Method and system for identifying abnormal users based on dynamic relationship network

Abstract

The application provides a kind of based on dynamic relationship network's abnormal user identification method and system. By obtaining user transaction data, the preset time range is divided into multiple time windows;Extract the user transaction data corresponding to each time window, and construct the user relationship network arranged according to the time window according to the user transaction data;Obtain the network characteristics of user relationship network in each time window;The network characteristics in all time windows are analyzed by maximum correlation minimum redundancy analysis, to obtain the optimal time window corresponding to the network characteristics;The network characteristics corresponding to the optimal time window are aggregated and processed and change point detection, to obtain the persistence characteristics and mutagenicity characteristics, to build an abnormal user identification model, to identify abnormal users in user transaction data according to the abnormal user identification model. Considering the dynamic change of user transaction data, by obtaining the persistence characteristics and mutagenicity characteristics modeling analysis abnormal user, abnormal user can be accurately identified.

Description

Technical Field

[0001] This invention relates to the field of abnormal user identification technology, and specifically to an abnormal user identification method and system based on dynamic relationship networks. Background Technology

[0002] With the deepening development of the digital economy, a large number of transactions emerge daily, whether in the financial sector (stock and foreign exchange trading), online shopping on e-commerce platforms, or logistics transactions in the supply chain. However, these transactions attract not only legitimate participants but also some suspicious users. These suspicious users engage in improper activities, such as stealing user information, legalizing illegal funds, and engaging in fraudulent transactions, to obtain illicit profits, causing significant losses to individuals, businesses, and institutions. Therefore, it is necessary to identify suspicious users in transactions to ensure transaction security.

[0003] Existing technologies for identifying abnormal users can employ graph models to model transaction data at a specific moment, construct a transaction relationship network, and then use social network analysis methods or graph deep learning methods to construct network features to analyze abnormal user behavior.

[0004] However, existing technologies process transaction data from a static perspective, while the actual transaction process is a dynamic and changing process. The information captured by static analysis methods is limited, making it difficult to accurately identify abnormal users in transaction activities, resulting in poor accuracy in identifying abnormal users. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] To address the shortcomings of existing technologies, this invention provides an abnormal user identification method and system based on dynamic relationship networks, solving the technical problem of poor accuracy in identifying abnormal users in existing technologies.

[0007] (II) Technical Solution

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] The present invention provides an abnormal user identification method based on a dynamic relationship network to solve its technical problem. The abnormal user identification method is executed by a computer and includes the following steps:

[0010] Acquire user transaction data and divide the preset time range into multiple time windows;

[0011] Extract user transaction data corresponding to each time window, and construct a user relationship network arranged according to the time window based on the user transaction data;

[0012] Obtain the network characteristics of the user relationship network within each time window;

[0013] Perform maximum correlation and minimum redundancy analysis on network features within all time windows to obtain the optimal time window corresponding to the network features;

[0014] The network features corresponding to the optimal time window are aggregated to obtain persistent features; change point detection is performed on the network features corresponding to the optimal time window to obtain abrupt change features.

[0015] An abnormal user identification model is constructed based on the persistent and mutable features to identify abnormal users in user transaction data.

[0016] Preferably, user transaction data includes transaction time, transaction user, and transaction amount;

[0017] Extract user transaction data for each time window, including:

[0018] The user transaction data is matched with the time window based on the transaction time to obtain the user transaction data corresponding to each time window;

[0019] A user relationship network is constructed based on user transaction data and arranged according to time windows, including:

[0020] A static relationship network is constructed based on the user transaction data corresponding to each time window. In the static relationship network, nodes represent transaction users, edges represent transaction relationships between transaction users, and the weight of the edges represents the transaction amount.

[0021] By combining multiple static relationship networks in chronological order, a dynamic user relationship network is obtained.

[0022] Preferably, the network features within each time window include: degree centrality, betweenness centrality, proximity centrality, PageRank centrality, and local clustering coefficient.

[0023] Preferably, the method for obtaining the degree centrality includes:

[0024]

[0025]

[0026] in,

[0027] and Let i represent the i-th user and j-th user within the t-th time window;

[0028] n tThis represents the number of users within the t-th time window;

[0029] The method for obtaining the betweenness centrality includes:

[0030]

[0031] in,

[0032] This represents the k-th user within the t-th time window;

[0033] Indicates the time window within the t-th time window Contact The number of shortest paths;

[0034] This indicates the time window from the t-th time period. arrive The shortest path passes through The number of paths;

[0035] The method for obtaining proximity centrality includes:

[0036]

[0037] in,

[0038] This represents the number of users within the t-th time window. The number of shortest paths to other users;

[0039] The method for obtaining PageRank centrality includes:

[0040]

[0041] in,

[0042] This represents the PageRank vector for each user after the i-th iteration within the t-th time window, with a vector length of n. t ;

[0043] P t Let represent the transition matrix between users within the t-th time window, where each element represents the probability of one user accessing another user's service.

[0044] α represents the damping coefficient; e represents a vector with all components equal to 1;

[0045] The method for obtaining the local clustering coefficient includes:

[0046]

[0047] in,

[0048] Indicates user The total number of triangles they belong to;

[0049] This represents the number of users within the t-th time window. The number of neighboring users.

[0050] Preferably, maximum correlation and minimum redundancy analysis is performed on the network features within all time windows, including:

[0051] Obtain the relevance parameter of the network feature; wherein, the relevance parameter of the target network feature within the target time window is: the average of the maximum information coefficients of the target network feature and the same type of network feature within each time window outside the target time window;

[0052] Obtain the redundancy parameter of the network feature; wherein, the redundancy parameter of the target network feature within the target time window is: the average of the maximum information coefficients of the target network feature and the same type of network features within the selected time window; the selected time window is the time window before the target time window in the window time sequence;

[0053] Based on the relevance parameter and the redundancy parameter, the optimal time window corresponding to each type of network feature is obtained.

[0054] Preferably, the optimal time window for obtaining network features corresponding to the target type includes:

[0055] Retrieve network features of target types across all time windows; retrieve network features of target types within the selected window;

[0056] The optimal network features are obtained based on preset optimal network feature selection conditions; the optimal network feature selection conditions are:

[0057]

[0058] in,

[0059] F represents the network characteristics of the target type across all time windows; S m-1 This represents the network features of the target type in a total of m-1 selected windows;

[0060] T represents the number of time windows; m represents the optimal network feature;

[0061] MIC(f j ;f t ) represents the network feature f of the target type in the j-th time window. j Network features f of the target type in the t-th time windowt The maximum information coefficient between them;

[0062] MIC(f i ;f j ) represents the network feature f of the target type in the i-th time window. i Network features f of the target type within the selected time window j The maximum information coefficient between them;

[0063] The time window corresponding to the optimal network feature is determined as the optimal time window corresponding to the network feature of the target type.

[0064] Preferably, the network features corresponding to the optimal time window are aggregated, including:

[0065]

[0066] in,

[0067] f q,t This represents the network characteristics within the t-th time window;

[0068] DAF q,t β represents the persistent feature; β∈[0,1), represents the decay weight.

[0069] Preferably, change point detection is performed on the network features corresponding to the optimal time window, including:

[0070] The number of change points for each network feature within the optimal time window is obtained using the Bayesian detection method, and the mutational features for each network feature are determined.

[0071] Preferably, the abnormal user identification model is:

[0072]

[0073] in,

[0074] x represents the input features, and w and b represent the model parameters;

[0075] w·x+ represents a linear function that performs classification based on input feature x;

[0076] Y∈{0,1} represents the recognition result, where 0 indicates that the user is a normal user and 1 indicates that the user is an abnormal user.

[0077] The present invention provides an abnormal user identification system based on a dynamic relationship network to solve its technical problem, comprising:

[0078] The data acquisition module is configured to acquire user transaction data and divide the preset time range into multiple time windows;

[0079] The network construction module is configured to extract user transaction data corresponding to each time window and construct a user relationship network arranged according to the time window based on the user transaction data;

[0080] The network feature acquisition module is configured to acquire the network features of the user relationship network within each time window;

[0081] The window filtering module is configured to perform maximum correlation and minimum redundancy analysis on network features within all time windows in order to obtain the optimal time window corresponding to the network features.

[0082] The parameter acquisition module is configured to aggregate the network features corresponding to the optimal time window to obtain persistent features; and to perform change point detection on the network features corresponding to the optimal time window to obtain abrupt change features.

[0083] The model building module is configured to build an abnormal user identification model based on the persistent features and the mutable features, so as to identify abnormal users in user transaction data according to the abnormal user identification model.

[0084] (III) Beneficial Effects

[0085] This invention provides a method and system for identifying abnormal users based on a dynamic relationship network. Compared with existing technologies, it has the following advantages:

[0086] This invention acquires user transaction data and divides a preset time range into multiple time windows; extracts user transaction data corresponding to each time window and constructs a user relationship network arranged according to the time windows based on the user transaction data; acquires the network features of the user relationship network within each time window; performs maximum correlation and minimum redundancy analysis on the network features to obtain the optimal time window corresponding to the network features; and performs aggregation processing and change point detection on the network features corresponding to the optimal time window to obtain persistent and abrupt features, thereby constructing an abnormal user identification model to identify abnormal users in user transaction data. Considering the dynamic changes in user transaction data, modeling and analyzing abnormal users by acquiring persistent and abrupt features can accurately identify abnormal users. Attached Figure Description

[0087] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0088] Figure 1 This is a flowchart illustrating the abnormal user identification method based on dynamic relationship networks provided in an embodiment of the present invention. Detailed Implementation

[0089] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are described clearly and completely. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0090] This application provides an abnormal user identification method and system based on a dynamic relationship network, which solves the problem of poor accuracy in semantic recognition of abnormal users in the prior art and improves the accuracy of abnormal user identification.

[0091] The technical solution in this application is to solve the above-mentioned technical problems, and the general idea is as follows:

[0092] This invention acquires user transaction data and divides a preset time range into multiple time windows; extracts user transaction data corresponding to each time window and constructs a user relationship network arranged according to the time windows based on the user transaction data; acquires the network features of the user relationship network within each time window; performs maximum correlation and minimum redundancy analysis on the network features to obtain the optimal time window corresponding to the network features; and performs aggregation processing and change point detection on the network features corresponding to the optimal time window to obtain persistent and abrupt features, thereby constructing an abnormal user identification model to identify abnormal users in user transaction data. Considering the dynamic changes in user transaction data, modeling and analyzing abnormal users by acquiring persistent and abrupt features can accurately identify abnormal users.

[0093] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0094] This invention provides a method for identifying abnormal users based on a dynamic relationship network, which is executed by a computer. Figure 1 This is a flowchart illustrating the abnormal user identification method provided in an embodiment of the present invention. The method includes the following steps:

[0095] S1. Obtain user transaction data and divide the preset time range into multiple time windows;

[0096] S2. Extract user transaction data corresponding to each time window, and construct a user relationship network arranged according to the time window based on the user transaction data;

[0097] S3. Obtain the network characteristics of the user relationship network within each time window;

[0098] S4. Perform maximum correlation and minimum redundancy analysis on the network features to obtain the optimal time window corresponding to the network features;

[0099] S5. Aggregate the network features corresponding to the optimal time window to obtain persistent features; perform change point detection on the network features corresponding to the optimal time window to obtain abrupt change features.

[0100] S6. Construct an abnormal user identification model based on the persistent and mutable features, so as to identify abnormal users in user transaction data according to the abnormal user identification model.

[0101] The following is a detailed analysis of each step.

[0102] In step S1, user transaction data is acquired, and a preset time range is divided into multiple time windows. To analyze abnormal users, a time range can be preset, such as several months, to analyze whether abnormal users exist during transactions within these months.

[0103] Once the time frame is determined, user transaction data within that timeframe can be obtained. This data includes the transaction time, the user, and the transaction amount. It may also include basic user characteristics such as age and income.

[0104] Based on a preset time range, it can be divided into multiple consecutive time windows. Each time window represents a fixed period of time, and the duration of each time window can be the same. A time window can be a day, a week, or a month. Depending on the different settings of the time range, it can be divided into different time windows. For example, if a one-month time range is preset, each day can be divided into a time window.

[0105] In step S2, user transaction data corresponding to each time window is extracted, and a user relationship network arranged according to the time window is constructed based on the user transaction data.

[0106] After dividing the data into multiple time windows, user transaction data corresponding to each time window can be extracted. The transaction time determines which time window each transaction belongs to, allowing all user transaction data to be matched with each time window to obtain the user transaction data corresponding to each time window.

[0107] A static relationship network can be constructed based on the user transaction data corresponding to each time window to represent the transaction relationships within each time window. A graph model can be used to model the transaction data within each time window, forming multiple static relationship networks.

[0108] In the static relationship network: nodes represent transaction users, edges represent transaction relationships between transaction users, and edge weights represent transaction amounts.

[0109] Combining multiple static relationship networks according to chronological order yields a dynamic user relationship network. A dynamic user relationship network can be represented as:

[0110]

[0111] in,

[0112] G represents a dynamic user relationship network, G t This represents the static relational network within the t-th time window; T is the number of time windows.

[0113] user E t This represents the set of users within the t-th time window;

[0114] user and users The transaction relationship is represented as R t This represents the set of transaction relationships within the t-th time window;

[0115] user and users Transaction relationship weight representation W t This represents the set of relation weights within the t-th time window.

[0116] In step S3, the network characteristics of the user relationship network within each time window are obtained.

[0117] In this embodiment of the application, five network features were constructed using social network analysis, including degree centrality, betweenness centrality, proximity centrality, PageRank centrality, and local clustering coefficient.

[0118] Degree centrality measures the number of direct connections between a user and other users, that is, the number of a user's neighboring users, representing the degree of direct association between a user and other users. Methods for obtaining degree centrality include:

[0119]

[0120]

[0121] in,

[0122] and Let i represent the i-th user and j-th user within the t-th time window;

[0123] n t This represents the number of users within the t-th time window.

[0124] Betweenness centrality measures the degree to which a user acts as a mediator or bridge within a network; that is, the user's ability to connect different groups within the network. Methods for obtaining betweenness centrality include:

[0125]

[0126] in,

[0127] This represents the k-th user within the t-th time window;

[0128] Indicates the time window within the t-th time window Contact The number of shortest paths;

[0129] This indicates the time window from the t-th time period. arrive The shortest path passes through Number of paths.

[0130] Proximity centrality measures the average distance a user is from other users in a network. Methods for obtaining proximity centrality include:

[0131]

[0132] in,

[0133] This represents the number of users within the t-th time window. The number of shortest paths to other users.

[0134] PageRank centrality measures a user's importance within a social network. Methods for obtaining PageRank centrality include:

[0135]

[0136] in,

[0137] This represents the PageRank vector for each user after the i-th iteration within the t-th time window, with a vector length of n.t ;

[0138] P t Let represent the transition matrix between users within the t-th time window, where each element represents the probability of one user accessing another user's service.

[0139] α represents the damping coefficient; e represents a vector with all components equal to 1.

[0140] The local clustering coefficient measures the degree of connectivity between a user's neighboring users. Methods for obtaining the local clustering coefficient include:

[0141]

[0142] in,

[0143] Indicates user The total number of triangles they belong to;

[0144] This represents the number of users within the t-th time window. The number of neighboring users.

[0145] The above five network features can be obtained within each time window.

[0146] In step S4, maximum correlation and minimum redundancy analysis is performed on the network features to obtain the optimal time window corresponding to each feature. It should be noted that an optimal time window can be obtained for each of the five network features; in this embodiment, degree centrality is used as an example.

[0147] This application addresses the information redundancy problem in the modeling of dynamic relationship networks by designing a time window selection algorithm based on unsupervised maximum correlation and minimum redundancy correlation to achieve effective modeling of dynamic relationship networks. Specifically, it includes the following steps:

[0148] S401. Obtain the relevance parameter of the network feature. The relevance parameter of the target network feature within the target time window is the average of the maximum information coefficients of the target network feature and the same type of network features within each time window outside the target time window.

[0149] Taking degree centrality as an example, the average maximum information coefficient of the degree centrality in each time window and the degree centrality of other time windows is calculated sequentially. The calculation method is as follows:

[0150]

[0151] in,

[0152] Let d represent the degree centrality of N users in a relational network within T time windows. t It is an N-dimensional vector representing the degree centrality of N users within the t-th time window.

[0153] MIC(d i ;d t ) represents the degree centrality feature d of the i-th time window. i Degree centrality feature d of the t-th time window t The maximum information coefficient between d. The larger this value, the better it represents d. t For d i The less information that can be added.

[0154] The calculation process for the maximum information coefficient is as follows:

[0155] First, the observed data for both features are sorted. Second, the observed data for each feature is divided into multiple segments, which divides the two-dimensional scatter plot into multiple squares. Next, the local density of each square is calculated using the K-nearest neighbor method, and the degrees of freedom are corrected. Then, the mutual information between different squares is calculated. The maximum value of the mutual information under different square sizes is found; this is the maximum information coefficient. Finally, the maximum information coefficient is normalized, limiting it to the range [0,1]. The specific calculation method is as follows:

[0156]

[0157] in,

[0158] f i and f t Indicates two features; | i | represents feature f i The number of segments into which the observation data is divided; B represents the total number of squares in the two-dimensional scatter plot. I(f i ; t ) represents feature f i and f t Mutual information between them.

[0159] For each network feature within any time window, its relevance parameter can be obtained.

[0160] S402. Obtain the redundancy parameter of the network feature. The redundancy parameter of the target network feature within the target time window is the average of the maximum information coefficients of the target network feature and network features of the same type within the selected time window. The selected time window is the time window preceding the target time window in the window time sequence.

[0161] Taking degree centrality as an example, the degree centrality feature d of the i-th time windowi The redundancy parameter is the average maximum information coefficient between it and the degree centrality feature of each selected time window. The calculation method is as follows:

[0162]

[0163] Where: S represents the degree centrality feature within the selected time window, and |S| represents the number of degree centrality features within the selected time window. Red(d i ) represents feature d i The redundancy of feature d is such that the smaller the value, the more it indicates the redundancy of feature d. i The less information a feature shares with the degree centrality features within the selected time window, the more incremental information it contains.

[0164] S403. Based on the relevance parameter and the redundancy parameter, obtain the optimal time window corresponding to each type of network feature.

[0165] The unsupervised time window selection method based on maximum correlation and minimum redundancy in this embodiment of the application must meet the following conditions:

[0166] maxΦ(Rel,Red),Φ=Rel-Red

[0167] You can first obtain the network features of the target type in all time windows, and then obtain the network features of the target type in the selected window.

[0168] The optimal network features are obtained based on the preset optimal network feature selection conditions.

[0169] Suppose F is the feature set containing degree centrality features within all time windows, and S is the feature set containing degree centrality features within m-1 selected time windows. m-1 The task is to maximize Φ(Rel,Red) from the set {FS} m-1 In this process, the m-th feature (the optimal network feature) is selected. Therefore, the pre-defined criteria for selecting the optimal network feature are:

[0170]

[0171] in,

[0172] F represents the network characteristics of the target type across all time windows; S m-1 This represents the network features of the target type in a total of m-1 selected windows;

[0173] T represents the number of time windows; m represents the optimal network feature;

[0174] MIC(f j ;f t) represents the network feature f of the target type in the j-th time window. j Network features f of the target type in the t-th time window t The maximum information coefficient between them;

[0175] MIC(f i ;f j ) represents the network feature f of the target type in the i-th time window. i Network features f of the target type within the selected time window j The maximum information coefficient between them.

[0176] Degree centrality, for example, can also be expressed as:

[0177]

[0178] in,

[0179] F represents the network characteristics of the target type across all time windows; S m-1 This represents the network features of the target type in a total of m-1 selected windows;

[0180] T represents the number of time windows; m represents the optimal network feature;

[0181] MIC(d j ;d t ) represents the degree centrality feature d in the j-th time window. j With the degree centrality feature d in the t-th time window t The maximum information coefficient between them;

[0182] MIC(d i ;d j ) represents the degree centrality feature d in the i-th time window. i With the selected time window, the degree centrality feature d j The maximum information coefficient between them.

[0183] The time window corresponding to the optimal network feature is determined as the optimal time window corresponding to the network feature of the target type.

[0184] Given that the selection of time windows is time-series, this paper adopts a forward search method to find a subset of features within the approximately optimal time window defined by Φ(Rel,Red) in order to determine the optimal time window.

[0185] In step S5, the network features corresponding to the optimal time window are aggregated to obtain persistent features; change point detection is performed on the network features corresponding to the optimal time window to obtain abrupt change features. Specifically, this includes the following steps:

[0186] S501. Aggregate the network features corresponding to at least one optimal time window.

[0187] In this embodiment, to address the persistent impact of dynamic changes in network features, an exponentially weighted smoothing method is used to aggregate five network features within the optimal time window, thereby achieving information aggregation. The aggregation process is represented as follows:

[0188]

[0189] in,

[0190] f q,t This represents the network characteristics of user q in the t-th time window;

[0191] DAF q,t Indicates based on network feature f q,t The derived persistent feature; β∈[0,1), represents the decay weight.

[0192] A smaller β means that network features from historical moments are given lower weights, which means that network features from the current moment are given higher weights.

[0193] S502. Perform change point detection on the network features corresponding to the optimal time window. The number of change points for each network feature in the optimal time window can be obtained according to the Bayesian detection method, and the abrupt change features derived from each network feature can be determined.

[0194] In this embodiment, to address the abrupt changes that occur during the dynamic transformation of the relationship network, a Bayesian change point detection function is used to detect the number of change points for five network features within the optimal time window. Bayesian change point detection is a statistical method for detecting change points in time series. Based on Bayes' theorem and Bayesian inference, it comprehensively considers both the prior distribution of the data and the posterior distribution of the observed data to determine the existence of change points. Specifically, if the posterior probability of a certain network feature at a certain time point is less than the experimentally set threshold, then that time point is considered a change point for that network feature.

[0195] The following example uses degree centrality features. Assuming the optimal number of time windows for degree centrality features is 15, a time series is constructed based on the degree centrality features within these 15 time windows, i.e., X = (x1, x2, ..., x...). 15 ), where x 15 This refers to the degree centrality feature value within the 15th time window. The basic steps for detecting whether the degree centrality feature changes within the optimal time window and the number of such changes are as follows:

[0196] (1) Calculate the prior and posterior distributions. First, assume that the degree centrality feature exists at a certain run length r. t The predicted distribution is as follows Here, run length refers to the length of a subsequence that contains consecutive identical values. The expression related to the run length r t The degree centrality feature x at time t is relevant. Furthermore, it is assumed that the posterior distribution for this run length is P(r... t |x 1:t The marginal prediction distribution P(x) is obtained based on the degree centrality characteristics of the predicted and posterior distributions. t+1 |x 1:t The calculation formula is as follows:

[0197]

[0198] According to Bayes' theorem, the posterior distribution P(r) of the degree centrality feature x is... t |x 1:t The calculation is as follows:

[0199]

[0200] Then, the run length r at time t t Degree centrality feature x from time 1 to time t 1:t The joint distribution P(r) t ,x 1:t The following recursive updates can be performed:

[0201]

[0202] Wherein, P(r) t |r t-1 The possible values ​​of ) are shown in the following formula.

[0203]

[0204] Where H(·) represents the risk function, which is usually set to a constant. The predicted distribution P(x) of the degree centrality feature. t+1 |r t-1 ,x 1:t It depends only on the degree centrality characteristic at the current time t.

[0205] (2) Set a probability threshold θ. This threshold is used to determine whether the degree centrality feature changes within the time window. If the posterior probability of a change in the degree centrality feature at time t is lower than the set probability threshold, then time t is considered a turning point for the network feature. This paper uses a grid search method to determine this probability threshold.

[0206] (3) Repeat the above two steps to obtain the number of variable points for the five network features.

[0207] It should be noted that, based on the two aspects of information persistence and mutation, 10 dynamic network features are derived from the 5 network features, namely, the aggregate value of degree centrality, the number of variable points of degree centrality, the aggregate value of betweenness centrality, the number of variable points of betweenness centrality, the aggregate value of proximity centrality, the number of variable points of proximity centrality, the aggregate value of PageRank centrality, the number of variable points of PageRank centrality, the aggregate value of local clustering coefficient, and the number of variable points of local clustering coefficient.

[0208] In step S6, an abnormal user identification model is constructed based on the persistent features and the abrupt change features, in order to identify abnormal users in user transaction data according to the abnormal user identification model. The persistent features and the abrupt change features are collectively referred to as dynamic network features.

[0209] In this embodiment, the derived 10 dynamic network features and the 4 basic features commonly used in existing abnormal user detection research (such as user age, income, number of transactions, transaction amount, etc.) are input into the pre-built logistic regression model to generate the final abnormal user identification model for identifying abnormal users.

[0210] The specific steps to achieve the above process are as follows:

[0211] (1) Training the logistic regression model. The user's dynamic network features, basic features, and label features indicating whether the user is an anomalous user constitute a dataset. The dataset is divided into a training set, a validation set, and a test set. The training set is used to train the logistic regression model, and the validation set is used to fine-tune the model during training, especially the selection of hyperparameters (including the optimal number of time windows and the probability threshold in the change point detection algorithm).

[0212] After the model is trained, the test set can be used as input features into the model, and the model outputs the prediction results, which are the abnormal users in the user transaction data corresponding to the test set.

[0213] The logistic regression model can be represented as:

[0214]

[0215] Where, x∈R n The input features are represented by 10 dynamic network features and 4 basic features, while w and b represent the model parameters.

[0216] w·x+b represents a linear function that performs classification based on input feature x;

[0217] Y∈{0,1} represents the recognition result, where 0 indicates that the user is a normal user and 1 indicates that the user is an abnormal user.

[0218] P(Y=1|x) represents the probability of being identified as an abnormal user given input feature x.

[0219] The loss function used when training the logistic regression model is the logarithmic loss function, which can be specifically expressed as:

[0220]

[0221] Where N represents the number of training samples, μ represents the regularization coefficient, and h w ( i ) represents the probability that the i-th sample is judged as an abnormal user.

[0222] Evaluation metrics for model training performance include AUC, KS score, and F1 score. The optimal logistic regression model is selected based on the best training performance.

[0223] (2) Input the data in the test set into the trained logistic regression model to identify abnormal users in the transaction process.

[0224] It is worth noting that, in the examples of this invention, not only can an abnormal user identification model be built based on logistic regression, but also based on other classification algorithms, including support vector machines, random forests, decision trees, etc.

[0225] This invention also provides an abnormal user identification system based on a dynamic relationship network, the system comprising:

[0226] The data acquisition module is configured to acquire user transaction data and divide the preset time range into multiple time windows;

[0227] The network construction module is configured to extract user transaction data corresponding to each time window and construct a user relationship network arranged according to the time window based on the user transaction data;

[0228] The network feature acquisition module is configured to acquire the network features of the user relationship network within each time window;

[0229] The window filtering module is configured to perform maximum correlation and minimum redundancy analysis on the network features to obtain the optimal time window corresponding to the network features.

[0230] The parameter acquisition module is configured to aggregate the network features corresponding to the optimal time window to obtain persistent features; and to perform change point detection on the network features corresponding to the optimal time window to obtain abrupt change features.

[0231] The model building module is configured to build an abnormal user identification model based on the persistent features and the mutable features, so as to identify abnormal users in user transaction data according to the abnormal user identification model.

[0232] It is understood that the above-mentioned abnormal user identification system provided in the embodiments of the present invention corresponds to the above-mentioned abnormal user identification method. The explanation, examples, and beneficial effects of the relevant content can be referred to the corresponding content in the abnormal user identification method, and will not be repeated here.

[0233] In summary, compared with existing technologies, it has the following beneficial effects:

[0234] This invention first acquires transaction data, and then models a dynamic relationship network based on the transaction data using a series of static relationship networks. Next, five network features are extracted for each static relationship network, including degree centrality, betweenness centrality, proximity centrality, PageRank centrality, and local clustering coefficient. Therefore, these five network features from multiple static relationship networks constitute five time series. Then, an unsupervised time window selection method based on maximum correlation and minimum redundancy is designed to select the optimal time window for each of the five network features. Furthermore, for the five network features within the optimal time window, considering both persistent and abrupt impacts, an exponentially weighted smoothing function and a Bayesian change point detection function are used to construct ten network features, collectively referred to as dynamic network features in this paper. Finally, an abnormal user identification model incorporating dynamic network features is constructed based on a logistic regression model to identify abnormal users. This invention can obtain dynamic relationship network modeling and dynamic network feature construction based on transaction data. At the same time, it can combine the specific actual situation of subsequent tasks with different transaction data features (or user basic features) and construct abnormal user identification models based on different classification algorithms, thereby reducing the information redundancy problem of dynamic relationship network modeling and improving the accuracy of abnormal user identification models.

[0235] 2. This invention designs an unsupervised time window selection method based on maximum relevance and minimum redundancy, which can alleviate the information redundancy problem in the process of modeling dynamic relational networks using a series of static relational networks. That is, it filters out effective information closely related to the target task (abnormal user identification) in each static relational network, thereby improving the modeling efficiency of dynamic relational networks.

[0236] 3. This invention comprehensively considers two aspects of dynamic information change when constructing dynamic network features: continuous and sudden changes. The resulting dynamic network features more comprehensively reflect the dynamic changes in transaction data, thereby improving the accuracy of the abnormal user identification model.

[0237] It should be noted that, through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments. Numerous specific details are set forth in the specification provided herein. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0238] In this text, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0239] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method of identifying an abnormal user based on a dynamic relationship network, the method of identifying an abnormal user being executed by a computer, characterized by, Includes the following steps: Acquire user transaction data and divide the preset time range into multiple time windows; Extract user transaction data corresponding to each time window, and construct a user relationship network arranged according to the time window based on the user transaction data; Obtain the network characteristics of the user relationship network within each time window; Perform maximum correlation and minimum redundancy analysis on network features within all time windows to obtain the optimal time window corresponding to the network features; The network features corresponding to the optimal time window are aggregated to obtain persistent features; Change point detection is performed on the network features corresponding to the optimal time window to obtain abrupt change features; An abnormal user identification model is constructed based on the persistent features and the mutable features, so as to identify abnormal users in user transaction data according to the abnormal user identification model; Perform maximum correlation and minimum redundancy analysis on the network features within all time windows, including: Obtain the relevance parameter of the network feature; wherein, the relevance parameter of the target network feature within the target time window is: the average of the maximum information coefficients of the target network feature and the same type of network feature within each time window outside the target time window; Obtain the redundancy parameter of the network feature; wherein, the redundancy parameter of the target network feature within the target time window is: the average of the maximum information coefficients of the target network feature and the same type of network features within the selected time window; the selected time window is the time window before the target time window in the window time sequence; Based on the relevance parameter and the redundancy parameter, obtain the optimal time window corresponding to each type of network feature; Obtain the optimal time window corresponding to the network features of the target type, including: Retrieve network features of target types across all time windows; retrieve network features of target types within the selected window; The optimal network features are obtained based on preset optimal network feature selection conditions; the optimal network feature selection conditions are: in, F This represents the network characteristics of the target type across all time windows; Indicates total Network features of the target type in the selected window; T represents the number of time windows; m represents the number of currently selected time windows; Indicates the first Network characteristics of target type within a time window With the Network characteristics of target type within a time window The maximum information coefficient between them; representing the maximum information coefficient between the network features of the target type in the selected time window and the network features of the target type in the selected time window; The time window corresponding to the optimal network feature is determined as the optimal time window corresponding to the network feature of the target type. The network features corresponding to the optimal time window are aggregated, including: in, representing a network feature in a th time window; denotes a persistence characteristic; denotes a decay weight.

2. The abnormal user identification method of claim 1, wherein, The user transaction data includes the transaction time, the transaction user, and the transaction amount; Extract user transaction data for each time window, including: The user transaction data is matched with the time window based on the transaction time to obtain the user transaction data corresponding to each time window; A user relationship network is constructed based on user transaction data and arranged according to time windows, including: A static relationship network is constructed based on the user transaction data corresponding to each time window. In the static relationship network, nodes represent transaction users, edges represent transaction relationships between transaction users, and the weight of the edges represents the transaction amount. By combining multiple static relationship networks in chronological order, a dynamic user relationship network is obtained.

3. The abnormal user identification method according to claim 2, characterized by, Network features within each time window include: degree centrality, betweenness centrality, proximity centrality, PageRank centrality, and local clustering coefficient.

4. The abnormal user identification method according to claim 3, characterized by, The method for obtaining the degree centrality includes: in, and denotes the th time window; and i denotes the j th user; represents the number of users within a time window; The method for obtaining the betweenness centrality includes: in, represents the first user within the first k time window; Indicates the first Within a time window Contact The number of shortest paths; Indicates the first Within a time window arrive The shortest path passes through The number of paths; The method for obtaining proximity centrality includes: in, representing the number of shortest paths a user contacts other users within a time window​ The method for obtaining PageRank centrality includes: in, denotes the PageRank vector of the th user after the th iteration in the th time window, and the vector length is represents a transition matrix between users in the th time window, where each element in the matrix represents a probability of a user visiting another user. denotes the damping coefficient; denotes a vector with all components equal to 1; The method for obtaining the local clustering coefficient includes: in, representing the user total number of triangles in which the user is located; represents the number of neighboring users of the user in the i-th time window. th time window.

5. The abnormal user recognizing method of claim 1, wherein Change point detection is performed on the network features corresponding to the optimal time window, including: The number of change points for each network feature within the optimal time window is obtained using the Bayesian detection method, and the mutational features for each network feature are determined.

6. The abnormal user recognizing method of claim 1, wherein The abnormal user identification model is as follows: in, represents an input feature, and represents a model parameter; representing a linear function based on the input features a linear function that performs the classification; represents the recognition result, where 0 represents that the recognition result is a normal user, and 1 represents that the recognition result is an abnormal user.

7. A dynamic relationship network-based abnormal user identification system applied to the abnormal user identification method of claim 1, characterized by, The system includes: The data acquisition module is configured to acquire user transaction data and divide the preset time range into multiple time windows; The network construction module is configured to extract user transaction data corresponding to each time window and construct a user relationship network arranged according to the time window based on the user transaction data; The network feature acquisition module is configured to acquire the network features of the user relationship network within each time window; The window filtering module is configured to perform maximum correlation and minimum redundancy analysis on network features within all time windows in order to obtain the optimal time window corresponding to the network features. The parameter acquisition module is configured to aggregate the network features corresponding to the optimal time window to obtain persistent features; and to perform change point detection on the network features corresponding to the optimal time window to obtain abrupt change features. The model building module is configured to build an abnormal user identification model based on the persistent features and the mutable features, so as to identify abnormal users in user transaction data according to the abnormal user identification model.

Images