Fraud identification method and device integrating graph diffusion convolution and grouping aggregation features

Abstract

The present invention discloses a fraud identification method and device that integrates graph diffusion convolution and grouping aggregation features. The method includes extracting the structure of the original graph, performing graph structure enhancement on the original graph to obtain a two-hop graph, and inputting it into a classification model, including dividing the graph into relationship subgraphs according to the relationship type, performing feature grouping aggregation on each relationship subgraph, performing graph diffusion convolution on the features after grouping and aggregation of each relationship subgraph, and then performing relationship aggregation on the features after diffusion convolution of each relationship subgraph to obtain the final features and output the prediction results through a fully connected layer. In addition to aggregating the grouped neighborhood node features of the original graph, the graph diffusion convolution of the present invention also aggregates the grouped neighborhood node features of the two-hop graph generated by graph structure enhancement, making full use of the structural information, relationship information, and grouping information of the graph. The application of the present invention in the field of fraud detection can effectively improve the ability to identify fraud and has great practical value.

Description

Technical Field

[0001] The present invention relates to the field of anti-fraud, and in particular to a fraud identification method and device integrating graph diffusion convolution and grouping aggregation features. Background Art

[0002] Anti-fraud machine learning models are an indispensable part of the anti-fraud field. They can help risk control workers accurately and efficiently identify fraudulent users, and to a certain extent, can reduce the work pressure of risk control personnel, while reducing the fraud rate, and reducing the economic losses and illegal activities caused by fraudulent behavior. Therefore, it is of great practical significance to establish a high-quality fraud identification model. Traditional fraud identification machine learning methods usually directly use the user's personal information features to model. This method can achieve good results in scenarios where user features are highly correlated with fraud labels, but it ignores the correlation between users and has poor recognition capabilities for gang fraud.

[0003] Graph diffusion convolution is a technology that uses graph diffusion models to aggregate features of user subgraph structures under each relationship, and then fully explores the associations between nodes. Grouped aggregation features are to group neighbor nodes of a node according to labels, and then aggregate the neighbor features of the group. In the field of anti-fraud identification, the use of this technology can fully mine the graph structure information, relationship information and grouping information between users, and can effectively identify fraudulent users. Existing technologies generally treat users as isolated nodes or simply aggregate neighbor features and input them into classifier training. This approach cannot fully utilize the relationship information and label information of neighbor nodes. Summary of the invention

[0004] The purpose of the present invention is to address the deficiencies of the prior art and provide a fraud identification method that integrates graph diffusion convolution and grouping aggregation features.

[0005] The object of the present invention is to achieve the following technical solution: a fraud identification method integrating graph diffusion convolution and grouping aggregation features, the method comprising:

[0006] S1. Build training data: Extract node features and graph relationship features in the fraud identification scenario, obtain the original graph and label it with fraud;

[0007] S2, enhancing the graph structure of the extracted original graph to obtain a two-hop graph structure;

[0008] S3, inputting the original graph and the two-hop graph into the fraud classification model and training until a preset number of iterations is reached;

[0009] The calculation process of the fraud classification model includes: dividing the original graph and the two-hop graph into multiple relationship subgraphs according to the relationship, performing group feature aggregation on each relationship subgraph; performing graph diffusion convolution on each relationship subgraph through the group feature set; performing relationship aggregation on the features obtained by the graph diffusion convolution; inputting the aggregated features into the fully connected layer to obtain the classification probability;

[0010] S4. Input the original image and the two-hop image in the fraud identification scenario into the trained fraud classification model to obtain the prediction result.

[0011] Furthermore, the original graph includes node features and graph relationship features, the node features are features required for the anti-fraud business, and the data type is a numerical type.

[0012] Furthermore, the graph structure enhancement is specifically as follows: connecting each node in the graph with nodes that can be reached in two hops to form a two-hop graph.

[0013] Furthermore, the original graph and the two-hop graph are divided into a plurality of relationship subgraphs according to the relationships. The specific division method is: dividing into relationship subgraphs according to the relationship attributes of the node connection edges, and the number of the relationship subgraphs is the same as the type of relationship attributes.

[0014] Furthermore, the group feature aggregation includes: grouping according to the fraud labels corresponding to the neighbor nodes of node i in each relationship subgraph, averaging the node features of each group and concatenating them with the features of node i, multiplying the parameter matrix and inputting the activation function to obtain the aggregated features of each group, and concatenating the features of the three groups to obtain the grouped aggregated features under the relationship r. The specific formula is as follows:

[0015]

[0016] Among them, the subscript g + represents the neighbor node grouping of node i whose fraud label is yes, g - represents the grouping of neighbor nodes whose fraud label of node i is no, g * represents the grouping of all neighbor nodes of node i that also includes node i; N(i) represents the set of neighbor nodes of node i, N(i) + 、N(i) - and N(i) * They represent the set of nodes with fraud labels of yes, the set of nodes with fraud labels of no, and the set of all neighbor nodes of node i, respectively. is a randomly initialized learnable parameter matrix; ReLU(·) is an activation function, ReLU(x)=max(x,0).

[0017] Furthermore, before inputting the original graph and the two-hop graph in the fraud identification scenario into the trained fraud classification model, some nodes need to be manually labeled with fraud labels for grouping and aggregation.

[0018] Furthermore, the graph diffusion convolution is specifically: using the original graph and the two-hop graph to perform graph diffusion convolution;

[0019] N1 is the set of neighbor nodes of node i in the original graph under relationship r, N2 is the set of neighbor nodes of node i in the two-hop graph under relationship r, τ1 and τ2 are the weight hyperparameters of the convolution of neighbor nodes in the original graph and the two-hop graph respectively. The features are obtained by grouping, aggregating and concatenating features;

[0020]

[0021] Said is the diffusion coefficient of the graph diffusion convolution, which is calculated as follows:

[0022]

[0023]

[0024] Furthermore, the relationship aggregation includes:

[0025] Multiply the characteristics of node i in multiple relationship subgraphs by the relationship coefficient Then find the sum; is the learnable parameter matrix, q T It is a learnable vector that controls the size of the product. The feature of node i in layer l obtained by relation aggregation

[0026] The relationship coefficient The calculation method of is as follows,

[0027]

[0028] Furthermore, the step of inputting the aggregated features into the fully connected layer to obtain the classification probability is as follows: inputting the features into the fully connected layer and connecting the SoftMax classifier to obtain the classification probability:

[0029]

[0030] For node i, the classification score p i Set the threshold z,

[0031] The loss function of the classification function is: Loss = -∑ i∈V [y i logpi +(1-y i )log(1-p i )], where y i is the true value of the label.

[0032] According to another aspect of the specification, a fraud identification device integrating graph diffusion convolution and grouping aggregation features is provided, the device is used to implement the method, and specifically comprises: a graph construction unit, a graph enhancement unit, a graph relationship division unit, a node grouping feature processing unit, a graph diffusion convolution feature unit, a graph relationship aggregation feature unit and a classification model training unit;

[0033] The graph construction unit is used to construct the original graph; the graph enhancement unit is used to construct a two-hop graph; the graph relationship division unit is used to divide the original graph and the two-hop graph into relationship subgraphs; the node grouping feature processing unit performs group aggregation on the relationship subgraph features to obtain group aggregation features; the graph diffusion convolution feature unit is used to perform graph diffusion convolution on the group aggregation features of the nodes; the graph relationship aggregation feature unit is used to perform relationship aggregation on the features of each relationship subgraph; and the classification model training unit is used to train the classification model.

[0034] Beneficial effects of the present invention: In addition to aggregating the grouped node features of the neighborhood, the present invention also aggregates the grouped node features of the second-order neighborhood generated by graph structure enhancement when performing graph diffusion convolution on the node graph relationship attributes, making full use of the graph's structural information, relationship information, and grouping information to enhance the fraud identification task. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a schematic diagram of the overall process of the present invention.

[0036] Figure 2 This is a schematic diagram of obtaining a two-hop graph structure by enhancing the graph structure based on the original graph structure.

[0037] Figure 3 This is a schematic diagram of the process of calculating the original image according to the classification model.

[0038] Figure 4 Schematic diagram of a fraud identification device that integrates graph diffusion convolution and group aggregation features. DETAILED DESCRIPTION

[0039] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0040] In order to enable those skilled in the art to better understand the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific examples.

[0041] (a) Extracting node features and graph relationship features in a fraud identification scenario.

[0042] like Figure 1 As shown, the process of the present invention includes preparing original data, extracting and constructing original graph and two-hop graph, graph grouping aggregation features, graph diffusion model convolution features, graph relationship aggregation features, input MLP (fully connected layer) training and prediction.

[0043] The features of the user node extracted in the present invention are determined according to the specific anti-fraud business scenario. The data type needs to be a numerical type. If there is non-numerical data, it needs to be encoded as a numerical type. Features such as transaction account number, transaction time, counterparty account, transaction amount, transaction device fingerprint, IP address, etc.

[0044] The original graph is a graph that contains the connection relationship of each node and the characteristics of each node, including the characteristics of each node, the connecting edges of each node and the relationship attributes of the edges.

[0045] (b) Enhance the graph structure of the extracted original image to obtain a two-hop graph structure.

[0046] like Figure 2 As shown in the figure, the original graph is enhanced to obtain a two-hop graph. In the figure, circles represent user nodes, 1hop refers to the original graph, and 2hop refers to a graph formed by connecting each node of the original graph with a node reached by two hops.

[0047] The original graph and the two-hop graph are input into the fraud classification model and trained until the preset number of iterations is reached; Figure 3 As shown, the calculation process of the fraud classification model includes: dividing the original graph and the two-hop graph into multiple relationship subgraphs according to the relationship, performing group feature aggregation on each relationship subgraph; performing graph diffusion convolution on each relationship subgraph through the group feature set; performing relationship aggregation on the features obtained by the graph diffusion convolution; inputting the aggregated features into the fully connected layer to obtain the classification probability; the specific steps are as follows:

[0048] (c) The original image and the two-hop graphs are divided into multiple relationship sub-graphs according to their relationships, and grouping features are aggregated for each relationship sub-graph.

[0049] like Figure 3 As shown in the figure, the original graph can be divided into multiple subgraphs according to the graph relationship (there are two graph relationships in the schematic diagram, which are distinguished by solid and dotted edges in the figure), and grouping features are aggregated for each subgraph. The division method is to divide the subgraphs according to the relationship attributes of the node connection edges, and there are as many subgraphs as the number of relationship attributes of the original graph.

[0050] The grouping feature aggregation process under a certain relationship subgraph is shown in formulas (1)-(4), where i represents a user node, l represents the layer number of the model iteration, r represents a certain graph relationship, and g + represents the neighbor node grouping of node i whose fraud label is yes, g -represents the grouping of neighbor nodes whose fraud label of node i is no, g * Represents the grouping of all neighbor nodes of node i (including node i). N(i) represents the set of neighbor nodes of node i. N(i) + 、N(i) - and N(i) * They represent the set of nodes with fraud labels of yes, the set of nodes with fraud labels of no, and the set of all neighboring nodes of node i. + For example, the feature of node i The features of its neighboring nodes are averaged and concatenated. is a parameter matrix, which performs matrix multiplication with the concatenated features. Randomly initialized value, its value will change with the gradient during training, They are obtained in the same way. They have different uses and are multiplied with the features of different groups. ReLU(·) is an activation function, ReLU(x)=max(x,0). The features obtained by grouping Do the concatenation to get the final features of node i grouping and aggregation under relationship r

[0051]

[0052] Among them, before inputting the original graph and two-hop graph in the new fraud identification scenario into the trained fraud classification model, some nodes need to be manually labeled with fraud labels for grouping and aggregation in this step.

[0053] (d) For the relationship subgraph of the original graph structure and the relationship subgraph of the two-hop graph structure, the node representation obtained in (c) is used to perform graph diffusion convolution.

[0054] Relationship of the original image Figure 1 The relationship between hop graph and two-hop graph Figure 2 Hop graph, use 1-hop graph and 2-hop graph for graph diffusion convolution. As shown in formula (5), N1 is the set of neighbor nodes of node i in the 1-hop graph under relationship r, N2 is the set of neighbor nodes of node i in the 2-hop graph under relationship r, τ1 and τ2 are the weight hyperparameters of 1-hop and 2-hop neighbor node convolution respectively, which can be adjusted manually. It is the feature obtained by grouping, aggregating and concatenating the features in formula (4).

[0055] (5)

[0057] is the diffusion coefficient of the graph diffusion convolution, and is calculated as shown in formulas (6) and (7).

[0058]

[0059] (e) Perform relational aggregation on the features generated by the graph diffusion convolution of each relational subgraph.

[0060] The features of node i under the relational subgraph r obtained after the diffusion convolution of the graph is completed To perform relationship aggregation, as shown in formula (8), the characteristics of node i in multiple relationship subgraphs are multiplied by the relationship coefficient Then sum it up. Relationship coefficient The calculation method of is shown in formula (9), is the learnable parameter matrix, q T are learnable vectors that control the size of the product. They are randomly initialized and change with the gradient during training. The features of node i at layer l obtained by relation aggregation

[0061]

[0062] (f) The features obtained by relationship aggregation are input into the fully connected layer to obtain the prediction results. Steps (c)-(e) are iterated L times to obtain the trained model parameters. The loss function of the classification model is the cross entropy, as shown below.

[0063] Loss=-∑ i∈V [y i logp i +(1-y i )log(1-p i )];

[0064] y i is the true value of the label; the node features output by the trained model are input into the fully connected layer and the final prediction result is obtained:

[0065] The final feature of node i is obtained by iterating the above group aggregation, graph diffusion convolution, and relationship aggregation process L times As shown in formula (10): Input MLP (fully connected layer) and connect to SoftMax classifier to obtain classification probability.

[0066]

[0067] For node i, the classification score p i Set the threshold z, z is the value that makes F1 optimal.

[0068] In addition, the present invention also provides a fraud identification device that integrates graph diffusion convolution and group aggregation features, including: a graph construction unit, configured to extract data in a fraud identification scenario and construct a relationship graph; the graph relationship data includes user data and interaction events between users; the relationship graph includes multiple nodes; the nodes are used to represent users; for each of the nodes, node features are obtained; a graph enhancement unit, configured to perform graph structure enhancement processing on the relationship graph and construct a two-hop graph structure; a graph relationship division unit, configured to divide the original graph and the two-hop graph into relationship subgraphs; a node grouping feature processing unit, configured to perform group aggregation on the relationship subgraph features to obtain group aggregation features; a graph diffusion convolution feature unit, configured to perform graph diffusion convolution on the group aggregation features of the nodes, and construct the diffusion convolution features of the nodes under each relationship subgraph; a graph relationship aggregation feature unit, configured to perform relationship aggregation on the features of each relationship subgraph to obtain relationship aggregation features; a classification model training unit, configured to input the node features after relationship aggregation into the classification model for training, and obtain the risk data corresponding to each user.

[0069] And, if Figure 4 As shown, an embodiment of the present invention provides a fraud identification device that integrates graph diffusion convolution and group aggregation features, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement the fraud identification method that integrates graph diffusion convolution and group aggregation features in the above embodiment.

[0070] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0071] At the same time, the present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the fraud identification method of the above-mentioned fusion graph diffusion convolution and group aggregation features is implemented.

[0072] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0073] The above embodiments are used to illustrate the present invention rather than to limit the present invention. Any modification and change made to the present invention within the spirit of the present invention and the protection scope of the claims shall fall within the protection scope of the present invention.

Claims

1. A fraud identification method integrating graph diffusion convolution and group aggregation features, characterized in that: The method includes: S1. Construct training data: extract node features and graph relationship features in the fraud identification scenario, obtain the original graph and label it with a fraud label; the original graph includes node features and graph relationship features, the node features are the features required for anti-fraud business, including transaction account number, transaction time, counterparty account, transaction amount, transaction device fingerprint and IP address, and the data type is a numerical type; S2, enhancing the graph structure of the extracted original graph to obtain a two-hop graph structure; S3, inputting the original graph and the two-hop graph into the fraud classification model and training until a preset number of iterations is reached; The calculation process of the fraud classification model includes: dividing the original graph and the two-hop graph into multiple relationship subgraphs according to the relationship, performing group feature aggregation on each relationship subgraph; performing graph diffusion convolution on each relationship subgraph through the group feature set; performing relationship aggregation on the features obtained by the graph diffusion convolution; inputting the aggregated features into the fully connected layer to obtain the classification probability; The group feature aggregation includes: grouping according to the fraud labels corresponding to the neighbor nodes of node i in each relationship subgraph, averaging the node features of each group and concatenating them with the features of node i, multiplying the parameter matrix and inputting the activation function to obtain the aggregated features of each group, and concatenating the features of the three groups to obtain the grouped aggregated features under the relationship r. The specific formula is as follows: Among them, the subscript g + represents the neighbor node grouping of node i whose fraud label is yes, g - represents the grouping of neighbor nodes whose fraud label of node i is no, g * represents the grouping of all neighbor nodes of node i that also includes node i; N(i) represents the set of neighbor nodes of node i, N(i) + 、N(i) - and N(u) * They represent the set of nodes with fraud labels of yes, the set of nodes with fraud labels of no, and the set of all neighbor nodes of node i, respectively. is a randomly initialized learnable parameter matrix; ReLU(·) is an activation function, ReLU(x)=max(x,0); The graph diffusion convolution specifically includes: using the original graph and the two-hop graph to perform graph diffusion convolution; N1 is the set of neighbor nodes of node i in the original graph under relationship r, N2 is the set of neighbor nodes of node i in the two-hop graph under relationship r, τ1 and τ2 are the weight hyperparameters of the convolution of neighbor nodes in the original graph and the two-hop graph respectively. The features are obtained by grouping, aggregating and concatenating features; Said is the diffusion coefficient of the graph diffusion convolution, which is calculated as follows: The relationship aggregation includes: Multiply the characteristics of node i in multiple relationship subgraphs by the relationship coefficient Then find the sum; is the learnable parameter matrix, q T It is a learnable vector that controls the size of the product. The feature of node i in layer l obtained by relation aggregation The relationship coefficient The calculation method of is as follows, S4. Input the original image and the two-hop image in the fraud identification scenario into the trained fraud classification model to obtain the prediction result.

2. According to claim 1, a fraud identification method integrating graph diffusion convolution and grouping aggregation features is characterized in that: The graph structure enhancement is specifically as follows: each node in the graph is connected to nodes that can be reached in two hops to form a two-hop graph.

3. According to claim 1, a fraud identification method integrating graph diffusion convolution and grouping aggregation features is characterized in that: The original graph and the two-hop graph are divided into a plurality of relationship subgraphs according to the relationships. The specific division method is: dividing into relationship subgraphs according to the relationship attributes of the node connection edges, and the number of the relationship subgraphs is the same as the type of relationship attributes.

4. According to claim 1, a fraud identification method integrating graph diffusion convolution and grouping aggregation features is characterized in that: Before inputting the original graph and two-hop graph in the fraud identification scenario into the trained fraud classification model, some nodes need to be manually labeled with fraud labels for grouping and aggregation.

5. According to claim 1, a fraud identification method integrating graph diffusion convolution and grouping aggregation features is characterized in that: The method of inputting the aggregated features into the fully connected layer to obtain the classification probability is specifically as follows: inputting the features into the fully connected layer and connecting the SoftMax classifier to obtain the classification probability: For node i, the classification score p i Set the threshold z, The loss function of the classification function is: Loss = -∑ i∈V [y i logp i +(1-y i )log(1-p i )], where y i is the true value of the label.

6. A fraud identification device integrating graph diffusion convolution and group aggregation features, characterized in that: The device is used to implement the method described in any one of claims 1 to 5, specifically comprising: a graph construction unit, a graph enhancement unit, a graph relationship division unit, a node grouping feature processing unit, a graph diffusion convolution feature unit, a graph relationship aggregation feature unit and a classification model training unit; The graph construction unit is used to construct the original graph; the graph enhancement unit is used to construct a two-hop graph; the graph relationship division unit is used to divide the original graph and the two-hop graph into relationship subgraphs; the node grouping feature processing unit performs group aggregation on the relationship subgraph features to obtain group aggregation features; the graph diffusion convolution feature unit is used to perform graph diffusion convolution on the group aggregation features of the nodes; the graph relationship aggregation feature unit is used to perform relationship aggregation on the features of each relationship subgraph; and the classification model training unit is used to train the classification model.

Images