Construction of a behavioral profile and method for telecommunications fraud detection thereof

Abstract

The application discloses a behavior graph construction method and a telecommunication fraud detection method thereof, and in the face of a telecommunication fraud scene, the application proposes a behavior graph construction method, constructs a hypergraph model for the behavior relationship between different subjects, and constructs a behavior graph by considering the multi-subject nature, uncertainty and interaction. The multi-subject nature is reflected by the participation of multiple parties such as fraudsters and normal users in the behavior graph; the uncertainty is reflected by the different behavior results caused by different behavior conditions and the different fraud links; and the interaction is reflected by the behavior relationship between the fraudsters and the normal users. Then, based on the behavior graph, a telecommunication fraud detection method is constructed, the set relationship between behaviors is learned and the representation is enhanced, and then it is predicted whether a user will fall into a fraud behavior link designed by a fraudster.

Description

Technical Field

[0001] This invention relates to the construction of a behavioral graph and a method for detecting telecommunications fraud, belonging to the field of information technology. Background Technology

[0002] Existing fraud detection methods and financial risk control systems are insufficient to prevent pre-emptive fraud and are also unsuitable for telecommunications fraud with story scripts. There is an urgent need to design and develop a "unchanging" method to deal with the "ever-changing" fraud scripts.

[0003] Research in financial risk control and anti-fraud primarily focuses on anomaly identification in transaction accounts, anomaly detection in transaction data, and the updating and iteration of fraud models. It involves learning from transaction data generated during the payment process to perform binary classification tasks. In recent years, many studies have shifted their focus from transaction participants to data, considering the interaction between users and the transaction system. This involves modeling behavioral profiles for groups or individuals, using probabilistic statistics or machine learning methods to learn historical behavioral sequences, and then comparing these sequences with newly generated behaviors to detect fraud. In the field of telecommunications fraud, much work is based on detailed call records, selecting attributes such as caller, callee, call time, and IP address. Machine learning, recurrent neural networks, and graph neural networks are used to learn features and ultimately identify the fraudster. However, reality is not so simple. Fraudsters' identities, numbers, and addresses are constantly changing and unpredictable. Call record detection is lagging and cannot prevent fraudulent events. Single models are insufficient to cope with the ever-changing scripts and tactics of fraudsters.

[0004] Existing work utilizes graphs to detect financial fraud. Knowledge graphs describe the relationships and attributes between defined entities, based on a general graph structure, using binary representations to describe the relationships between entity nodes. Event graphs are knowledge bases describing the evolutionary patterns and rules between events; they are also based on a general graph structure, constructing pairwise relationships between event nodes using binary representations. Consistency checks, outlier analysis, and potential risk prediction are applications of knowledge graphs in anti-fraud. Miao et al. constructed a dynamic financial knowledge graph, displaying stock data changes over time in a timeline format. Li et al. used entities and relationships in knowledge graphs to model semantics, extracting interest paths from the graph and combining them with interest fluctuation signals to predict click-through rates. Wang et al. enhanced the role of relationships in P2P lending knowledge graphs by recovering lost associations and mining underlying associations, thereby improving data quality and detecting organized fraud. In the financial field, event graphs are mainly used to detect hot events, predict future risk events, and identify event patterns. Li et al. extracted event chains from a news corpus to construct a narrative event evolution graph, using a proportional graph neural network to learn event representations and predict subsequent events. Ding et al. proposed an event logic graph, defining four types of relationships between events, and used the constructed graph for script prediction. Yang et al. proposed a narrative graph neural network, considering the sequential nature of the sequence and the structural nature of the graph to predict intermediate events. Wang et al. argued that the shortcomings of existing script prediction tasks are that they ignore the fine-grained relationships between event components; therefore, they unified parameter representation, event representation, and chain representation into a single framework to predict subsequent events. However, the above graph studies are all based on graph structures represented by binary tuples to describe deterministic entities and events, focusing on the evolution and development of the entire event. They can only perform post-event predictions and cannot characterize uncertain, multi-agent events with high-order relationships, making it difficult to prevent fraud beforehand.

[0005] General graph structures are used to describe paired node relationships but cannot characterize complex high-order relationships in the real world. Hypergraphs, composed of binary pairs of a set of vertices and a set of hyperedges, can be used to model complex and varied story scripts in fraud scenarios. Because hyperedges differ significantly from edges in general graph structures, they can connect multiple vertices. Hypergraphs are mainly applied in image processing, very large-scale integrated circuits, and recommender systems, with link prediction being a representative task in these scenarios. Fatemi et al. introduced positional information, learning the embedding representations of nodes and positions through translation and convolution operations, and using inner products to calculate scores to predict connectivity. Yadati et al. used graph convolutional neural networks to predict hyperlinks in undirected and directed hypergraphs. Fan et al. proposed a heterogeneous hypergraph variational autoencoder for link prediction in heterogeneous information networks. While these methods all consider using hypergraphs to model high-order relationships in knowledge graphs, they do not address the complexities of behavioral interactions between multiple agents. While some methods involve directed hypergraphs, they unroll the hypergraph into a clique and use graph convolutional networks to learn the representation, thus disrupting the original structure of the hypergraph, adding redundant and invalid information, and failing to accurately model the directedness of the hypergraph. Summary of the Invention

[0006] The purpose of this invention is to propose a behavior graph based on directed hypergraphs to address the complex and ever-changing fraud scripts in telecommunications fraud scenarios. This invention considers the subjects involved in the behavior, the internal and external factors that cause the behavior, and provides a rigorous definition of the behavior. It also considers multi-subject behavior, uncertain behavior, and interactive behavior in the scenario, describes the relationships between behaviors, and then constructs a behavior graph. Based on the latent representation of the behavior, the representation of the behavior graph is learned, and finally, fraud is identified.

[0007] To achieve the above objectives, the technical solution of the present invention provides a method for constructing a behavioral graph and detecting telecommunications fraud, characterized by comprising the following steps:

[0008] Step 1: For each case in a telecommunications fraud scenario, extract the behaviors and related information that occur within it; Step 2: Based on the association information of the behavior, establish the relationships between behaviors and entities, and between behaviors themselves; Step 3: Using entities as nodes and behaviors as hyperedges, build an inner hypergraph model by utilizing the relationships between behaviors and entities; Using behaviors as nodes and two sets of behaviors as directed hyperedges, an outer hypergraph model is built by utilizing the relationships between behaviors. Step 4: Merge the inner hypergraph model and the outer hypergraph model to construct a behavior graph with a two-layer structure. The inner structure represents the relationship between behavior and entity, and the outer structure represents the relationship between behavior. The directionality is reflected in the transition relationship between behavior sets. The final behavior graph is constructed from entity set, behavior set, and hyperedge set. Step 5: Initialize the representation of the behavior graph and extract the superbehaviors and the relationships between them; Step 6: Input the initial representation obtained in Step 5 into the directed hypergraph neural network, and learn the enhanced representation of nodes and hyperedges by aggregating neighbor information; Step 7: Use the superbehavior representation and its neighbor structure to obtain the behavior graph representation, build a classifier to determine the type of behavior graph, and obtain fraud detection results.

[0009] Preferably, in step 1, for any action Represented as:

[0010] in, It is behavior The action, It is behavior The implementing body It is behavior The target of action, It is behavior The triggering conditions, It is behavior The result of It is a set of behaviors.

[0011] Preferably, in step 2, establishing the relationship between behaviors and entities includes: Establish behavior and the subject of the action The target of the behavior The relationship between them will determine the subjects performing the behavior. and the target Unified representation as entities ,Right now ; Establishing relationships between behaviors includes: The relationships between behaviors can be described as sequential, concurrent, and cyclical, where: The definition of order relation is: for , Represent a set of behaviors that satisfy:

[0012] So it is called and They have a sequential relationship; The definition of concurrency is: for ,if If there is no order relationship, then it is called and It has a concurrent relationship.

[0013] The definition of a loop relationship is: for If any and There is an order relationship between them, and and If there is an order relationship between them, then it is called... There is a cyclical relationship; According to the triggering conditions of the behavior and the results The classification of one-to-one, one-to-many, many-to-one, and many-to-many relationships between behaviors will produce results. and triggering conditions Two identical behaviors and Each is assigned to a hyperedge The final episode He Tou Ji ,Right now For all tail-focused behaviors to occur, head-focused behaviors must also occur.

[0014] Preferably, in step 3, for the outer hypergraph model, the set of directed hyperedges is traversed, and for hyperedges with the same tail set, their head set behavior is merged, and redundant hyperedges are deleted.

[0015] Preferably, in step 4, the behavioral map is represented by a triple, as shown in the following equation:

[0016] in, It represents a collection of entities used to describe the entities associated with a certain behavior, including the subject that performs the behavior and the object that acts upon it; A set of behaviors is used to describe a series of actions, each of which is composed of actions. ,main body ,object ,condition and results Composition, of which, the main body and object They all belong to entities; The superbeginning represents a set, used to describe the relationship between sets of behaviors, where... A superedge is called a superbehavior and contains the tail set. He Tou Ji Two parts, ending He Tou Ji The behaviors in the set are concurrent, and the tail set is... He Tou Ji There is an order relationship between them:

[0017] The physical meaning of the above formula represents: tail set All actions in the sequence must occur for the first episode to be triggered. The occurrence of the behavior in the middle, and the first episode Not all of the behaviors in the process need to occur.

[0018] Preferably, step 5, the initialization representation of the behavioral graph includes the following steps: Using jieba word segmentation and the word2vec model, the initial embedding vector of the behavior node is calculated based on semantic information relevant to the financial field. Next, the directed superedge composed of multiple behaviors is represented, i.e., the representation of the superbehavior. Specifically, considering the tail set He Tou Ji The structure will superbe The representation is split into a tail and a head, meaning the initial embedding of the tail set is calculated separately. and the initial embedding of the head set :

[0019]

[0020] Next, the correlation matrices of the inner and outer hypergraph structures are calculated, i.e., the entity-behavior layer correlation matrices. And behavior-superbehavior layer association matrix The behavior-superbehavior layer involves directed superedges:

[0021]

[0022] The behavior-superbehavior layer correlation matrix is ​​split into a tail matrix and a head matrix:

[0023]

[0024] Further obtaining their dual matrices facilitates subsequent calculations:

[0025]

[0026]

[0027] In the formula, Indicates super behavior The tail set, that is, the set of tail behaviors. Indicates super behavior The head set, i.e., the set of head behaviors.

[0028] Preferably, step 5, extracting the relationship between super-behaviors and super-behaviors, includes the following steps: In the behavior graph, we find the intersection behaviors between different superbehaviors, where the previous superbehavior can trigger the next superbehavior. A superbehavior represents a set of directed superedges, containing tail set behaviors and head set behaviors. Based on the shared behavior nodes, we establish the transition relationships between superbehaviors, forming a general graph with superbehaviors as nodes. This is used to represent the subsequent learning behavior graph.

[0029]

[0030] In the formula, Representing a general diagram adjacency matrix The Middle Line number The value of the column is used to describe the first column. The first super behavior and the first Each superaction indicates whether there is a connection relationship; if so, the value is 1, otherwise it is 0.

[0031] Preferably, step 6 includes the following steps: For the inner structure, entity nodes need to consider all their associated hyperedge information and aggregate neighbor behavior to enhance their own representation:

[0032] In the formula, Representing entities Node embedding, This represents the learnable weight parameters. This represents the learnable bias parameter; The hyperbehavior needs to consider the information of all the nodes it contains, and aggregate neighbor entities to enhance its own representation. In addition, since each entity has different importance to the behavior, it is also necessary to make the behavior pay attention to the important entity information, adding an attention mechanism:

[0033] In the formula, Indicates behavior Inner layer embedding, This represents the learnable weight parameters. This represents the learnable bias parameter; For the outer structure, behavior nodes need to consider the information of their associated outer directed hyperedges, and aggregate the set of neighbor behaviors to enhance their own representation. Note that the tail and head information need to be calculated separately.

[0034] In the formula, Indicates behavior Outer embedding, This represents the learnable weight parameters. This represents the learnable weight parameters. This represents the learnable bias parameters. This represents the learnable bias parameter; The representation of behavioral nodes needs to combine the augmented representations learned from the inner and outer layers of the structure:

[0035] In the formula, Indicates behavior Node embedding; The super-behavior needs to consider the information of all behavior nodes it contains, and aggregate neighbor behaviors to enhance its own representation. Note that the tail and head information need to be calculated separately.

[0036] In the formula, Indicates super behavior Hyperedge embedding, This represents the learnable weight parameters. This represents the learnable weight parameters. This represents the learnable bias parameters. This represents the learnable bias parameter; We focus on the impact of different hyperbehaviors on the entire behavior graph and use a graph attention network to extract feature information from the behavior graph:

[0037] In the formula, Represents the embedding of the behavior graph. This represents a graph attention network.

[0038] To address telecommunications fraud scenarios, this invention proposes a behavior graph construction method. This method constructs a hypergraph model based on the behavioral relationships between different entities, and then considers multi-agent characteristics, uncertainty, and interactivity to construct the behavior graph. The behavior graph reflects multi-agent characteristics through the participation of multiple parties, including fraudsters and legitimate users; uncertainty is reflected by the different behavioral conditions leading to different behavioral outcomes and generating different fraud chains; and interactivity is reflected by the mutual influence between fraudsters and legitimate users. Based on this behavior graph, a telecommunications fraud detection method is constructed, learning the set relationships between behaviors and enhancing the representation, thereby predicting whether a user will fall into a fraudulent behavior chain designed by a scammer.

[0039] This invention discloses a behavior graph construction method and a method for detecting telecommunications fraud. Addressing the problem of existing anti-fraud models constantly changing due to the numerous and rapidly evolving fraud scripts, this invention constructs a behavior graph with a dual-layer structure based on directed hypergraphs, which can describe high-order complex relationships. From a set perspective, it considers multi-state, uncertain behaviors under different conditions; from a micro perspective, it considers interactive behaviors involving multiple participants. Simultaneously, it utilizes a directed hypergraph neural network to learn the embedded representation of the behavior graph, employs an attention mechanism to focus on the importance of different entities to behaviors, and monitors the influence of different hyperbehaviors on the entire behavior graph. Ultimately, it obtains a representation of the behavior graph to identify fraud, providing technical support for fraud detection in telecommunications fraud scenarios. Attached Figure Description

[0040] Figure 1 It is a flowchart of the construction process of the behavior graph; Figure 2 This is an example diagram of a behavior map; Figure 3 This is a system framework diagram of the construction of behavioral graphs and its telecommunications fraud detection methods. Detailed Implementation

[0041] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0042] The main problem is that fraud scripts in telecommunications fraud scenarios are characterized by their variety, rapid changes, and strong concealment. Event graphs based on general graph structures are insufficient to describe such high-order and complex behavioral relationships, and event graphs can only be used for post-event fraud detection, still causing financial losses to victims. To better describe behavioral relationships, this invention proposes a behavioral graph that characterizes behavioral relationships with multiple agents, uncertainty, and interactivity. A behavioral graph-based telecommunications fraud detection method is proposed, which uses a directed hypergraph neural network to learn the embedding representations of nodes and hyperedges, aggregates neighbor information to enhance the representation, and finally obtains a behavioral graph embedding to identify fraud.

[0043] This embodiment discloses a method for constructing a behavioral graph and detecting telecommunications fraud therein, such as... Figure 3 The diagram shows the system framework of the behavior graph fraud detection method. The behavior graph and its fraud detection method are constructed from two aspects: first, extracting behavior and its associated information to construct the behavior graph; second, inputting the initial representation of the behavior graph into a directed hypergraph neural network for learning to establish the fraud detection method.

[0044] I. Constructing a Behavioral Graph: For each case in a telecommunications fraud scenario, extract the behaviors and their associated information; based on the behavioral associations, establish relationships between behaviors and entities, and between behaviors themselves; construct hypergraph models based on these relationships; and combine inner and outer two-layer hypergraph structures to build a behavioral graph, specifically including the following steps: S101: Extracting behavior and related information: In sociology, behavior describes the attitudes and lifestyles exhibited by humans or animals in life. Under certain conditions, it refers to the basic characteristics displayed by different individuals, animals, or groups, or their active responses to stimuli from internal and external environmental factors. In telecommunications fraud scenarios, the interactions between legitimate users and fraudsters conform to the sociological description of behavior. It contains 5 basic elements that are related to each other:

[0045] in, It is behavior The action, It is behavior The implementing body It is behavior The target of action, It is behavior The triggering conditions, It is behavior The result of the action. This refers to the methods or tools used by the actor when acting on the object, and the conditions. This refers to the objective environment in which the subject and object of an action interact, and the result. It indicates the degree of correspondence between the subject's intended behavior and the actual behavior performed.

[0046] S102: Establishing relationships between behaviors and entities: Consider the participants associated with each behavior and establish the behavior. and the subject of the action Target of action The relationship between them. Every single action must have an executing agent, the object of which is a person, while the object of the action may exist, such as a person or a telephone call, or it may not. This relates to the executing agent of the action. and the target Unified representation as entities ,Right now , For entities A set. Because every action must have an executing entity, there are no completely independent actions without any entity connection.

[0047] S103: Establishing relationships between behaviors: The occurrence of a certain behavior is generally accompanied by the occurrence of other behaviors; therefore, the relationships between behaviors can be sequential, concurrent, or cyclical. In this embodiment, the sequential relationship is defined as: for , Represent a set of behaviors that satisfy:

[0048] So it is called and They have a sequential relationship.

[0049] In this embodiment, the concurrency relationship is defined as: for ,if If there is no order relationship, then it is called and It has a concurrent relationship.

[0050] The definition of a loop relationship is: for If any and There is an order relationship between them, and and If there is an order relationship between them, then it is called... There is a cyclical relationship.

[0051] Since the triggering conditions of a behavior are external influencing factors, and the resulting outcome of a behavior is an internal influencing factor, the transfer between behaviors is judged by whether the triggering conditions and the resulting outcome are consistent; that is, based on the triggering conditions of the behavior... and the results This involves classifying the relationships between behaviors into one-to-one, one-to-many, many-to-one, and many-to-many categories. The results will be... and triggering conditions Two identical behaviors and Each is assigned to a hyperedge The final episode He Tou Ji ,Right now Because all tail-focused behaviors must occur for head-focused behaviors to occur.

[0052] S104: Establish the inner and outer hypergraph models: Based on steps S102 and S103, an inner hypergraph model is established using entities as nodes and behaviors as hyperedges, leveraging the relationships between behaviors and entities. An outer hypergraph model is then established using behaviors as nodes and sets of behaviors as directed hyperedges, leveraging the relationships between behaviors. Directed hypergraphs can be used to describe high-order, complex relationships in the real world. Directed hyperedges not only serve as sets of nodes but also possess directionality, allowing them to describe the transition relationships between sets of behaviors.

[0053] S105: Merge directed superedges: Based on the outer hypergraph model established in step S104, the set of directed hyperedges is traversed. For hyperedges with the same tail set, their head set behaviors are merged, and redundant hyperedges are deleted to reduce redundancy. This is because all behaviors in the tail set must occur for a behavior in the head set to occur. Therefore, if the tail sets are the same, the head sets of multiple directed hyperedges may all occur; hence, merging these directed hyperedges is equivalent to merging the head sets.

[0054] S106: Constructing a Behavioral Graph A behavior graph is a directed hypergraph with an inner and outer layer structure. The inner layer consists of entity nodes describing subjects and objects and behavior hyperedges, while the outer layer consists of behavior nodes and directed hyperedges representing superbehaviors. A behavior graph is represented by a triple:

[0055] in, It represents a set of entities used to describe the entities associated with a certain behavior, including the subject that performs the behavior and the object that acts upon it. A set of behaviors is used to describe a series of actions, each of which is composed of actions. ,main body ,object ,condition and results Composition, of which the main body and object They all belong to physical entities. The superbeginning represents a set, used to describe the relationship between sets of behaviors, where... A superedge is called a superbehavior and contains the tail set. He Tou Ji Two parts, ending He Tou Ji The behaviors in the set are concurrent, and the tail set is... He Tou Ji There is an order relationship between them:

[0056] Its physical meaning is represented by: tail set All actions in the sequence must occur for the first episode to be triggered. The occurrence of the behavior in the middle, and the first episode Not all of the behaviors in the process need to occur.

[0057] The set of entities formed by the interaction of subjects and objects embodies the multi-subjectivity of the behavior graph. Different triggering conditions lead to different behavioral outcomes, forming different hyperbehaviors and ultimately creating different fraud chains, reflecting the uncertainty of the behavior graph. Behaviors involving different subjects interact to form the tail set of hyperbehaviors, generating different new behaviors that constitute the head set of hyperbehaviors, reflecting the interactivity of the behavior graph.

[0058] Based on steps S104 and S105, the inner and outer hypergraph models are merged to construct a behavior graph with a two-layer structure. The inner structure represents the relationships between behaviors and entities, with the action subject and object as entity nodes, and behaviors associated with a set of entities as hyperedges. These hyperedges are undirected and simply represent sets of entities that exhibit the same behavior. The outer structure represents the relationships between behaviors, with behaviors as nodes and sets of behaviors as tail sets. Or the first episode Then, directed hyperedges are used to describe the transition directions between sets of behaviors. These directed hyperedges clearly describe the transition relationships between sets of behaviors, that is, some behaviors trigger the occurrence of other behaviors. The final behavior graph is constructed from the entity set, behavior set, and hyperedge set.

[0059] II. Behavior Graph Fraud Detection Method: Initialize the behavior graph and extract the relationships between super-behaviors; input the initial representation into a directed hypergraph neural network, and learn the enhanced representations of nodes and hyperedges by aggregating neighbor information; use the super-behavior representation and its neighbor structure to obtain the behavior graph representation, build a classifier to determine the type of behavior graph, and obtain fraud detection results.

[0060] S201: Initialize the representation of the behavior graph: The behavior graph is initialized using jieba word segmentation and a word2vec model. Initial embedding vectors for behavior nodes are calculated based on semantic information relevant to the financial domain. Next, calculate the initial embedding of the superline into the directed superedge. Specifically, considering the tail set... He Tou Ji The structure will superbe The representation is split into a tail and a head, meaning the initial embedding of the tail set is calculated separately. and the initial embedding of the head set :

[0061]

[0062] Next, the correlation matrices of the inner and outer hypergraph structures are calculated, i.e., the entity-behavior layer correlation matrices. And behavior-superbehavior layer association matrix The behavior-superbehavior layer involves directed superedges, so it is slightly different:

[0063]

[0064] The behavior-superbehavior layer correlation matrix is ​​split into a tail matrix and a head matrix:

[0065]

[0066] Further obtaining their dual matrices facilitates subsequent calculations:

[0067]

[0068]

[0069] In the formula, Indicates super behavior The tail set, that is, the set of tail behaviors. Indicates super behavior The head set, i.e., the set of head behaviors.

[0070] S202: Establishing relationships between super-behaviors In the behavior graph, find the intersection behaviors between different superbehaviors. An intersection behavior indicates that a preceding superbehavior can trigger a subsequent superbehavior. A superbehavior represents a set of directed superedges, containing tail-set behaviors and head-set behaviors. Based on shared behavior nodes, establish transition relationships between superbehaviors, forming a general graph with superbehaviors as nodes. This is used to represent the subsequent learning behavior graph.

[0071]

[0072] In the formula, Representing a general diagram adjacency matrix The Middle Line number The value of the column is used to describe the first column. The first super behavior and the first Each superaction indicates whether there is a connection relationship; if so, the value is 1, otherwise it is 0.

[0073] S203: Learning augmented representations of nodes and hyperedges: The initialization representations from steps S201 and S202 are input into the directed hypergraph neural network to learn the embedding representations of nodes and hyperedges. For the inner structure, entity nodes need to consider all their associated hyperedge information and aggregate neighbor behavior to enhance their own representation.

[0074] In the formula, Representing entities Node embedding, This represents the learnable weight parameters. This represents the learnable bias parameter.

[0075] The hyperbehavior needs to consider the information of all the nodes it contains, and aggregate neighbor entities to enhance its own representation. In addition, since each entity has different importance to the behavior, it is also necessary to make the behavior pay attention to the important entity information, adding an attention mechanism:

[0076] In the formula, Indicates behavior Inner layer embedding, This represents the learnable weight parameters. This represents the learnable bias parameter.

[0077] For the outer structure, behavior nodes need to consider the information of their associated outer directed hyperedges, and aggregate the set of neighbor behaviors to enhance their own representation. Note that the tail and head information need to be calculated separately.

[0078] In the formula, Indicates behavior Outer embedding, This represents the learnable weight parameters. This represents the learnable weight parameters. This represents the learnable bias parameters. This represents the learnable bias parameter.

[0079] The representation of behavioral nodes needs to combine the augmented representations learned from the inner and outer layers of the structure:

[0080] In the formula, Indicates behavior Node embedding.

[0081] The super-behavior needs to consider the information of all behavior nodes it contains, and aggregate neighbor behaviors to enhance its own representation. Note that the tail and head information need to be calculated separately.

[0082] In the formula, Indicates super behavior Hyperedge embedding, This represents the learnable weight parameters. This represents the learnable weight parameters. This represents the learnable bias parameters. This represents the learnable bias parameter.

[0083] S204: Obtain behavioral graph representation: Based on the hyperbehaviors and relationships established in step S202, we focus on the degree of influence of different hyperbehaviors on the entire behavior graph, and use a graph attention network to extract feature information from the behavior graph:

[0084] In the formula, Represents the embedding of the behavior graph. This represents a graph attention network.

[0085] S205: Fraud Detection Based on the behavioral graph representation, classification scores are obtained through a max pooling layer and two fully connected layers. A cross-entropy function is then established to calculate the loss error.

[0086]

[0087] in, Indicates sample The probability of predicting a positive class. Indicates sample The tag value.

Claims

1. A method for constructing a behavioral graph and detecting telecommunications fraud therein, characterized in that, Includes the following steps: Step 1: For each case in a telecommunications fraud scenario, extract the behaviors and related information that occur within it; Step 2: Based on the association information of the behavior, establish the relationships between behaviors and entities, and between behaviors themselves; Step 3: Using entities as nodes and behaviors as hyperedges, build an inner hypergraph model by utilizing the relationships between behaviors and entities; Using behaviors as nodes and two sets of behaviors as directed hyperedges, an outer hypergraph model is built by utilizing the relationships between behaviors. Step 4: Merge the inner hypergraph model and the outer hypergraph model to construct a behavior graph with a two-layer structure. The inner structure represents the relationship between behavior and entity, and the outer structure represents the relationship between behavior. The directionality is reflected in the transition relationship between behavior sets. The final behavior graph is constructed from entity set, behavior set, and hyperedge set. Step 5: Initialize the representation of the behavior graph and extract the superbehaviors and the relationships between them; Step 6: Input the initial representation obtained in Step 5 into the directed hypergraph neural network, and learn the enhanced representations of nodes and hyperedges by aggregating neighbor information, including the following steps: For the inner structure, entity nodes need to consider all their associated hyperedge information and aggregate neighbor behavior to enhance their own representation: In the formula, Representing entities Node embedding, This represents the learnable weight parameters. This represents the learnable bias parameter; The hyperbehavior needs to consider the information of all the nodes it contains, and aggregate neighbor entities to enhance its own representation. In addition, since each entity has different importance to the behavior, it is also necessary to make the behavior pay attention to the important entity information, adding an attention mechanism: In the formula, Indicates behavior Inner layer embedding, This represents the learnable weight parameters. This represents the learnable bias parameter; For the outer structure, behavior nodes need to consider the information of their associated outer directed hyperedges, and aggregate the set of neighbor behaviors to enhance their own representation. Note that the tail and head information need to be calculated separately. In the formula, Indicates behavior Outer embedding, This represents the learnable weight parameters. This represents the learnable weight parameters. This represents the learnable bias parameters. This represents the learnable bias parameter; The representation of behavioral nodes needs to combine the augmented representations learned from the inner and outer layers of the structure: In the formula, Indicates behavior Node embedding; The super-behavior needs to consider the information of all behavior nodes it contains, and aggregate neighbor behaviors to enhance its own representation. Note that the tail and head information need to be calculated separately. In the formula, Indicates behavior Node embedding, This represents the learnable weight parameters. This represents the learnable weight parameters. This represents the learnable bias parameters. This represents the learnable bias parameter; We focus on the impact of different hyperbehaviors on the entire behavior graph and use a graph attention network to extract feature information from the behavior graph: In the formula, This represents the learnable bias parameters. Represents a graph attention network; Step 7: Use the superbehavior representation and its neighbor structure to obtain the behavior graph representation, build a classifier to determine the type of behavior graph, and obtain fraud detection results.

2. The construction of a behavioral graph and its method for detecting telecommunications fraud as described in claim 1, characterized in that, In step 1, for any action Represented as: in, It is behavior The action, It is behavior The implementing body It is behavior The target of action, It is behavior The triggering conditions, It is behavior The result of It is a set of behaviors.

3. The construction of a behavioral graph and its method for detecting telecommunications fraud as described in claim 2, characterized in that, Step 2, establishing the relationship between behaviors and entities includes: Establish behavior and the subject of the action The target of the behavior The relationship between them will determine the subjects performing the behavior. and the target Unified representation as entities ,Right now ; Establishing relationships between behaviors includes: The relationships between behaviors can be described as sequential, concurrent, and cyclical, where: The definition of order relation is: for , Represent a set of behaviors that satisfy: So it is called and They have a sequential relationship; The definition of concurrency is: for ,if If there is no order relationship, then it is called and It has a concurrent relationship; The definition of a loop relationship is: for If any and There is an order relationship between them, and and If there is an order relationship between them, then it is called... There is a cyclical relationship; According to the triggering conditions of the behavior and the results The classification of one-to-one, one-to-many, many-to-one, and many-to-many relationships between behaviors will produce results. and triggering conditions Two identical behaviors and Each is assigned to a hyperedge The final episode He Tou Ji ,Right now For all tail-focused behaviors to occur, head-focused behaviors must also occur.

4. The construction of a behavioral graph and its method for detecting telecommunications fraud as described in claim 3, characterized in that, In step 3, for the outer hypergraph model, the set of directed hyperedges is traversed. For hyperedges with the same tail set, their head set behavior is merged, and redundant hyperedges are deleted.

5. The construction of a behavioral graph and its method for detecting telecommunications fraud as described in claim 4, characterized in that, In step 4, the behavior graph is represented by a triple, as shown in the following equation: in, It represents a collection of entities used to describe the entities associated with a certain behavior, including the subject that performs the behavior and the object that acts upon it; A set of behaviors is used to describe a series of actions, each of which is composed of actions. ,main body ,object ,condition and results Composition, of which, the main body and object They all belong to entities; The superbehavior set is used to describe the relationship between behavior sets and behavior sets. A superedge is called a superbehavior and contains the tail set. He Tou Ji Two parts, ending He Tou Ji The behaviors in the set are concurrent, and the tail set is... He Tou Ji There is an order relationship between them: The physical meaning of the above formula represents: tail set The actions in the sequence must occur simultaneously for the head set to be triggered. The occurrence of the behavior in the middle, and the first episode The actions in the process do not necessarily have to occur simultaneously.

6. The construction of a behavioral graph and its method for detecting telecommunications fraud as described in claim 5, characterized in that, Step 5, the initialization of the behavioral graph representation includes the following steps: Using jieba word segmentation and the word2vec model, the initial embedding vector of the behavior node is calculated based on semantic information relevant to the financial field. Next, the directed superedge composed of multiple behaviors is represented, i.e., the representation of the superbehavior. , will exceed The representation is split into a tail and a head, meaning the initial embedding of the tail set is calculated separately. and the initial embedding of the head set : Next, the correlation matrices of the inner and outer hypergraph structures are calculated, i.e., the entity-behavior layer correlation matrices. And behavior-superbehavior layer association matrix The behavior-superbehavior layer involves directed superedges: The behavior-superbehavior layer correlation matrix is ​​split into a tail matrix and a head matrix: Further obtaining their dual matrices facilitates subsequent calculations: In the formula, Indicates super behavior The tail set, that is, the set of tail behaviors. Indicates super behavior The head set, i.e., the set of head behaviors.

7. The construction of a behavioral graph and its method for detecting telecommunications fraud as described in claim 6, characterized in that, Step 5, extracting the relationships between super-behaviors, includes the following steps: In the behavior graph, find the intersection behavior between different superbehaviors. The intersection behavior indicates that the previous superbehavior triggers the next superbehavior. A superbehavior represents a set of directed superedges, including tail set behaviors and head set behaviors. Based on the shared behavior nodes, establish the transition relationship between superbehaviors to form a general graph with superbehaviors as nodes. This is used for the representation of subsequent learning behavior graphs. In the formula, Representing a general diagram adjacency matrix The Middle Line number The value of the column is used to describe the first column. The first super behavior and the first Does each superbehavior have a connection relationship?

Images