Method and apparatus for determining node properties

Abstract

The application provides a method for judging node properties, comprising the steps of: obtaining a user topology graph, each node in the user topology graph being used to represent each user in a group of users, and each edge in the user topology graph being used to represent a relationship between the users; determining a to-be-identified node in each node, and obtaining a plurality of local subgraphs in the user topology graph through a graph walk algorithm; for each local subgraph, judging whether the local subgraph is a local subgraph walked out from the to-be-identified node as a starting point through a pre-trained judgment model; and identifying the properties of the to-be-identified node according to the judgment results for each local subgraph. Correspondingly, the application discloses a device for judging node properties.

Description

Technical Field

[0001] This application relates to the fields of machine learning and graph neural network technology, and in particular to a method and apparatus for determining node properties. Background Technology

[0002] Gang detection typically involves using community segmentation algorithms (possibly incorporating node attributes) on large networks to identify and refine closely related local subgraphs. In practical risk control, these subgraphs correspond to a group of accounts within a community that are closely linked and likely to be risky. However, some of these accounts may be actually risk-free. Directly labeling all accounts within the gang as risky would unnecessarily disrupt these safe accounts. However, accurately assessing and segmenting the risk level of accounts within a gang remains a challenging problem.

[0003] In existing technologies, common whitelisting solutions generally include structure-based judgment, attribute-based judgment, and supervised model-based methods. Structure-based judgment matches and determines the local connections around an account based on manually abstracted business rules. On the one hand, this requires a large amount of business experience input; as risks change, the business rules must also change accordingly, resulting in low robustness. On the other hand, graph structure matching itself has significant computational overhead. Attribute-based judgment detects anomalies based on attributes, but this assumes that most points are normal and a small portion are anomalous. Therefore, in these business scenarios, the detected anomalies are actually low-risk accounts. Because this solution does not consider the connections between accounts, it struggles to make correct judgments when account features are incomplete or very similar in certain business scenarios. Supervised model solutions, such as tree models and supervised graph neural network node classification models, also do not consider account connections. Although supervised graph neural network node classification considers account attributes and connections, both require a large amount of business black and white label input, making them difficult to work when labels are missing. Furthermore, if the form of risk changes or the business labels fluctuate, the model needs to be retrained.

[0004] In view of this, how to provide a solution for screening risks in the internal accounts of a group to overcome the defects or deficiencies of the existing solutions has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of the aforementioned deficiencies in existing technologies for screening risks within group accounts, this application provides a method and apparatus for determining node properties.

[0006] According to one aspect of this application, a method for determining node properties is provided, comprising the steps of:

[0007] Obtain a user topology graph, wherein each node in the user topology graph represents each user in a group of users, and each edge in the user topology graph represents the relationship between the users;

[0008] The node to be identified is determined among the nodes, and several local subgraphs in the user topology graph are obtained through a graph walk algorithm;

[0009] For each local subgraph, a pre-trained judgment model is used to determine whether the local subgraph is a local subgraph that was traversed from the node to be identified.

[0010] The properties of the node to be identified are determined based on the judgment results for each local subgraph.

[0011] Furthermore, in some embodiments, the output of the judgment model is a predicted score, which is used to determine whether the local subgraph is a local subgraph that originated from the node to be identified. The method includes:

[0012] The nature of the node to be identified is determined based on the distribution of multiple predicted scores.

[0013] Furthermore, in some implementations, the nature of the node to be identified is determined based on the distribution of multiple predicted scores, including:

[0014] If the degree of discretization of the predicted score at both ends is lower than a preset level, the node to be identified is determined to be of the first nature.

[0015] Furthermore, in some implementations, the nature of the node to be identified is determined based on the distribution of multiple predicted scores, including:

[0016] Obtain the first predicted scores of n local subgraphs that originate from the node to be identified, and the second predicted scores of n local subgraphs that do not originate from the node to be identified.

[0017] Calculate the average difference between the second predicted score and the first predicted score. If the average difference is less than a preset threshold, determine that the node to be identified is of the first nature.

[0018] Furthermore, in some implementations, obtaining several local subgraphs in the user topology graph through a graph walking algorithm includes:

[0019] Starting from any node in the graph, a random walk algorithm is used to obtain several local subgraphs in the user topology graph.

[0020] Furthermore, in some embodiments, the determination model is obtained based on the following steps:

[0021] Obtain a sample graph, where nodes in the sample graph represent sample users, the set of all nodes represents sample groups, and the edges between nodes represent the relationships between sample users.

[0022] Determine the first node in the sample group and obtain the sample subgraphs of the sample graph. The sample subgraphs starting from the first node are stored as the positive sample pair training set, and the sample subgraphs not starting from the first node are stored as the negative sample pair training set.

[0023] Determine the node representation of the first node, and the subgraph representation of each sample subgraph in the training set of positive sample pairs and negative sample pairs;

[0024] A training model is established based on node representation and subgraph representation. The training model is then trained using positive and negative sample pairs to obtain a well-trained judgment model.

[0025] Furthermore, in some implementations, determining the node representation of the first node includes:

[0026] By using a graph isomorphic neural network, the information of the first node itself and the information of the first node's neighboring nodes are aggregated to obtain the node representation.

[0027] Furthermore, in some implementations, determining the subgraph representation of each sample subgraph includes:

[0028] Obtain the node representation of each node included in the sample subgraph;

[0029] Based on the node representations of each node, the subgraph representation is determined through the graph readout function.

[0030] Furthermore, in some implementations, a training model is built based on node representations and subgraph representations, including:

[0031] A bilinear scoring function is established based on the node representation and the subgraph representation, which serves as the training model.

[0032] Furthermore, in some implementations, obtaining a sample sub-image of a sample image includes:

[0033] The training set of positive sample pairs and negative sample pairs corresponding to the first node is collected using a random walk algorithm.

[0034] Furthermore, in some embodiments, after obtaining the sample sub-image of the sample image, the method further includes:

[0035] The sample subgraphs are anonymized and stored in the corresponding positive sample pair training set or negative sample pair training set.

[0036] According to another aspect of this application, a node property determination device is provided, which includes a model module, a sampling module and a determination module that communicate with the model module via data communication:

[0037] The sampling module acquires a user topology graph, where each node in the user topology graph represents a user in a group of users, and each edge in the user topology graph represents the relationship between the users.

[0038] The sampling module determines the node to be identified among the nodes and obtains several local subgraphs in the user topology graph through a graph walk algorithm;

[0039] For each local subgraph, the model module uses a pre-trained judgment model to determine whether the local subgraph is a local subgraph that originated from the node to be identified.

[0040] The judgment module identifies the properties of the node to be identified based on the judgment results for each local subgraph.

[0041] Furthermore, in some embodiments, the model module determines the predicted score of the model's output, which is used to determine whether the local subgraph is a local subgraph that originated from the node to be identified.

[0042] The judgment module is also used to determine the nature of the node to be identified based on the distribution of multiple predicted scores.

[0043] Furthermore, in some embodiments, the judgment module is also used to determine that the node to be identified is of the first nature when the degree of discretization of the two poles of the predicted score is lower than a preset degree.

[0044] Furthermore, in some embodiments, the determination module is also used for

[0045] Obtain the first predicted scores of n local subgraphs that originate from the node to be identified, and the second predicted scores of n local subgraphs that do not originate from the node to be identified.

[0046] Additionally, the average difference between the second predicted score and the first predicted score is calculated, and when the average difference is less than a preset threshold, the node to be identified is determined to be of the first nature.

[0047] Furthermore, in some embodiments, the model module further includes a training module for training the judgment model.

[0048] The training module obtains a sample graph, where nodes in the sample graph represent sample users, the set of all nodes is a sample group, and the edges between nodes represent the relationships between sample users. The first node in the sample group is determined, and a sample subgraph of the sample graph is obtained. The sample subgraph starting from the first node is stored as a positive sample pair training set, and the sample subgraph not starting from the first node is stored as a negative sample pair training set.

[0049] The training module determines the node representation of the first node, as well as the subgraph representations of each sample subgraph in the training set of positive sample pairs and negative sample pairs.

[0050] The training module establishes a training model based on node representation and subgraph representation, and trains the training model using positive sample pairs and negative sample pairs to obtain a trained judgment model.

[0051] Furthermore, in some embodiments, the training module aggregates the information of the first node itself and the information of the neighboring nodes of the first node through a graph isomorphic neural network to obtain a node representation.

[0052] Furthermore, in some implementations, the training module determines the subgraph representation based on the node representation of each node through a graph readout function.

[0053] Furthermore, in some embodiments, the training module establishes a bilinear scoring function based on the node representation and the subgraph representation as a training model.

[0054] Furthermore, in some implementations, the training module collects sample subgraphs using a random walk algorithm, anonymizes the sample subgraphs, and stores them in the corresponding positive sample pair training set or negative sample pair training set.

[0055] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the steps in the node property determination method described in the present invention.

[0056] The present invention also provides a computing device including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it performs the steps in the node property determination method of the present invention.

[0057] The node property determination method and apparatus of this application first obtain a graph, where the set of nodes in the graph is called a group, and the relationship between nodes is called an edge. Then, the node to be identified is determined, and a random local subgraph of the graph is obtained. Next, the node to be identified and the local subgraph are combined to form a sample pair to be identified. The sample pair to be identified is input into a pre-trained judgment model to obtain an output result. The output result is used to determine whether the sample pair to be identified is a positive sample pair or a negative sample pair, where a positive sample pair indicates that the local subgraph originates from the node to be identified, and a negative sample pair indicates that the local subgraph does not originate from the node to be identified. Finally, multiple sets of sample pairs corresponding to the node to be identified are respectively passed through the judgment model to obtain multiple output results, and the property of the node to be identified is determined based on the output results.

[0058] Compared with the prior art, the node property determination method and apparatus of this application have at least one of the following advantages:

[0059] The comparative learning sample pairs designed in this scheme are node-node local subgraphs and node-random sampled subgraphs, and graph neural networks are used for encoding. Therefore, node attributes, local structure, and the connection differences between different nodes and their local subgraphs are considered simultaneously, which makes the mining of graph relationships very thorough.

[0060] This solution relies on a self-supervised task that distinguishes between node-node local subgraphs and node-random sampled subgraphs for model training, thus eliminating the need for business label input;

[0061] This scheme's node-subgraph level sample pair design allows for local sampling at each node, enabling efficient sampling even with large groups and offering strong scalability.

[0062] When business risks change, the basic assumption that most nodes within the risk group are at risk while a small number of nodes are not will not change. Therefore, the training model can still work normally without retraining. Attached Figure Description

[0063] After reading the detailed embodiments of this application with reference to the accompanying drawings, the reader will gain a clearer understanding of all aspects of this application. Wherein:

[0064] Figure 1 An exemplary flowchart of one implementation of the node property determination method of the present invention is shown.

[0065] Figure 2 The flowchart illustrating the sampling of sample pairs in one implementation of the node property determination method of the present invention is shown as an example.

[0066] Figure 3The flowchart of obtaining the judgment model in the node property judgment method of the present invention is illustrated in one implementation.

[0067] Figure 4 A schematic diagram of one embodiment of the node property determination device of the present invention is shown as an example. Detailed Implementation

[0068] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0069] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0070] Graph neural networks typically use the underlying graph as a computational graph and learn neural network primitives to generate single-node embedding vectors by passing, transforming, and aggregating node feature information across the entire graph. The generated node embedding vectors can be used as input to any differentiable prediction layer and for node classification or predicting connections between nodes. The complete model can be trained end-to-end.

[0071] In risk control scenarios, we believe that nodes of different risk types will have different relationships with their local substructures. For example, in some fraud scenarios, fraudulent accounts will be more connected to legitimate accounts and less connected to other fraudulent accounts; legitimate accounts will be connected to both legitimate accounts and some fraudulent accounts. This pattern becomes apparent when we observe the combination of a particular account and the accounts that interact with it. Therefore, we designed node-node local subgraph level sample pairs to capture this difference.

[0072] Gang detection typically involves using community segmentation algorithms, possibly incorporating node attributes, to identify and refine closely related local subgraphs within a large network. In practical risk control, these subgraphs correspond to a group of accounts within a community that are closely connected and likely to pose a risk. A gang refers to a small group within a larger group that is structurally closely linked or highly similar in attributes. However, some of these accounts may still be actually risk-free; "whitelisting" refers to determining whether an account poses any business risk.

[0073] Self-supervised learning, employing self-supervision, can be viewed as a special form of unsupervised learning with a supervised approach. Here, supervision is induced by the self-supervised task rather than pre-existing prior knowledge. Compared to completely unsupervised settings, self-supervised learning uses information from the dataset itself to construct pseudo-labels. Contrastive learning is a typical example of discriminative self-supervised learning. Its guiding principle is to automatically construct similar and dissimilar instances, aiming to learn a representation learning model that ensures similar instances are close in the projection space, while dissimilar instances are far apart.

[0074] This invention is also based on graph neural networks and self-supervised learning of contrastive learning sample pairs, namely node-node local subgraphs and node-random sampled subgraphs, and uses graph neural networks for encoding. It also considers node attributes, local structure and the connection differences between different nodes and their local subgraphs, which is very thorough in mining graph relationships.

[0075] In one embodiment of the present invention, a method for determining node properties is proposed. Figure 1 The flowchart of the node property determination method of the present invention is shown as an example in one embodiment.

[0076] like Figure 1 As shown, the method for determining node properties includes the following steps:

[0077] 100: Obtain the user topology graph. Each node in the user topology graph represents a user within a group. The set of nodes in the graph represents a group, and the edges in the graph represent the relationships between these users. This graph can also be viewed as a full graph corresponding to a group obtained through group mining, where nodes correspond to accounts within the group, and the edges represent the relationship attributes between accounts. The users mentioned above can also be any other type of subject.

[0078] 110: Determine the node to be identified among all nodes, and obtain several local subgraphs in the user topology graph through a graph walk algorithm.

[0079] Identify the nodes within the group that require nature assessment, i.e., the accounts that need risk evaluation. The aforementioned node nature assessment is the determination of the account risk level. If most of the account nodes in the group are known to be high-risk accounts or have been judged to be high-risk accounts, while the node to be identified is judged to be a low-risk account, then the account screening within the risky group is achieved.

[0080] It should be noted that the account screening in high-risk groups is merely one application scenario of the node nature determination method provided by this invention. In the embodiments of this invention, this application scenario is used to explain and illustrate the method, but it is not intended to limit the method. For example, in some embodiments, if most node accounts in the group are known to be low-risk accounts or are determined to be low-risk accounts, this method can also be used to screen high-risk accounts. Furthermore, the above method can be used to distinguish the different natures of user nodes in a cluster of user nodes containing arbitrarily different attributes.

[0081] Obtaining a local subgraph using a graph walk algorithm involves starting from any node in the graph and traversing it using a pre-defined arbitrary graph walk algorithm. The walk algorithm can be for homogeneous graphs, heterogeneous graphs, or other methods used to obtain a local subgraph. In some embodiments, a random walk with restart algorithm is used to obtain the local subgraph. The number of nodes in the local subgraph can be predetermined or unlimited.

[0082] 120: For each local subgraph, a pre-trained judgment model is used to determine whether the local subgraph is a local subgraph that has been traversed from the node to be identified.

[0083] In some more specific embodiments, to facilitate the description of the relationship between the node to be identified and each local subgraph, the judgment result can be described in the form of sample pairs. A positive sample pair indicates that the local subgraph originates from the node to be identified, and a negative sample pair indicates that the local subgraph does not originate from the node to be identified. The output result is the judgment of whether the sample pair to be identified is a positive or negative sample pair. For example, there is node 1 in the entire graph, and a randomly selected local subgraph obtained through a walk algorithm. Figure 1 and local sub Figure 2 Then (node ​​1, local sub-node) Figure 1 ) and (node ​​1, local sub-) Figure 2Both sets of sample pairs can form a pair to be identified. These two sets of sample pairs are then input into a pre-trained judgment model, which is trained to determine whether a sample pair is positive or negative. Therefore, the judgment model can output the respective results for each of the sample pairs. If the output is a positive sample pair, it indicates that the judgment model's prior knowledge considers the local sub-sample pair to be a positive or negative sample pair. Figure 1 This is a local subgraph formed starting from node 1; similarly, if the output is a negative sample pair, it indicates that the prior knowledge of the judgment model considers the local subgraph to be... Figure 2 This is not a local subgraph formed starting from node 1. The above sample pairs are merely a form used to describe the relationship between the node to be identified and the local subgraph. They do not restrict the input of the judgment model to sample pairs; their essence is still to determine the relationship between the local subgraph and the node to be identified.

[0084] 130: Identify the properties of the node to be identified based on the judgment results for each local subgraph.

[0085] To illustrate the relationship between the output and the node properties, the training process of the judgment model needs to be explained.

[0086] In some embodiments, Figure 2 The flowchart illustrating the node property determination method of the present invention in one implementation is shown as follows: Figure 2 As shown, the training process of the judgment model in step 120 includes the following steps:

[0087] 200: Obtain the sample graph. In the sample graph, nodes represent sample users, sets of nodes represent sample groups, and edges between nodes represent the relationships between sample users.

[0088] The sample graph is the full graph corresponding to a sample group obtained through group mining. The nodes on the graph correspond to the various accounts in the sample group, and the edges of the graph represent the relationship attributes between accounts.

[0089] 210: Determine the first node in the sample group and obtain the sample subgraphs of the sample graph. The sample subgraphs starting from the first node are stored as the positive sample pair training set, and the sample subgraphs not starting from the first node are stored as the negative sample pair training set.

[0090] Step 210 can be viewed as a comparison sample pair sampling process. Figure 3 An exemplary flowchart illustrates the sampling process for sample pairs in one implementation of the node property determination method described in this invention. For example... Figure 3As shown, starting from node 6, a local subgraph of node 6 is sampled using a graph walk algorithm. In some embodiments, a random walk algorithm is used to collect the local subgraph. In some embodiments, after collecting the sample subgraph, the sample subgraph is anonymized and stored in the corresponding positive sample pair training set or negative sample pair training set. Because the anonymized sample subgraph no longer has obvious node features, it can better train the judgment model to judge the sample pair type based on the relationship between nodes, and can also obtain a judgment model that can be better used for the above-mentioned node property judgment method. Then node 6 and the anonymized subgraph form a positive sample pair.

[0091] The process of generating negative sample pairs is similar, but the starting point of the random walk is not node 6 but another randomly selected node, such as... Figure 2 The middle node is 8. Therefore, the anonymized local subgraphs generated by nodes 6 and 8 form a negative sample pair.

[0092] This process involves sampling numerous pairs of positive and negative samples and storing them in a pool, thus completing this step. The sampled pairs of positive and negative samples are then used to train the graph neural network model.

[0093] Suppose we have a sample pair:

[0094]

[0095] Where v i Indicates the target node. Represents a local subgraph, y i This is the label of the sample pair. When the sample subgraph is obtained by walking through the target node, P i For positive sample pairs, the label y of the sample pair i The value is 1, otherwise P i For negative sample pairs, the label y of the sample pair i The value is 0.

[0096] 220: Determine the node representation of the first node, and the subgraph representation of each sample subgraph in the training set for positive sample pairs and negative sample pairs.

[0097] In some embodiments, a node representation is obtained by aggregating the information of the first node itself and the information of the neighboring nodes of the first node through a graph isomorphic neural network.

[0098] In some more specific embodiments, considering both node attributes and topological information, the information of the target node itself and its neighboring nodes are aggregated to obtain a node representation:

[0099]

[0100] in and These represent the node representation matrices of the (l-1)th layer and the lth layer, respectively. Let represent the learnable convolutional parameter matrix of the (l-1)th layer. Preferably, the graph network structure can be GCN (Graph Convolutional Network), GAT (Graph Attention Network), or GIN (Graph Isomorphism Network). In some embodiments, GIN, a graph isomorphism network that currently performs well on graph-level tasks, can be used to extract local subgraph representations of nodes.

[0101] In some embodiments, the node representation of each node included in the sample subgraph is obtained; based on the node representation of each node, the subgraph representation is determined by a graph readout function.

[0102] In a more specific embodiment, the GNN model described above can obtain node representations, but we also have subgraph structures in the comparison sample pairs. After calculating the representations of all nodes in the subgraph, the comparison sample pairs still have local subgraph structures, so the subgraph representations can be obtained by the graph readout module:

[0103]

[0104] in E represents the representation of a local subgraph. i The node representation matrix of the local subgraph, (E i ) k E represents i The k-th row, n i This indicates the number of nodes in the local subgraph.

[0105] After determining the node representations and subgraph representations, the final step is to build a training model and determine the target loss function used to optimize the training model.

[0106] 230: Build a training model based on node representation and subgraph representation, and train the training model on the training set with positive samples and negative samples to obtain a trained judgment model.

[0107] In some embodiments, a bilinear scoring function is established based on node representations and subgraph representations as a training model.

[0108] In a more specific embodiment, the trained model predicts the labels of the current positive and negative sample pairs using a bilinear scoring function:

[0109]

[0110] Here we use a simple bilinear scoring function, where and W represents the target node representation and the local subgraph representation, respectively. (d) This represents the weight matrix of the discriminator. The resulting s i This represents the discriminator's prediction of the label for the current sample pair, while the true sample pair label uses y. i This is represented by the sample pair consisting of the first node and the local subgraph collected in the aforementioned steps, and the output of the label discriminator module for that sample pair is determined.

[0111] Here, a binary classification cross-entropy loss function is used for a batch of size N. The loss function is:

[0112]

[0113] in This represents the entire contrastive learning module, which includes the steps involved in the training process of the aforementioned judgment model.

[0114] Through the above steps, the training model is trained using the positive samples and negative samples obtained from the sampling training set until the loss function meets the preset conditions, thus obtaining a well-trained judgment model.

[0115] Based on the above sample collection and training process, and combined with the application scenario of risk gang screening, we can see that there are some basic characteristics within risk gangs, such as: 1. Most nodes are risky, and only a small number of nodes are not risky; and 2. An important characteristic of whether a node is risky is its relationship (agreement) with its neighboring subgraph.

[0116] Based on the first characteristic mentioned above, the trained model learned the connection relationship between risky nodes and their local subgraphs. However, since the proportion of risk-free nodes is very small, the connection relationship between risk-free nodes and their local subgraphs was not learned. Combined with the second characteristic, it can be concluded that even a well-trained judgment model cannot effectively distinguish between positive and negative sample pairs of risk-free nodes.

[0117] Based on the above conclusions, we return to step 130: Multiple local subgraphs corresponding to the node to be identified are processed by the judgment model to obtain multiple output results. The nature of the node to be identified is determined based on these output results. The higher the accuracy of the multiple sets of samples of the node to be identified in the output results obtained by the judgment model, the higher the probability that the node to be identified is a risk node. Conversely, the lower the accuracy of the multiple sets of samples of the node to be identified in the output results obtained by the judgment model, and even the higher the probability that the same sample will produce different output results multiple times through the judgment model, the higher the probability that the node to be identified is a risk node.

[0118] In some embodiments, the output of the model is the predicted score of the sample pair to be identified. The predicted score is used to classify positive and negative sample pairs, and the nature of the node to be identified is determined based on the distribution of multiple predicted scores. In some binary classification models, the output is a numerical value within a preset range, and classification is performed based on the range in which the value falls. As in the aforementioned embodiments, s i If the predicted score can be considered as a representation of the output result, then the accuracy of the result can be judged more intuitively and quantitatively by the distribution of the predicted score.

[0119] Furthermore, in some embodiments, if the degree of discretization at both extremes of the predicted score is lower than a preset level, the node to be identified is determined to have the first property. Since the predicted score is within a preset range, for example, s... i If the predicted score is set between [0.1], then a predicted score close to 1 indicates a positive sample pair, and close to 0 indicates a negative sample pair. Therefore, for risk points, the predicted scores obtained by the model for the sample pairs to be identified will be closer to either extreme. Conversely, for non-risk points, the predicted scores for the sample pairs to be identified will be less clear, and may even fluctuate within the acceptable data range, exhibiting a lower degree of polarization.

[0120] Optionally, in some embodiments, to further quantify the degree of separation, the nature of the node to be identified is determined based on the distribution of multiple predicted scores, including:

[0121] Obtain the first predicted scores of n local subgraphs that originate from the node to be identified, and the second predicted scores of n local subgraphs that do not originate from the node to be identified. Based on the aforementioned definition of positive and negative sample pairs, this can also be understood as obtaining n positive sample pairs of the node to be identified and their predicted scores, and n negative sample pairs and their predicted scores.

[0122] Calculate the average difference between the predicted scores of negative sample pairs and the predicted scores of positive sample pairs. If the average difference is less than a preset threshold, the node to be identified is determined to be of the first property.

[0123] In a more specific embodiment, this application defines a function f(v) for calculating the outlier score of a target node. i ):

[0124]

[0125] Where R represents the number of positive and negative samples sampled from the node. The difference in scores between positive and negative samples is calculated and averaged to eliminate random errors. For risky nodes, the model can accurately determine the Si value of its sample pairs. For negative sample pairs of this node, the predicted Si(-) value tends to 0, and the predicted Si(+) value for positive samples tends to 1, with the average difference tending to -1. However, for low-risk nodes, the model's judgment is ambiguous, causing both Si(-) and Si(+) to fluctuate around the median value, and the difference tends to 0. Therefore, from the perspective of outlier scores, for nodes that constitute the majority of the group, such as risky nodes, the score tends to be close to -1; for nodes that constitute a minority, such as risk-free nodes, the score tends to be close to 0. In other words, nodes with outlier scores close to 0 can be identified as corresponding to low-risk accounts within risky groups, thus eliminating potential outliers.

[0126] The node property judgment method provided by this invention encodes node properties using a graph neural network based on comparative learning sample pairs. It considers node attributes, local structure, and differences in connections between different nodes and their local subgraphs, thus providing a comprehensive understanding of graph relationships. Model training relies on a self-supervised task of distinguishing between positive and negative sample pairs, eliminating the need for business label input. The node-subgraph level sample pair design allows for local sampling of each node, enabling distributed processing even with large groups or subgraphs. Furthermore, the fundamental assumption that most nodes within a risky group are at risk while a small number are not remains unchanged when business risks change; therefore, the model can still function normally without retraining.

[0127] Figure 4 A schematic diagram of one embodiment of the node property determination device of the present invention is shown as an example. Figure 4 As shown, another embodiment of the present invention also provides a node property determination device 40, which includes a model module 41, and a sampling module 43 and a determination module 45 that communicate with the model module.

[0128] The node property determination device is configured to perform the following steps:

[0129] 310: The sampling module acquires the user topology graph. Each node in the user topology graph represents a user in a group of users, and each edge in the user topology graph represents the relationship between the users.

[0130] 320: The sampling module identifies the node to be identified among all nodes and obtains several local subgraphs in the user topology graph through a graph walk algorithm. It then determines the nodes within the group that require nature assessment, i.e., the accounts that need risk evaluation. This node nature assessment is essentially a judgment of account risk level. If most account nodes in the group are known to be high-risk or have been judged as high-risk, while the node to be identified is judged as a low-risk account, then account screening within the risky group is achieved.

[0131] It should be noted that the account screening in high-risk groups is merely one application scenario of the node nature determination method provided by this invention. In the embodiments of this invention, this application scenario is used to explain and illustrate the method, but it is not intended to limit the method. For example, in some embodiments, if most node accounts in the group are known to be low-risk accounts or are determined to be low-risk accounts, this method can also be used to screen high-risk accounts. Furthermore, the above method can be used to distinguish the different properties of nodes in a node cluster containing arbitrarily different attributes.

[0132] The sampling module obtains local subgraphs of the global topology graph through a graph walk algorithm. This is achieved by starting from any node in the graph and traversing using a pre-defined arbitrary graph walk algorithm. The walk algorithm can be for homogeneous graphs, heterogeneous graphs, or other methods used to obtain local subgraphs. In some embodiments, a random walk with restart algorithm is used to obtain the local subgraph. The number of nodes in the local subgraph can be predetermined or unlimited.

[0133] The collected sample pairs to be identified will be input into the model module, which includes a pre-trained judgment model.

[0134] 330: For each local subgraph, the model module uses a pre-trained judgment model to determine whether the local subgraph is a local subgraph that has been traversed from the node to be identified.

[0135] In some more specific embodiments, to facilitate the description of the relationship between the node to be identified and each local subgraph, the judgment result can be described in the form of sample pairs. A positive sample pair indicates that the local subgraph originates from the node to be identified, and a negative sample pair indicates that the local subgraph does not originate from the node to be identified. The output result can be described as used to determine whether the sample pair to be identified is a positive or negative sample pair. For example, there is node 1 in the entire graph, and a randomly selected local subgraph obtained through a walk algorithm... Figure 1 and local sub Figure 2 Then (node ​​1, local sub-node) Figure 1 ) and (node ​​1, local sub-) Figure 2 Both pairs of samples can form a pair to be identified. These two pairs are then input into a pre-trained judgment model, which is trained to determine whether a pair is positive or negative. Therefore, the judgment model can output the respective results for each pair. If the output is a positive pair, it indicates that the judgment model's prior knowledge considers the local sample pair to be a positive or negative pair. Figure 1 This is a local subgraph formed starting from node 1; similarly, if the output is a negative sample pair, it indicates that the prior knowledge of the judgment model considers the local subgraph to be... Figure 2 This is not a local subgraph originating from node 1. The sample pairs mentioned above are merely a form to describe the relationship between the node to be identified and the local subgraph; they do not restrict the input of the judgment model to sample pairs. Essentially, they are still used to determine the relationship between the local subgraph and the node to be identified.

[0136] 340: The judgment module identifies the properties of the node to be identified based on the judgment results for each local subgraph.

[0137] To explain the judgment logic between the output result and the node properties in the judgment module, it is necessary to elaborate on the training process of the judgment model.

[0138] In some embodiments, the model module further includes a training module for training the judgment model.

[0139] The training module obtains a sample graph. The set of nodes in the sample graph is called a sample group, and the relationship between nodes is called an edge. The first node in the sample group is determined, and the sample subgraph of the sample graph is obtained. The sample subgraph starting from the first node is stored as a positive sample pair training set, and the sample subgraph not starting from the first node is stored as a negative sample pair training set.

[0140] The training module determines the node representation of the first node, as well as the subgraph representations of each sample subgraph in the training set for positive sample pairs and negative sample pairs.

[0141] The training module establishes a training model based on node representation and subgraph representation, and trains the training model using positive sample pairs and negative sample pairs to obtain a trained judgment model.

[0142] In a more specific embodiment, the training module includes a contrastive sample pair sampling module and a neural network-based contrastive learning module.

[0143] The comparison sample pair sampling graph module starts from a sample obtained from a specific group through group mining. For example, taking node 6 in the group, it uses a random walk algorithm with a probability of returning to the previous position to sample a local subgraph of node 6. Then, this local subgraph is anonymized, and node 6 and the anonymized subgraph form a positive sample pair. The process for generating negative sample pairs is exactly the same, but the starting point of the random walk is not node 6 but another randomly selected node, such as node 8. Then, the anonymized local subgraph generated by node 6 and node 8 forms a negative sample pair. By sampling many positive and negative sample pairs in this way and storing them in a pool, this step is completed.

[0144] The sampled positive and negative pairs are used to train the graph neural network model. Assume there is a sample pair:

[0145]

[0146] Where v i Represents the target node, characterized by: This is a local subgraph, y i The label of the sample pair is P. When the local subgraph is obtained by walking the target node, then P... i For positive samples, y i The value is 1, otherwise y i The value is 0.

[0147] The contrastive learning module is further divided into three sub-modules: the GNN module, the graph readout module, and the discriminator module.

[0148] In some embodiments, the training module aggregates the information of the first node itself and the information of the neighboring nodes of the first node through a graph isomorphic neural network to obtain a node representation.

[0149] In some more specific embodiments, the GNN module simultaneously considers node attributes and topological information, aggregating the node's own information and its neighboring node information to obtain a node representation:

[0150]

[0151] in and These represent the node representation matrices of the (l-1)th layer and the lth layer, respectively. This represents the learnable convolutional parameter matrix of the (l-1)th layer. The above selection could include common graph network structures such as GCN, GAT, and GIN. Considering the need to extract subgraph representations, we use the graph isomorphic neural network GIN, which performs best on graph-level tasks.

[0152] The GNN module described above can obtain node representations, but we also compare the subgraph structures in the sample pairs. In some embodiments, the training module determines the subgraph representation based on the node representations of each node through a graph readout function.

[0153] In some more specific embodiments, after the representations of all nodes in the subgraph have been computed, the representation of the subgraph can be obtained by the graph readout module:

[0154]

[0155] in E represents the representation of a local subgraph. i The node representation matrix of the local subgraph, (E i ) k E represents i The k-th row, n i This indicates the number of nodes in the local subgraph.

[0156] In some embodiments, the training module establishes a bilinear scoring function based on the node representation and the subgraph representation as a training model.

[0157] In some more specific embodiments, the discriminator module receives a set of sample pairs consisting of a target node and a local subgraph, and determines the label of the sample pair:

[0158]

[0159] A simple bilinear scoring function is used here, where and W represents the target node representation and the local subgraph representation, respectively. (d) This represents the weight matrix of the discriminator. The resulting s i This represents the discriminator's prediction of the label for the current sample; the true label is represented by y. i This indicates that a common binary classification cross-entropy loss function is used for a batch of size N. The loss function is:

[0160]

[0161] in This represents the entire comparative learning module described above.

[0162] Based on the above sample collection and training process, and combined with the application scenario of risk gang screening, we can see that there are some basic characteristics within risk gangs, such as: 1. Most nodes are risky, and only a small number of nodes are not risky; and 2. An important characteristic of whether a node is risky is its relationship (agreement) with its neighboring subgraph.

[0163] Based on the first characteristic mentioned above, the trained model learned the connection relationship between risky nodes and their local subgraphs. However, since the proportion of risk-free nodes is very small, the connection relationship between risk-free nodes and their local subgraphs was not learned. Combined with the second characteristic, it can be concluded that even a well-trained judgment model cannot effectively distinguish between positive and negative sample pairs of risk-free nodes.

[0164] Therefore, in the process of the judgment module obtaining multiple outputs from the model module and judging the nature of the node to be identified based on these outputs, the higher the accuracy of multiple sets of samples of the node to be identified against the outputs obtained by the judgment model, the higher the probability that the node to be identified is a risk node. Conversely, the lower the accuracy of multiple sets of samples of the node to be identified against the outputs obtained by the judgment model, and even the higher the probability that the same sample will produce different outputs multiple times through the judgment model, the higher the probability that the node to be identified is a risk node.

[0165] In some embodiments, the output of the model is the predicted score of the sample pair to be identified. The predicted score is used to classify positive and negative sample pairs, and the nature of the node to be identified is determined based on the distribution of multiple predicted scores. In some binary classification models, the output is a numerical value within a preset range, and classification is performed based on the range in which the value falls. As in the aforementioned embodiments, s i If the predicted score can be considered as a representation of the output result, then the accuracy of the result can be judged more intuitively and quantitatively by the distribution of the predicted score.

[0166] Furthermore, in some embodiments, if the degree of discretization at both extremes of the predicted score is lower than a preset level, the node to be identified is determined to have the first property. Since the predicted score is within a preset range, for example, s... i If the predicted score is set between [0.1], then a predicted score close to 1 indicates a positive sample pair, and close to 0 indicates a negative sample pair. Therefore, for risk points, the predicted scores obtained by the model for the sample pairs to be identified will be closer to either extreme. Conversely, for non-risk points, the predicted scores for the sample pairs to be identified will be less clear, and may even fluctuate within the acceptable data range, exhibiting a lower degree of polarization.

[0167] Optionally, in some embodiments, to further quantify the degree of separation, the nature of the node to be identified is determined based on the distribution of multiple predicted scores, including:

[0168] Obtain n positive sample pairs and the predicted score of each positive sample pair for the node to be identified, and n negative sample pairs and the predicted score of each negative sample pair.

[0169] Calculate the average difference between the predicted scores of negative sample pairs and the predicted scores of positive sample pairs. If the average difference is less than a preset threshold, the node to be identified is determined to be of the first property.

[0170] In a more specific embodiment, this application defines a function f(v) for calculating the outlier score of a target node. i ):

[0171]

[0172] Where R represents the number of positive and negative samples sampled from the node. The difference in scores between positive and negative samples is calculated and averaged to eliminate random errors. For risky nodes, the model can accurately determine the Si value of its sample pairs. For negative sample pairs of this node, the predicted Si(-) value tends to 0, and the predicted Si(+) value for positive samples tends to 1, with the average difference tending to -1. However, for low-risk nodes, the model's judgment is ambiguous, causing both Si(-) and Si(+) to fluctuate around the median value, and the difference tends to 0. Therefore, from the perspective of outlier scores, for nodes that constitute the majority of the group, such as risky nodes, the score tends to be close to -1; for nodes that constitute a minority, such as risk-free nodes, the score tends to be close to 0. In other words, nodes with outlier scores close to 0 can be identified as corresponding to low-risk accounts within risky groups, thus eliminating potential outliers.

[0173] The node property judgment device provided by this invention encodes data using a graph neural network based on comparative learning sample pairs. It considers node attributes, local structure, and differences in connections between different nodes and their local subgraphs, thus providing a thorough understanding of graph relationships. Model training relies on a self-supervised task of distinguishing between positive and negative sample pairs, eliminating the need for business label input. The node-subgraph level sample pair design allows for local sampling of each node, enabling distributed processing even with large groups or subgraphs. Furthermore, the fundamental assumption that most nodes within a risky group are at risk while a small number are not remains unchanged when business risks change; therefore, the model can still function normally without retraining.

[0174] One embodiment of the present invention also provides a computer-readable storage medium storing a computer program that, when executed in a computer, causes the computer to perform the steps of the node property determination method described in the above embodiments of the present invention. Since the steps performed are the same as those of the node property determination method described above, they will not be repeated here.

[0175] One embodiment of the present invention provides a computing device including a memory and a processor. The memory stores executable code. When the processor executes the executable code, it performs the steps of the node property determination method described in the above embodiment of the present invention. Since the steps performed are the same as those performed by the node property determination method described above, they will not be described again here.

[0176] It should be noted that the above examples are merely specific embodiments of the present invention, and the present invention is obviously not limited to the above embodiments, with many similar variations. All modifications that can be directly derived or conceived by those skilled in the art from the content disclosed in this invention should fall within the protection scope of this invention.

Claims

1. A method for determining node properties, comprising the following steps: Obtain the user topology graph that needs to be screened after being mined by gangs. The set of nodes in the user topology graph is the risk gang. Each node in the user topology graph is used to represent each account in the risk gang. Each edge in the user topology graph is used to represent the interaction relationship between the accounts. The node to be identified is determined among the nodes, and several local subgraphs in the user topology graph are obtained through a graph walk algorithm. The local subgraphs correspond to a group of accounts that are in a community, closely related, and likely to be at risk. The node to be identified is paired with several corresponding local subgraphs to form a node-local subgraph pair. The node-local subgraph pair is input into a pre-trained judgment model. The output of the judgment model is a predicted score. The predicted score is used to determine whether the local subgraph is a local subgraph that originated from the node to be identified. The properties of the node to be identified are determined based on the distribution of multiple predicted scores for each node.

2. The node property determination method as described in claim 1, which determines the property of the node to be identified based on the distribution of multiple predicted scores, includes: If the degree of discretization of the predicted score at both ends is lower than a preset level, the node to be identified is determined to be of the first nature.

3. The node property determination method as described in claim 1, which determines the property of the node to be identified based on the distribution of multiple predicted scores, includes: Obtain the first predicted scores of n local subgraphs that originate from the node to be identified, and the second predicted scores of n local subgraphs that do not originate from the node to be identified. Calculate the average difference between the second predicted score and the first predicted score. If the average difference is less than a preset threshold, determine that the node to be identified is of the first nature.

4. The node property determination method as described in claim 1, wherein obtaining several local subgraphs in the user topology graph through a graph walk algorithm includes: Starting from any node in the graph, a random walk algorithm is used to obtain several local subgraphs in the user topology graph.

5. The node property determination method as described in claim 1, wherein the determination model is obtained based on the following steps: Obtain the sample image, where, In the sample graph, nodes represent sample users, sets of nodes represent sample groups, and edges between nodes represent the relationships between sample users. Determine the first node in the sample group and obtain the sample subgraphs of the sample graph. The sample subgraphs starting from the first node are stored as the positive sample pair training set, and the sample subgraphs not starting from the first node are stored as the negative sample pair training set. Determine the node representation of the first node, and the subgraph representation of each sample subgraph in the training set of positive sample pairs and negative sample pairs; A training model is established based on node representation and subgraph representation. The training model is then trained using positive and negative sample pairs to obtain a well-trained judgment model.

6. The node property determination method as described in claim 5, determining the node representation of the first node, includes: By using a graph isomorphic neural network, the information of the first node itself and the information of the first node's neighboring nodes are aggregated to obtain the node representation.

7. The node property determination method as described in claim 5, determining the subgraph representation of each sample subgraph, includes: Obtain the node representation of each node included in the sample subgraph; Based on the node representations of each node, the subgraph representation is determined through the graph readout function.

8. The node property determination method as described in claim 5, comprising establishing a training model based on node representation and subgraph representation, including: A bilinear scoring function is established based on the node representation and the subgraph representation, which serves as the training model.

9. The node property determination method as described in claim 5, wherein obtaining the sample subgraph of the sample graph includes: The training set of positive sample pairs and negative sample pairs corresponding to the first node is collected using a random walk algorithm.

10. The node property determination method as described in claim 5, after obtaining the sample subgraph of the sample graph, the method further includes: The sample subgraphs are anonymized and stored in the corresponding positive sample pair training set or negative sample pair training set.

11. A node property determination device, comprising a model module, and a sampling module and a determination module communicating with the model module via data: The sampling module obtains a user topology graph that needs to be screened out after gang mining. The set of nodes in the user topology graph is a risk gang. Each node in the user topology graph is used to represent each account in the risk gang. Each edge in the user topology graph is used to represent the interaction relationship between the accounts. The sampling module determines the node to be identified among the nodes and obtains several local subgraphs in the user topology graph through a graph walking algorithm. The local subgraphs correspond to a group of accounts that are in a community, closely related, and likely to be at risk. The model module forms a node-local subgraph pair by pairing the node to be identified with several corresponding local subgraphs. The node-local subgraph pair is then input into a pre-trained judgment model. The output of the judgment model is a prediction score, which is used to determine whether the local subgraph is a local subgraph that originated from the node to be identified. The judgment module identifies the nature of the node to be identified based on the distribution of multiple predicted scores for each node.

12. The node property determination device as described in claim 11, wherein the determination module is further configured to determine that the node to be identified has a first property when the degree of discretization of the two poles of the predicted score is lower than a preset degree.

13. The node property determination device as described in claim 11, wherein the determination module is further used for Obtain the first predicted scores of n local subgraphs that originate from the node to be identified, and the second predicted scores of n local subgraphs that do not originate from the node to be identified. Additionally, the average difference between the second predicted score and the first predicted score is calculated, and when the average difference is less than a preset threshold, the node to be identified is determined to be of the first nature.

14. The node property determination device as described in claim 11, wherein the model module further comprises a training module for training the determination model. The training module obtains sample images, where, In the sample graph, nodes represent sample users, sets of nodes represent sample groups, and edges between nodes represent the relationships between sample users. Determine the first node in the sample group and obtain the sample subgraphs of the sample graph. The sample subgraphs starting from the first node are stored as the positive sample pair training set, and the sample subgraphs not starting from the first node are stored as the negative sample pair training set. The training module determines the node representation of the first node, as well as the subgraph representations of each sample subgraph in the training set of positive sample pairs and negative sample pairs. The training module establishes a training model based on node representation and subgraph representation, and trains the training model using positive sample pairs and negative sample pairs to obtain a trained judgment model.

15. The node property determination device as described in claim 14, wherein the training module aggregates the information of the first node itself and the information of the neighboring nodes of the first node through a graph isomorphic neural network to obtain a node representation.

16. The node property determination device as described in claim 14, wherein the training module determines the subgraph representation based on the node representation of each node through a graph readout function.

17. The node property determination device as described in claim 14, wherein the training module establishes a bilinear scoring function based on the node representation and the subgraph representation as a training model.

18. The node property determination device as described in claim 14, wherein the training module collects sample subgraphs through a random walk algorithm, anonymizes the sample subgraphs, and stores them in the corresponding positive sample pair training set or negative sample pair training set.

Images