A method for gang identification based on graph neural network node classification

Abstract

The application discloses a method for gang identification based on graph neural network node classification, realizes preprocessing of node classification based on a graph convolutional neural network and optimization of an adjacency matrix to an adjacency list. In this process, graphsage is optimized, and gang identification is performed on black samples predicted by graphsage, so that control measures can be taken on customers whose gang number exceeds a certain threshold, and the model misjudgment rate can be reduced to a certain extent.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a method for gang identification based on graph neural network node classification. BACKGROUND

[0002] A large number of real-world problems can be solved as a set of small computational tasks on a graph. Inference of node attributes, detection of abnormal nodes (such as spam senders), identification of genes related to diseases, and drug recommendations for patients can all be summarized as node classification problems. Recommendation, drug side effect prediction, drug-target interaction identification, and completion of knowledge graphs are essentially edge prediction problems. The nodes of the same graph have connection relationships, which means that the nodes are not independent.

[0003] Traditional deep learning methods have achieved great success in extracting features of Euclidean space data, but many data in practical application scenarios are generated from non-Euclidean space, and the performance of traditional deep learning methods in processing non-Euclidean space data is still unsatisfactory. For example, in e-commerce, a graph-based learning system can make very accurate recommendations using user and product interactions, but the complexity of the graph poses a huge challenge to existing deep learning algorithms. This is because the graph is irregular, each graph has a variable size and unordered node, and each node in the graph has a different number of adjacent nodes, which makes some important operations (such as convolution) easy to calculate on images, but no longer suitable for direct use on graphs. In addition, one of the core assumptions of existing deep learning algorithms is that data samples are independent of each other. However, this is not the case for graphs, as each data sample (node) in the graph has edges related to other data samples (nodes) in the graph, and this information can be used to capture the interdependence between instances. Traditional machine learning models can only identify relationships between features and cannot well identify relationships between nodes when learning. SUMMARY

[0004] In view of the deficiencies of the prior art, the present application aims to provide a method for gang identification based on graph neural network node classification.

[0005] In order to achieve the above-mentioned purpose, the technical scheme adopted by the present application is as follows:

[0006] A method for gang identification based on graph neural network node classification, the specific process is:

[0007] S1, preparing data, the data including account information and transaction behavior data of the account;

[0008] S2, the transaction behavior data of the account is derived and constructed into a feature, which is a wide table, and the transaction behavior constitutes the relationship between points and edges, and a graph transaction relationship table is constructed as a graph relationship structure;

[0009] S3, node feature preprocessing, the preprocessing includes missing value and outlier processing and feature correlation deduplication;

[0010] S4, feature visualization, category encoding and chi-square binning are performed, wherein the missing values of the features are placed in a separate bin during chi-square binning, and the outliers of the features are combined with other values into a bin;

[0011] S5, mapping the features to the bins, mapping each bin to a separate feature transpose, performing one-hot encoding, and after correlation elimination and data concentration elimination, the node feature input is obtained; the node is the account;

[0012] S6, generating node features according to account information and transaction relationship, generating label tuples according to black and white samples, generating adjacency matrices of transactions and transaction counterparties, and adjacency matrices of devices used in transactions, connection dictionaries of nodes and edges, generating random samples to build training set, test set and validation set;

[0013] S7, using GraphSAGE to construct a graph convolutional neural network node classification model, performing linear transformation on the features of the node itself and the sampled neighbor node features respectively, then concatenating them, and performing linear transformation again to obtain the feature representation of the target node. Finally, the obtained feature representation of the target node is used for downstream tasks; during model training, unsupervised training can use NCELoss, supervised classification training can use cross-entropy, create a graph, convert the matrix tuple to GPU, create input dimensions, and sagegcn layers, use the dgl library in python to build a node classification model, and obtain prediction probability;

[0014] S8, 1 in the classification result is a black sample, and 0 is a positive sample; after initializing each node with a unique label, the label propagation algorithm is used to repeatedly socialize the label of a node to the label with the highest frequency among the neighboring nodes of the node; when the label of each node appears most frequently in its neighboring nodes, the algorithm stops; the algorithm is asynchronous because each node is updated without waiting for the rest of the nodes to update; using the transfer of accounts during transactions, first generate account nodes, then generate device number nodes used during account transactions, generate account-device number relationship networks, obtain community groups, and analyze nodes.

[0015] Further, in the random sample, 70% is taken as the training set, 20% is taken as the test set, and 10% is taken as the verification set.

[0016] Further, in step S3, the specific process of the feature correlation elimination is: first, the features are sorted according to the discrimination degree from high to low, and the features are selected from high to low according to the discrimination degree, and the selected standard is that when the feature and all the selected features have a correlation less than a preset threshold, it can be selected; then, the selected features are analyzed for correlation, and the features with higher importance are screened out according to the importance threshold, and the features with lower importance are eliminated.

[0017] The beneficial effects of the present application are that the present application realizes preprocessing of node classification based on graph convolutional neural network and optimization of adjacency matrix to adjacency list. In this process, graphsage is optimized, and gang identification is performed on the black samples predicted by graphsage, so that control measures can be taken for customers whose gang number exceeds a certain threshold, and the model misjudgment rate can be reduced to a certain extent. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 The present application provides an embodiment method of the overall flowchart. DETAILED DESCRIPTION

[0019] The present application will be further described below with reference to the accompanying drawings. It should be noted that the present embodiment is based on the technical solution, and detailed implementation and specific operation process are given, but the protection scope of the present application is not limited to the present embodiment.

[0020] The present embodiment provides a method for gang identification based on graph neural network node classification, which is developed using the pytorch library in python language, and the graphsage algorithm in the dgl framework is used for node classification. In the classification result, 1 is a black sample and 0 is a positive sample. As shown in Figure 1 The specific steps include the following steps:

[0021] S1, preparing data, the data including account information and transaction behavior data of the account;

[0022] The account information includes ID number, home address, annual income, gender, contact number, account opening type, etc., and the transaction behavior data includes single-point behavior of the user such as starting, logging in, browsing, clicking transaction, and feature data such as transfer amount and frequency in different time periods.

[0023] Candidate independent variables (The term independent variable comes from mathematics. Also called experimental stimulus. In mathematics, y = f(x). In this equation, the independent variable is x, and the dependent variable is y. When this equation is applied to psychological research, the independent variable refers to the factor or condition that the researcher actively manipulates to cause changes in the dependent variable, so the independent variable is considered the cause of the dependent variable. Independent variables can be continuous variables or categorical variables. If the experimenter manipulates the independent variable as a continuous variable, the experiment is a functional experiment. If the experimenter manipulates the independent variable as a categorical variable, the experiment is a factorial experiment. In psychological experiments, a major problem is to have an organism as a subject to respond to the stimulus. Obviously, the stimulus variable here is the independent variable. In this embodiment, the account information and transaction behavior data are determined according to the observation point and the data availability.

[0024] S2, the transaction behavior data of the account are derived and constructed into features, combined into a wide table, and the transaction behavior constitutes a point and an edge relationship, and a graph transaction relationship table is constructed as a graph relationship structure. In the transaction behavior, a customer and a customer transaction counterparty form a graph relationship, wherein a point is a customer and a customer transaction counterparty, and an edge represents that a customer and a customer transaction counterparty have a transaction relationship. It should be noted that when the features are constructed, the stability of the features, the discrimination degree between the features, the difference degree of the features, and the business logic all meet the business requirements, and the data of good and bad samples meet the requirements of the classification model construction.

[0025] S3, feature preprocessing: the preprocessing includes missing value and abnormal value processing, and feature correlation elimination; the specific process of the feature correlation elimination is as follows: first, the features are sorted according to the discrimination degree of the black and white samples from high to low, and the features are selected from high to low according to the discrimination degree, and the selected standard is that when the correlation between the feature and all the selected features is less than a preset threshold, the feature can be selected; then, the selected features are analyzed for correlation between each other, and the features with higher importance are screened out according to an importance threshold, and the features with lower importance are eliminated.

[0026] S4, feature visualization, category coding, and chi-square binning are performed, wherein the missing values of the features are separately placed in a box, and the abnormal values of the features are combined with other values into a box.

[0027] It should be noted that the features are numerical, and therefore the category variables cannot be directly put into the model, and need to be encoded. In addition, in order to obtain the stability of the node classification model, the numerical features need to be processed by binning when modeling.

[0028] Finally, before bringing in the node classification model, the features also need to be analyzed univariately and multivariately. The scoring results need to have certain stability. For example, when the overall credit quality of the borrower does not change, the scoring results should also remain stable. A little fluctuation in some variables (such as income) should not affect the scoring results. For example, when the monthly income changes from 6k to 7k, the scoring results will not change under the condition that other factors remain unchanged.

[0029] When the number of values of a category variable is large, the variable will be inflated if it is not binned. For example, for 31 provincial administrative regions (excluding Hong Kong, Macao and Taiwan), using onehot encoding will generate 31 variables; using dummy variable encoding will generate 30 variables. Category variables are based on chi-square distribution and chi-square value to determine whether a factor will affect the target variable. For example, when testing whether gender will affect the default probability, chi-square test can be used to determine. The null hypothesis H0 of chi-square test is that there is no difference between the observed frequency and the expected frequency, i.e. the factor does not affect the target variable. Based on this hypothesis, χ2value is calculated, which represents the degree of deviation between the observed value and the theoretical value. According to χ2distribution and degrees of freedom, the probability P of obtaining the current statistical quantity and more extreme cases under the condition that H0 hypothesis is established can be determined. If the P value is very small, it means that the observed value deviates too much from the theoretical value, and the null hypothesis should be rejected, indicating that there is a significant difference between the comparison data; otherwise, the null hypothesis cannot be rejected, and it cannot be considered that the actual situation represented by the sample and the theoretical hypothesis are different.

[0030] S5, after mapping the features to the bins, each bin is mapped to a separate feature transpose, which is on-hot encoded and used as the input of the node features after correlation elimination and data concentration elimination.

[0031] S6, generate node features according to account information and transaction relationship, generate label tuples according to black and white samples, generate adjacency matrices of transactions and transaction counterparties, and adjacency matrices of devices used in transactions and transaction times, connection dictionaries of nodes and edges, generate random samples to build training set, test set and validation set, where the training set accounts for 70%, the test set accounts for 20%, and the validation set accounts for 10%; the node is the account;

[0032] S7, using GraphSAGE to construct a graph convolutional neural network node classification model, performing a linear transformation (that is, multiplying a W parameter matrix, and then adding a relu activation enhancement representation) on the features of the target node itself and the sampled neighbor node features respectively, then adding them together, and then performing a linear transformation to obtain the feature representation of the target node, and finally using the obtained feature representation of the target node to perform downstream tasks; during model training, unsupervised training can use NCELoss, supervised classification training can use cross-entropy, create a graph, convert the matrix tuple to a GPU, create an input dimension, and a sagegcn layer, use the dgl library in python to build a node classification model to obtain a prediction probability.

[0033] It should be noted that GraphSAGE is an abbreviation of GraphSAmple and aggreGatE, and its running process is: sampling the neighbor nodes of each node in the graph; aggregating the information contained in the neighbor nodes according to the aggregation function to obtain the vector representation of each node in the graph.

[0034] S8, 1 in the classification result is a black sample, and 0 is a positive sample; for the account whose predicted classification result is 1, after initializing each node with a unique label, the label propagation algorithm is used to repeatedly socialize the label of a node to the label with the highest frequency in the adjacent nodes of the node. When the label of each node appears most frequently in its adjacent nodes, the algorithm stops. The algorithm is asynchronous because each node is updated without waiting for the rest of the nodes to update. Using the transfer of account transactions, first generate account nodes, then generate device number nodes used in account transactions, generate account-device number relationship networks, obtain community groups, and analyze nodes.

[0035] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all these changes and modifications should be included in the protection scope of the claims of the present application.

Claims

1. A method for gang identification based on graph neural network node classification, characterized in that, The specific process is as follows: S1. Prepare data, including account information and account transaction data; S2. Derivate and construct features from the account's transaction behavior data, combine them into a wide table, and construct a graph transaction relationship table as the graph relationship structure, with transaction behavior forming the relationship between points and edges. S3. Node feature preprocessing, the preprocessing includes handling missing and outlier values ​​and deduplication of feature correlations; S4. Perform feature visualization, category coding, and chi-square binning. In chi-square binning, missing values ​​of features are placed in a separate bin, while outliers of features are combined with other values ​​into one bin. S5. After mapping the features to bins, each bin is mapped to a separate feature transpose, which is then on-hot encoded and used as the feature input for the node after relevance removal and data centrality removal; the node is the account. S6. Generate node features based on account information and transaction relationships, generate label tuples based on black and white samples, generate adjacency matrices of transactions and counterparties, adjacency matrices of transactions and device numbers used during transactions, and connection dictionaries of nodes and edges based on transaction relationships between accounts, and generate random samples to construct training sets, test sets, and validation sets. S7. Use GraphSAGE to build a graph convolutional neural network node classification model. Perform a linear transformation on the node's own features and the features of sampled neighbor nodes, then concatenate them and perform another linear transformation to obtain the feature representation of the target node. Finally, use the obtained feature representation of the target node for downstream tasks. During model training, NCELoss can be used for unsupervised training, and cross-entropy can be used for supervised classification training. Create a graph, transfer the matrix tuples to the GPU, create the input dimension and the SageGCN layer, and use the DGL library in Python to build a node classification model to obtain the predicted probability. S8. In the classification results, 1 represents a black sample and 0 represents a positive sample. For accounts with a predicted classification result of 1, after initializing each node with a unique label, the label propagation algorithm is used to repeatedly community the label of a node with the most frequent label among its neighboring nodes. The algorithm stops when the label of each node appears most frequently among its neighboring nodes. This algorithm is asynchronous because each node updates itself without waiting for other nodes to update. Using the transfer during account transactions, account nodes are first generated, then device number nodes used during account transactions are generated, an account-device number relationship network is generated, community groups are obtained, and the nodes are analyzed.

2. The method according to claim 1, characterized in that, In the random samples, 70% is used as the training set, 20% as the test set, and 10% as the validation set.

3. The method according to claim 1, characterized in that, In step S3, the specific process of feature correlation elimination is as follows: First, sort the features from high to low according to their discrimination of black and white samples, and select features from high to low discrimination. The selection criterion is that the feature can only be selected when its correlation with all the already selected features is less than a preset threshold. Then, perform pairwise correlation analysis on the selected features, screen out the features with higher importance according to the importance threshold, and eliminate the features with lower importance.

Images