Method and apparatus for identifying solicited fraudulent users based on user relationship graph
By combining the features of one-hop and two-hop neighbors in the user relationship graph, an improved LightGBM model is used to identify users who are being instigated to commit fraud, which solves the problem of low identification accuracy in traditional methods and achieves accurate identification of users who are being instigated to commit fraud.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ALIPAY (HANGZHOU) INFORMATION TECH CO LTD
- Filing Date
- 2023-01-17
- Publication Date
- 2026-07-31
AI Technical Summary
In leasing business scenarios, traditional anomaly detection algorithms based on user relationship graphs struggle to identify situations where low-credit users are instigated to commit fraud, because these users have relatively normal characteristics, resulting in low identification accuracy.
By identifying instigating users based on known fraudulent users in the user relationship graph, and combining the features of one-hop and two-hop neighbors, instigated fraudulent users are identified. The LightGBM model, an improvement on the PageRank and Eriskcom algorithms, is used for identification.
It improves the accuracy of identifying users who are being instigated to commit fraud and solves the accuracy problem of traditional methods that rely solely on one-hop neighbor identification.
Smart Images
Figure CN116028676B_ABST
Abstract
Description
Technical Field
[0001] This specification relates to the field of computer technology, and more particularly to a method and apparatus for identifying instigated fraudulent users based on user relationship graphs. Background Technology
[0002] Traditional anomaly detection algorithms based on user relationship graphs typically assume that anomalous nodes corresponding to fraudulent users differ significantly from normal nodes corresponding to normal users. However, in some business scenarios, such as the leasing industry, there may be situations where users incite low-credit users to commit fraud (hereinafter referred to as the incitement fraud pattern). These low-credit users have relatively normal user characteristics, making it difficult to identify such fraudulent users using traditional methods. Summary of the Invention
[0003] This specification describes one or more embodiments of a method and apparatus for identifying instigated fraudulent users based on user relationship graphs, which can accurately identify instigated fraudulent users.
[0004] Firstly, a method for identifying manipulated fraudulent users based on a user relationship graph is provided, wherein the connecting edges in the user relationship graph indicate a preset type of association between users; the method includes:
[0005] In the user relationship graph, based on the marked nodes corresponding to known fraudulent users, several central nodes corresponding to instigating users are determined, wherein the statistics of the marked nodes among the first-order neighbor nodes of the central nodes satisfy a preset condition.
[0006] In the user relationship graph, candidate nodes that have target connection edges with the plurality of central nodes are determined, wherein the target connection edge indicates that the association relationship has occurred within the most recent first period.
[0007] For each candidate node, the aggregation features of each candidate node are determined based on the user features of the corresponding central node and the edge features of the corresponding target connection edge.
[0008] Based on the aggregation characteristics of each candidate node, the instigated fraudulent users are identified from each candidate node.
[0009] Secondly, an apparatus is provided for identifying manipulated fraudulent users based on a user relationship graph, wherein the connecting edges in the user relationship graph indicate a preset type of association between users; the apparatus includes:
[0010] A determining unit is used to determine, in a user relationship graph, a number of central nodes corresponding to instigating users based on the marked nodes corresponding to known fraudulent users, wherein the statistics of the marked nodes among the first-order neighbor nodes of the central nodes satisfy a preset condition.
[0011] The determining unit is further configured to determine, in the user relationship graph, each candidate node having a target connection edge with the plurality of central nodes, wherein the target connection edge indicates that the association relationship has occurred within the most recent first period;
[0012] The determining unit is further configured to determine the aggregation features of each candidate node based on the user features of the corresponding central node and the edge features of the corresponding target connection edge.
[0013] The identification unit is used to identify the instigated fraudulent users from the candidate nodes based on the aggregation characteristics of each candidate node.
[0014] Thirdly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first aspect.
[0015] Fourthly, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method of the first aspect.
[0016] This specification provides a method and apparatus for identifying manipulated fraudulent users based on a user relationship graph, using one or more embodiments. In the user relationship graph, the manipulator is first determined based on known fraudulent users. Then, the fraudulent user is identified from the manipulator's recently contacted users. It should be understood that the known fraudulent users here are the two-hop neighbors of the unknown fraudulent users connected through the manipulator. In other words, this solution can simultaneously combine one neighbor and two-hop neighbors to identify unknown fraudulent users. Therefore, it can significantly improve the accuracy of identifying manipulated fraudulent users. Attached Figure Description
[0017] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0018] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification;
[0019] Figure 2A flowchart illustrating a method for identifying induced fraudulent users based on a user relationship graph, according to one embodiment;
[0020] Figure 3 This diagram illustrates a method for identifying manipulated fraudulent users in one example.
[0021] Figure 4 A schematic diagram of an apparatus for identifying instigated fraudulent users based on a user relationship graph, according to one embodiment, is shown. Detailed Implementation
[0022] The solution provided in this specification will now be described with reference to the accompanying drawings.
[0023] As mentioned earlier, in the instigation fraud model, the characteristics of fraudulent users are usually relatively normal, so we cannot directly identify fraudulent users based on user characteristics.
[0024] Algorithms like PageRank and Eriskcom consider the propagation of information from neighbors to calculate target importance (e.g., webpage importance). PageRank measures webpage importance based on the principle that a webpage's importance is propagated by the importance of other webpages connected to it. In user relationship graph-based anomaly detection, a user is identified as fraudulent by aggregating the features of their one-hop neighbors. However, this approach doesn't align with the instigation fraud pattern because the connections between fraudulent users instigated by a fraudulent user are relatively few. Eriskcom borrows ideas from PageRank but overemphasizes one-hop neighbors while neglecting two-hop neighbors. Therefore, neither of these algorithms is suitable for instigation fraud.
[0025] Therefore, this solution proposes that, in the user relationship graph, the instigating user be identified first based on the known fraudulent users. Then, the fraudulent user is identified from the instigating user's recent contacts. It should be understood that the known fraudulent users here are the two-hop neighbors of the unknown fraudulent users connected through the instigating user. In other words, this solution can simultaneously combine one-hop neighbors and two-hop neighbors to identify unknown fraudulent users. This significantly improves the accuracy of identifying instigated fraudulent users.
[0026] Figure 1 This is a schematic diagram illustrating an implementation scenario of one of the embodiments disclosed in this specification. Figure 1In this process, for the user relationship graph, several instigating users can be traced based on the statistics of known fraudulent users among the first-order neighbors of each user. For these instigating users, other members closely related to them can be expanded according to a predefined gang relationship pattern, thus obtaining the final instigating users. Finally, the fraudulent users who have been instigated are identified from the recent contacts of each instigating user.
[0027] It should be understood that Figure 1 This is merely an illustrative example. In practical applications, it is not necessary to extend the scope of the aforementioned instructional users. This specification does not limit such extensions.
[0028] Figure 2 A flowchart illustrating a method for identifying manipulated fraudulent users based on a user relationship graph, according to one embodiment, is shown. This method can be executed by any device, apparatus, platform, or cluster of devices with computing and processing capabilities. Figure 2 As shown, the method may include the following steps:
[0029] Step S202: In the user relationship graph, based on the marked nodes corresponding to known fraudulent users, determine several central nodes corresponding to instigating users.
[0030] The user relationship graph above includes multiple user nodes and connecting edges between user nodes, which indicate that there are preset types of association relationships between users.
[0031] In one embodiment, the aforementioned preset type of association includes at least one of the following: transaction relationship, shared network relationship, and shared device relationship. Transaction relationship can indicate a direct association between users, such as a money transfer relationship. Shared network relationship and shared device relationship can indicate an indirect association between users; for example, a shared network relationship can be a shared Wi-Fi MAC address, and a shared device relationship can be a shared mobile phone number.
[0032] Furthermore, the aforementioned relationships can include relationships occurring at different times, and different relationship networks can be formed based on relationships at different times. In other words, the user relationship diagram described in this specification can be a heterogeneous diagram.
[0033] In one embodiment, the aforementioned known fraudulent user (Fraud) may refer to a user who has committed a breach of contract within a predetermined period (e.g., 60 days).
[0034] In one embodiment, determining a number of central nodes corresponding to an abettor includes: selecting user nodes in the user relationship graph whose statistics for corresponding marked nodes meet preset conditions as the number of central nodes.
[0035] The statistics for marked nodes include at least one of the following: the number of marked nodes among the first-order neighbors of the user node, and the percentage of marked nodes among the first-order neighbors of the user node.
[0036] Taking the number of marked nodes as a statistic as an example, the above-mentioned conditions for meeting the preset criteria include: the number of marked nodes is greater than a threshold. Taking the percentage of marked nodes as a statistic as another example, the above-mentioned conditions for meeting the preset criteria include: the percentage of marked nodes is greater than a percentage threshold.
[0037] The aforementioned first-order neighbor nodes refer to user nodes that have established a relationship with a user node within the third period. This third period can be, for example, one year. In other words, the aforementioned central nodes can be identified within a third relationship network formed based on the relationships that have occurred between users within one year. It should be understood that in this third relationship network, the connecting edges between user nodes indicate that a relationship has occurred within the third period.
[0038] In another embodiment, determining the central nodes corresponding to the instigating users includes: selecting user nodes in the user relationship graph whose statistics for corresponding marked nodes meet preset conditions as initial central nodes. This step can refer to one of the embodiments described above. Then, in the user relationship graph, user nodes whose associations with the initial central nodes during the fourth period match a predefined gang relationship pattern are selected as extended central nodes. Based on the initial and extended central nodes, the final set of central nodes is formed.
[0039] The fourth period here is longer than the third period, for example, it can be 2 years. Of course, in practical applications, the duration of the fourth period can also be the same as that of the third period.
[0040] Taking a four-year period as an example, the aforementioned extended central node can be determined in the fourth relationship network formed based on the connections that occurred between users within those two years. It should be understood that in this fourth relationship network, the connecting edges between user nodes indicate that connections occurred within the fourth period.
[0041] It should be noted that in order to profit from illegal activities, instigators usually increase the scale of instigation. That is, instigators are usually associated with multiple fraudulent users. The dense association makes the instigator a good center or hub. Therefore, this scheme can identify instigators based on the statistics of known fraudulent users.
[0042] Step S204: In the user relationship graph, determine each candidate node that has a target connection edge with several central nodes, the target connection edge indicating that an association relationship has occurred within the most recent first period.
[0043] The duration of the first period here is shorter than that of the third and fourth periods mentioned above; for example, it can be one week. In other words, the aforementioned candidate nodes can be determined from a first relationship network formed based on the associations that occurred between users within one week. It should be understood that in this first relationship network, the connecting edges between user nodes indicate that an association occurred within the most recent first period.
[0044] It should be noted that in the instigation fraud mode, the fraudulent user will have a close relationship with the instigating user in a short period of time before committing fraud. Therefore, this solution determines the candidate nodes for identifying the instigated fraudulent user based on the above target connection edges.
[0045] Step S206: For each candidate node, based on the user characteristics of the corresponding central node and the edge characteristics of the corresponding target connection edge, determine the aggregation characteristics of each candidate node.
[0046] The user characteristics of the central node here may include at least one of the following: the statistics of marked nodes among the first-order neighbors of the central node, and the statistics of candidate nodes that have the aforementioned target connection edges with the central node. The statistics of the candidate nodes here may include at least one of the following: the number of candidate nodes and the proportion of candidate nodes.
[0047] In addition, the user characteristics of the central node may also include descriptive information about the user corresponding to the central node, such as identity, hobbies, and occupation.
[0048] The edge characteristics of the aforementioned target connection edges may include: number of days and amount, etc.
[0049] Taking any first candidate node among the above candidate nodes as an example, the above determination of the aggregation features of each candidate node may include: summing or averaging the user features of the first central node corresponding to the first candidate node and the edge features of the target connection edge between the first candidate node and the first central node to obtain the aggregation features of the first candidate node.
[0050] Step S208: Based on the aggregation characteristics of each candidate node, identify the instigated fraudulent users from each candidate node.
[0051] In one embodiment, a feature threshold can be manually set, and then users corresponding to candidate nodes whose aggregated features are greater than the feature threshold can be identified as instigated fraudulent users.
[0052] In another embodiment, the aggregated features of each candidate node can be input into the scoring model to obtain a score for each candidate node. This score indicates the probability that the user corresponding to the candidate node is a manipulated fraudulent user. Users corresponding to candidate nodes whose scores are greater than a threshold are identified as manipulated fraudulent users.
[0053] The scoring model here can be implemented as a tree structure model. Specifically, this tree structure model can include: LightGBM (a lightweight gradient boosting machine), extreme gradient boosting (XGBoost), or random forest, etc.
[0054] In one embodiment, the scoring model described above is trained based on the aggregated features and labeling of each candidate node in the user relationship graph. The labeling indicates whether the user corresponding to the candidate node is a fraudulent user who has been instigated.
[0055] It should be understood that the candidate nodes for samples here are determined based on the center nodes of the samples. The methods for determining the center nodes and candidate nodes can refer to the methods for determining the center nodes and candidate nodes described above (i.e., refer to steps S202-S204), and will not be repeated here.
[0056] It should be noted that the aforementioned candidate nodes can be determined based on a second relationship network formed by the connections that occurred between users during the second period. In this second relationship network, the connecting edges between user nodes (also called sample connecting edges) indicate that connections occurred during the second period. The duration of this second period is longer than that of the first period, and it can be, for example, one month.
[0057] Of course, in practical applications, the duration of the second period here can be the same as the third and fourth periods mentioned above, and these three periods are collectively referred to as the historical period, while the first period is referred to as the recent period. Thus, in the relationship network formed based on the connections between users during the historical period, the central node corresponding to the instigating user can be first identified. Then, in the relationship network formed based on the connections between users during the recent period, candidate nodes with recent connections to the central node are identified, and the instigated fraudulent user is identified from among these candidate nodes.
[0058] In summary, this solution can accurately identify unknown, instigated fraud users by combining the characteristics of the relationship between known fraudulent users and instigating users, as well as the characteristics of the relationship between instigating users and unknown fraudulent users, under the instigation fraud model.
[0059] Figure 3This diagram illustrates a method for identifying manipulated fraudulent users in one example. Figure 3 In this context, a user relationship graph G can be formed based on multiple user nodes and three types of relationships between them: U (shared device relationship), T (transaction relationship), and W (shared network relationship).
[0060] In Graph G, core instigators and candidate instigators are identified based on the associations (FA relationships) between known fraudulent users and other users over the past year. Here, the number of known fraudulent users among the first-hop neighbors of a core instigator exceeds a predetermined threshold. Fraudulent users are present among the first-hop neighbors of a candidate instigator. Next, extended instigators are identified based on the associations (AA relationships) between the core instigator and other users over the past two years that match a predefined gang relationship pattern, thus obtaining all instigators. Finally, the instigated fraudulent users are identified based on the associations (AF relationships) between each instigator and other users over the most recent seven days.
[0061] The aforementioned potential fraud victims were identified using the LightGBM model. This model is trained based on the user characteristics of the instigating user and the relationships between the instigating user and other users over the past month. After training, the LightGBM model can make predictions based on the user characteristics of the instigating user and the relationships between the instigating user and other users over the most recent seven days.
[0062] In summary, the method for identifying instigated fraudulent users based on user relationship graphs provided in this specification can simultaneously combine one-hop neighbors and two-hop neighbors to identify unknown fraudulent users. This solves the problem of inaccurate identification caused by traditional methods that rely solely on one-hop neighbors, where the limited connections between fraudulent users mean that one-hop neighbors cannot propagate effective information. In conclusion, this solution can accurately identify instigated fraudulent users in instigation fraud scenarios.
[0063] Corresponding to the aforementioned method for identifying induced fraudulent users based on user relationship graphs, one embodiment of this specification also provides an apparatus for identifying induced fraudulent users based on user relationship graphs, wherein the connecting edges in the user relationship graph indicate the existence of preset types of association relationships between users. The preset types of association relationships include at least one of the following: transaction relationships, shared network relationships, and shared device relationships. For example... Figure 4 As shown, the device may include:
[0064] The determining unit 402 is used to determine, in the user relationship graph, a number of central nodes corresponding to instigating users based on the marked nodes corresponding to known fraudulent users, wherein the statistics of the marked nodes among the first-order neighbor nodes of the central nodes satisfy preset conditions.
[0065] Among them, known fraudulent users refer to users who have committed breach of contract within the predetermined period.
[0066] In one embodiment, the statistics for labeled nodes include at least one of the following: the number of labeled nodes and the percentage of labeled nodes.
[0067] The determining unit 402 is also used to determine, in the user relationship graph, each candidate node that has a target connection edge with several central nodes, the target connection edge indicating that an association relationship has occurred within the most recent first period.
[0068] The determining unit 402 is also used to determine the aggregation features of each candidate node based on the user features of the corresponding central node and the edge features of the corresponding target connection edge.
[0069] In one embodiment, the aforementioned plurality of central nodes includes a second central node, the user characteristics of which include at least one of the following:
[0070] The statistics of the marked nodes among the first-order neighbors of the second central node, and the statistics of the candidate nodes that have a target connection edge with the second central node.
[0071] The identification unit 404 is used to identify the instigated fraudulent users from each candidate node based on the aggregation characteristics of each candidate node.
[0072] In one embodiment, the identification unit 404 includes:
[0073] The input submodule 4042 is used to input the aggregated features of each candidate node into the scoring model to obtain the score of each candidate node. The score indicates the probability that the user corresponding to the candidate node is an instigated fraudulent user.
[0074] The determination submodule 4044 is used to identify users corresponding to candidate nodes whose scores are greater than the score threshold as instigated fraudulent users.
[0075] In one embodiment, the scoring model is trained based on the aggregated features and labeling of each sample candidate node in the user relationship graph, wherein the labeling indicates whether the user corresponding to the sample candidate node is an instigated fraudulent user.
[0076] The aforementioned candidate nodes and their corresponding central nodes were associated with each other during the second period, which was longer than the first period.
[0077] In one embodiment, the first-order neighbor nodes of the central node refer to user nodes that have been associated with the central node during a third period, the duration of which is longer than that of the first period.
[0078] In one embodiment, the determining unit 402 includes:
[0079] Select submodule 4022, which is used to select user nodes in the user relationship graph whose statistics of the corresponding marked nodes meet the preset conditions as the initial center nodes;
[0080] The selection submodule 4022 is also used to select, in the user relationship graph, user nodes whose associations with the initial central node in the fourth period match the predefined gang relationship pattern, as extended central nodes, the duration of which is longer than that of the first period;
[0081] Forming submodule 4024 is used to form a final set of center nodes based on the initial center node and the extended center node.
[0082] In one embodiment, each candidate node includes a first candidate node, and the determining unit 402 is specifically used for:
[0083] The aggregated features of the first candidate node are obtained by summing or averaging the user features of the first central node corresponding to the first candidate node and the edge features of the target connection edge between the first candidate node and the first central node.
[0084] The functions of each functional module of the apparatus in the above embodiments of this specification can be implemented through the steps of the above method embodiments. Therefore, the specific working process of the apparatus provided in one embodiment of this specification will not be repeated here.
[0085] This specification provides an embodiment of an apparatus for identifying instigated fraudulent users based on user relationship graphs, which can greatly improve the accuracy of identifying instigated fraudulent users.
[0086] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 2 or Figure 3 The method described.
[0087] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, it implements a combination... Figure 2 or Figure 3 The method described.
[0088] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.
[0089] The steps of the methods or algorithms described in conjunction with the disclosure in this specification can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, external hard disk, CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a server. Of course, the processor and storage medium can also exist as discrete components in the server.
[0090] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium accessible to a general-purpose or special-purpose computer.
[0091] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.
[0092] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of this specification. It should be understood that the above description is only a specific embodiment of this specification and is not intended to limit the scope of protection of this specification. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of this specification should be included within the scope of protection of this specification.
Claims
1. A method for identifying manipulated fraudulent users based on a user relationship graph, wherein the connecting edges in the user relationship graph indicate a preset type of association between users; the method includes: In the user relationship graph, based on the marked nodes corresponding to known fraudulent users, several central nodes corresponding to instigating users are determined, wherein the statistics of the marked nodes among the first-order neighbor nodes of the central nodes meet preset conditions; the instigating users and the known fraudulent users have historical association relationships; In the user relationship graph, candidate nodes that have target connection edges with the plurality of central nodes are determined, wherein the target connection edge indicates that the association relationship has occurred within the most recent first period. For each candidate node, the aggregation features of each candidate node are determined based on the user features of the corresponding central node and the edge features of the corresponding target connection edge. Based on the aggregation characteristics of each candidate node, instigated fraudulent users are identified from each candidate node; The determination of several central nodes corresponding to instigating users includes: selecting user nodes whose statistics of corresponding marked nodes in the user relationship graph meet the preset conditions as initial central nodes, and expanding to obtain several central nodes based on whether the association relationship between the initial central nodes and associated users conforms to a predefined gang relationship pattern.
2. The method according to claim 1, wherein, The process of identifying instigated fraudulent users from each of the candidate nodes includes: The aggregated features of each candidate node are input into the scoring model to obtain the score of each candidate node; the score indicates the probability that the user corresponding to the candidate node is an instigated fraudulent user. Among the candidate nodes, the users corresponding to the candidate nodes whose scores are greater than the score threshold are identified as the instigated fraud users.
3. The method according to claim 2, wherein, The scoring model is trained based on the aggregated features and labeling of each candidate node in the user relationship graph; the labeling indicates whether the user corresponding to the candidate node is a fraudulent user who has been instigated. The candidate node and the corresponding center node of the sample had the association relationship within the second period; the duration of the second period was longer than that of the first period.
4. The method according to claim 1, wherein, The first-order neighbor nodes of the central node refer to user nodes that have had the association relationship with the central node within the third period; the duration of the third period is longer than that of the first period.
5. The method according to claim 1, wherein, Each candidate node includes a first candidate node; determining the aggregation features of each candidate node includes: The aggregated features of the first candidate node are obtained by summing or averaging the user features of the first central node corresponding to the first candidate node and the edge features of the target connection edges between the first candidate node and the first central node.
6. The method according to claim 1, wherein, The plurality of central nodes includes a second central node; the user characteristics of the second central node include at least one of the following: The statistics of the marked nodes among the first-order neighbor nodes of the second central node, and the statistics of the candidate nodes that have the target connection edge with the second central node.
7. The method according to claim 1, wherein, The statistics of the marked nodes include at least one of the following: the number of marked nodes and the percentage of marked nodes.
8. The method according to claim 1, wherein, The preset type of association includes at least one of the following: transaction relationship, shared network relationship, and shared device relationship.
9. The method according to claim 1, wherein, The known fraudulent users refer to users who have committed breaches of contract within the predetermined period.
10. An apparatus for identifying manipulated fraudulent users based on a user relationship graph, wherein connecting edges in the user relationship graph indicate a preset type of association between users; the apparatus comprises: The determining unit is used to determine, in the user relationship graph, a number of central nodes corresponding to instigating users based on the marked nodes corresponding to known fraudulent users, wherein the statistics of the marked nodes among the first-order neighbor nodes of the central nodes meet preset conditions; and the instigating users and the known fraudulent users have a historical association relationship. The determining unit is further configured to determine, in the user relationship graph, each candidate node having a target connection edge with the plurality of central nodes, wherein the target connection edge indicates that the association relationship has occurred within the most recent first period; The determining unit is further configured to determine the aggregation features of each candidate node based on the user features of the corresponding central node and the edge features of the corresponding target connection edge. The identification unit is used to identify the instigated fraudulent users from the candidate nodes based on the aggregation features of each candidate node. The determining unit is specifically used to: select user nodes whose statistics of corresponding marked nodes in the user relationship graph meet the preset conditions as initial central nodes, and expand to obtain the plurality of central nodes based on whether the association relationship between the initial central nodes and associated users conforms to the predefined gang relationship pattern.
11. The apparatus according to claim 10, wherein, The identification unit includes: The input submodule is used to input the aggregated features of each candidate node into the scoring model to obtain the score of each candidate node; the score indicates the probability that the user corresponding to the candidate node is an instigated fraudulent user. The determination submodule is used to identify the users corresponding to the candidate nodes whose scores are greater than the score threshold among the candidate nodes as the instigated fraud users.
12. The apparatus according to claim 11, wherein, The scoring model is trained based on the aggregated features and labeling of each candidate node in the user relationship graph; the labeling indicates whether the user corresponding to the candidate node is a fraudulent user who has been instigated. The candidate node and the corresponding center node of the sample had the association relationship within the second period; the duration of the second period was longer than that of the first period.
13. The apparatus according to claim 10, wherein, The first-order neighbor nodes of the central node refer to user nodes that have had the association relationship with the central node within the third period; the duration of the third period is longer than that of the first period.
14. The apparatus according to claim 10, wherein, Each candidate node includes a first candidate node; the determining unit is specifically used for: The aggregated features of the first candidate node are obtained by summing or averaging the user features of the first central node corresponding to the first candidate node and the edge features of the target connection edges between the first candidate node and the first central node.
15. The apparatus according to claim 10, wherein, The plurality of central nodes includes a second central node; the user characteristics of the second central node include at least one of the following: The statistics of the marked nodes among the first-order neighbor nodes of the second central node, and the statistics of the candidate nodes that have the target connection edge with the second central node.
16. The apparatus according to claim 10, wherein, The statistics of the marked nodes include at least one of the following: the number of marked nodes and the percentage of marked nodes.
17. The apparatus according to claim 10, wherein, The preset type of association includes at least one of the following: transaction relationship, shared network relationship, and shared device relationship.
18. The apparatus according to claim 10, wherein, The known fraudulent users refer to users who have committed breaches of contract within the predetermined period.
19. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed in the computer, it causes the computer to perform the method of any one of claims 1-9.
20. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-9.