Graph feature search method and system for risk transaction capture

Abstract

The present disclosure proposes a graph feature search method for risk transaction capture. The method comprises: constructing graph features and their initial search space based on transaction data; obtaining a plurality of candidate graph features from the initial search space, wherein each candidate graph feature comprises an information aggregation representation; determining a mutation position and a mutation value to obtain feature feedback by using a reinforcement learning strategy; reducing the initial search space based on the feature feedback to obtain a target search space; obtaining a target graph feature from the target search space; and capturing a risk transaction in the transaction data by using the target graph feature.

Description

Technical Field

[0001] This disclosure relates primarily to the field of machine learning, and in particular to graph feature search methods and systems for risky transaction capture. Background Technology

[0002] In the real world, connections between transactions don't always exist on individual objects, but rather on commonalities between them. For example, in a transaction network, by accumulating the transaction amounts of all accounts under the same card for a user over a period of time, it's possible to determine whether a user's transactions pose a risk. This accumulated information can be described using graph features.

[0003] Graph features can effectively reveal relationships between things and improve modeling results. However, obtaining graph features requires continuous case analysis using existing data, and organizing manually extracted patterns into feature generation logic, a process that consumes significant human resources. Features obtained through representation learning methods, such as deep representation learning, have poor interpretability and are sometimes unusable directly. Furthermore, features obtained through existing techniques are often aggregations of first-degree information, unable to leverage second-degree or higher information to characterize features, thus lacking efficient utilization of graph features.

[0004] In view of this, we hope to propose an improved graph feature search method and system that can automatically obtain effective graph features, reduce human input, reduce feature engineering time, and improve modeling results. Summary of the Invention

[0005] The following provides a brief overview of one or more aspects to offer a basic understanding of them. This overview is not an exhaustive summary of all conceived aspects, nor is it intended to identify the key or decisive elements of all aspects, nor to define the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as an introduction to the more detailed description that follows.

[0006] This disclosure proposes a graph feature search method for capturing risky transactions, comprising: constructing graph features and an initial search space based on transaction data; obtaining multiple candidate graph features from the initial search space, wherein each candidate graph feature includes an information aggregation representation; using a reinforcement learning strategy to determine the mutation location and mutation value to obtain feature feedback; reducing the initial search space based on the feature feedback to obtain a target search space; obtaining target graph features from the target search space; and using the target graph features to capture risky transactions in the transaction data.

[0007] In one embodiment of this disclosure, each candidate graph feature includes a subject, an object, a time window, filtering conditions, and a graph structure.

[0008] In one embodiment of this disclosure, information aggregation refers to the aggregation of second-degree information and / or information of more than two degrees.

[0009] In one embodiment of this disclosure, the plurality of candidate graph features includes randomly generated graph features and previously evaluated graph features.

[0010] In one embodiment of this disclosure, each candidate graph feature is a Graph Query Language (GQL) feature.

[0011] In one embodiment of this disclosure, using a reinforcement learning strategy to determine the mutation location and mutation value to obtain feature feedback further includes: using the reinforcement learning strategy to recommend the mutation location and mutation value; applying the mutation location and mutation value to the plurality of candidate map features to obtain a plurality of mutated map features; and determining and evaluating the feature value of each mutated map feature to obtain the feature feedback.

[0012] In one embodiment of this disclosure, determining and evaluating the feature value of each variant graph feature to obtain the feature feedback further includes: determining a metric for the feature value of each variant graph feature; filtering out variant graph features whose metrics do not meet the criteria; and determining the importance of the retained variant graph features as the feature feedback.

[0013] In one embodiment of this disclosure, the metric includes at least one of the following: variance, missing value ratio, chi-square value, IV value, and PSI value.

[0014] In one embodiment of this disclosure, determining the importance of the retained variant graph features further includes: inputting the retained variant graph features into a tree model to determine the importance.

[0015] In one embodiment of this disclosure, reducing the initial search space based on the feature feedback to obtain the target search space further includes iteratively performing the following steps until the feature feedback meets a preset condition: adjusting the reinforcement learning strategy based on the feature feedback; using the adjusted reinforcement learning strategy to determine new mutation locations and mutation values ​​to obtain multiple new mutation map features; determining and evaluating the feature value of each new mutation map feature to obtain new feature feedback; and reducing the initial search space based on the new feature feedback.

[0016] In one embodiment of this disclosure, the mutation location is one of a plurality of candidate mutation locations of the graph feature, and the mutation value is one of a plurality of candidate feature values ​​of the graph feature.

[0017] This disclosure also proposes a graph feature search system for capturing risky transactions, comprising: a search space construction module for constructing graph features and an initial search space based on transaction data; a candidate graph feature module for obtaining multiple candidate graph features from the initial search space, wherein each candidate graph feature includes an information aggregation representation; a graph feature mutation module for using a reinforcement learning strategy to determine mutation locations and mutation values ​​to obtain feature feedback; a search space reduction module for reducing the initial search space based on the feature feedback to obtain a target search space; a target graph feature module for obtaining target graph features from the target search space; and a capture module for using the target graph features to capture risky transactions in the transaction data.

[0018] This disclosure also proposes a computer-readable storage medium storing a computer program that can be executed by a processor to perform the aforementioned graph feature search method for risk transaction capture.

[0019] The technical solution disclosed herein obtains information aggregation representations of degree two and above by defining the representation of graph features. Simultaneously, it utilizes reinforcement learning strategies to obtain the location and specific values ​​of feature mutations, reducing the search space and ensuring the generation of effective graph features within a reasonable timeframe. Attached Figure Description

[0020] The features, essence, and advantages of this disclosure will become more apparent when understood in conjunction with the accompanying drawings. In the drawings, the same reference numerals are consistently used accordingly. It should be noted that the described drawings are schematic and non-limiting. In the drawings, some parts may be enlarged and are not drawn to scale for illustrative purposes.

[0021] Figure 1 A schematic architecture diagram of graph feature search according to an embodiment of the present disclosure is shown.

[0022] Figure 2 An exemplary flowchart of a graph feature search method for risk transaction capture according to an embodiment of the present disclosure is shown.

[0023] Figure 3 An exemplary GQL graph feature of an embodiment of this disclosure is shown.

[0024] Figure 4 A schematic diagram of reinforcement learning is shown.

[0025] Figure 5 An exemplary process for reducing the initial search space based on feature feedback, according to an embodiment of this disclosure, is shown.

[0026] Figure 6 A schematic diagram illustrating search space reduction according to an embodiment of the present disclosure is shown.

[0027] Figure 7 An exemplary process for capturing risky transactions using the graph feature search method of this disclosure is shown.

[0028] Figure 8 A block diagram of a graph feature search system for risk transaction capture according to an embodiment of the present disclosure is shown.

[0029] Figure 9 A device block diagram of a graph feature search system for risk transaction capture, according to an embodiment of the present disclosure, is shown. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the described exemplary embodiments. However, it will be apparent to those skilled in the art that the described embodiments can be practiced without some or all of these specific details. In other exemplary embodiments, well-known structures have not been described in detail to avoid unnecessarily obscuring the concepts of this disclosure. It should be understood that the specific embodiments described herein are merely illustrative of this disclosure and are not intended to limit it. Furthermore, the various aspects described in the embodiments can be combined arbitrarily without conflict.

[0031] As mentioned above, the process of organizing manually extracted patterns into feature generation logic consumes a significant amount of human resources. Furthermore, existing technologies produce features with poor interpretability, often representing aggregations of first-degree information, unable to utilize second-degree or higher information to characterize features, thus lacking the ability to fully leverage graph features.

[0032] In view of this, this disclosure proposes an improved graph feature search method and system.

[0033] Figure 1 A schematic architecture diagram 100 is shown for graph feature search according to an embodiment of the present disclosure.

[0034] In this disclosure, graph features refer to local or global features of a graph obtained through a certain method of graph construction, including but not limited to the aggregation of first-degree and second-degree information. Graph construction here refers to an algorithm that connects nodes through relationships and groups related points into a subgraph. Furthermore, as used herein, graph feature generation / graph feature search refers to a method for automatically generating graph features, which optimizes and computes effective graph features (e.g., graph features that meet preset conditions / requirements) within a graph feature search space.

[0035] For example, user transaction data can be graphed, and the characteristics of user transaction data can be described by generating effective graph features.

[0036] It should be noted that although most of the descriptions in this disclosure are based on transaction data and risky transaction scenarios, the technical solutions of this disclosure can be applied to various suitable scenarios related to graph features in other fields, such as social network scenarios, product recommendation scenarios, etc.

[0037] like Figure 1 As shown, in the graph feature generation stage, variant graph features can be obtained based on the input candidate graph features.

[0038] In one embodiment of this disclosure, candidate graph features may come from two parts: one part comes from randomly generated graph features, and the other part comes from graph features with higher scores among previously evaluated features (e.g., graph features with scores exceeding a certain value, graph features with high scores, etc.).

[0039] Candidate graph features are mutated into new graph features (also referred to as "mutated graph features" in this paper) through reinforcement learning strategies. Mutated graph features differ from the original candidate graph features by altering / mutating at one or more locations. Specifically, the reinforcement learning strategy recommends mutation locations and values ​​based on the candidate graph features, causing the values ​​at these mutation locations to change, thus obtaining the mutated graph features. Reinforcement learning and reinforcement learning strategies will be described in further detail below.

[0040] After obtaining the features of the variogram, the graph features are determined. Here, the true feature values ​​of the variogram features are determined (e.g., calculated) based on the graph data.

[0041] After determining the eigenvalues, the eigenvalues ​​can be evaluated. For example, the variance, missing value ratio, chi-square value, IV value, PSI value, etc., of each eigenvalue can be evaluated. Subsequently, ineligible eigenvalues ​​can be removed, and the remaining eigenvalues ​​can be evaluated to determine their importance.

[0042] After feature evaluation, the obtained feature information can be used as feature feedback to feed back into reinforcement learning, thereby optimizing the reinforcement learning strategy. For example, feature importance can be used as feature feedback. Simultaneously, features with higher feature importance are selected as candidate map features, and the entire process is iterated again until the feature feedback meets preset conditions. At this point, the optimization of the reinforcement learning strategy can be considered complete. It should be noted that feature importance is only one example of feature feedback and not a limitation. In practical implementations, those skilled in the art can use other suitable metrics as feature feedback.

[0043] The graph features obtained after the iteration can be used as the system output.

[0044] Figure 2An exemplary flowchart of a graph feature search method 200 for risk transaction capture according to an embodiment of the present disclosure is shown.

[0045] Method 200 begins with step 202. In step 202, graph features and their initial search space are constructed based on the transaction data.

[0046] In one embodiment of this disclosure, transaction data can be all data related to transactions performed by a user within a specific time period. After obtaining this data, a graph (such as a static graph or a dynamic graph) can be constructed based on the transaction data.

[0047] In some implementations, each node in the graph can represent a user, and user information can be included in the node's attributes. Edges between adjacent nodes can represent transactional relationships between different users, and transaction-related features can be included in the edge's attributes. In a preferred implementation, a dynamic graph can be constructed to reflect the characteristics of user transactions changing over time.

[0048] After constructing the graph based on transaction data, various graph features are obtained, and all graph features and their combinations constitute the initial search space. In an alternative embodiment, all graph features can be processed to obtain the initial search space. For example, in a risk transaction capture scenario, graph features that are irrelevant or have little correlation with the user's risk transactions (such as graph features related to the user's health data) can be filtered out. In a product recommendation scenario, graph features that are irrelevant or have little correlation with the user's purchasing habits can be filtered out. In this way, the initial search space can be kept small, thereby improving the efficiency of graph feature search.

[0049] In step 204, multiple candidate graph features are obtained from the initial search space, wherein each candidate graph feature includes an information aggregation representation.

[0050] In one embodiment of this disclosure, each candidate graph feature includes a subject, an object, a time window, filtering conditions, an aggregation function, and a graph structure. The aggregation function enables the aggregated representation of information. The detailed structure of the candidate graph features will be described below. Figure 3 Further description is required.

[0051] In one embodiment of this disclosure, information aggregation refers to the aggregation of second-degree information and / or higher-degree information. By utilizing second-degree information and / or higher-degree information, graph features can be characterized more effectively.

[0052] In one embodiment of this disclosure, the plurality of candidate graph features may include randomly generated graph features and previously evaluated graph features (e.g., graph features with higher scores / better performance in previous evaluations).

[0053] In one embodiment of this disclosure, each candidate graph feature is a Graph Query Language (GQL) feature.

[0054] In step 206, a reinforcement learning strategy is used to determine the mutation location and mutation value to obtain feature feedback.

[0055] In one embodiment of this disclosure, the mutation location is one of a plurality of candidate mutation locations of the graph feature, and the mutation value is one of a plurality of candidate feature values ​​of the graph feature.

[0056] By employing reinforcement learning strategies, the mutation locations and values ​​of feature mutations can be recommended, thereby reducing the search space, ensuring the generation of effective graph features within a reasonable time, and improving the efficiency of graph feature generation.

[0057] Although this disclosure describes the use of reinforcement learning strategies to control feature mutation, other algorithms can be used in practice. For example, a genetic algorithm can be used to control feature mutation, prioritizing the mutation of superior parent features to generate child features, and continuously optimizing the seed pool to improve the quality of the generated features.

[0058] In one embodiment of this disclosure, using a reinforcement learning strategy to determine the mutation location and mutation value to obtain feature feedback further includes: using a reinforcement learning strategy to recommend mutation locations and mutation values; applying the mutation locations and mutation values ​​to multiple candidate map features to obtain multiple mutated map features; and determining and evaluating the feature value of each mutated map feature to obtain feature feedback.

[0059] In one embodiment of this disclosure, determining and evaluating the feature value of each variant graph feature to obtain feature feedback further includes: determining a metric for the feature value of each variant graph feature; filtering out variant graph features whose metrics do not meet the criteria; and determining the importance of the retained variant graph features as feature feedback.

[0060] In one embodiment of this disclosure, the metric may include at least one of the following: variance, missing value ratio, chi-square value, IV value, and PSI value.

[0061] Variance represents the difference between each variable (observation) and the population mean.

[0062] The proportion of missing values ​​can be expressed as the number of missing features divided by the total number of samples.

[0063] The chi-square value reflects the degree of deviation between the actual observed values ​​and the theoretically predicted values ​​of a statistical sample. The larger the chi-square value, the greater the deviation; conversely, the smaller the deviation.

[0064] Information Values ​​(IVs) are primarily used to encode and evaluate the predictive power of input variables. The magnitude of a feature variable's IV value indicates the strength of its predictive power. A higher IV value indicates a stronger predictive power.

[0065] The PSI (population stability index) value is used to measure the difference in the distribution of scores between the test sample and the model development sample, and is a common indicator for evaluating model stability. The smaller the PSI value, the smaller the difference between the two distributions, and thus the more stable the model.

[0066] After determining the metric for the feature value, features of the variant graph that do not meet the criteria can be filtered out. Specifically, the criteria that the metric must meet can be preset, and when the determined metric does not meet the preset criteria, the corresponding variant graph feature can be filtered out.

[0067] For example, when measuring the proportion of missing values, a preset condition can be that the proportion of missing values ​​does not exceed a specific threshold. For instance, if the proportion of missing values ​​exceeds 0.1, the feature can be considered unreasonable. When measuring the IV value, a preset condition can be that the IV value is greater than a specific threshold. For instance, if the IV value is less than or equal to 0.02, the feature can be considered to have no predictive power. When measuring the PSI value, a preset condition can be that the PSI value does not exceed a specific threshold. For instance, if the PSI value exceeds 0.25, the feature can be considered unstable. In this case, features that do not meet the preset conditions can be removed.

[0068] It should be noted that the above-mentioned metrics and specific preset conditions are provided only as examples. In actual implementation, those skilled in the art may also adopt other metrics and / or other appropriate preset conditions according to the actual situation.

[0069] The importance of graph features can be measured in various ways. In one embodiment of this disclosure, a tree model can be used to measure the importance of retained variant graph features.

[0070] Tree models are a widely used type of model in the field of machine learning. Common tree models include decision trees, random forests, XGBoost, and so on.

[0071] In this disclosure, XGBoost is preferably used. XGBoost expands the objective function to a second-order Taylor series, thus preserving more information about the objective function. Simultaneously, XGBoost incorporates L2 regularization terms for the leaf weights, which helps the model achieve lower variance. Furthermore, XGBoost adds a strategy for automatically handling missing value features, automatically partitioning samples with missing values ​​without requiring preprocessing to impute missing features.

[0072] In one embodiment of this disclosure, the total_gain value output by XGBoost can be selected as a metric for feature importance. Total_gain represents the total gain brought by a certain feature in each node split.

[0073] The specific implementations of the aforementioned tree models are well-known in the field of machine learning and will not be elaborated upon here.

[0074] The use of XGBoost to measure the importance of graph features described above is merely exemplary and not restrictive. In different implementations, other models or metrics can be used to measure feature importance.

[0075] In step 208, the initial search space is reduced based on the feature feedback to obtain the target search space.

[0076] In one embodiment of this disclosure, reducing the initial search space based on the feature feedback to obtain the target search space further includes iteratively performing the following steps until the feature feedback meets a preset condition: adjusting the reinforcement learning strategy based on the feature feedback; using the adjusted reinforcement learning strategy to determine new mutation locations and mutation values ​​to obtain multiple new mutation map features; determining and evaluating the feature value of each new mutation map feature to obtain new feature feedback; and reducing the initial search space based on the new feature feedback.

[0077] The detailed process of reducing the initial search space will be described below. Figure 5 Further description is required.

[0078] In step 210, target graph features are obtained from the target search space.

[0079] When the feature feedback meets preset conditions, the quality of the graph features in the target search space can be considered relatively high (e.g., meeting preset requirements). Graph features can be obtained from the target search space as target graph features. In some embodiments, graph features can be randomly selected from the target search space as target graph features. In alternative embodiments, graph features can be selected from the target search space as target graph features according to certain rules. For example, the graph feature with the highest importance can be selected from the target search space as the target graph feature.

[0080] In step 212, the target graph features are used to capture risky transactions in the transaction data.

[0081] Target graph features can effectively represent risk patterns in transaction data, and based on these patterns, risky transactions can be captured from user transaction data. Target graph features can characterize the commonalities of risky transactions, allowing for the identification of these commonalities. For example, by using "the cumulative transaction amount of all accounts under the same card within a specific time period" as the target graph feature, potential risky transactions of a user can be identified efficiently and accurately. Therefore, this target graph feature demonstrates excellent performance and good interpretability.

[0082] In practice, target graph features can also be used in combination with other models and strategies in risk control schemes to more effectively identify / capture risky transactions.

[0083] Figure 3 An exemplary GQL graph feature 300 of an embodiment of this disclosure is shown.

[0084] In one embodiment of this disclosure, GQL graph features are used to characterize graph features, thereby obtaining a second-degree or higher information aggregation representation. Figure 3 An exemplary two-degree GQL graph feature is shown.

[0085] In one embodiment of this disclosure, the GQL graph features mainly include six components: subject, object, time window, filtering conditions, aggregation function (AGG_FUNCTION), and graph structure. The time window is included in the graph construction logic and filtering conditions, and the aggregation function can realize the aggregation representation of information.

[0086] Each variable position / component of a GQL graph feature can be represented as a slot. By embedding each slot, the entire GQL graph feature can be transformed into an embedding representation, which can then be fed into a reinforcement learning model for further training.

[0087] When performing feature mutation, one or more components can be selected from the six components of the GQL graph feature for mutation.

[0088] It should be noted that Figure 3 The GQL graph features shown are merely examples and not limiting. In actual implementations, those skilled in the art can define different forms of GQL graph features.

[0089] Figure 4 A schematic diagram 400 of reinforcement learning is shown.

[0090] Reinforcement learning (also known as reward learning, evaluation learning, or reinforcement learning) is a paradigm and methodology of machine learning used to describe and solve problems in which an agent learns strategies to maximize rewards or achieve specific goals during its interaction with the environment.

[0091] In reinforcement learning, the agent and the environment are interactive entities. The agent can perceive the state of the external environment and the rewards received, and then learn and make decisions. The agent's decision-making function refers to taking different actions based on the state of the external environment, while its learning function refers to adjusting its strategy based on the rewards received from the external environment. The environment consists of everything outside the agent, and its state is changed by the agent's actions, providing the agent with corresponding rewards.

[0092] Reinforcement learning has four elements: state, action, policy, and reward. State refers to the information the agent acquires from the environment; action refers to the agent's behavioral representation; reward refers to the environment's feedback on the action; and policy refers to the function by which the agent takes its next action based on the state.

[0093] Reinforcement learning is a process in which an agent learns through trial and error, using rewards gained from interacting with the environment to guide its actions. Its ultimate goal is to find an optimal policy that allows the agent to obtain as many rewards as possible from the environment.

[0094] Taking the GQL graph features disclosed herein as an example, the state (S) t () can refer to candidate GQL graph features. For example, candidate GQL graph features can have the following form:

[0095] (n1:USER)[e1:RED_PACKET_TRANSACTION WHERE amt<=1]->(n2:USER)WHEREn1.id<>n2.id RETURN n1.id AS n1,STD(DISTINCT e1.62)AS aggResult GROUP BY n1

[0096] Action (A) t This can refer to modifying one or more of the six components of a GQL graph feature, such as modifying the filter condition, changing the filter condition "amt<=1" to "amt>100AND amt<=500".

[0097] Next state (S) t+1This refers to new GQL graph features obtained through the current state and actions. For example, new GQL graph features can be obtained by mutating the filtering conditions of the above candidate GQL graph features:

[0098] (n1:USER)-[e1:RED_PACKET_TRANSACTION WHERE amt>100AND amt<=500]->(n2:USER)WHERE n1.id<>n2.id RETURN n1.id AS n1,STD(DISTINCT e1.62)ASaggResult GROUP BY n1

[0099] Rewards (R) t This can refer to performing analysis such as IV, variance, and chi-square values ​​on new GQL graph features, and then inputting them into a tree model to obtain feature importance. In this disclosure, "reward," "feedback," and "feature feedback" can be used interchangeably.

[0100] The specific implementation of reinforcement learning is well known in this field and will not be elaborated here.

[0101] Figure 5 An exemplary process 500 for reducing the initial search space based on feature feedback, according to an embodiment of this disclosure, is shown. Process 500 may be part of 200 (e.g., step 208).

[0102] Process 500 begins at step 502. In step 502, the reinforcement learning policy is adjusted based on feature feedback (e.g., feature feedback obtained in step 206).

[0103] In step 504, a modified reinforcement learning strategy is used to determine new mutation locations and mutation values ​​to obtain multiple new mutation map features.

[0104] In some implementations, the value at a single position can be mutated. In other implementations, the value at multiple positions can be mutated.

[0105] Combining the above text Figure 3 and Figure 4 Taking the described GQL graph features as an example, one or more parts of the GQL graph features can be mutated. For instance, the filter condition can be mutated, changing the filter condition "amt<=1" to...

[0106] The mutation is defined as "amt > 100 AND amt <= 500". For each mutation location, a set of candidate 5 mutation values ​​can be pre-set. When mutating a specific location of a graph feature, the corresponding set of candidate values ​​can be selected.

[0107] Select one variant from the variants (e.g., randomly select, select according to a predetermined rule, etc.).

[0108] In step 506, the eigenvalues ​​of each new variant feature are determined and evaluated to obtain new feature feedback.

[0109] In one embodiment of this disclosure, determining and evaluating the eigenvalues ​​of each new variant map feature to obtain new feature feedback further includes: determining a metric for the eigenvalues ​​of each new variant map feature (e.g., the proportion of missing values ​​of 0, IV value, etc.); and filtering out variant map features whose feature feedback metrics do not meet the criteria (e.g., filtering out features with missing values ​​of 0, IV value, etc.).

[0110] Variant features with a loss ratio exceeding 0.1, and variant features with an IV value exceeding 0.25 are filtered out; the importance of the retained variant features (e.g., the total_gain value output by the XGBoost tree model) is determined as new feature feedback.

[0111] In step 508, the initial search space is reduced based on the new feature feedback.

[0112] 5. In practical implementation, various methods can be used to reduce the initial search space. For example, if the new feature feedback is better than the feature feedback in the previous iteration (e.g., in the case of feature importance, the new feature importance is higher than the feature importance in the previous iteration), then the mutation map features from the previous iteration can be filtered out from the initial search space.

[0113] Feature feedback can filter out mutated graph features from the initial search space during this iteration. By mutating features to zero and reducing the initial search space, the quality of the graph features retained in the reduced search space can be continuously improved.

[0114] In decision box 510, determine whether the feature feedback meets the preset conditions.

[0115] If the feature feedback meets the preset conditions, the iteration is complete, and process 500 ends. The search space obtained at this point is the target search space.

[0116] 5. If the feature feedback does not meet the preset conditions, process 500 proceeds to step 502 for the next iteration.

[0117] For example, a preset condition could be that the feature importance meets a preset threshold. This preset threshold can be set based on experience, through training or experimentation, or through theoretical calculations. Different preset conditions can also be set in different implementations.

[0118] Figure 6A schematic diagram 600 illustrating search space reduction according to an embodiment of the present disclosure is shown.

[0119] As shown in the figure, a feature feedback can be obtained based on the initial search space. For example, it can be obtained through... Figure 2 Step 206 can obtain the feature feedback.

[0120] Subsequently, the initial search space can be reduced based on this feature feedback to obtain a reduced search space. For example, if the feature feedback does not meet certain requirements (such as the feature feedback not reaching a certain threshold), the corresponding graph features can be filtered out from the initial search space.

[0121] New feature feedback can be obtained based on this reduced search space. For example, it can be achieved through... Figure 5 Step 506 obtains the new feature feedback.

[0122] Next, a preset condition judgment can be made on the new feature feedback to determine whether the new feature feedback meets the preset conditions.

[0123] If the preset conditions are not met, the next iteration can proceed. In the next iteration, the search space is further reduced based on the new feature feedback.

[0124] As mentioned above, space reduction can be performed based on a comparison of feature feedback in adjacent iterations. Specifically, if the feature feedback in the current iteration is better than the feature feedback in the previous iteration, the graph features corresponding to the feature feedback in the previous iteration can be removed from the search space; conversely, if the feature feedback in the previous iteration is better than the feature feedback in the current iteration, the graph features corresponding to the feature feedback in the current iteration can be removed from the search space. Again, this space reduction method is merely exemplary and not restrictive. In practical implementations, those skilled in the art can employ different methods to perform space reduction.

[0125] If the preset conditions are met, the iteration can end. The search space at this point can be used as the target search space.

[0126] Through multiple iterative processes (such as...) Figure 6 (As shown in the dashed box in the image), the search space can be continuously reduced until the target search space is obtained.

[0127] Figure 7 An exemplary process 700 for capturing risky transactions using the graph feature search method of this disclosure is shown.

[0128] At the start of process 700, user transaction data can be obtained first.

[0129] In some implementations of this disclosure, the user transaction data can be some or all transaction data of a single user within a certain time period (e.g., one day, one week, one month, etc.). In other implementations, the user transaction data can be some or all transaction data of multiple users (e.g., multiple users belonging to the same organization, multiple users in the same region, etc.) within a certain time period. In the case of multiple users, the transaction data can reflect the financial interaction relationships between these users.

[0130] After obtaining user transaction data, graphs can be constructed based on the transaction data.

[0131] As mentioned above, static or dynamic graphs can be constructed based on transaction data. Specifically, nodes in the graph can correspond to user information, and edges can correspond to user transaction information. In a preferred embodiment, a dynamic graph can be used to represent changes in transactions over time.

[0132] After the graph is constructed, the graph feature search scheme disclosed herein can be used to obtain the target graph features.

[0133] Risky transactions in user transaction data can be captured based on target graph features.

[0134] Target graph features can reveal commonalities in risky transactions. For example, users engaging in risky transactions often have a large total transaction amount across all their accounts within a specific time period. Therefore, the total transaction amount across all accounts within a specific time period can be used as a target graph feature to identify potential risky transactions. For instance, feature values ​​can be calculated for the target graph feature; when a feature value exceeds a certain threshold, the user can be considered to have engaged in risky transactions. Thus, target graph features can be used to identify transactions with common characteristics, thereby identifying risky transactions and risky users.

[0135] When user transaction data includes the transaction data of a single user, risky transactions of that single user can be captured. When user transaction data includes the transaction data of multiple users, risky transactions of a single user and risky transactions among multiple users can be captured (e.g., identifying risky transaction groups).

[0136] In some implementations, risky transactions can be captured directly based on target graph features. In other implementations, target graph features can be combined with intermediate modules (e.g., training modules, prediction modules, etc.) to further improve the accuracy of identifying risky transactions.

[0137] Figure 8 A block diagram of a graph feature search system 800 for risk transaction capture according to an embodiment of the present disclosure is shown.

[0138] See Figure 8 The system 800 may include a search space construction module 802, a candidate graph feature module 804, a graph feature mutation module 806, a search space reduction module 808, a target graph feature module 810, and a capture module 812. Each of these modules may be directly or indirectly connected to or communicate with each other on one or more buses 814.

[0139] The search space construction module 802 can construct graph features and its initial search space based on transaction data.

[0140] The candidate graph feature module 804 can obtain multiple candidate graph features from the initial search space, where each candidate graph feature includes an information aggregation representation.

[0141] In one embodiment of this disclosure, each candidate graph feature includes a subject, an object, a time window, filtering conditions, an aggregation function, and a graph structure.

[0142] In one embodiment of this disclosure, the information aggregation refers to the aggregation of second-degree information and / or information of more than two degrees.

[0143] In one embodiment of this disclosure, the plurality of candidate graph features includes randomly generated graph features and previously evaluated graph features.

[0144] In one embodiment of this disclosure, each candidate graph feature is a GQL graph feature.

[0145] The graph feature mutation module 806 can use reinforcement learning strategies to determine the mutation location and mutation value to obtain feature feedback.

[0146] In one embodiment of this disclosure, the graph feature mutation module 806 may also be configured to: utilize a reinforcement learning strategy to recommend mutation locations and mutation values; apply the mutation locations and mutation values ​​to multiple candidate graph features to obtain multiple mutated graph features; and determine and evaluate the feature value of each mutated graph feature to obtain feature feedback.

[0147] In one embodiment of this disclosure, determining and evaluating the feature value of each variant graph feature to obtain feature feedback further includes: determining a metric for the feature value of each variant graph feature; filtering out variant graph features whose metrics do not meet the criteria; and determining the importance of the retained variant graph features as feature feedback.

[0148] In one embodiment of this disclosure, the metric includes at least one of the following: variance, missing value ratio, chi-square value, IV value, and PSI value.

[0149] In one embodiment of this disclosure, determining the importance of the retained variant graph features further includes: inputting the retained variant graph features into a tree model to determine the importance.

[0150] The search space reduction module 808 can reduce the initial search space based on feature feedback to obtain the target search space.

[0151] In one embodiment of this disclosure, the search space reduction module 808 may be further configured to reduce the initial search space by iteratively performing the following steps until the feature feedback meets a preset condition: adjusting the reinforcement learning strategy based on the feature feedback; using the adjusted reinforcement learning strategy to determine new mutation locations and mutation values ​​to obtain multiple new mutation map features; determining and evaluating the feature value of each new mutation map feature to obtain new feature feedback; and reducing the initial search space based on the new feature feedback.

[0152] In one embodiment of this disclosure, the mutation location is one of a plurality of candidate mutation locations of the graph feature, and the mutation value is one of a plurality of candidate feature values ​​of the graph feature.

[0153] The target graph feature module 810 can obtain target graph features from the target search space.

[0154] The capture module 812 can use target graph features to capture risky transactions in transaction data.

[0155] Although Figure 8 The diagram illustrates specific modules of system 800, but it should be understood that these modules are exemplary and not limiting. In different implementations, one or more of these modules may be combined, split, removed, or additional modules may be added. For example, in some implementations, the search space reduction module 808 and the target graph feature module 810 may be merged into a single module. In some implementations, system 800 may also include additional modules.

[0156] Figure 9 A block diagram of an apparatus 900 including a graph feature search system for risk transaction capture, according to an embodiment of the present disclosure, is shown.

[0157] This device illustrates a general hardware environment in which the present disclosure can be applied according to exemplary embodiments thereof.

[0158] Now refer to Figure 9 Device 900 is described as an exemplary embodiment of a hardware device that can be applied to various aspects of this disclosure. Device 900 can be any machine configured to perform processing and / or computation, and can be, but is not limited to, a workstation, server, desktop computer, laptop computer, tablet computer, personal digital assistant (PDA), smartphone, or any combination thereof.

[0159] Device 900 may include components that can be connected to or communicate with bus 912 via one or more interfaces. For example, device 900 may include bus 912, processor 902, memory 904, input device 908, and output device 910, etc.

[0160] Processor 902 can be any type of processor and may include, but is not limited to, general-purpose processors and / or special-purpose processors (e.g., special-purpose processing chips), intelligent hardware devices (e.g., general-purpose processors, DSPs, CPUs, microcontrollers, ASICs, FPGAs, programmable logic devices, discrete gate or transistor logic components, discrete hardware components, or any combination thereof). In some cases, processor 902 may be configured to use a memory controller to operate a memory array. In other cases, a memory controller (not shown) may be integrated into processor 902. Processor 902 may be responsible for managing the bus and general processing, including executing software stored in memory. Processor 902 may also be configured to perform the various functions described herein related to graph feature search for risk transaction capture. For example, processor 902 may be configured to: construct graph features and an initial search space based on transaction data; obtain multiple candidate graph features from the initial search space, wherein each candidate graph feature includes an information aggregation representation; use a reinforcement learning strategy to determine mutation locations and mutation values ​​to obtain feature feedback; reduce the initial search space based on the feature feedback to obtain a target search space; obtain target graph features from the target search space; and use the target graph features to capture risky transactions in the transaction data.

[0161] Memory 904 can be any storage device capable of storing data. Memory 904 may include, but is not limited to, disk drives, optical storage devices, solid-state storage, floppy disks, hard disks, magnetic tape or any other magnetic media, optical discs or any other optical media, ROM (read-only memory), RAM (random access memory), cache memory and / or any other memory chip or cartridge, and / or any other medium from which a computer can read data, instructions and / or code. Memory 904 may store computer-executable software 906 including computer-readable instructions that, when executed, cause a processor to perform the various functions described herein related to graph feature search for risk transaction capture.

[0162] Input device 908 can be any type of device that can be used to input information.

[0163] The output device 910 can be any type of device used for outputting information. In one case, the output device 910 can be any type of output device capable of displaying information.

[0164] The technical solution disclosed herein uses the GQL graph query language to characterize graph features, thereby obtaining information aggregation representations of degree two and above. Furthermore, by defining the six components of graph features (subject, object, time window, filtering conditions, aggregation function, and graph structure), an embedded representation of the graph features is obtained, providing possibilities for subsequent feature mutation. In addition, by using reinforcement learning to recommend the location and specific values ​​of feature mutations, the search space is effectively reduced, ensuring that effective graph features can be generated within a reasonable time. The graph features obtained in this way exhibit excellent performance and good interpretability.

[0165] The detailed description above, in conjunction with the accompanying drawings, describes examples but does not represent all examples that can be implemented or fall within the scope of the claims. The terms "example" and "exemplary" are used in this specification to mean "serving as an example, instance, or illustration" and do not imply "superiority or superiority over other examples."

[0166] Throughout this specification, the terms "an embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment of this disclosure. Therefore, the use of these phrases may refer to more than one embodiment. Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0167] The preceding description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will readily be understood by those skilled in the art, and the universal principles defined herein can be applied to other aspects. Therefore, the claims are not intended to be limited to the aspects shown herein, but are to be granted the full scope consistent with the language of the claims, wherein references to the singular form of an element, unless specifically stated otherwise, are not intended to mean “one and only one,” but rather “one or more.” Unless specifically stated otherwise, the term “some” refers to one or more. All structural and functional equivalents of the elements of the various aspects described throughout this disclosure, whether now or hereafter known to a person skilled in the art, are expressly incorporated herein by reference and are intended to be covered by the claims.

[0168] It should also be noted that these embodiments may be described as processes depicted as flowcharts, flow diagrams, structure diagrams, or block diagrams. Although a flowchart may describe the operations as a sequential process, many of these operations can be executed in parallel or concurrently. Furthermore, the order of these operations can be rearranged.

[0169] While various embodiments have been described and illustrated, it should be understood that the embodiments are not limited to the precise configurations and components described above. Various modifications, substitutions, and improvements that will be apparent to those skilled in the art can be made to the arrangement, operation, and details of the apparatus disclosed herein without departing from the scope of the claims.

Claims

1. A graph feature search method for risk transaction capture, comprising: Constructing graph features and its initial search space based on transaction data; Multiple candidate graph features are obtained from the initial search space, wherein each candidate graph feature includes an information aggregation representation; A reinforcement learning strategy is used to recommend mutation locations and mutation values, wherein the mutation location is one of multiple candidate mutation locations of the graph feature, and the mutation value is one of multiple candidate feature values ​​of the graph feature. The mutation location and the mutation value are applied to the multiple candidate map features to obtain multiple mutated map features; Determine and evaluate the eigenvalues ​​of each variation map feature to obtain feature feedback; The initial search space is reduced based on the feature feedback to obtain the target search space; Obtain target graph features from the target search space; The target graph features are used to capture risky transactions in the transaction data.

2. The method according to claim 1, wherein each candidate graph feature includes a subject, an object, a time window, filtering conditions, and a graph structure.

3. The method according to claim 1, wherein the information aggregation refers to the aggregation of second-degree information and / or information of higher degrees.

4. The method according to claim 1, wherein each candidate graph feature is a Graph Query Language (GQL) feature.

5. The method of claim 1, further comprising determining and evaluating the eigenvalues ​​of each variation map feature to obtain the feature feedback, including: Determine the measure of the eigenvalues ​​for each variation map feature; Screen out variation graph features that do not meet the criteria; The importance of the retained variant features is determined as the feature feedback.

6. The method of claim 5, wherein the metric includes at least one of the following: variance, missing value ratio, chi-square value, IV value, and PSI value.

7. The method of claim 5, further comprising determining the importance of the retained variant map features: The retained variant map features are input into the tree model to determine their importance.

8. The method according to claim 1, wherein reducing the initial search space based on the feature feedback to obtain the target search space further comprises iteratively performing the following steps until the feature feedback satisfies a preset condition: The reinforcement learning strategy is adjusted based on the aforementioned feature feedback. A modified reinforcement learning strategy is used to determine new mutation locations and mutation values ​​to obtain multiple new mutation map features; Determine and evaluate the eigenvalues ​​of each new variant graph feature to obtain new feature feedback; The initial search space is reduced based on the new feature feedback.

9. A graph feature search system for risk transaction capture, comprising: The search space construction module constructs graph features and its initial search space based on transaction data. The candidate graph feature module obtains multiple candidate graph features from the initial search space, wherein each candidate graph feature includes an information aggregation representation; The graph feature mutation module is configured as follows: A reinforcement learning strategy is used to recommend mutation locations and mutation values, wherein the mutation location is one of multiple candidate mutation locations of the graph feature, and the mutation value is one of multiple candidate feature values ​​of the graph feature. The mutation location and the mutation value are applied to the multiple candidate map features to obtain multiple mutated map features; Determine and evaluate the eigenvalues ​​of each variation map feature to obtain feature feedback; The search space reduction module reduces the initial search space based on the feature feedback to obtain the target search space. The target graph feature module obtains target graph features from the target search space; The capture module uses the features of the target graph to capture risky transactions in the transaction data.

10. A computer-readable storage medium storing a computer program that can be executed by a processor to perform the method as described in any one of claims 1-8.

Images