Network platform fraud detection system

Abstract

The present invention provides a network platform deception behavior detection system, which is implemented based on a preset adversarial generative network model; wherein the adversarial generative network model includes a discriminator and a generator, wherein the discriminator is used to divide the users to be detected into groups to obtain the information of the users at the group level; based on the information at the group level, the collusion pattern is amplified to identify and remove the disguise of the users; the time and space collusion pattern is captured to detect whether the user who removes the disguise is a deceiver; the generator is used to generate a deceiver sample by generating disguise and deliberately showing false information, and compete with the deceiver under disguise detected by the discriminator. The present invention can more effectively identify deceivers with disguise by dividing users into groups, based on the information at the group level to which they belong, by amplifying the collusion pattern to identify and remove the disguise, and finally by capturing the time and space collusion pattern to detect the deceiver after the disguise is removed.

Description

Technical Field

[0001] The present invention relates to the field of information detection technology under the field of artificial intelligence technology, and more specifically, to a network platform deception behavior detection system. Background Art

[0002] Deception is one of the main threats to the healthy development of various online platforms. Since deception can easily obtain improper benefits and has a low risk of exposure, its occurrence is increasing day by day. In order to detect deceivers, spatiotemporal graph neural network models have been widely used to detect temporal and spatial collusion patterns. The application of machine learning to deception detection has also obtained rich and complex settings, methods, theories and results.

[0003] The usual deception implementation process is as follows Figure 1 As shown. Scammers seek out and study the target of deception, and then mislead the target by manipulating, distorting or falsifying evidence, inducing the target to react in a way that harms their own interests. It can be seen that deception is different from denial. Denial refers to measures taken to hinder or prevent the target from understanding something by hiding or interfering. The basis of denial is to hide and cover up the truth; while the basis of deception is to disguise and present false content.

[0004] Deception channels refer to the information flow path between the deception means and the deception target. In the planning stage of deception, it is necessary to clarify the strategic goal; predict how the deceived will react; predict how the deceived will perceive the deception information; what information must be concealed and what must be displayed; how to conceal; how to show false information; and analyze the effect of the above on the deceived. In the implementation stage of deception, false features are transmitted through various deception channels, and the deception activities should be perceived by the deceived.

[0005] Counter-deception includes intelligence activities to identify denial and deception, as well as activities to eliminate and reduce the impact of the adversary's denial and deception activities. The most important thing in counter-deception is to understand the deceivers and recognize their disguises.

[0006] At present, the detection of deception behavior on online platforms mainly includes: deception detection in psychology, deception detection in the healthcare industry, and graph-based anomaly detection.

[0007] From a psychological perspective, focusing on the nonverbal and verbal behaviors of individual perceivers can be used to detect deception. Researchers believe that deception is accompanied by different psychological activities, and some signs may seep through when an individual is lying. Therefore, people often try to detect deception based on nonverbal indicators such as body movements and eye contact, while ignoring or paying less attention to verbal signals. For example, DePaulo and Morris conducted a meta-analysis of possible predictors of deception. They claimed that detecting deception is an inexact science and that there is a link between lying and pupil dilation, which is a sign of tension and concentration. In addition, they found that people who listen to lies think they are more worried than those who tell the truth because their voices have a higher pitch. Liars are also more likely to keep their mouths shut than those who tell the truth. However, they did notice that liars did not appear more irritable, blink more or stand in a less casual manner. According to DePaulo and Morris, only when liars are more motivated and in danger will they appear unusually quiet and make significantly less eye contact with the audience.

[0008] The healthcare industry has developed anti-fraud methods for medical insurance ranging from statistical rules to classical machine learning methods. Later, deep neural networks were introduced to learn the underlying deception patterns, revealing the power of deep architectures in deception detection. At the same time, the cheating methods have also escalated and become too deceptive and covert to be detected by classical deep models, which treat each deception behavior as isolated. Recently, graph neural networks (GNNs) have been used for deception detection with remarkable success, as GNNs can effectively learn latent features from historical interconnected behaviors. In other words, GNNs can more accurately infer the probability of deception by learning deception behaviors from the relationship graph.

[0009] Graph-based anomaly detection (GAD) refers to identifying anomalies that deviate significantly from the majority of objects in relational and structured data. As graph data becomes ubiquitous and growing, graph-based anomaly detection has attracted increasing attention due to its wide range of applications, such as Ye and Akoglu et al. proposed spammer identification and Weber et al. used graphs for financial cheater identification. Due to the complex interactions between nodes in real-world systems, detecting anomalies in graph data becomes more challenging than anomaly detection in non-interactive feature spaces. Considering the tendency of cheaters in the network to connect with a large number of normal users, the homogeneity assumption limits the ability of traditional GNNs, so various techniques can be used to mitigate the negative impact. From the spectral domain, both AMNet and BWGNN design multi-pass spectral filters to discover high-frequency anomalies. To select important neighbors, both CARE-GNN and AOGNN use reinforcement learning modules, taking the similarity measurement of neighbors to self-nodes and AUC performance as rewards, respectively. PC-GNN directly measures the anomaly probability gap by training an additional MLP that only takes node attributes as input.

[0010] However, the above-mentioned existing deception detection techniques rarely pay enough attention to the disguised behavior of deceivers. Many existing graph neural network models face the challenge of extreme sample imbalance caused by rare deceivers hidden among massive users, which leads to imperfect deception detection schemes and low detection accuracy. Summary of the invention

[0011] In view of the above-mentioned problems existing in the current field of false information detection, such as poor detection accuracy, the purpose of the present invention is to provide a network platform deception behavior detection system, which divides users into groups and detects deceivers based on group-level information.

[0012] On the one hand, the present invention provides a network platform deception behavior detection system, which is implemented based on a preset adversarial generative network model; wherein the adversarial generative network model includes a discriminator and a generator; wherein the discriminator is used to detect a deceiver in disguise, including:

[0013] A group division module, used to divide the users to be detected into groups to obtain information about the users at the group level;

[0014] a disguise identification module, configured to identify and remove the disguise of the user by amplifying the collusion pattern based on the group-level information;

[0015] A deception detection module, used to detect whether the user who removed the disguise is a deceiver by capturing the temporal and spatial collusion pattern;

[0016] The generator is used to generate a deceiver sample by generating disguise and intentionally showing false information, so as to compete with the deceiver under disguise detected by the discriminator;

[0017] The discriminator and the generator share a space-time graph, and each node and each edge of the space-time graph are transformed into node features and edge features of the space-time graph through two double-layer perceptrons.

[0018] Among them, an optional solution is that the group division module uses a Gaussian mixture model to divide the users to be detected into m groups through cluster contrast learning, denoted as: C = {c1, c2, ..., c m},in, Among them, C is a group set, c represents a group, v represents a node in it, and n i =|c i |Refers to group c i The number of users; m is a hyperparameter.

[0019] Among them, an optional solution is that the group division module also

[0020] Using contrastive learning, the output of the group partitioning module h(v) contains more negative sample graph structure information nodes by bringing node v and its positive sample neighbors closer to each other in the embedding space and moving node v away from other nodes; and

[0021] Temporal correlation is used to weight positive samples to reduce the weight of disguised edges, where the group partition loss is expressed as follows:

[0022]

[0023] in, represents the group partitioning loss, M is a negative sample randomly selected from V except the neighbors of node v, and h(v i ) is the node v i After the output of RNN, h(v j ) is the node v in the negative sample j After the output of RNN; E and Updated with the latest general graph and graph trajectory respectively.

[0024] Among them, an optional solution is that the camouflage identification module includes:

[0025] A mask generation unit, configured to output a mask for each edge associated with the deceptive node in each snapshot graph; wherein the disguise of the user node during period t is reflected in the node features and edge features at the snapshot graph Gt;

[0026] an edge feature updating unit, configured to update the edge feature by element-by-element multiplication of the edge feature and the mask;

[0027] The camouflage removal unit is used to adjust the corresponding node features to align with the edge features to remove the camouflage in the snapshot image.

[0028] Among them, an optional solution is that the mask generating unit includes:

[0029] Embedding generation unit for a given temporal embedding layer and edge embedding H t The output of (E) generates a mask embedding h′ for each edge associated with the cheating node t (m ij ), where m ij represents the edges related to the cheating node;

[0030] An embedding conversion unit, configured to convert each mask embedding into a mask value, wherein the mask value is a continuous value between 0 and 1;

[0031] Among them, the tanh function is used for smooth approximation to generate the mask of the edge related to the deceptive node, as shown in the following formula:

[0032]

[0033] Among them, W and b are learnable parameters, β is a hyperparameter used to control the strength of the smooth approximation, and the output

[0034] Among them, an optional solution is that the generator includes a disguise generation module and a deliberate false module; wherein,

[0035] The disguise generation module is used to add disguise to the existing deceiver; including:

[0036] A disguised edge feature generation unit is used to output each disguised edge feature associated with the deceptive node in each snapshot graph. Wherein, for each connection between a deceiver and other users in each snapshot graph, regardless of whether there is an edge in the original graph, the disguised edge feature contains all information related to the disguise;

[0037] The sample edge feature generating unit is used to generate the camouflaged edge feature by With the initial edge feature x t (e ij ) add them element by element to generate the edge features of the new deceptive sample;

[0038] A feature alignment unit, used to align edge features of a newly generated deceptive sample with node features to generate a disguise of the node;

[0039] The deliberate false module is used to add a false content vector to the existing deceiver, which together with the content generated by the disguise generation module constitutes a deceiver sample.

[0040] Among them, an optional solution is to further include an adversarial optimization module, which is used to identify the disguise generated by the disguise generation module through the disguise identification module; and detect the deceiver in the deceiver sample through the disguise identification module and the deception detection module.

[0041] Among them, an optional solution is that the disguise identification module identifies the disguise generated by the disguise generation module, including:

[0042] Given a group partition C;

[0043] Fixed θ2, by maximizing the collusion loss and And maximize the camouflage identification loss to optimize ω; and, by maximizing the collusion loss and To optimize μ;

[0044] Fix ω, by minimizing the collusion loss and And minimize the loss of camouflage identification To optimize θ2.

[0045] Among them, an optional solution is to detect the deceiver in the deceiver sample through the disguise recognition module and the deception detection module, including: fixing θ2 and θ3, the generator maximizes the deception detection error To optimize ω; fixed ω, the discriminator minimizes the deception detection error To optimize θ2 and θ3.

[0046] It can be seen from the above technical solutions that the network platform deception behavior detection system provided by the present invention can more effectively identify deceivers with disguises by dividing users into groups, amplifying collusion patterns based on information at the group level to which they belong, and finally detecting deceivers after removing disguises by capturing time and space collusion patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] By referring to the following description in conjunction with the accompanying drawings, and with a more comprehensive understanding of the present invention, other objects and results of the present invention will become more clear and easy to understand. In the accompanying drawings:

[0048] Figure 1 Schematic diagram of the common deception implementation process;

[0049] Figure 2A schematic diagram of the logical structure of a network platform fraud behavior detection system according to an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of a detection process of a fraudulent behavior detection system for an application network platform according to an embodiment of the present invention;

[0051] Figure 4 A schematic diagram of an optimization process of a discriminator according to an embodiment of the present invention;

[0052] Figure 5 It is a schematic diagram of the optimization process of the generator according to an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In the following description, for the purpose of illustration, in order to provide a comprehensive understanding of one or more embodiments, many specific details are set forth. However, it is apparent that these embodiments may also be implemented without these specific details. In other examples, for ease of describing one or more embodiments, known structures and devices are shown in the form of block diagrams.

[0054] In response to the many problems existing in the aforementioned existing false information detection methods, the present invention proposes a solution that integrates psychology or human cognition, using the principles of psychology to comprehensively evaluate the authenticity and credibility of information to improve the accuracy of false information detection.

[0055] In order to better illustrate the technical solution of the present invention, some technical terms involved in the present invention are briefly explained below.

[0056] Generative Adversarial Networks (GAN), the traditional GAN ​​is mainly composed of two parts: the generative network and the discriminator network, also called the generator and the discriminator. In GAN, the two networks are trained separately. First, the discriminator is trained to enable it to distinguish the authenticity of the picture. Then the generator is trained to generate images through the generator, and the images generated by the discriminator are used for discrimination.

[0057] A generator is a special iterator that uses the yield statement in a function to generate values. Each time the generator's next() method is called, the function will execute to yield, return the value and pause. The next call will continue from where it was last paused.

[0058] The discriminator is a network used to identify the data generated by the generator in the adversarial neural network. It improves the classification accuracy by constraining the membership and true label generated by the generator to be the opposite of the results output by the discriminator.

[0059] Space-time diagram is a geometric language used to analyze physical problems. It can use world lines and reference frames to describe events and locations in space and time.

[0060] The RNN (Recurrent Neural Network) model is a model that can be used specifically to process time series data. It generally takes sequence data as input and effectively captures the relationship characteristics between sequences through the internal structure design of the network. It also generally outputs in the form of a sequence. The biggest difference between RNN and traditional neural networks is that each time the previous output result is brought to the next hidden layer for training together.

[0061] Gaussian Mixture Models (GMM) is a clustering method in unsupervised learning, which refers to the linear combination of multiple Gaussian distribution functions. In theory, GMM can fit any type of distribution. Gaussian mixture models are usually used to solve the problem that the data in the same set contains multiple different distributions. Specific applications include clustering, density estimation, and generating new data.

[0062] Bidirectional Long Short-Term Memory (BiLSTM) is an improved method based on Recurrent Neural Network (RNN), which is composed of forward LSTM and backward LSTM, and can better capture the bidirectional semantic dependency and the representation of sentiment words.

[0063] A deep understanding of the real records of deceivers shows that deceivers usually engage in group-level disguise, which is specifically divided into two types: time disguise and space disguise. This disguise can deceive many existing graph neural network models by hiding the collusion pattern and disguising themselves as a benign group. Specifically, in order to cover up the temporal collusion pattern, deceivers introduce temporal disguise by engaging in illegal activities that are not limited to a short time window. In addition, deceivers use spatial disguise to intentionally associate themselves with benign individuals, which can effectively hide the spatial collusion pattern. Therefore, the present invention starts with analyzing the deceiver's disguised behavior and improves the ability to identify disguise by identifying the deceiver's group information.

[0064] In order to solve the problem of low detection accuracy in existing detections, the present invention provides a network platform deception behavior detection system. Based on the deception and anti-deception theory, a Fraud Detection (Adversarial Generation Fraud Detection, AGFD) is proposed for deception detection. Specifically, it can also be used to detect false information with deceptive intentions, so as to improve the accuracy of deception information and false information detection.

[0065] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0066] It should be noted that the following description of the exemplary embodiments is merely illustrative and is not intended to limit the present invention and its application or use. Technologies and devices known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, the technologies and devices should be considered as part of the specification.

[0067] In order to illustrate the network platform fraud detection system provided by the present invention, Figure 2 , Figure 3 The network platform fraud behavior detection system framework and application method flow of the embodiment of the present invention are respectively exemplarily marked. It should be noted that the drawings and the embodiments described below are only some implementations of the present invention and are not intended to limit the present invention. For ordinary technicians in this field, other drawings and implementations can be obtained based on these drawings and implementations without creative work.

[0068] refer to Figure 2 The network platform deception behavior detection system 200 provided in this embodiment is implemented based on a preset adversarial generative network model; the adversarial generative network model mainly includes two parts, namely a discriminator 220 and a generator 240, with a total of five modules, which are responsible for group division, disguise identification, deception detection, disguise generation and false display generation. Among them, the first three modules (group division module 222, disguise identification module 224 and deception detection module 226) constitute a discriminator 220, which is intended to detect deceivers in disguise; the last two modules (disguise generation module 242 and false display generation module 244) constitute a generator 240, which is used to generate a deceiver sample by generating disguise and deliberately displaying false information, and compete with the deceivers in disguise detected by the aforementioned discriminator 220.

[0069] Among them, the discriminator 220 uses a spatiotemporal graph neural network as the basic model. The group division module 222 aims to divide users into groups and provide group-level information; its purpose is to identify groups among all users and extract group-level information. The disguise identification module 224 detects disguised behavior by amplifying the deceiver's criminal collusion pattern based on group division, which is a prerequisite for the deception detection module to perform deception detection. After removing the detected disguise, the deception detection module adopts a spatiotemporal graph neural network to capture the temporal and spatial collusion pattern to detect the deceiver. The generator 240 generates a deceiver sample by generating disguises and deliberately showing false information, competing with the discriminator 220 to alleviate the challenges of sample imbalance and improve the robustness of the model.

[0070] Accordingly, according to Figure 3 As shown, the detection process of the application network platform deception behavior detection system mainly includes a deception identification step S100 and a deception generation step S200; wherein, the deception identification step S100 is used to detect a deceiver in disguise, including:

[0071] S110: Divide the users to be detected into groups to obtain information of the users at the group level;

[0072] S120: Based on the group-level information, amplifying the collusion pattern to identify and remove the disguise of the user;

[0073] S130: detecting whether the user who removed the disguise is a cheater by capturing the time and space collusion pattern;

[0074] The deception generation step S200 is used to generate a deceiver sample by generating disguise and deliberately showing false information, so as to compete with the deceiver in disguise detected by the deception identification step S100.

[0075] It can be seen from the corresponding deception detection process of the above-mentioned deception detection system that, in response to the above-mentioned technical problems existing in the prior art, the present invention mainly improves the ability to identify disguises by identifying the group information of deceivers, so as to realize adversarial generation of deception detection based on deception and anti-deception theory.

[0076] The network platform fraud behavior detection system 200 and the fraud detection process of the network platform fraud behavior detection system of the present invention will be described below in conjunction with more detailed embodiments.

[0077] The reasoning phase only uses the disguise identification module 224 and the deception detection module 226. In order to support new registered users in actual business scenarios, the reasoning phase does not use group division. This enables AGFD to handle newly added nodes in general graphs and graph trajectories, and can also be used for false information detection with deceptive intent.

[0078] The trainable parameters in the group division module 222, the disguise identification module 224, the deception detection module 226, the disguise generation module 242 and the false generation module 244 are written as θ1, θ2, θ3 and ω, μ respectively. The values ​​of these five parameters are continuously optimized and updated during the deep model training process.

[0079] The above five modules all share the space-time graph. That is, the discriminator and the generator share the space-time graph. Each node and each edge of the space-time graph is transformed into node features and edge features of the space-time graph through two two-layer perceptrons. Specifically, as an example, the input of the module is the graph trajectory Each node in the spatiotemporal graph needs to first pass through two double-layer perceptrons to convert the feature X of node V in time period t into t (V) Transformation into node features of spatiotemporal graph Each edge E also passes through two double-layer perceptrons to convert the feature X of edge E in time period t into t (E t ) is transformed into the edge feature H of the space-time graph t (E t ), where the edge features of the space-time graph And the node characteristics of the space-time graph n t is the number of edges in time period t, d v and d e is the dimension of node embedding and edge embedding. The spatiotemporal layer consists of the spatial embedding layer and the temporal embedding layer.

[0080] The spatial embedding layer aims to mine the spatial patterns of interactions between users in each snapshot graph Gt (an undirected static graph containing information within a certain time period t). The input corresponding to the snapshot graph Gt is and H t (E t ). The spatial embedding layer consists of 1 graph attention layer. In each layer, the node embedding is updated with the information of the neighbors. Among them, the spatial embedding layers of the four modules of the group segmentation module 222, the disguise identification module 224, the deception detection module 226 and the disguise generation module 242 share the same parameters to avoid overfitting.

[0081] The input of the temporal embedding layer is the spatial embedding layer at each time step In the temporal embedding layer, the RNN model is used to capture sequence-based The output of the RNN model is written as

[0082] Figure 4 The optimization process of the discriminator according to an embodiment of the present invention is shown.

[0083] like Figure 4 As shown, for the discriminator 220, the optimization can be divided into two stages. In the first stage, the group division module 222 is optimized to divide the users into multiple groups. At the beginning, the group division is based on the initial general graph G, without considering disguise. In the second stage, the group division C, the disguise identification module 224 identifies the disguise by maximizing the collusion pattern. After removing the disguise, the deception detection module 226 is used to accurately detect the deceiver. The modules of the two stages are optimized alternately. After removing the disguise in the second stage, the general graph is updated and further used for the next round of optimization of the group division module. After several rounds of optimization, when the discriminator converges, the generator is optimized.

[0084] The following is an illustrative description of the specific implementations of the group classification module 222, the disguise identification module 224 and the deception detection module 226.

[0085] Specifically, as an example, the goal of the group division module 222 is to assign users to m groups, which are denoted as group set C = {c1, c2, ..., c m},in Among them, C is a group set, c represents a group, v represents a node in it, and n i =|c i |Refers to group c i . Note that each group c i are all subgraphs of the initial general graph G. These groups are non-overlapping, where

[0086] Since the general graph G is constantly changing, the group segmentation module 222 always divides users into different groups according to the latest general graph (the current state of the graph G). Cluster contrast learning is usually used for group detection. In the present invention, this cluster contrast learning method is also followed to divide groups. Based on the output of the last time step of the RNN (the output contains the RNN network's understanding or summary of the entire sequence), a Gaussian mixture model is used to divide all nodes into m groups, where m is a hyperparameter. During the entire deep learning model training process, the obtained groups are labeled as deceivers and benign groups according to the user-level labels. It is worth noting that the deceiver samples generated by the generator 240 will not be included in group detection, and they will retain the original groups.

[0087] The optimization objective of the group segmentation module 222 considers both the graph structure and the node attributes. Contrastive learning is used to bring node v and its neighbors (positive samples) closer to each other in the embedding space, while moving node v away from other nodes, so that the output h(v) of the group segmentation module contains more graph structure information nodes (negative samples). At the beginning, camouflaged behavior may be detrimental to group segmentation because the camouflaged edges associated with spatial camouflage always connect benign and deceptive nodes. In order to facilitate group segmentation in the early stages of the training process, temporal correlation is used to weight positive samples. By measuring behavioral similarity, temporal correlation can reduce the weight of camouflaged edges. To this end, the group segmentation loss can be expressed as follows:

[0088]

[0089] in, represents the group partition loss, M is a negative sample, which is randomly selected from nodes V except the neighbors of the node v; h(v i ) is the node v i After the output of RNN, h(v j ) is the node v in the negative sample j After the output of RNN, E and Updated with the latest general graph and graph trajectory respectively.

[0090] Before introducing the camouflage identification module 224, it is first introduced how camouflage is reflected in the snapshot image and how to remove camouflage from the snapshot image. The camouflage during the period t is reflected in the snapshot image G t In a specific embodiment of the present invention, the de-masquerading operation starts from the edge and adjusts the node features according to the edge features.

[0091] In a specific embodiment of the present invention, the masquerade identification module includes a mask generation unit, an edge feature update unit and a masquerade removal unit (not shown in the figure).

[0092] Specifically, in order to remove the disguise, the disguise identification module 224 outputs a mask for each edge related to the deceptive node in each snapshot graph through the mask generation unit. In the disguise identification module 224, the time embedding layer is BiLSTM so that the node information at different time steps can be mutually enhanced. As an example, the mask generation unit further includes an embedding generation unit and an embedding conversion unit.

[0093] Among them, the embedding generation unit is used for a given time embedding layer and edge embedding H t The output of (E) generates a mask embedding h′ for each edge associated with the cheating node t (m ij ), where m ijRepresents the edge associated with the deceptive node. The embedding conversion unit is used to convert each mask embedding into a mask value, which is a continuous value between 0 and 1. To this end, the tanh function is used for smooth approximation to generate the mask of the edge associated with the deceptive node, as shown in the following formula:

[0094]

[0095] Among them, W and b are learnable parameters, β is a hyperparameter used to control the strength of the smooth approximation, and the output is the mask of the edges associated with the deceptive node. For convenience, the nodes and edges corresponding to the disguise are named disguise nodes and disguise edges respectively. For those normal edges, the mask is close to 1, while for the disguised edges, the mask should be less than 1. Then, the edge feature is updated by multiplying the edge feature by the element-by-element of the mask through the edge feature update unit. Figure 4 Finally, the corresponding node features are adjusted to align with the edge features through the edge feature update unit. In this way, the disguise in the snapshot graph can be easily removed. Correspondingly, the edge weight a of the disguised edge in the general graph G is ij It will also decrease.

[0096] It should be noted that in the formula parameter representation of the present invention, the difference between the same symbol without ^ and with ^ is that without ^ represents real data, and with ^ represents false (deceptive) data generated. t (m) represents the mask, Then it represents the edge mask associated with the cheating node.

[0097] The output of the deception detection module 226 is the detection result. The spatial embedding layer and the temporal embedding layer may mine spatial collusion patterns and temporal collusion patterns to assist in deception detection. Based on the output of the camouflage identification module 224, The output of the last step uses linear combination and softmax to generate the output representing the probability that node v is a cheater As the output of the entire fraud detection module 226.

[0098] Optimization goals of disguise identification and deception detection: The optimization goals of these two modules are from the perspective of the supervisor, that is, to accurately identify disguises and detect deceivers. Specifically, as an example, in another embodiment of the present invention, the deception detection module 226 also includes a disguise identification optimization unit (not shown in the figure), which is used to optimize disguise identification using collusion loss and disguise identification loss after removing the disguise of the user, and use deception detection loss to guide the disguise identification module 224 and the deception detection module 226 to detect deceivers.

[0099] Among them, the collusion loss includes temporal collusion loss and spatial collusion loss, which is used to guide the camouflage identification module to remove camouflage edges by maximizing the increment of the temporal and spatial collusion scores after the mask operation relative to the initial collusion scores. The temporal collusion loss can be calculated as follows:

[0100]

[0101] in, represents the time collusion loss, c represents a group, is the output of the camouflage identification module, Refers to c after the mask operation i The temporal collusion score of . Similarly, the spatial collusion loss can be calculated as:

[0102]

[0103] in, represents the spatial collusion loss, c represents a group, is the output of the camouflage identification module, Refers to c after the mask operation i The spatial collusion score.

[0104] The disguise recognition loss can guide the discriminator model to remove disguises through supervisory signals. At the beginning, the supervisory signal can only indicate the spatial disguise between benign users and deceivers. After the first round of optimization, the generator can provide additional supervisory signals. On this basis, the mask can be learned in a supervised manner through a binary classification task, and the mask of the disguised edge generated by the generator is optimized towards 0, and the mask of other edges is optimized towards 1. The cross entropy is used to calculate the disguise recognition loss, as follows:

[0105]

[0106] in, is the disguise recognition loss, E is the edge of the spatiotemporal graph, and y t (m ij ) represents a mask, represents the mask of the edge associated with the deceptive node calculated in the above formula (2), The mask representing the fake edges associated with the cheating node.

[0107] In the second stage of the discriminator, the objective function for optimizing camouflage recognition can be expressed as follows:

[0108]

[0109] Among them, γ1, γ2 and γ3 are hyperparameters, Measure the losses for cheaters.

[0110] The deception detection loss is used to optimize the deception detection module and detect whether users in the community have engaged in deception activities. The calculation formula is as follows:

[0111]

[0112] Among them, y v represents the mask of node v, represents the disguised mask of node v, in the fraudulent background, y v =1 for cheaters, y v =0 represents a benign user.

[0113] In a specific embodiment of the present invention, the generator includes a disguise generation module 242 and a false display generation module 244 , so that the disguise generation module 242 and the false display generation module 244 can jointly create a new deception sample. Figure 5 Schematic diagram of the optimization process of the generator according to an embodiment of the present invention. Figure 5 As shown, in the optimization process of the generator, deceiver samples are created by adding disguises and fake content to the existing population. In this way, the generator learns to create fake deception samples by incorporating feedback from the discriminator, specifically, to make the discriminator classify its output as a benign user. After several rounds of optimization, when the generator converges, the generated deception samples can be used to expand the deception samples in the training set.

[0114] The disguise generation module 242 is used to add disguise to the existing deceiver. Specifically, it includes:

[0115] A disguised edge feature generation unit is used to output a disguised edge feature for each edge associated with the deceptive node in each snapshot graph. Among them, for each connection between each deceiver and other users in each snapshot graph, regardless of whether they have an edge in the original graph, the feature contains all the information related to the disguise. In order to ensure that the disguise generation module can only change the initial feature by adding disguise, in a specific embodiment of the present invention, ReLU is used to make each element in the generated disguise edge feature not less than 0.

[0116] The sample edge feature generation unit is used to generate the camouflaged edge feature With the initial edge feature x t (e ij ) are added element by element to generate the edge features of the new deceptive sample. If there is no edge between vi and vj in the original snapshot graph, then x t (e ij ) will be filled with 0.

[0117] The feature alignment unit, similar to the deletion operation, is used to align the edge features and node features of the newly generated deception sample to generate the disguise of the node. Figure 5 In the expression Unlike the delete operation, the general graph G is not updated.

[0118] Optimization goal of disguise generation. Disguise behavior is from the perspective of the deceiver, that is, to avoid being discovered at the lowest cost. Intuitively, disguise behavior will bring costs, and the more disguises, the higher the cost. Based on this, the generator follows a basic principle, that is, to add as little disguise as possible to hide the collusion pattern as much as possible. To this end, the objective function of the disguise generation module consists of two parts. The first part is to compete with the discriminator, including maximizing the deception detection loss, disguise identification loss, and collusion loss. Considering the disguise cost, L1 regularization is used to ensure that only a small amount of disguise is generated. The loss function of the disguise generation module can be expressed as the equation shown in the following formula (7):

[0119]

[0120] in, represents the camouflage detection loss of the camouflage generation module, represents the spatial collusion loss of the camouflage generation module, represents the time collusion loss of the camouflage generation module, represents the disguise recognition loss of the disguise generation module, represents the L1 regularization of the disguise generation module to prevent overfitting, and γ4, γ5, γ6 and γ7 are hyperparameters.

[0121] The generated disguises are further used as supervisory signals to optimize the disguise recognition module. The number of generated disguises is small, resulting in an imbalanced supervisory signal. This ensures that only a few edges are judged as disguise edges by the disguise recognition module, thus keeping disguise recognition and disguise generation consistent.

[0122] The fake generating module 244 is used to add the fake content vector to the existing deceiver in an element-by-element addition manner, and together with the content output by the disguise generating module 242, form a deceiver sample.

[0123] In a specific embodiment of the present invention, there is no corresponding camouflage identification module like the camouflage generation module, but only optimizes by maximizing the deception detection loss and collusion loss. The same L1 regularization is used. The overall loss function of the camouflage generation module can be expressed as the following equation:

[0124]

[0125] in, represents the loss function of the fake generation module, represents the false detection loss of the false generation module, represents the spatial collusion loss of the fake generation module, represents the temporal collusion loss of the fake generation module, γ8 and γ9 are hyperparameters. So far, the overall loss of the generator is:

[0126]

[0127] The following is an example of the adversarial optimization process of the discriminator and the generator.

[0128] The generator competes with the discriminator in two aspects. In a specific embodiment of the present invention, the network platform deception behavior detection system 200 further includes an adversarial optimization module (not shown in the figure), which is used to identify the disguise generated by the disguise generation module through the disguise identification module 224; and detect the deceiver in the deceiver sample through the disguise identification module 224 and the deception detection module 226.

[0129] First, the disguise generation module directly outputs disguises. Its opponent, the disguise identification module, tries to identify the disguises generated by the disguise generation module. From an optimization point of view, given the group partition C, by fixing θ2, the disguise generation module maximizes the collusion loss and And maximize the camouflage identification loss To optimize ω, which is disadvantageous to the camouflage identification module. The fake generation module maximizes the collusion loss and To optimize μ. On the contrary, by fixing ω, the camouflage recognition module minimizes the collusion loss and And minimize the loss of camouflage identification To optimize θ2.

[0130] On the other hand, the generator generates deceptive samples, while the disguise recognition module and the deception detection module try to detect the deceiver. Similarly, by fixing θ2 and θ3, the generator maximizes the deception detection error By fixing ω, the discriminator optimizes ω by minimizing the spoofing detection error. To optimize θ2 and θ3. In this way, the discriminator and the generator are optimized in an adversarial manner.

[0131] As described above, the network platform fraud detection system proposed in the present invention is described by way of example with reference to the accompanying drawings. However, those skilled in the art should understand that various improvements can be made to the network platform fraud detection system proposed in the present invention without departing from the content of the present invention. Therefore, the protection scope of the present invention should be determined by the content of the attached claims.

Claims

1. A network platform fraud behavior detection system, characterized in that: The method is implemented based on a preset generative adversarial network model; wherein the generative adversarial network model includes a discriminator and a generator; The discriminator is used to detect a deceiver in disguise, including: A group division module, used to divide the users to be detected into groups to obtain information about the users at the group level; a disguise identification module, configured to identify and remove the disguise of the user by amplifying the collusion pattern based on the group-level information; A deception detection module is used to detect whether the user who has removed the disguise is a deceiver by capturing the temporal and spatial collusion pattern; it includes a disguise identification optimization unit, which is used to optimize the disguise identification by using the collusion loss and the disguise identification loss after removing the disguise of the user; wherein, The collusion loss includes a temporal collusion loss and a spatial collusion loss, and is used to guide the camouflage identification module to remove the camouflage edge by maximizing the increment of the temporal and spatial collusion scores after the mask operation relative to the initial collusion scores; wherein the temporal collusion loss is calculated as follows: in, represents the time collusion loss, c represents a group, is the output of the camouflage identification module, c i The temporal collusion score, c i The temporal collusion score after masking; The spatial collusion loss is calculated as: in, represents the spatial collusion loss, c represents a group, is the output of the camouflage identification module, c i The spatial collusion score, c i The spatial collusion score after masking operation; The disguise recognition loss is used to guide the model to remove disguises through supervisory signals; wherein the mask is learned in a supervised manner through a binary classification task, the mask of the disguised edge generated by the generator is optimized toward 0, and the mask of other edges is optimized toward 1; the disguise recognition loss is calculated using cross entropy, as shown in the following formula: in, is the disguise recognition loss, E is the edge of the spatiotemporal graph, and e ij is node v i ,v j The edge, y t (m ij ) represents a mask, represents the mask of edges associated with the cheating node, The mask representing the fake edges associated with the cheating node; The objective function for optimizing camouflage recognition is expressed as follows: Among them, γ1, γ2 and γ3 are hyperparameters, Detection losses for deception; Among them, y v represents the mask of node v, represents the disguised mask of node v, in the fraudulent background, y v =1 for cheaters, y v =0 represents a benign user; The generator is used to generate a deceiver sample by generating disguise and intentionally showing false information, so as to compete with the deceiver under disguise detected by the discriminator; The discriminator and the generator share a space-time graph, and each node and each edge of the space-time graph are transformed into node features and edge features of the space-time graph through two double-layer perceptrons.

2. The network platform fraud behavior detection system according to claim 1, characterized in that: The group division module uses a Gaussian mixture model to divide the users to be detected into m groups through cluster contrast learning, denoted as: C = {c1, c2, ..., c m },in, Among them, C is the group set, c i represents the i-th group, c m represents the mth group; v represents the node in it, n i =|c i |Refers to group c i The number of users; m is a hyperparameter, v ij represents user j in group i, represents user n in group i i .

3. The network platform fraud behavior detection system according to claim 2, characterized in that: The group partitioning module also uses contrastive learning to bring node v and its positive sample neighbors closer to each other in the embedding space, while moving node v away from other nodes, so that the output of the group partitioning module h(v) contains more negative sample graph structure information nodes; and, Temporal correlation is used to weight positive samples to reduce the weight of disguised edges, where the group partition loss is expressed as follows: in, represents the group partition loss, n is the number of groups; M is a negative sample, randomly selected from V except the neighbors of node v, h(v i ) is the node v i After the output of RNN, h(v j ) is the node v in the negative sample j Output of RNN; E is the set of edges of the general graph G, e ij is node v i , v j The edges that form is node v i , v j The time between the collusion loss, E and Updated with the latest general graph and graph trajectory respectively.

4. The network platform fraud behavior detection system according to claim 3, characterized in that: The camouflage identification module includes: A mask generation unit, configured to output a mask for each edge associated with the deceptive node in each snapshot graph; wherein the disguise of the user node during period t is reflected in the node features and edge features at the snapshot graph Gt; an edge feature updating unit, configured to update the edge feature by element-by-element multiplication of the edge feature and the mask; The camouflage removal unit is used to adjust the corresponding node features to align with the edge features to remove the camouflage in the snapshot image.

5. The network platform fraud behavior detection system according to claim 4, characterized in that: The mask generating unit comprises: Embedding generation unit for a given temporal embedding layer and edge embedding H t The output of (E) generates a mask embedding h′ for each edge associated with the cheating node t (m ij ), where m ij represents the edges related to the cheating node; An embedding conversion unit, configured to convert each mask embedding into a mask value, wherein the mask value is a continuous value between 0 and 1; Among them, the tanh function is used for smooth approximation to generate the mask of the edge related to the deceptive node, as shown in the following formula: Where W and b are learnable parameters, β is a hyperparameter used to control the strength of the smooth approximation, Represents the mask of the edge, output 6. The network platform fraud behavior detection system according to claim 4, characterized in that: The generator includes a disguise generation module and a false generation module; wherein, The disguise generation module is used to add disguise to the existing deceiver; including: A disguised edge feature generation unit is used to output a disguised edge feature for each edge associated with the deceptive node in each snapshot graph. Wherein, for each connection between a deceiver and other users in each snapshot graph, regardless of whether there is an edge in the original graph, the disguised edge feature contains all information related to the disguise; The sample edge feature generating unit is used to generate the camouflaged edge feature by With the initial edge feature x t (e ij ) add them element by element to generate the edge features of the new deceptive sample; A feature alignment unit, used to align edge features of a newly generated deceptive sample with node features to generate a disguise of the node; The fake generating module is used to add fake content vectors to the existing deceiver, which together with the content generated by the disguise generating module form a deceiver sample.

7. The network platform fraud behavior detection system according to claim 6, characterized in that: It also includes a countermeasure optimization module, which is used to identify the disguise generated by the disguise generation module through the disguise recognition module; and The deceiver in the deceiver sample is detected by the disguise identification module and the deception detection module.

8. The network platform fraud behavior detection system according to claim 7, characterized in that: The camouflage recognition module identifies the camouflage generated by the camouflage generation module, including: Given a group partition C; Fixed θ2, by maximizing the collusion loss and And maximize the camouflage identification loss to optimize ω; and, by maximizing the collusion loss and To optimize μ; Fix ω, by minimizing the collusion loss and And minimize the loss of camouflage identification To optimize θ2; Among them, θ2 is the training parameter of the camouflage recognition module, represents the time collusion loss of the camouflage generation module, represents the spatial collusion loss of the disguise generation module, ω is the training parameter of the disguise generation module, To show the time collusion loss of the fake generation module, is the spatial collusion loss of the fake generation module, and μ is the training parameter of the fake generation module.

9. The network platform fraud behavior detection system according to claim 8, characterized in that: Detecting the deceiver in the deceiver sample by the disguise identification module and the deception detection module includes: Fixed the training parameters θ2 of the disguise recognition module and θ3 of the deception detection module, the generator maximizes the deception detection error To optimize ω; The training parameters ω of the disguise generation module are fixed, and the discriminator minimizes the deception detection error To optimize θ2 and θ3.

Images