A fraud detection method, system, electronic device, and medium

Abstract

This invention discloses a fraud detection method, system, electronic device, and medium, relating to the field of fraud detection. The method includes: determining the relationship score of the edges between the target node and each neighbor node using a first multilayer perceptron based on the initial node features of the target node and the initial node features of its neighbor nodes in the dataset to be detected; determining the edge attributes of the edges between the target node and each neighbor node based on the relationship scores; determining the aggregate features of the target node using a graph transformer based on the edge attributes; determining the final features of the target node using a second multilayer perceptron based on the aggregate features and the initial node features of the target node; determining the type label of the target node using a third multilayer perceptron based on the final features; and determining the type of the transaction user based on the type label of the target node. This invention improves the accuracy of fraud detection.

Description

Technical Field

[0001] This invention relates to the field of fraud detection, and in particular to a fraud detection method, system, electronic device, and medium. Background Technology

[0002] With the rapid development of the Internet in recent years, it has provided many conveniences in areas such as trade, social interaction and entertainment, such as e-commerce, social networks and entertainment software.

[0003] In the past, researchers used statistics for traditional fraud detection. With the development of deep learning, researchers began to combine deep learning with fraud detection. In recent years, the development of graph neural networks has brought graph fraud detection to the forefront of both academia and industry. Fraud detection is achieved by treating users as nodes in a network and interactions as edges between nodes, thus reflecting transaction behavior.

[0004] However, traditional GNNs are models designed based on the homogeneity assumption, ignoring the heterogeneity. In real-world complex networks, fraudulent nodes tend to interact with normal nodes, which makes the node representation less than ideal, thus leading to inaccurate fraud detection. Summary of the Invention

[0005] The purpose of this invention is to provide a fraud detection method, system, electronic device, and medium to improve the accuracy of fraud detection.

[0006] To achieve the above objectives, the present invention provides the following solution:

[0007] A fraud detection method includes:

[0008] Obtain the dataset to be inspected; the dataset to be inspected includes a node group, the initial node features corresponding to the nodes in the node group, and multiple connecting edges; the node group includes a target node to be inspected and multiple neighboring nodes; one node corresponds to one transaction user; the connecting edges represent the interaction behavior between transaction users;

[0009] Based on the initial node features of the target node to be inspected and the initial node features of the neighboring nodes, a first multilayer perceptron is used to determine the relationship score of the edge connection between the target node to be inspected and each of the neighboring nodes; the first multilayer perceptron is obtained by training the first initial multilayer perceptron using the DGraph dataset;

[0010] Based on the relationship score, the connection attributes of the edges connecting the target node to be inspected and each of the neighboring nodes are determined; the connection attributes are either homogeneous edges or heterogeneous edges.

[0011] Based on the edge attributes, the initial node features of the target node to be detected and the initial node features of all the neighboring nodes are aggregated using a graph transformer to obtain the aggregated features of the target node to be detected.

[0012] Based on the aggregated features and the initial node features of the target node to be inspected, the final features of the target node to be inspected are determined using a second multilayer perceptron; the second multilayer perceptron is obtained by training a second initial multilayer perceptron using the DGraph dataset;

[0013] Based on the final features, the type label of the target node to be detected is determined using a third multilayer perceptron; the third multilayer perceptron is obtained by training a third initial multilayer perceptron using the DGraph dataset;

[0014] The type of the transaction user is determined based on the type label of the target node to be inspected; the type is either a non-fraudulent user or a fraudulent user.

[0015] Optionally, the training process of the first multilayer perceptron, the second multilayer perceptron, and the third multilayer perceptron specifically includes:

[0016] Obtain the DGraph dataset;

[0017] Based on the DGraph dataset, a training isomorphic graph is generated; the training isomorphic graph includes a node set, a node feature set, an edge set, and a label set; the node set includes fraudulent nodes and non-fraudulent nodes; the node feature set includes the initial node features of any node; the label set includes a node label set and an edge label set.

[0018] Taking any node in the node set as the target node, for any target node:

[0019] Based on the initial node features of the target node and the initial node features of the non-target nodes, the initial relationship score of the edge connecting the target node and each of the non-target nodes is determined using a first initial multilayer perceptron; the non-target nodes are the nodes in the node set other than the target node.

[0020] The initial relationship score is updated to obtain the updated relationship score;

[0021] Based on the updated relationship score and the corresponding edge labels, determine the relationship score loss;

[0022] Determine global normal node features and global fraud node features; the global normal node features are the average of the initial node features of all non-fraudulent nodes; the global fraud node features are the average of the initial node features of all fraudulent nodes.

[0023] The global normal distance and global fraud distance between the final embedding feature of the target node and the global normal node feature and the global fraud node feature are determined respectively; the global normal distance is the L2 norm of the final embedding feature of the target node and the global normal node feature; the global fraud distance is the L2 norm of the final embedding feature of the target node and the global fraud node feature.

[0024] The global normal distance and the global fraud distance are concatenated to obtain the global node features;

[0025] The global node features are input into the fourth initial multilayer perceptron to obtain the fourth predicted node type;

[0026] Based on the fourth prediction node type and the corresponding node label, determine the global attribute loss;

[0027] Based on the updated relation score and relation score threshold, predict the connection attributes between the target node and any of the non-target nodes;

[0028] Based on the edge connection attribute, the initial node features of the target node and the initial node features of all the neighboring nodes are aggregated using a graph transformer to obtain the aggregated features of the target node.

[0029] Based on the aggregated features of the target node and the initial node features of the target node, the final features of the target node are determined using a second initial multilayer perceptron.

[0030] Based on the final features of the target node, the type label of the target node is determined using a third initial multilayer perceptron;

[0031] The node classification loss is determined based on the type label of the target node and the corresponding node label;

[0032] The total loss is determined based on the relationship score loss, the global attribute loss, and the node classification loss.

[0033] If the total loss meets a preset condition, then training ends, and the first initial multilayer perceptron with the current first model parameters is used as the first multilayer perceptron, the second initial multilayer perceptron with the current second model parameters is used as the second multilayer perceptron, and the third initial multilayer perceptron with the current third model parameters is used as the third multilayer perceptron; the preset condition is that the total loss is less than a preset loss threshold or the maximum number of training iterations is reached.

[0034] If the total loss does not meet the preset conditions, then the first model parameters of the first initial multilayer perceptron, the second model parameters of the second initial multilayer perceptron, the third model parameters of the third initial multilayer perceptron, and the fourth model parameters of the fourth initial multilayer perceptron are updated according to the total loss.

[0035] Optionally, the initial relationship score is updated to obtain an updated relationship score, specifically including:

[0036] Determine the behavior cycle of the target node and the behavior cycles of the target node's neighboring nodes;

[0037] The time density of the target node is determined based on the behavior cycle of the target node and the behavior cycle of the neighboring nodes;

[0038] The time density score of the target node is determined based on the time density of the target node;

[0039] The initial relationship score is updated based on the time density score to obtain the updated relationship score.

[0040] Optionally, determining the behavior period of the target node specifically includes:

[0041] Using formula Determine the behavior cycle of the target node; Represents the target node The timestamp of the last interaction. Represents the target node The timestamp of the first interaction Represents the target node The degree of departure.

[0042] Optionally, the time density of the target node is determined based on the behavior cycle of the target node and the behavior cycles of its neighboring nodes, specifically including:

[0043] Using formula Determine the time density of the target node; wherein, Represented as the target node All neighboring nodes, Indicates neighbor node j, Representing neighboring nodes The behavioral cycle.

[0044] Optionally, the time density score of the target node is determined based on the time density of the target node, specifically including:

[0045] Using formula Determine the time density score of the target node; wherein, This represents the time density of the target node. Representing neighboring nodes The time density.

[0046] Optionally, the initial relationship score is updated based on the time density score to obtain the updated relationship score, specifically including:

[0047] Using formula Determine the updated relationship score; among which, Score the initial relationship. The time density score is given by δ, which is a preset hyperparameter threshold.

[0048] A fraud detection system, comprising:

[0049] The data acquisition module is used to acquire the dataset to be inspected; the dataset to be inspected includes a node group, the initial node features corresponding to the nodes in the node group, and multiple connecting edges; the node group includes a target node to be inspected and multiple neighboring nodes; one node corresponds to one transaction user; the connecting edges represent the interaction behavior between transaction users;

[0050] The relationship score determination module is used to determine the relationship score between the target node to be inspected and each of the neighboring nodes based on the initial node features of the target node to be inspected and the initial node features of the neighboring nodes, using a first multilayer perceptron; the first multilayer perceptron is obtained by training a first initial multilayer perceptron using the DGraph dataset;

[0051] The edge attribute determination module is used to determine the edge attribute of the edge connecting the target node to be inspected and each of the neighboring nodes based on the relationship score; the edge attribute is either a homogeneous edge or a heterogeneous edge.

[0052] An aggregation module is used to aggregate the initial node features of the target node to be inspected and the initial node features of all the neighboring nodes based on the edge attributes using a graph transformer to obtain the aggregated features of the target node to be inspected.

[0053] The final node feature determination module is used to determine the final features of the target node to be detected based on the aggregated features and the initial node features of the target node to be detected, using a second multilayer perceptron; the second multilayer perceptron is obtained by training a second initial multilayer perceptron using the DGraph dataset;

[0054] The classification module is used to determine the type label of the target node to be detected based on the final features using a third multilayer perceptron; the third multilayer perceptron is obtained by training a third initial multilayer perceptron using the DGraph dataset;

[0055] The fraudulent user identification module is used to determine the type of the transaction user based on the type label of the target node to be inspected; the type is either a non-fraudulent user or a fraudulent user.

[0056] An electronic device includes: a memory and a processor, wherein the memory stores a computer program, and the processor runs the computer program to cause the electronic device to perform the fraud detection method described above.

[0057] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the fraud detection method described above.

[0058] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0059] The fraud detection method, system, electronic device, and medium of this invention first determine whether the node-edge-node triple relationship is homogeneous or heterogeneous. Relationship scores are calculated using label perception, temporal density, and global node attributes. Then, a relationship threshold derived from reinforcement learning is used to qualitatively classify the edges. Finally, combined with a Graph Transformer, homogeneous and heterogeneous edges are aggregated positively and negatively, respectively. This results in homogeneous normal nodes being more similar to their neighbors, while heterogeneous fraudulent nodes are more different from their neighbors, leading to more accurate fraud detection results. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 Flowchart of the fraud detection method provided by the present invention;

[0062] Figure 2 This is a flowchart of the training process for the fraud detection framework of the present invention;

[0063] Figure 3 This is a structural diagram of the fraud detection framework of the present invention;

[0064] Figure 4 This is a diagram illustrating the fraud behavior assessment for node v1. Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] The purpose of this invention is to provide a fraud detection method, system, electronic device, and medium to improve the accuracy of fraud detection. It relates to the fields of fraud detection and deep learning technology and can be applied to specific areas such as fraud detection in finance and social networks.

[0067] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0068] like Figure 1 As shown, the fraud detection method provided by the present invention includes:

[0069] Step 101: Obtain the dataset to be inspected; the dataset to be inspected includes a node group, the initial node features corresponding to the nodes in the node group, and multiple connecting edges; the node group includes a target node to be inspected and multiple neighboring nodes; one node corresponds to one transaction user; the connecting edges represent the interaction behavior between transaction users.

[0070] Step 102: Based on the initial node features of the target node to be inspected and the initial node features of the neighboring nodes, the relationship score of the edge connection between the target node to be inspected and each of the neighboring nodes is determined using a first multilayer perceptron; the first multilayer perceptron is obtained by training the first initial multilayer perceptron using the DGraph dataset.

[0071] Step 103: Based on the relationship score, determine the connection attributes of the edges connecting the target node to be inspected and each of the neighboring nodes; the connection attributes are either homogeneous edges or heterogeneous edges.

[0072] Step 104: Based on the edge attributes, use a graph transformer to aggregate the initial node features of the target node to be inspected and the initial node features of all the neighboring nodes to obtain the aggregated features of the target node to be inspected.

[0073] Step 105: Based on the aggregated features and the initial node features of the target node to be inspected, the final features of the target node to be inspected are determined using a second multilayer perceptron; the second multilayer perceptron is obtained by training the second initial multilayer perceptron using the DGraph dataset.

[0074] Step 106: Based on the final features, determine the type label of the target node to be inspected using a third multilayer perceptron; the third multilayer perceptron is obtained by training the third initial multilayer perceptron using the DGraph dataset.

[0075] Step 107: Determine the type of the transaction user based on the type label of the target node to be inspected; the type is either a non-fraudulent user or a fraudulent user.

[0076] This invention proposes a Graph Transformer fraud detection framework that is aware of homogeneity and heterogeneity. It calculates the relationship score of the connection by using node attributes and domain knowledge, and then uses a threshold updated in real time by reinforcement learning to determine whether the connection is homogeneous or heterogeneous. Finally, it combines with Graph Transformer to aggregate homogeneous and heterogeneous neighborhood information to obtain the final node embedding representation.

[0077] As an alternative implementation method, such as Figure 2 As shown, the training process of the first multilayer perceptron, the second multilayer perceptron, and the third multilayer perceptron specifically includes:

[0078] Step 1: Obtain the training set of the isomorphic graph structure and the feature matrix representation of the nodes in the training set. The specific process is as follows:

[0079] Obtain the DGraph dataset; download the DGraph dataset published by Xinyi Technology as the training set. The training set includes a total of 3,700,550 nodes, 4,300,999 edges and 1,225,601 labels.

[0080] Based on the DGraph dataset, a training isomorphic graph is generated; the training isomorphic graph includes a node set, a node feature set, an edge set, and a label set; the node set includes fraudulent nodes and non-fraudulent nodes; the node feature set includes the initial node features of any node; the label set includes a node label set and an edge label set.

[0081] In practical applications, a graph is defined as... in This represents the set of all nodes in the training isomorphic graph. This represents the set of features for all nodes in the graph. Let represent the feature of node i, and the dimension of its feature is d. ε is the set of all edges in the training isomorphic graph, e i,j ∈ε represents a node With nodes There is a connecting edge between them. This represents the set of labels for all nodes in the graph. In the text, the label of each node The value is 0 or 1, where 0 represents a normal user (non-fraudulent user) and 1 represents a fraudulent user.

[0082] Step 2: Calculate the initial relationship score of the edge by combining the node attributes (initial node features) at both ends of the edge with the label perception score. The specific process is as follows:

[0083] Taking any node in the node set as the target node, for any target node:

[0084] Based on the initial node features of the target node and the initial node features of the non-target nodes, the initial relationship score of the edge connecting the target node and each of the non-target nodes is determined using a first initial multilayer perceptron; the non-target nodes are the nodes in the node set other than the target node.

[0085] In practical applications, label-aware scoring is used to calculate the initial relationship score of the edges. A first initial multilayer perceptron (MLP) is used as the node label predictor, and the L2 distance between the predicted label results of two nodes is used as the similarity metric. For nodes in the l-th layer... and nodes The initial relation score of the edge e is calculated using the following formula:

[0086]

[0087] in, Represents a node The node embedding representation in the l-th layer Represents a node The node embedding representation is used in the l-th layer. l Let represent the MLP of layer l. σ represents the non-linear activation function, here it is the sigmoid function. MLP 1 The input is the original features of the nodes (initial node features), and the subsequent input is the node embedding representation output from the previous layer.

[0088] The initial relationship score is updated to obtain the updated relationship score, as detailed in step 3.

[0089] Step 3: Calculate the temporal density of nodes based on their behavioral cycles. Use the absolute value of the difference in temporal density between the nodes at both ends of the edge as the temporal density score of the edge, and update the initial relationship score from Step 2. The specific process is as follows:

[0090] (3-1) Calculate the behavior cycle of the target node: using To represent the target node The behavioral cycle. Defined as:

[0091]

[0092] in, Represents the target node The timestamp of the last interaction. Represents the target node The timestamp of the first interaction Represents the target node The degree of departure.

[0093] (3-2) Calculate the time density of the target node:

[0094] use To represent the target node The time density. Defined as:

[0095]

[0096] in, Represented as the target node All neighboring nodes, Indicates neighbor node j, Representing neighboring nodes The behavioral cycle.

[0097] (3-3) Calculate the time density score: The time density score can be expressed as:

[0098]

[0099] (3-4) Update the relation score in step (2): Use the time density score to correct the initial relation score. The formula is as follows:

[0100] Where δ is a predefined hyperparameter threshold.

[0101] Based on the updated relationship score and the corresponding edge labels, determine the relationship score loss, as detailed in step 4.

[0102] Step 4: Calculate the relation score loss based on the training set labels and relation scores of the connected edges. The specific process is as follows:

[0103] By adding a loss to learn the calculation of relation scores, and in order to better learn heterogeneous edge information, the loss is defined as:

[0104]

[0105] Where σ is the nonlinear activation function, here it is the ReLU function. δ is a hyperparameter greater than 0. The label represents the edge e, with 1 for homogeneous edges and -1 for heterogeneous edges. When the edge is homogeneous, the smaller its relation score, the greater its loss. When the edge is heterogeneous, the larger its relation score, the greater its loss. δ can be used to better focus on the loss of heterogeneous edges.

[0106] Determine the global normal node characteristics and the global fraud node characteristics; the global normal node characteristics are the average of the initial node characteristics of all non-fraudulent nodes; the global fraud node characteristics are the average of the initial node characteristics of all fraudulent nodes. See step 5 for details.

[0107] Step 5: Calculate the global normal node features and global fraud node features in the current training batch. The specific process is as follows:

[0108] The average feature of all normal nodes in the training set of the current batch is used as the global normal node feature, and the average feature of all fraudulent nodes is used as the global fraudulent node feature. The global normal node feature and the global fraudulent node feature are defined as follows: and

[0109] The global normal distance and global fraud distance between the final embedding feature of the target node and the global normal node feature and the global fraud node feature are determined respectively; the global normal distance is the L2 norm of the final embedding feature of the target node and the global normal node feature; the global fraud distance is the L2 norm of the final embedding feature of the target node and the global fraud node feature.

[0110] The global normal distance and the global fraud distance are concatenated to obtain the global node features.

[0111] The global node features are input into the fourth initial multilayer perceptron to obtain the fourth predicted node type.

[0112] Based on the fourth predicted node type and the corresponding node label, determine the global attribute loss, as detailed in step 6.

[0113] Step 6: Calculate the L2 norm of the node features and the global normal and fraudulent node features, concatenate them, and input them into the classifier (fourth initial multilayer perceptron). Compare the classification result with the training set labels and calculate the global attribute loss. The specific process is as follows:

[0114] We calculate the L2 distance between each node and the global normal and fraudulent node features separately as the global normal distance and global fraudulent distance. We then concatenate these two distances to obtain the embedding result of the global node features. Finally, we optimize the embedding by minimizing the cross-entropy loss.

[0115]

[0116]

[0117]

[0118]

[0119] in, Represents a node The final embedding features, This represents all fraudulent nodes in the l-th batch of the current epoch. This represents all normal nodes in the l-th batch of the current epoch. For splicing operations. L GA This is the final global attribute loss.

[0120] Step 7: Adaptively adjust the score threshold used to determine the relationship between homogeneous and heterogeneous edges based on reinforcement learning. The specific process is as follows:

[0121] The percentage of heterogeneous edges in the total number of connected edges, p e We use this as the threshold. By designing a binary random reward, we update the action using the immediate reward based on the average predicted heterogeneous edge ratio over two consecutive epochs. The average predicted heterogeneous edge ratio of the e-th epoch is used as the threshold. The definition is as follows:

[0122]

[0123] This indicates that in the e-th epoch, the scores of all edges in the training set are less than s. e The number of connected edges, This means that in the e-th epoch, the score of all edges in the training set is greater than or equal to s. e The number of connected edges.

[0124] The reward for the e-th epoch is defined as:

[0125]

[0126] Where, α e Indicates in p e A hyperparameter for addition and subtraction; when Greater than When the time is right, the reward is positive, and at this time, for p... e Increase α e The operation of p. Conversely, the operation of p. e Reduce α e The operation is then performed. Finally, the termination condition is defined as follows:

[0127]

[0128] Once the termination condition is met, p will be... e Fix it.

[0129] Based on the updated relation score and relation score threshold, predict the edge attributes between the target node and any of the non-target nodes. Specifically:

[0130] According to p e The relationship score threshold s can be obtained by sorting the scores after connecting the edges. e All scores below the relationship score e All edges with the same shape are considered heterogeneous edges, and vice versa. The predicted edge relationships are represented as follows: If they are homogeneous, then It is 1 if it is not 1, and -1 otherwise.

[0131] Based on the edge attributes, a graph transformer is used to aggregate the initial node features of the target node and the initial node features of all the neighboring nodes to obtain the aggregated features of the target node.

[0132] Based on the aggregated features of the target node and the initial node features of the target node, the final features of the target node are determined using a second initial multilayer perceptron, as described in step 8.

[0133] Step 8: Input the initial node features of the target node and the initial node features of its neighboring nodes into the GraphTransformer. Based on the edge relationship scores and relationship score thresholds, perform homogeneous aggregation and heterogeneous aggregation respectively to obtain the node's feature representation. The specific process is as follows:

[0134] The nodes are represented by a vector matrix of Query, Key, and Value, as shown in the following formula:

[0135]

[0136] Where l represents the l-th layer GNN, h represents the number of attention heads in the multi-head attention mechanism, and W and b are learnable parameters. The formula for calculating the attention weights of node i and node j at the h-th attention head in the l-th layer is as follows:

[0137]

[0138] Here, d represents the dimension of the attention head, designed to prevent gradient vanishing due to excessive similarity. Next, a multi-head attention mechanism is used to aggregate nodes based on their neighborhood:

[0139]

[0140] The predicted edge relationships are represented as follows: Finally, the features are concatenated with the initial node features of the target node and output through a single-layer MLP (second initial multilayer perceptron) to form the final node representation (final feature):

[0141]

[0142] Based on the final characteristics of the target node, the type label of the target node is determined using a third initial multilayer perceptron.

[0143] The node classification loss is determined based on the type label of the target node and the corresponding node label.

[0144] The total loss is determined based on the relationship score loss, the global attribute loss, and the node classification loss, as detailed in step 9.

[0145] Step 9: Input the node feature representation (the final features of the target node) into the classifier (third initial multilayer perceptron) for classification, and calculate the overall loss function by comparing it with the training set labels. The sum of the relation score loss, global attribute loss, and node classification loss is used as the overall loss. The specific process is as follows:

[0146] (9-1) Classify node feature representations and calculate node classification loss: Input the final embedding representation of the node (the final feature of the target node) into the MLP classifier (third initial multilayer perceptron) to obtain the final classification result, and optimize it by minimizing the cross-entropy loss. The node classification loss is defined as:

[0147]

[0148] in, This is the result of the MLP classifier.

[0149] (9-2) The sum of the relation score loss, global attribute loss, and node classification loss is taken as the total loss:

[0150]

[0151] Where, λ RS and λ GA These are weighted parameters.

[0152] If the total loss meets a preset condition, then training ends, and the first initial multilayer perceptron with the current first model parameters is used as the first multilayer perceptron, the second initial multilayer perceptron with the current second model parameters is used as the second multilayer perceptron, and the third initial multilayer perceptron with the current third model parameters is used as the third multilayer perceptron; the preset condition is that the total loss is less than a preset loss threshold or the maximum number of training iterations is reached.

[0153] If the total loss does not meet the preset conditions, then the first model parameters of the first initial multilayer perceptron, the second model parameters of the second initial multilayer perceptron, the third model parameters of the third initial multilayer perceptron, and the fourth model parameters of the fourth initial multilayer perceptron are updated according to the total loss. See step 10 for details.

[0154] Step 10: If the accuracy of this round of testing improves by more than 0.1% compared to the previous round, or if the maximum number of training iterations is reached, the fraud detection framework is considered trained; otherwise, continue to update the model hyperparameters and train based on the classification results and loss function. The specific process is as follows:

[0155] Set the maximum number of training iterations to η. Calculate the prediction accuracy for normal and fraudulent nodes in the current training round. When the number of training iterations reaches the maximum η or the accuracy of the current training round improves by less than 0.1% compared to the previous round, the fraud detection framework training ends; otherwise, continue to update the model hyperparameters and train the model according to the loss function.

[0156] Experimental Description and Results: Both the training and test sets were the DGraph dataset released by Xinyi Technology. The dataset contains 3,700,550 nodes, 4,300,999 edges, and 1,225,601 labels. The ratio of the training set to the test set is 3:7. Table 1 shows the comparison results of different training methods on the test set. The AUC metric is calculated by ranking the prediction probabilities of all normal and fraudulent users. Recall-macro represents the average recall of normal and fraudulent users. F1-macro represents the average F1 score of normal and fraudulent users. GCN, GAT, and GraphSAGE, as traditional GNNs, only aggregate neighboring nodes. GAT uses an attention mechanism, while GraphSAGE randomly samples neighboring nodes. CARE-GNN and PC-GNN use filtered neighbor nodes and label balanced samplers, respectively, to attempt to solve the fraud spoofing problem. AMNet learns node representations by fusing low-frequency and high-frequency information through an attention mechanism. DAGNN designs difference enhancement paths and similarity enhancement paths to increase the similarity of homogeneous nodes and the difference of heterogeneous nodes for fraud detection. The method of this invention determines the relationship between edges through an edge relationship scoring mechanism and threshold reinforcement learning, and then uses a Graph Transformer to simultaneously aggregate homogeneous and heterogeneous information from the neighborhood of the target node to represent the node. It can be seen that the method of this invention achieves near-optimal performance across all metrics.

[0157] Table 1 Statistical Table of Test Results

[0158]

[0159] like Figure 3 The diagram shows the overall framework (fraud detection framework) of HHAGT. First, the relation scoring module calculates the relation score of each connection, and then combines this score with the relation threshold in the threshold adaptation process to identify edges. Finally, a Graph Transformer is used to aggregate homogeneous and heterogeneous information to achieve fraud detection.

[0160] like Figure 4 As shown, in the DGraph dataset, in order to determine the target node... Is it a fraudulent node?

[0161] For the target node After obtaining the node feature x1, calculate its relationship score LS with the features of its neighboring nodes.

[0162] Based on the original feature information of the target node and its neighboring nodes, calculate the target node's... Time density Its neighboring nodes The time density is calculated by taking the absolute value of the time density difference between node pairs as the time density score (TDS) of the connection, and then using the time density score to correct the initial relation score.

[0163] Finally, the node feature x1 and its neighbor node features are input into the Graph Transformer. Homogeneous aggregation and heterogeneous aggregation are performed based on the relation score of the edges and the relation score threshold obtained from reinforcement learning, respectively, to obtain the feature representation of the node.

[0164] Finally utilize Input into the classifier for nodes Classify fraud.

[0165] The method described in this invention determines the nature of edges by calculating the relationship score of the edges, and then adaptively aggregates homogeneous and heterogeneous information of neighboring regions through GraphTransformer, thereby effectively alleviating the fraud spoofing problem and improving the accuracy of fraud detection.

[0166] Example 2

[0167] In order to execute the method corresponding to Embodiment 1 above and achieve the corresponding functions and technical effects, a fraud detection system is provided below, including:

[0168] The data acquisition module is used to acquire the dataset to be inspected; the dataset to be inspected includes a node group, the initial node features corresponding to the nodes in the node group, and multiple connecting edges; the node group includes a target node to be inspected and multiple neighboring nodes; one node corresponds to one transaction user; the connecting edges represent the interaction behavior between transaction users.

[0169] The relationship score determination module is used to determine the relationship score between the target node to be inspected and each of the neighboring nodes based on the initial node features of the target node to be inspected and the initial node features of the neighboring nodes, using a first multilayer perceptron; the first multilayer perceptron is obtained by training a first initial multilayer perceptron using the DGraph dataset.

[0170] The edge attribute determination module is used to determine the edge attribute of the edge between the target node to be inspected and each of the neighboring nodes based on the relationship score; the edge attribute is either a homogeneous edge or a heterogeneous edge.

[0171] An aggregation module is used to aggregate the initial node features of the target node to be inspected and the initial node features of all the neighboring nodes based on the edge attributes using a graph transformer, so as to obtain the aggregated features of the target node to be inspected.

[0172] The final node feature determination module is used to determine the final features of the target node to be inspected based on the aggregated features and the initial node features of the target node to be inspected, using a second multilayer perceptron; the second multilayer perceptron is obtained by training a second initial multilayer perceptron using the DGraph dataset.

[0173] The classification module is used to determine the type label of the target node to be inspected based on the final features using a third multilayer perceptron; the third multilayer perceptron is obtained by training a third initial multilayer perceptron using the DGraph dataset.

[0174] The fraudulent user identification module is used to determine the type of the transaction user based on the type label of the target node to be inspected; the type is either a non-fraudulent user or a fraudulent user.

[0175] Example 3

[0176] The present invention provides an electronic device, including: a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the fraud detection method of Embodiment 1.

[0177] Example 4

[0178] The present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the fraud detection method of Embodiment 1.

[0179] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0180] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A fraud detection method, characterized in that, include: Obtain the dataset to be inspected; the dataset to be inspected includes a node group, the initial node features corresponding to the nodes in the node group, and multiple connecting edges; the node group includes a target node to be inspected and multiple neighboring nodes; one node corresponds to one transaction user; the connecting edges represent the interaction behavior between transaction users; Based on the initial node features of the target node to be inspected and the initial node features of the neighboring nodes, the relationship score of the connection between the target node to be inspected and each of the neighboring nodes is determined using a first multilayer perceptron. The behavior cycle of the target node and the behavior cycles of its neighboring nodes are determined; the temporal density of the target node is determined based on the behavior cycle of the target node and the behavior cycles of its neighboring nodes; the temporal density score of the target node is determined based on the temporal density score; the initial relationship score is updated based on the temporal density score to obtain the updated relationship score; the first multilayer perceptron is obtained by training the first initial multilayer perceptron using the DGraph dataset; Based on the updated relationship score, the connection attributes of the edges connecting the target node to be inspected and each of the neighboring nodes are determined; the connection attributes are either homogeneous or heterogeneous. Based on the edge attributes, the initial node features of the target node to be detected and the initial node features of all the neighboring nodes are aggregated using a graph transformer to obtain the aggregated features of the target node to be detected. Based on the aggregated features and the initial node features of the target node to be inspected, the final features of the target node to be inspected are determined using a second multilayer perceptron. The second multilayer perceptron was obtained by training the second initial multilayer perceptron using the DGraph dataset; Based on the final features, the type label of the target node to be inspected is determined using a third multilayer perceptron. The third multilayer perceptron was obtained by training the third initial multilayer perceptron using the DGraph dataset; The type of the transaction user is determined based on the type label of the target node to be inspected; the type is either a non-fraudulent user or a fraudulent user.

2. The fraud detection method according to claim 1, characterized in that, The training process for the first multilayer perceptron, the second multilayer perceptron, and the third multilayer perceptron specifically includes: Obtain the DGraph dataset; Based on the DGraph dataset, a training isomorphic graph is generated; the training isomorphic graph includes a node set, a node feature set, an edge set, and a label set; the node set includes fraudulent nodes and non-fraudulent nodes; the node feature set includes the initial node features of any node; the label set includes a node label set and an edge label set. Taking any node in the node set as the target node, for any target node: Based on the initial node features of the target node and the initial node features of the non-target nodes, the initial relationship score of the edge connecting the target node and each of the non-target nodes is determined using a first initial multilayer perceptron; the non-target nodes are the nodes in the node set other than the target node. The initial relationship score is updated to obtain the updated relationship score; Based on the updated relationship score and the corresponding edge labels, determine the relationship score loss; Determine global normal node features and global fraud node features; the global normal node features are the average of the initial node features of all non-fraudulent nodes; the global fraud node features are the average of the initial node features of all fraudulent nodes. The global normal distance and global fraud distance between the final embedding feature of the target node and the global normal node feature and the global fraud node feature are determined respectively; the global normal distance is the L2 norm of the final embedding feature of the target node and the global normal node feature; the global fraud distance is the L2 norm of the final embedding feature of the target node and the global fraud node feature. The global normal distance and the global fraud distance are concatenated to obtain the global node features; The global node features are input into the fourth initial multilayer perceptron to obtain the fourth predicted node type; Based on the fourth prediction node type and the corresponding node label, determine the global attribute loss; Based on the updated relation score and relation score threshold, predict the connection attributes between the target node and any of the non-target nodes; Based on the edge attributes, the initial node features of the target node and the initial node features of all the neighboring nodes are aggregated using a graph transformer to obtain the aggregated features of the target node. Based on the aggregated features of the target node and the initial node features of the target node, the final features of the target node are determined using a second initial multilayer perceptron. Based on the final features of the target node, the type label of the target node is determined using a third initial multilayer perceptron; The node classification loss is determined based on the type label of the target node and the corresponding node label; The total loss is determined based on the relationship score loss, the global attribute loss, and the node classification loss. If the total loss meets a preset condition, then training ends, and the first initial multilayer perceptron with the current first model parameters is used as the first multilayer perceptron, the second initial multilayer perceptron with the current second model parameters is used as the second multilayer perceptron, and the third initial multilayer perceptron with the current third model parameters is used as the third multilayer perceptron; the preset condition is that the total loss is less than a preset loss threshold or the maximum number of training iterations is reached. If the total loss does not meet the preset conditions, then the first model parameters of the first initial multilayer perceptron, the second model parameters of the second initial multilayer perceptron, the third model parameters of the third initial multilayer perceptron, and the fourth model parameters of the fourth initial multilayer perceptron are updated according to the total loss.

3. The fraud detection method according to claim 1, characterized in that, Determining the behavior cycle of the target node specifically includes: Using formula Determine the behavior cycle of the target node; Represents the target node The timestamp of the last interaction Represents the target node The timestamp of the first interaction Represents the target node The degree of departure.

4. The fraud detection method according to claim 1, characterized in that, The time density of the target node is determined based on the behavior cycle of the target node and the behavior cycles of its neighboring nodes, specifically including: Using formula Determine the time density of the target node; wherein, Represented as the target node All neighboring nodes, Representing neighboring nodes , Representing neighboring nodes The behavioral cycle.

5. The fraud detection method according to claim 1, characterized in that, Based on the time density of the target node, the time density score of the target node is determined, specifically including: Using formula Determine the time density score of the target node; wherein, This represents the time density of the target node. Representing neighboring nodes The time density.

6. The fraud detection method according to claim 1, characterized in that, Based on the time density score, the initial relationship score is updated to obtain the updated relationship score, specifically including: Using formula Determine the updated relationship score; among which, Score the initial relationship. The time density score is given. This is the preset hyperparameter threshold.

7. A fraud detection system, characterized in that, include: The data acquisition module is used to acquire the dataset to be inspected; the dataset to be inspected includes a node group, the initial node features corresponding to the nodes in the node group, and multiple connecting edges; the node group includes a target node to be inspected and multiple neighboring nodes; one node corresponds to one transaction user; the connecting edges represent the interaction behavior between transaction users; The relationship score determination module is used to determine the relationship score between the target node to be inspected and each of the neighboring nodes based on the initial node features of the target node to be inspected and the initial node features of the neighboring nodes, using a first multilayer perceptron. The behavior cycle of the target node and the behavior cycles of its neighboring nodes are determined; the temporal density of the target node is determined based on the behavior cycle of the target node and the behavior cycles of its neighboring nodes; the temporal density score of the target node is determined based on the temporal density score; the initial relationship score is updated based on the temporal density score to obtain the updated relationship score; the first multilayer perceptron is obtained by training the first initial multilayer perceptron using the DGraph dataset; The edge attribute determination module is used to determine the edge attribute of the edge between the target node to be inspected and each of the neighbor nodes based on the updated relationship score; the edge attribute is either a homogeneous edge or a heterogeneous edge. An aggregation module is used to aggregate the initial node features of the target node to be inspected and the initial node features of all the neighboring nodes based on the edge attributes using a graph transformer to obtain the aggregated features of the target node to be inspected. The final node feature determination module is used to determine the final features of the target node to be inspected based on the aggregated features and the initial node features of the target node to be inspected, using a second multilayer perceptron. The second multilayer perceptron was obtained by training the second initial multilayer perceptron using the DGraph dataset; The classification module is used to determine the type label of the target node to be inspected based on the final features using a third multilayer perceptron. The third multilayer perceptron was obtained by training the third initial multilayer perceptron using the DGraph dataset; The fraudulent user identification module is used to determine the type of the transaction user based on the type label of the target node to be inspected; the type is either a non-fraudulent user or a fraudulent user.

8. An electronic device, characterized in that, include: A memory and a processor, the memory being used to store a computer program, the processor running the computer program to cause the electronic device to perform the fraud detection method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the fraud detection method according to any one of claims 1-6.

Images