2,...,n}, the initial prototype vectors of positive and negative samples are:

[0093]

[0094] wherein, represents the initial prototype vector of the positive sample, the label y n of the positive sample is y n =1, the label y n of the abnormal sample is y n =1, that is, the initial value of the abnormal prototype vector; represents the initial prototype vector of the negative sample, the label y n of the negative sample is y n =0, the label y n of the normal sample is y n =0, that is, the initial value of the normal prototype vector, |K|, |M| are the sizes of the positive sample set and the negative sample set respectively, |K|+|M| =|N|.

[0095] In order to more intuitively and effectively show the effect of the model of the present application, Table 1 shows the test results of the model of the present application and other currently best models on two real world data sets. The best model is marked in bold, and the second best model is underlined.

[0096] Table 1 Model comparison results and relative improvement data

[0097]

[0098] The present application is described by way of example, and obviously the specific implementation of the present application is not limited by the above method. Any non-essential improvement or direct application of the concept and technical solution of the present application to other occasions is within the protection scope of the present application.

Claims

1. A method for identifying abnormal users, characterized in that, The method specifically includes the following steps: S1. Extract feature data from user samples and construct user feature matrix X. Feature data includes: transaction object, gender, age and user location. S2. Construct an adjacency matrix based on transaction data from user samples; S3. Input the user feature matrix X and the adjacency matrix into the graph convolutional neural network. The graph convolutional neural network outputs the user feature matrix X′, thereby obtaining the user's feature vector. S4. Input the user's feature vector into the linear classifier and output the user's predicted label, which is either an abnormal user or a normal user. The method for obtaining the user feature matrix X′ is as follows: S31. The hidden matrix H based on the output of the last layer in the current iteration. (L) To classify the sample features, the sample features that contribute significantly to the anomaly detection are placed in feature subset C, and the remaining sample features are placed in feature subset S. S32. Calculate the abnormal user and the current abnormal prototype vector based on the feature subset C. KL divergence and abnormal user vs. normal prototype vector The KL divergence between the two is denoted as L. tC ; S34. Based on the feature subset S, calculate the average KL divergence between all users and their s neighbors, and the average KL divergence between all users and s random non-neighbors. The difference between the two is denoted as L. tS ; S35, Based on divergence difference L tC Divergence difference L tS and cross-entropy loss L GNN Calculate the loss value corresponding to the current model parameters and select the model parameters with the smallest loss value; S36. Check if the current iteration count has reached the threshold. If the check result is yes, then the hidden matrix H in step S31... (L) This is the user feature matrix X′. If the detection result is negative, then the first iteration is executed, i.e., step S31 is executed. The hidden matrix H in the current t-th iteration (L) The specific formation method is as follows: The hidden matrix H of the l-th layer (l) and the weight matrix W of the l-th layer (l) After multiplication, the result is nonlinearized using the ReLU activation function to obtain the next layer's hidden matrix H. (l+1) Hidden matrix H (l+1) The rows in the table represent the four features of each sample in the l-th layer, and the specific calculation formula is as follows: H (l+1) =σ(A n H (l) W (l) ); H (0) =X; Where σ is the activation function, W (l) W represents the guiding model parameters at the l-th iteration. (0) Initialize randomly; The hidden matrix output by the Lth layer is the hidden matrix H. (L) .

2. The abnormal user identification method as described in claim 1, characterized in that, The loss value is calculated based on the loss function, and the specific formula for calculating the loss function is as follows: L t =L GNN +λ(L tC +L tS ) Where λ is the balance parameter, and L is the cross-entropy loss of the balanced graph neural network. GNN and constraint terms (L tC +L tS ) loss.

3. The abnormal user identification method as described in claim 2, characterized in that, Cross-entropy loss L GNN The specific calculation formula is as follows: L GNN =∑ n -log(y n ·σ(z nL )) Among them, the last hidden matrix H (L) Each row forms a hidden vector z nL , z nL H represents the hidden matrix (L) The feature vector of the nth sample is composed of four features.

4. The abnormal user identification method as described in claim 1, characterized in that, Classification Hidden Matrix H of Sample Features (L) The specific method is as follows: S311. In the current iteration, the hidden matrix H output by the last layer... (L) The contribution of various features of user samples to label classification is calculated using the following formula: in, This represents the contribution weight of the feature of the k-th sample to the true class c, where c is the true class of the node. The label represents the sample's annotation, and k represents the label of the sample's feature dimension. H represents the hidden matrix (L) The feature of the k-th sample in the n-th user sample; S312, Based on weight values The sample features are segmented, and Features with large weights are placed into feature subset C, and the remaining features are placed into feature subset S.

5. The abnormal user identification method as described in claim 1, characterized in that, Normal prototype vector in the t-th iteration and abnormal prototype vector The specific update method is as follows: In the t-th iteration, if the n-th sample after the update in the current iteration If the sample is positive, then calculate the sample features. The prototype vector formed by the previous iteration cosine similarity If the nth sample after the update in the current iteration If it is a negative sample, then calculate the sample features. Compared with the prototype vector of the previous time step cosine similarity Based on cosine similarity or cosine similarity Update Sample The sample weights in the current iteration, sample The specific formula for updating the weights is as follows: If the nth sample If it is a positive sample, then the weight If the nth sample If it is a negative sample, then the weight Where exp(·) is the exponential function; τ is the temperature coefficient, which controls the smoothness of the function; The prototype vector in the current iteration is updated based on the sample weights and features in the current iteration. The specific update formula is as follows: Normal prototype vector: Exception prototype vector:

6. The abnormal user identification method as described in claim 5, characterized in that, The specific methods for obtaining the initial values ​​of the normal prototype vector and the abnormal prototype vector are as follows: The average value of the sample feature vectors is used as the initialization of the sample distribution. Let the sample set {x} be... n Given |n=1,2,K,n}, the initial prototype vectors of the positive and negative samples are: in, This represents the initial prototype vector of the positive sample, and the label y of the positive sample. n =1, the label y of the abnormal sample n =1, which is the initial value of the anomaly prototype vector; This represents the initial prototype vector of the negative sample, and the label y of the negative sample. n =0, label y of normal samples n =0, which is the initial value of the normal prototype vector. |K| and |M| are the sizes of the positive and negative sample sets, respectively, and |K|+|M|=|N|.

7. The abnormal user identification method as described in claim 1, characterized in that, The process of forming the adjacency matrix is ​​as follows: User Sample x i With user sample x j If there is a transaction between them, then element a in adjacency matrix A... ij =1, if user sample x i With user sample x j If there are no transactions between them, then element a in adjacency matrix A... ij =0, in addition, the element a on the diagonal of the adjacency matrix A is also 0. ii =1, normalize the adjacency matrix A to form a new adjacency matrix A. n : Where D is the degree matrix of the node corresponding to the element, and the elements in the degree matrix D represent the number of users who have transactions with the user corresponding to the node.

Images