A fraudulent node detection method based on graph semi-supervised representation learning

Abstract

The present invention discloses a fraud node detection method based on graph semi-supervised representation learning, comprising the following steps: obtaining malicious nodes to be detected based on the data of fraud instances, and determining the feature vectors of the nodes to be detected; inputting the feature vectors of the nodes to be detected into a fine-tuned graph neural network trained based on a self-supervised loss function and a supervised contrast loss function, outputting the node suspicion score, and completing malicious node detection. Experimental results based on real data Wikipedia edits, Bitcoin Alpha, and Amazon show that the representations of different types of nodes output by the graph neural network after graph contrast learning and imbalanced loss function optimization have better discrimination, and the detection results have been greatly improved compared with the previous graph-based fraud detection effect.

Description

Technical Field

[0001] The present invention relates to the field of fraud detection, and in particular to a fraud node detection method based on graph semi-supervised representation learning. Background Art

[0002] Real-world data usually contains a small number of abnormal instances whose behavior patterns deviate from the majority of instances or do not conform to expected behaviors. For example, with the development of the Internet, e-commerce has attracted a large number of users and created huge economic benefits. Common platforms such as Taobao, Meituan, Amazon, etc. calculate the ranking index and reputation factors of online merchants through users' click-through rate, adding favorites, transactions and comments. Generally, items with better ranking indexes are listed at the front of the search results, and users prefer items with good reputation. Conventional methods to improve these indicators include providing high-quality goods, excellent services and advertising, which usually requires a lot of effort. However, there are some bad merchants who promote goods through fraudulent behaviors, such as registering some accounts to frequently click on the target goods, adding the target goods to favorites, false transactions, false reviews, etc. These fraudulent behaviors can lead to various serious consequences: 1) misleading users to buy goods that seem to only focus on sales but not quality; 2) the income of regular merchants is directly affected, resulting in unfair competition; 3) for e-commerce platforms, it increases the difficulty of identifying excellent sellers and establishing a fair seller reputation system. In the financial field, such as Alipay, malicious users can register a large number of accounts and use a series of actions to maliciously cash out, causing great harm to the entire financial system. On lending platforms such as Huabei and Jiedaibao, there are users who default or default on loans. The existence of these users will put companies at risk and requires effective identification methods. On social networking platforms such as Weibo and Facebook, malicious users can register a large number of robot accounts to spread spam, such as positive reviews, illegal advertising, hype, etc., thereby making huge profits.

[0003] Malicious node detection aims to find these abnormal nodes. It is a crucial task in different fields such as e-commerce, finance, security, social networks, and academic networks. Traditional rule-based or machine learning detection methods have difficulty in handling complex patterns that are constantly changing or rarely consider interactions between users. In addition, in actual scenarios, malicious node detection rarely has labeled data, and there is usually a large amount of unlabeled data, because a large amount of data is generated every day in many actual scenarios, and most of these data are normal. It is very costly to label some fraudulent behaviors as "abnormal". In addition, in real situations, abnormal instances only account for a small part of the overall data, and the overall data is unbalanced.

[0004] In traditional fraud detection methods based on graph neural networks, real data has scarce labels and unbalanced data sets, resulting in low classification accuracy. Summary of the invention

[0005] In order to overcome the problems in the prior art, the present invention aims to provide a fraudulent node detection method based on graph semi-supervised representation learning. The method has low cost and high classification detection accuracy, and overcomes the problems of overall data imbalance and label scarcity.

[0006] To achieve the above object, the present invention adopts the following technical solutions:

[0007] A fraud node detection method based on graph semi-supervised representation learning includes the following steps:

[0008] According to the data of the fraud instance, the malicious node to be detected is obtained, and the feature vector of the node to be detected is determined;

[0009] The feature vector of the node to be detected is input into the fine-tuned graph neural network trained based on the self-supervised loss function and the supervised contrast loss function, and the node suspicion score is output to complete the malicious node detection.

[0010] Furthermore, the fine-tuned graph neural network trained based on the self-supervised loss function and the supervised contrastive loss function is obtained through the following process:

[0011] Step 1: Obtain fraud instance data and construct a graph structure based on the interaction relationship between each instance. Each instance is a node in the network, and the relationship between instances constitutes an edge. Then divide it and construct a training sample set.

[0012] Step 2: Diffusion of the graph structure to obtain the diffusion matrix of the graph structure;

[0013] Step 3: Divide the nodes in the graph structure into K clusters, each cluster is a node list;

[0014] Step 4: Build a graph neural network, which includes a classifier consisting of a message passing module, a fully connected layer, and a normalized index module;

[0015] The message passing module is used to encode the nodes to obtain the node representation on the original graph and the node representation on the diffusion graph. The node representation on the original graph and the node representation on the diffusion graph are added together, and the addition result is sequentially input into the fully connected layer and the normalized index module to obtain the node's suspiciousness score.

[0016] Step 5: Pre-train the graph neural network through supervised contrast loss function and self-supervised loss function;

[0017] Step 6: Use the loss function of the label distribution-aware data imbalance problem on the training sample set, and fine-tune the pre-trained graph neural network and classifier based on the suspiciousness score of the node to obtain a fine-tuned graph neural network trained based on the self-supervised loss function and the supervised contrast loss function.

[0018] Furthermore, the diffusion matrix of the graph structure is obtained through a graph diffusion method based on personalized web page ranking.

[0019] Furthermore, the diffusion matrix S of the graph structure PPR Calculated by the following formula:

[0020] S PPR =α(I n -(1-α)D -1 / 2 AD -1 / 2 ) -1

[0021] Among them, α is the transition probability in the random walk, I n is a diagonal matrix, D is a diagonal matrix, and A is the adjacency matrix of the graph structure.

[0022] Furthermore, the node list C k Calculated by the following formula:

[0023]

[0024] Among them, C is the set of node lists of each cluster that satisfies the Kmeans algorithm, μ is the set of cluster centers of each cluster that satisfies the Kmeans algorithm, i is the index of each cluster, and x j is the feature vector of the graph node, and μi is the cluster center.

[0025] Furthermore, the result of adding the node representation on the original graph and the node representation on the diffusion graph is as follows:

[0026]

[0027] Among them, H is the sum of matrices, H τ is the matrix consisting of all node representation vectors in the original graph τ, H β is the matrix consisting of all node representation vectors in the diffusion graph β, It is a matrix consisting of n node representation vectors of dimension d, where n is the number of nodes in the structure graph.

[0028] Furthermore, the node's suspiciousness score p i Calculated by the following formula:

[0029]

[0030] Among them, σ is the normalized exponential module, W is the trainable weight matrix, and h i For node v i is a representation vector of , and b is a trainable bias parameter.

[0031] Furthermore, the self-supervised loss function The formula is as follows:

[0032]

[0033] Among them, θ is the optimizable parameter in the coding model of the original graph τ, ω is the optimizable parameter in the coding model of the diffusion graph β, K is the set of total clusters, k is one of the K clusters, |K| represents the number of clusters, |k| represents the number of nodes in cluster k, MI is the mutual information, is the representation vector of each node in the kth cluster on the original graph τ, is the readout vector of all nodes in the kth cluster on the diffusion graph β, is the representation vector of each node in the kth cluster on the diffusion graph β, is the readout vector of all nodes in the kth cluster on the original graph τ.

[0034] Furthermore, there is a supervised contrast loss function The formula is as follows:

[0035]

[0036]

[0037]

[0038] in, is the indicator function, τ is the original graph, β is the diffusion graph, l is the number of nodes with labels, For each labeled node v s The supervised contrast loss on the original image τ is For each labeled node v s Supervised contrastive loss on the diffusion map β, y s For a labeled node v s The label, v t is the label and the labeled node v s Same node, y t is the label and the labeled node v s The same node v t The label, v j For all nodes with labels, For a labeled node v s The representation vector on the original graph τ, is the label and the labeled node vs The same node v t The representation vector on the diffusion map β, For a labeled node v s The representation vector on the diffusion map β, is the label and the labeled node v s The same node v t The representation vector on the original graph τ, For all nodes with label v j The representation vector on the diffusion map β, For all nodes with label v j represents a vector on the original graph τ, and 〈·〉 represents a vector inner product operation.

[0039] Furthermore, according to the label distribution perception loss function of the imbalanced problem Fine-tune the trained graph neural network and classifier using the following formula:

[0040]

[0041]

[0042] Among them, x is the feature vector of the sample, y is the true label, j is the node type, and p y is the probability that the node type in the prediction result is y, p j is the probability of node type j in the predicted result type, Δ j is the margin distance perceived by the number of nodes of category j, C is a hyperparameter, Δ y is the margin distance perceived by the number of nodes of category y, n j is the number of nodes of type j.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] In the present invention, malicious node detection is achieved by adopting a fine-tuned graph neural network trained based on a self-supervised loss function and a supervised contrast loss function. Since the graph neural network is trained by a self-supervised loss function and a supervised contrast loss function, the nodes can learn a node representation with discrimination through the graph neural network when labels are scarce. Through fine-tuning, a fraud detection model that accurately classifies fraudulent nodes under label scarcity and data imbalance problems is obtained, thereby improving the classification detection accuracy. Experimental results based on real data Wikipedia edits, Bitcoin Alpha and Amazon show that the node representations of different types output by the graph neural network after graph contrast learning and imbalance loss function optimization have better discrimination, and the detection results are greatly improved compared with the previous graph-based fraud detection effect, overcoming the problems of scarcity of data labels and low detection accuracy and low node representation discrimination caused by the imbalance of data sets in the traditional graph-based fraud detection problem solved in the prior art.

[0045] Furthermore, the present invention proposes a semi-supervised fraud detection method based on the introduction of diffusion matrix of graph structure and self-supervised learning. The fraud node detection and classification process is mainly divided into three steps: First, due to the scarcity of data labels, the original data is enhanced, and the diffusion matrix of the original graph is obtained using a graph diffusion method based on personalized web page ranking. The original graph and the diffusion graph are used as consistent views of the same graph structure. The adjacency matrix and the diffusion matrix provide local information and global information of the graph structure respectively. Secondly, the nodes are clustered using the Kmeans algorithm, and subsequent training is performed on each cluster, which can further enable the nodes to learn the rich behavior patterns in the graph. The nodes are encoded by vector representation using a graph neural network, and the neural network is trained and optimized together through a self-supervised loss function and a supervised contrast loss function using a small amount of label information, so that the nodes can learn discriminative node representations through the graph neural network when labels are scarce. Finally, we get the node representation output by the pre-trained graph neural network. However, considering the data imbalance problem in fraud detection data, we use the loss function of label distribution-aware data imbalance problem to fine-tune the graph neural network and classifier together, and finally get a fraud detection model that can accurately classify fraud nodes under the problem of scarce labels and imbalanced data. Compared with traditional graph fraud detection methods, we can learn highly discriminative node representations when labels are scarce and unbalanced, providing a good foundation for downstream detection tasks, thereby improving classification detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1Visualization of the graphs formed by the relationships between nodes in different fraud detection datasets; (a) is the Wikipedia edits graph structure, (b) is the Bitcoin Alpha graph structure, and (c) is the Amazon graph structure;

[0047] Figure 2 Schematic diagram of the fraud node detection method based on graph semi-supervised representation learning. DETAILED DESCRIPTION

[0048] The present invention is described in detail below with reference to the accompanying drawings.

[0049] The present invention provides an improved fraud node detection method based on graph semi-supervised representation learning. Starting from the problem of data label scarcity and data set imbalance, the graph diffusion method is introduced for data enhancement, and the self-supervised learning method InfoMax is introduced. The nodes are clustered by introducing the Kmeans clustering algorithm, and subsequent training is performed on each cluster of the cluster, so that the model can learn the rich behavior patterns in the graph. By using a graph contrast loss with a small number of labels, the detection of fraud nodes is improved. and label distribution-aware data imbalance loss Further improve the accuracy of fraud detection. Therefore, compared with the traditional graph-based fraud detection method, the accuracy of the fraud detection model proposed in this paper has been greatly improved, and it benefits from the introduction of graph comparison loss using a small number of labels. The model can learn node representations with high discrimination, providing a good foundation for downstream classification tasks.

[0050] A fraud node detection method based on graph semi-supervised representation learning of the present invention comprises the following steps:

[0051] Firstly, a graph structure is constructed based on user interaction data from real-world platforms in different fields such as e-commerce, finance, security, and social networks. The graph diffusion method is used to obtain the original graph τ and the diffusion graph β. The original graph τ and the diffusion graph β are regarded as consistent views of the same graph structure. Then, the nodes are clustered on the graph structure. The self-supervised learning method is used to maximize the mutual information between the node representation in one view and the cluster-level representation in another view. The graph neural network is trained and a contrast loss function is constructed using a small amount of label information. The graph neural network is optimized to obtain a more discriminative node representation vector. Finally, the imbalanced loss function is used to fine-tune the overall model to achieve accurate detection of fraudulent nodes in real-world label-scarce data. The specific steps include:

[0052] Step 1: Obtain data on fraud instances in the real world and construct a graph structure based on the interaction between each instance. The adjacency matrix of the graph structure is n is the number of nodes in the graph, It is a matrix with dimension n×n. Each instance is a node in the network. The relationship between instances constitutes edges, which are then divided to construct a training sample set.

[0053] Step 2: Obtain the diffusion matrix S of the graph structure through the graph diffusion method based on PersonalizedPageRank (personalized web page ranking) PPR ; The specific process is as follows:

[0054] Step 2.1: Use the fast approximation and sparsification method to calculate the diffusion matrix S, and the calculation formula is as follows;

[0055]

[0056] Where T is the generalized transfer matrix, θ = (θ1, θ2, ...) T is the weighting coefficient, is a matrix of dimension n×n, which determines the ratio of global and local information and needs to satisfy: θ k is the weight, the eigenvalue λ of the generalized transfer matrix T i ∈[0, 1];

[0057] Step 2.2: The present invention adopts a diffusion instance based on personalized web page ranking, an adjacency matrix of a graph structure And the angle matrix Using the transfer matrix T = AD -1 ,θ k =α(1-α) k , I n is a diagonal matrix, where α represents the transition probability in the random walk, and the diffusion matrix S of the graph structure PPR The calculation formula is as follows:

[0058] S PPR =α(I n -(1-α)D -1 / 2 AD -1 / 2 ) -1

[0059] Step 3: Use the Kmeans algorithm to divide the nodes in the graph structure obtained in step 1 into K clusters, each cluster is a node list C k ; The specific process is as follows:

[0060] Step 3.1: Determine the number of clusters K based on the elbow method, whose core indicator is SSE (sum of the squared errors);

[0061] Step 3.2: Use the Kmeans algorithm to cluster all nodes in the graph structure based on the node features in the graph structure to obtain K clusters, each cluster is a node list C k ; The specific calculation method is as follows:

[0062]

[0063] Among them, C is the set of node lists of each cluster that satisfies the Kmeans algorithm, μ is the set of cluster centers of each cluster that satisfies the Kmeans algorithm, i is the index of each cluster, and x j is the feature vector of the graph node, μ i C i The cluster center.

[0064] Step 4: Construct a graph neural network, which includes a classifier consisting of a message passing module, a fully connected layer, and a normalized index module, where:

[0065] The semantic feature message passing method on the graph neural network is as follows: In the graph neural network, the graph node x i The semantic features and edge features of each neighbor node are fused to obtain the first neighbor node message, and each first neighbor node message is aggregated through an aggregation function to obtain an aggregation result, and the aggregation result is used as the updated graph node semantic feature to obtain the node's new representation vector h. i ;

[0066] The above-mentioned semantic feature message passing based on graph neural network is performed on the original graph τ and the diffusion graph β respectively. Specifically, the message passing module is used to pass the semantic feature message to the node x i Encoding is performed to obtain the node representation on the original graph and the node representation on the diffusion graph. The node representations in the original graph and the diffusion graph are added together, and the result of the addition is sequentially input into the fully connected layer and the normalized index module to obtain the suspiciousness score of the node.

[0067] The specific process is as follows:

[0068] Step 4.1: Take the original features of the nodes in the structure graph as the initial node representation, perform L convolution operations on the entire structure graph, and each node in the structure graph will eventually aggregate the information of L-hop neighbors. The specific process is as follows:

[0069]

[0070]

[0071] in, is the initial vector, is node v i The representation vector at layer l is is node v i The nodes in the previous layer represent vectors. represents a vector of dimension d, ∈ (l) is the weight coefficient of the node's own information during aggregation, N(v i ) is the node v i Neighbor nodes of It is the node representation vector of the neighbor node in the previous layer, l∈[1,L], l is the current number of convolution layers, and L is the maximum number of convolution layers.

[0072] Step 4.2: Encode the nodes in the original graph τ and the diffusion graph β respectively, and obtain the matrix H consisting of the node representation vector of each node in the two views α , H β , by adding the representations of the two views as the input of the downstream task, the specific process is as follows:

[0073]

[0074]

[0075] Among them, h i is the sum of the vectors, For each node v in the kth cluster in the original graph τ i (i∈[1,n]) The final representation vector is, For each node v in the diffusion graph β i (i∈[1,n]) The final representation vector is, is a vector of dimension d, d is the dimension of the vector, H is the sum of the matrices, H τ Represents the vectors of all nodes in the original graph τ The matrix H β Represents the vectors of all nodes in the diffusion graph β The matrix formed, It is a matrix consisting of n node representation vectors of dimension d, where n is the number of nodes in the structure graph.

[0076] Step 4.3: The node v obtained in step 4.2 i The representation vector h i As the input of the classifier, we get the node v i The suspicious score p i :

[0077] p i =σ(W T h i +b)

[0078] Where σ is the normalized exponential module, is the trainable weight matrix, and b is the trainable bias parameter.

[0079] Step 5: Construct a self-supervised loss function based on the InfoMax algorithm on the training sample set obtained in step 1 According to the self-supervised loss function In each cluster node list C k Maximize the mutual information MI between the node representation in one view and the cluster-level representation in another view; the specific process is as follows:

[0080] Step 5.1: List C of nodes in each cluster in both views k The readout function is used to obtain the representation vector encoded by the lth convolutional layer on the original graph τ and the representation vector encoded by the lth convolutional layer on the diffusion map β The specific calculation method is as follows:

[0081]

[0082]

[0083] in, is the representation vector encoded by the lth convolutional layer on the original graph τ, is the representation vector encoded by the lth convolutional layer on the diffusion graph β, W represents the trainable weight matrix, || represents the concatenation operation, σ is the normalized index module, i represents the index of a node in the structure graph, k is the index of the current cluster, and n represents the total number of nodes in the structure graph.

[0084] Step 5.2: By analyzing the node features x of the original graph i Perform perturbations and construct negative samples

[0085] Step 5.3: Based on negative samples The node encoding model is optimized by maximizing the mutual information MI between the node representation in one view and the graph representation in another view, and the optimized loss function is The details are as follows:

[0086]

[0087] Among them, θ is the optimizable parameter in the encoding model of the original graph τ, ω is the optimizable parameter in the encoding model of the diffusion graph β, K is the set of total clusters, k is a cluster among K clusters, |K| represents the number of clusters, |k| represents the number of nodes in cluster k, specifically, the dot product operation is performed on the two vectors For each node v in the kth cluster iThe representation vector of (i∈[1,|k|]) on the original graph τ, For each node v in the kth cluster i The representation vector of (i∈[1,|k|]) on the diffusion graph β, is the readout vector of all nodes in the kth cluster on the original graph τ.

[0088] Step 6: Use a small amount of label information on the training sample set obtained in step 1 to construct a supervised contrast loss function

[0089] Supervised Contrastive Loss Function The specific form is as follows:

[0090]

[0091]

[0092]

[0093] in, is the indicator function, when [·] is true, its value is 1, when it is false, its value is 0, τ is the original graph, β is the diffusion graph, l is the number of nodes with labels, For each labeled node v s The supervised contrast loss on the original image τ is For each labeled node v s Supervised contrastive loss on the diffusion map β, y s For a labeled node v s The label, v t is the label and the labeled node v s Same node, y t is the label and the labeled node v s The same node v t The label of y s =y t , v j For all nodes with labels, including labels and labeled nodes v s Nodes with the same label, including labels and labeled nodes v s Label nodes differently. For a labeled node v s The representation vector on the original graph τ, is the label and the labeled node v s The same node v t The representation vector on the diffusion map β, For a labeled node v s The representation vector on the diffusion map β, is the label and the labeled node vs The same node v t The representation vector on the original graph τ, For all nodes with label v j The representation vector on the diffusion map β, For all nodes with label v j represents a vector on the original graph τ, and 〈·〉 represents a vector inner product operation.

[0094] Step 7: Use self-supervised loss function And supervised contrast loss function Pre-training the graph neural network, the specific process is as follows:

[0095] By minimizing The graph neural network is trained and optimized until convergence to obtain the pre-trained graph neural network.

[0096] Step 8: Use the label distribution-aware loss function for the data imbalance problem on the training sample set Based on the suspiciousness scores of the nodes obtained in step 4, the pre-trained graph neural network and classifier are fine-tuned to obtain a fine-tuned graph neural network;

[0097] Adopting label distribution aware loss function for data imbalance problem Fine-tune the trained graph neural network and classifier. The specific process is as follows:

[0098]

[0099]

[0100] Among them, x is the feature vector of the sample, y is the true label, and j is the node type, which can be 0 or 1. y is the probability that the node type in the prediction result is y, p j is the probability of node type j in the predicted result type, Δ j is the margin distance perceived by the number of nodes of category j, C is a hyperparameter, Δ y is the margin distance perceived by the number of nodes of category y, n j is the number of nodes of type j.

[0101] During the fine-tuning process, the parameters of the graph neural network and the classifier are optimized simultaneously.

[0102] Step 9: When applied, the feature vector of the node to be detected is obtained according to the malicious node to be detected, the feature vector of the node to be detected is input into the fine-tuned graph neural network, and the node suspicion score is output to complete the malicious node detection.

[0103] Example 1

[0104] Referring to Table 1, the present invention first counts the relevant information of common fraud detection data sets. Wikipediaedits (Wikipedia) will find and ban some accounts through various measures to prevent malicious modifications. This data set contains information about user edited pages within one month, and users include banned users and benign users. The Amazon data set includes users who make product reviews under the musical instrument category of the Amazon e-commerce platform. Users with more than 80% useful votes in the comments are marked as benign users, and users with less than 20% useful votes are marked as malicious users. Under the same product review, a connection relationship is established between the top 5% of users with similarity in comment text. BitcoinAlpha is a Bitcoin trading platform where users can rate each other. Since Bitcoin users are anonymous, it is necessary to keep a record of user reputation to prevent transactions with fraudulent and risky users. Benign users are platform creators and users with scores greater than or equal to 0.5, while malicious users are users who are consistently negatively rated (less than or equal to -0.5) by benign users.

[0105] Table 1 shows the information statistics of different fraud detection datasets

[0106]

[0107] From Table 1, we can see that for malicious node detection, very little data is labeled, and there is usually a large amount of unlabeled data. For example, in the Bitcoin Alpha dataset, only 214 of the 3275 users have labels. In order to simulate the scarcity of labels in reality, this method only retains a small number of labels for Wiki and Amazon for training. Figure 1 In (a), (b) and (c), it can be found that there is rich interactive information between nodes, and the interaction between similar nodes is closer, which is consistent with the situation of using GNN for node representation learning. Therefore, the present invention considers using a graph-based semi-supervised fraud detection model, introducing a graph diffusion matrix for data enhancement and using a self-supervised model for node representation learning.

[0108] In addition, it is found that abnormal instances only account for a small part of the overall data, and the overall data is unbalanced. The ratio of malicious nodes to normal nodes can even reach 1:35. In this case, if the traditional graph-based fraud detection model is directly adopted, it will cause overfitting of the model, that is, the prediction results will be tilted towards normal nodes, thereby reducing the detection accuracy. Therefore, the present invention considers introducing a label distribution-aware imbalance loss function when using labels to train the classifier. At the same time, in order to reduce the impact of label imbalance on node representation learning, self-supervised learning and contrastive learning are first used to pre-train the graph neural network, and then Fine-tune the overall model.

[0109] Figure 2 Schematic diagram of fraud node detection method based on graph semi-supervised representation learning. The diffusion matrix S of the original graph is obtained by using the graph diffusion method based on personalized web page ranking. PPR The original data is enhanced to treat the original graph and the diffusion graph as consistent views of the same graph structure; the Kmeans algorithm is used to cluster the nodes so that the nodes can learn the rich behavioral patterns in the graph, and the graph neural network is used to encode the nodes as vector representations, and the self-supervised loss function based on InfoMax is used to Supervised contrastive loss function using small amount of label information Train and optimize the neural network together, so that nodes can learn discriminative node representations through graph neural networks when labels are scarce; use the loss function of label distribution-aware data imbalance problem Fine-tune the graph neural network and classifier together so that it can perform fraud node detection tasks more accurately in the case of data imbalance. The specific steps include:

[0110] Step 1: First, adopt the diffusion instance based on personalized web page ranking, the adjacency matrix of the graph structure And the angle matrix Using the transfer matrix T = AD -1 ,θ k =α(1-α) k , I n is a diagonal matrix, and the diffusion matrix S of the graph structure PPR The calculation formula is as follows. This step corresponds to Figure 2 Diffuse process in:

[0111] S PPR =α(I n -(1-α)D -1 / 2 AD -1 / 2 ) -1

[0112] Among them, α represents the transition probability in the random walk, and a trade-off can be made between maintaining locality and utilizing information from a large neighborhood. A large α can maintain locality, while a small α can utilize information from a large neighborhood. Since real data has the problem of scarce labels, it is expected that nodes can learn more information through data enhancement. The adjacency matrix and the diffusion matrix are regarded as consistent views of the same graph structure, namely the original graph τ and the diffusion graph β. Since the original graph τ and the diffusion graph β provide local information and global information of the graph structure respectively, learning the maximum consistency between the representations from these two views will encode rich local and global information for the model at the same time.

[0113] Step 2: Use the Kmeans algorithm to cluster all nodes based on node features. This step yields Figure 2 The specific calculation method is as follows:

[0114]

[0115] Among them, C is the set of node lists of each cluster that satisfies the Kmeans algorithm, μ is the set of cluster centers of each cluster that satisfies the Kmeans algorithm, i is the index of each cluster, and x j is the feature vector of the graph node, and μi is the cluster center.

[0116] Step 3: Build and train the graph neural network detection model, and perform graph representation learning on the two view original graphs τ and diffusion graphs β obtained in steps 1 and 2 and their respective clusters. This step is Figure 2 GNN(g in θ (·), g ω (·)) The specific calculation process of the learning process is as follows:

[0117] 1) First, the original features of the node are used as the initial node representation, and L convolution operations are performed on the entire structure graph. Each node will eventually aggregate the information of L-hop neighbors. The calculation process can be expressed as follows:

[0118]

[0119]

[0120] in, is the initial vector, is node v i The representation vector at layer l is is node v i The nodes in the previous layer represent vectors. represents a vector of dimension d, ∈ (l) is the weight coefficient of the node's own information during aggregation, N(v i ) is the node v iThe neighbor nodes of It is the node representation vector of the neighbor node in the previous layer, l∈[1,L], l is the current number of convolution layers, and L is the maximum number of convolution layers.

[0121] 2) Encode the nodes in the original graph τ and the diffusion graph β respectively, and obtain the matrix H consisting of the node representation vector of each node in the two views α , H β , by adding the representations of the two views as the input of the downstream task, the specific process is as follows:

[0122]

[0123]

[0124] Among them, h i is the sum of the vectors, For each node v in the original graph τ i (i∈[1,n]) The final representation vector is, For each node v in the diffusion graph β i (i∈[1,n]) The final representation vector is, is a vector of dimension d, d is the dimension of the vector, H is the sum of the matrices, H τ Represents the vectors of all nodes in the original graph τ The matrix H β Represents the vectors of all nodes in the diffusion graph β The matrix formed, It is a matrix consisting of n node representation vectors of dimension d, where n is the number of nodes in the structure graph.

[0125] 3) In each cluster node list C of the two views k The readout function is used to obtain the representation vector encoded by the lth convolutional layer on the original graph τ and the representation vector encoded by the lth convolutional layer on the diffusion map β The specific calculation method is as follows:

[0126]

[0127]

[0128] in, is the representation vector encoded by the lth convolutional layer on the original graph τ, is the representation vector encoded by the lth convolutional layer on the diffusion graph β, W represents the trainable weight matrix, || represents the concatenation operation, σ is the normalized index module, i represents the index of a node in the structure graph, k is the index of the current cluster, and n represents the total number of nodes in the structure graph.

[0129] Step 4: Use the graph representation vector output by the model to use the self-supervised loss function based on InfoMax and a supervised contrast loss function constructed with a small amount of label information Pre-training the graph neural network enables the model to learn discriminative node representations when labels are scarce. It is divided into two parts:

[0130] 1) By maximizing the mutual information MI between the node representation in one view and the graph representation in another view, the node representation in the two views is made to have maximum consistency. This step corresponds to Figure 2 The contrast process in For local information, It is global information, and its specific form is as follows:

[0131]

[0132] Among them, θ is the optimizable parameter in the encoding model of the original graph τ, ω is the optimizable parameter in the encoding model of the diffusion graph β, K is the set of total clusters, k is a cluster among K clusters, |K| represents the number of clusters, |k| represents the number of nodes in cluster k, specifically, the dot product operation is performed on the two vectors For each node v in the original graph τ i The representation vector of (i∈[1,n]), is the readout vector of all nodes in the kth cluster on the diffusion graph β, For each node v in the diffusion graph β i The representation vector of (i∈[1,n]), is the readout vector of all nodes in the kth cluster on the original graph τ.

[0133] 2) Use a small amount of label information to construct a supervised contrast loss function This step corresponds to Figure 2 The contrast process in is as follows:

[0134]

[0135]

[0136]

[0137] in, is the indicator function, when [·] is true, its value is 1, when it is false, its value is 0, τ is the original graph, β is the diffusion graph, l is the number of nodes with labels, For each labeled node v s The supervised contrast loss on the original image τ is For each labeled node v s Supervised contrastive loss on the diffusion map β, y s For a labeled node v s The label, v t is the label and the labeled node v s Same node, y t is the label and the labeled node v s The same node v t The label of y s =y t , v j For all nodes with labels, including labels and labeled nodes v s Nodes with the same label, including labels and labeled nodes v s Label nodes differently. For a labeled node v s The representation vector on the original graph τ, is the label and the labeled node v s The same node v t The representation vector on the diffusion map β, For a labeled node v s The representation vector on the diffusion map β, is the label and the labeled node v s The same node v t The representation vector on the original graph τ, For all nodes with label v j The representation vector on the diffusion map β, For all nodes with label v j represents a vector on the original graph τ, and 〈·〉 represents a vector inner product operation.

[0138] Repeat steps 1) and 2) until and convergence

[0139] Steps 1 to 4 correspond to Figure 2 Contents of MVGRL-Based SSLEncoder in .

[0140] Step 5: The node representation vector h obtained in step 3 i As a classifier ( Figure 2 The Classifier in the example above is used as the input to obtain the node’s suspiciousness score p. i Right now Figure 2The suspicious score in , and adopts the label distribution aware loss function specific to the data imbalance problem Fine-tune the overall model. This step corresponds to Figure 2 The calculation formula for the finetune step is as follows:

[0141]

[0142]

[0143]

[0144] Among them, x is the feature vector of the sample, y is the true label, corresponding to Figure 2 The label in j is the node type, which can be 0 or 1. y is the probability that the node type in the prediction result is y, p j is the probability of node type j in the predicted result type, Δ j is the margin distance perceived by the number of nodes of category j, C is a hyperparameter, Δ y is the margin distance perceived by the number of nodes of category y, n j is the number of nodes of type j.

[0145] Step 6: Finally, the nodes are detected for fraud based on the suspiciousness scores of the nodes to be classified output by the trained model.

[0146] Compared with traditional graph fraud detection methods, the present invention can learn highly discriminative node representations when labels are scarce and unbalanced, providing a good foundation for downstream detection tasks, thereby improving classification detection accuracy.

[0147] Table 2 Comparison of fraud detection accuracy

[0148]

[0149] Table 2 shows the accuracy comparison between the improved graph-based fraud node detection method proposed by the present invention and the previous graph-based fraud detection method. In practical applications, the training data for malicious detection is usually class-unbalanced, and normal user nodes often outnumber malicious nodes. Therefore, the widely used metric ROC-AUC is used to consider all possible thresholds for classification. The following is its definition:

[0150] True Positive Rate (TPR): The ratio of nodes predicted to be positive and actually positive;

[0151] False Positive Rate (FPR): The ratio of nodes predicted as positive examples but actually negative examples;

[0152] TPR and FPR are based on the predicted positive examples and the predicted negative examples, that is, they observe the relevant probability problems in the actual positive samples and negative samples respectively. Because of this, it will not be affected whether the samples are balanced or not.

[0153] The horizontal axis of the ROC curve is FPR, and the vertical axis is TPR. By traversing all classification thresholds, a ROC curve can be drawn. The higher the TPR and the lower the FPR, that is, the steeper the ROC curve, the better the model performance. Therefore, the closer the corresponding ROC-AUC score is to 1, the better the model classification effect.

[0154] It can be seen that the method of the present invention is better than other models on both BitcoinAlpha and Amazon datasets. At the same time, it is observed that the effect of using decoupled training for malicious detection problems is better than using joint training in most cases.

[0155] The invention proposes: 1) data enhancement based on a graph diffusion method for personalized web page ranking, 2) a pre-training method based on InfoMax and graph contrast learning, and 3) a loss function based on label distribution perception. This paper mainly solves the problems of data label scarcity, low detection accuracy caused by imbalanced data sets, and low node representation discrimination in traditional graph-based fraud detection. In order to solve the problem of data label scarcity, the graph diffusion method is introduced for data enhancement, and the self-supervised learning method InfoMax is introduced. The nodes are clustered by introducing the Kmeans clustering algorithm, and subsequent training is performed on each cluster, so that the model can learn the rich behavior patterns in the graph. By using a small number of labeled graph contrast loss Improve the distinction between different node representations. To address the data imbalance problem, introduce label distribution-aware data imbalance loss Further improve the accuracy of fraud detection. Experimental results based on real data Wikipediaedits, BitcoinAlpha and Amazon show that the invention has good detection results after graph contrast learning and imbalanced loss function optimization.

[0156] Compared with previous graph-based fraud detection results, the effect has been greatly improved, and the node representations of different data sets output by the trained graph neural network have better differentiation.

Claims

1. A fraud node detection method based on graph semi-supervised representation learning, characterized in that: The following steps are involved: According to the data of the fraud instance, the malicious node to be detected is obtained, and the feature vector of the node to be detected is determined; The feature vector of the node to be detected is input into the fine-tuned graph neural network trained based on the self-supervised loss function and the supervised contrast loss function, and the node suspicion score is output to complete the malicious node detection; The fine-tuned graph neural network trained with self-supervised loss function and supervised contrastive loss function is obtained through the following process: Step 1: Obtain fraud instance data and construct a graph structure based on the interaction relationship between each instance. Each instance is a node in the network, and the relationship between instances constitutes an edge. Then divide it and construct a training sample set. Step 2: Diffusion of the graph structure to obtain the diffusion matrix of the graph structure; Step 3: Divide the nodes in the graph structure into K clusters, each cluster is a node list; Step 4: Build a graph neural network, which includes a classifier consisting of a message passing module, a fully connected layer, and a normalized index module; The message passing module is used to encode the nodes to obtain the node representation on the original graph and the node representation on the diffusion graph. The node representation on the original graph and the node representation on the diffusion graph are added together, and the addition result is sequentially input into the fully connected layer and the normalized index module to obtain the node's suspiciousness score. Step 5: Use supervised contrast loss function and self-supervised loss , pre-train the graph neural network; Step 6: Use the loss function of the label distribution-aware data imbalance problem on the training sample set, and fine-tune the pre-trained graph neural network and classifier based on the suspiciousness score of the node to obtain a fine-tuned graph neural network trained based on the self-supervised loss function and the supervised contrast loss function.

2. According to claim 1, a fraud node detection method based on graph semi-supervised representation learning is characterized in that: The diffusion matrix of the graph structure is obtained by using the graph diffusion method based on personalized web page ranking.

3. According to claim 1, a fraud node detection method based on graph semi-supervised representation learning is characterized in that: Diffusion Matrix of Graph Structure Calculated by the following formula: in, is the transition probability in the random walk, is a diagonal matrix, for , is the adjacency matrix of the graph structure.

4. According to claim 1, a fraud node detection method based on graph semi-supervised representation learning is characterized in that: Node List Calculated by the following formula: in, To satisfy the set of node lists of each cluster of the Kmeans algorithm, μ is the set of cluster centers that satisfy the Kmeans algorithm, i is the index of each cluster, is the feature vector of the graph node, is the cluster center.

5. According to claim 1, a fraudulent node detection method based on graph semi-supervised representation learning is characterized in that: The result of adding the node representation on the original graph and the node representation on the diffusion graph is as follows: in, is the sum of matrices, Original image All nodes in represent the matrix composed of vectors, Diffusion map All nodes in represent the matrix composed of vectors, for The dimensions are The nodes represent the matrix composed of vectors, and n is the number of nodes in the structure diagram.

6. The fraud node detection method based on graph semi-supervised representation learning according to claim 1 is characterized in that: Suspiciousness score of the node Calculated by the following formula: in, is the normalized exponential module, is the trainable weight matrix, For Node The representation vector of is a trainable bias parameter.

7. The fraud node detection method based on graph semi-supervised representation learning according to claim 1 is characterized in that: Self-supervised loss The formula is as follows: in, Original image The optimizable parameters in the encoding model of Diffusion map The optimizable parameters in the encoding model of is the total set of clusters, for A cluster in a cluster, represents the number of clusters, Representative cluster The number of nodes in the is mutual information, For the Each node in the original graph The representation vector on , For the All nodes in the diffusion graph The readout vector on For the Each node in the diffusion graph superior , For the Node in the original graph The readout vector on .

8. The fraud node detection method based on graph semi-supervised representation learning according to claim 1 is characterized in that: Supervised Contrastive Loss Function The formula is as follows: in, is the indicator function, is the original picture, is a diffusion diagram, is the number of nodes with labels, For each labeled node In the original picture The supervised contrast loss on For each labeled node In the diffusion diagram The supervised contrast loss on For labeled nodes Tags, For labels and labeled nodes The same node, For labels and labeled nodes Same Node Tags, For all nodes with labels, For labeled nodes In the original picture The representation vector on , For labels and labeled nodes Same Node In the diffusion diagram The representation vector on , For labeled nodes In the diffusion diagram The representation vector on , For labels and labeled nodes Same Node In the original picture The representation vector on , For all nodes with labels In the diffusion diagram The representation vector on , For all nodes with labels In the original picture The representation vector on , Represents a vector inner product operation.

9. The fraud node detection method based on graph semi-supervised representation learning according to claim 1 is characterized in that: Label distribution aware loss function for imbalanced problem Fine-tune the trained graph neural network and classifier using the following formula: Among them, x is the characteristic vector of the sample, is the true label, is the node type, The node type in the prediction result is The probability of The node type in the prediction result type is The probability of For category The node number-aware margin distance, is a super parameter, For category The node number-aware margin distance, For type The number of nodes.

Images