Financial fraud user identification method and device, storage medium and electronic equipment

Abstract

The application discloses a financial fraud user identification method and device, a storage medium and an electronic device. The method comprises the following steps: acquiring user data and converting the user data into a graph structure; performing data extraction on the graph structure to obtain a target subgraph and an adjacency matrix of the target subgraph; obtaining a cohesive adjacency matrix and an extended adjacency matrix based on the adjacency matrix; encoding the cohesive adjacency matrix and the extended adjacency matrix respectively to obtain a first feature and a second feature, and subtracting the first feature from the second feature to obtain a differential feature; strengthening the differential feature to obtain a strengthened differential matrix; calculating a norm of the differential matrix, and integrating the norm to obtain an identification result of the user data. The application can avoid the gradual fusion and smoothing of difference information in the feature extraction process by constructing a directional difference view, and can improve the accuracy of financial fraud user identification.

Description

Technical Field

[0001] This application relates to the field of fraud identification technology, and in particular to a method, device, storage medium and electronic device for identifying users involved in financial fraud. Background Technology

[0002] With the development of internet technology, the online financial industry has expanded rapidly. While attracting a large number of users with its more convenient and faster services, it has also brought some hidden dangers, among which financial fraud is an aspect that cannot be ignored.

[0003] Due to the virtual nature of the internet, online financial fraud is more covert and difficult to detect, and it is also more difficult to hold illegal users accountable. However, most companies currently rely on experts to formulate review and verification rules for screening, which is not ideal in terms of adaptability and accuracy. Therefore, using artificial intelligence technology to assess the risk of financial fraud has become a hot topic.

[0004] Currently, methods for identifying financial fraud users using artificial intelligence technology generally suffer from problems such as loss of differences during information aggregation and insufficient mining of subgraph context information, resulting in unsatisfactory results. Summary of the Invention

[0005] This application provides a method, apparatus, storage medium, and electronic device for identifying financial fraud users, which can improve the accuracy of identifying financial fraud users.

[0006] This application provides a method for identifying users involved in financial fraud, including: Acquire user data and convert the user data into a graph structure; Data extraction is performed on the graph structure to obtain the target subgraph and the adjacency matrix of the target subgraph; Based on the adjacency matrix, an inner adjacency matrix and an outer adjacency matrix are obtained. The inner adjacency matrix and the outer adjacency matrix are encoded to obtain a first feature and a second feature, respectively. The first feature and the second feature are subtracted to obtain a difference feature. The difference features are enhanced to obtain the enhanced difference matrix; Calculate the norm of the difference matrix, and integrate the norms to obtain the recognition result of the user data.

[0007] Furthermore, in the above-mentioned method for identifying users involved in financial fraud, the graph structure includes multiple nodes connected by edges, and the multiple nodes include a target node and its neighboring nodes. The step of extracting data from the graph structure to obtain the target subgraph and the adjacency matrix of the target subgraph includes: Randomly select the target node and K first-order neighbor nodes to form the target subgraph; The target subgraph is as follows: ; in, This represents the set of all nodes contained in the target subgraph. This represents the set of all edges contained in the target subgraph. This represents the set of attributes of each node in the target subgraph. Let be the adjacency matrix of the target subgraph.

[0008] Furthermore, in the aforementioned method for identifying users involved in financial fraud, the step of obtaining the cohesive adjacency matrix and the extended adjacency matrix based on the adjacency matrix includes: Construct the first mask matrix and the second mask matrix; The cohesive adjacency matrix is ​​obtained based on the first mask matrix and the adjacency matrix; The extended adjacency matrix is ​​obtained based on the second mask matrix and the adjacency matrix.

[0009] Furthermore, in the aforementioned method for identifying users involved in financial fraud, the first mask matrix is:

[0010] The second mask matrix is:

[0011] The step of obtaining the cohesive adjacency matrix based on the first mask matrix and the adjacency matrix includes: The first mask matrix is ​​multiplied by the adjacency matrix to obtain the cohesive adjacency matrix. The step of obtaining the extended adjacency matrix based on the second mask matrix and the adjacency matrix includes: The second mask matrix is ​​multiplied by the adjacency matrix to obtain the extended adjacency matrix.

[0012] Furthermore, in the aforementioned method for identifying users involved in financial fraud, the step of enhancing the differential features to obtain the enhanced difference matrix includes: The differential features are input into the node-level attention convolution kernel to obtain the node-level attention score; The differential features are input into the feature-level attention convolution kernel to obtain the feature-level attention score; The attention matrix is ​​obtained by multiplying the node-level attention score by the feature-level attention score; The difference matrix is ​​obtained by performing a Hadamard product between the difference features and the attention matrix.

[0013] Furthermore, in the aforementioned method for identifying users involved in financial fraud, the step of calculating the norm of the difference matrix and integrating the norms to obtain the identification result of the user data includes: Calculate the L2 norm of each row vector in the difference matrix; The L2-norm is input into the linear layer of the neural network to obtain the recognition result of the user data.

[0014] This application also provides a financial fraud user identification device, including: The acquisition and conversion module is used to acquire user data and convert the user data into a graph structure; The subgraph construction module is used to extract data from the graph structure to obtain the target subgraph and the adjacency matrix of the target subgraph. The directional differential view module is used to obtain an inner adjacency matrix and an outer adjacency matrix based on the adjacency matrix, encode the inner adjacency matrix and the outer adjacency matrix respectively to obtain a first feature and a second feature, and subtract the first feature from the second feature to obtain a differential feature; A multi-level attention module is used to enhance the difference features to obtain an enhanced difference matrix; The anomaly detection module is used to calculate the norm of the difference matrix and integrate the norms to obtain the identification result of the user data.

[0015] Furthermore, in the aforementioned financial fraud user identification device, the directional differential view module includes an inner encoder and an outer encoder. The inner encoder is used to encode the inner adjacency matrix to obtain a first feature, and the outer encoder is used to encode the outer adjacency matrix to obtain a second feature. Both the cohesive encoder and the expansive encoder include several convolutional modules, activation function units, and batch normalization units.

[0016] This application also provides a computer-readable storage medium storing a plurality of instructions adapted to be loaded by a processor to execute any of the above-described financial fraud user identification methods.

[0017] This application also provides an electronic device, including a processor and a memory, wherein the processor is electrically connected to the memory, the memory is used to store instructions and data, and the processor is used in the steps of the financial fraud user identification method described above.

[0018] The financial fraud user identification method, device, storage medium, and electronic device provided in this application convert user data into a graph structure, extract a target subgraph from the graph structure, and extract differential features from the adjacency matrix of the target subgraph by constructing a directional differential view. By constructing a directional differential view, the gradual fusion and smoothing of differential information during the feature extraction process can be avoided. Finally, based on the differential features, it is predicted whether the user is an abnormal user. This method can improve the accuracy of financial fraud user identification. Attached Figure Description

[0019] The technical solution and other beneficial effects of this application will become apparent from the following detailed description of specific embodiments in conjunction with the accompanying drawings.

[0020] Figure 1 This is a flowchart illustrating the financial fraud user identification method provided in this application embodiment.

[0021] Figure 2 Another flowchart of the financial fraud user identification method provided in the embodiments of this application.

[0022] Figure 3 This is a schematic diagram of the structure of a graph encoder provided in an embodiment of this application.

[0023] Figure 4 This is a schematic diagram of the structure of the financial fraud user identification device provided in the embodiments of this application.

[0024] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0025] Figure 6 Another structural schematic diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0026] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] This application provides a method, apparatus, storage medium, and electronic device for identifying users involved in financial fraud. The financial fraud user identification apparatus provided in this application can be integrated into an electronic device, which may be a terminal, server, or other such device. The terminal may include a tablet computer, laptop computer, personal computer (PC), microprocessor box, or other devices.

[0028] Please see Figure 1 and Figure 2 , Figure 1 This is a flowchart illustrating the financial fraud user identification method provided in an embodiment of this application. Figure 2 Another flowchart illustrating the financial fraud user identification method provided in this application embodiment, which is applied in an electronic device, includes the following steps: S1, acquire user data and convert the user data into a graph structure.

[0029] The graph structure includes multiple nodes connected by edges, and the nodes include a target node and its neighboring nodes.

[0030] In one embodiment, user data can be a user transaction network graph, where each node is a different anonymous account, and the attribute vector of each node can contain information such as registration date, log activity, and interaction frequency. Each edge represents a transaction record between account nodes.

[0031] S2 extracts data from the graph structure to obtain the target subgraph and its adjacency matrix.

[0032] In one embodiment, the target node and K first-order neighbor nodes are randomly selected to form the target subgraph.

[0033] Specifically, for each target node, a target subgraph consisting of the target node and its neighboring nodes needs to be constructed as the basis for judging the target node. K first-order neighboring nodes are randomly selected to form a target subgraph together with a target node. If the number of first-order neighboring nodes is less than K, the only first-order neighboring nodes can be copied repeatedly until K are reached.

[0034] The target subgraph is: ; in, This represents the set of all nodes contained in the target subgraph. This represents the set of all edges contained in the target subgraph. This represents the set of attributes of each node in the target subgraph. It is actually an attribute matrix, where each row is the attribute vector of a certain node. Let be the adjacency matrix of the target subgraph. Each element in the adjacency matrix records whether there is an edge connecting two nodes. For example, if the value in the i-th row and j-th column of the adjacency matrix is ​​1, it means there is an edge between node i and node j, and vice versa.

[0035] S3. Based on the adjacency matrix, obtain the cohesive adjacency matrix and the extended adjacency matrix. Encode the cohesive adjacency matrix and the extended adjacency matrix respectively to obtain the first feature and the second feature. Subtract the first feature from the second feature to obtain the difference feature.

[0036] Specifically, in order to accurately grasp the differences between the central node and its neighboring nodes within the target subgraph, the original adjacency matrix A of the target subgraph is split into two different views for observation. This requires constructing two mask matrices. and .

[0037] In one embodiment, obtaining the cohesive adjacency matrix and the extended adjacency matrix based on the adjacency matrix in step S3 may include the following steps: S31, construct the first mask matrix and the second mask matrix.

[0038] The first mask matrix can be:

[0039] The second mask matrix can be:

[0040] S32, the cohesive adjacency matrix is ​​obtained based on the first mask matrix and the adjacency matrix.

[0041] Specifically, the Hadamard product of the first mask matrix and the adjacency matrix is ​​used to obtain the cohesive adjacency matrix, which can be expressed by the following formula:

[0042] in, It is an adjacency matrix. It is the identity matrix. For Hadama accumulation.

[0043] S33, the extended adjacency matrix is ​​obtained based on the second mask matrix and the adjacency matrix.

[0044] Specifically, the Hadamard product of the second mask matrix and the adjacency matrix is ​​used to obtain the extended adjacency matrix, which can be expressed by the following formula:

[0045] in, It is an extended adjacency matrix.

[0046] Furthermore, a pair of graph encoders, namely the cohesive graph encoder and the expanding graph encoder, are used to process the cohesive adjacency matrix respectively. and the extended adjacency matrix Feature extraction is performed to obtain the first feature and the second feature.

[0047] In one embodiment, such as Figure 3 As shown, Figure 3 This is a schematic diagram of the graph encoder structure. Each graph encoder consists of several units, each composed of a graph convolutional module, an activation function, and a batch normalization (BN) layer, connected sequentially. The purpose is to minimize the vanishing gradient problem after graph convolution operations. The graph convolutional module is composed of a dropout layer (random deactivation layer) and a spatial graph convolutional layer, which aims to prevent overfitting and suboptimal performance to some extent.

[0048] The basic computation process of a single graph convolution module can be represented as follows:

[0049] in, Indicates the first Hidden layer properties obtained by the graph convolution module In the two graph encoders, the cohesive adjacency matrix is ​​respectively... and the extended adjacency matrix , This represents the activation function, specifically the ReLU function. These are the neural network weight parameters that need to be learned.

[0050] Finally, subtracting the features encoded by the two graph encoders (the first feature and the second feature) yields the difference features:

[0051] in, The first feature output by the cohesive graph encoder. The second feature output by the extended map encoder. It is a difference feature.

[0052] S4, enhance the difference features to obtain the enhanced difference matrix.

[0053] In one embodiment, step S4 includes the following steps: S41, input the differential features into the node-level attention convolution kernel to obtain the node-level attention score, which can be expressed by the following formula:

[0054] in, In node-level attention convolution kernels, Node-level attention score.

[0055] S42, input the difference features into the feature-level attention convolution kernel to obtain the feature-level attention score, which can be expressed by the following formula:

[0056] in, For feature-level attention convolution kernels, This is the feature-level attention score.

[0057] S43, the attention matrix is ​​obtained by multiplying the node-level attention score by the feature-level attention score, which can be expressed by the following formula:

[0058] in, This is the attention matrix.

[0059] S44. Perform a Hadamard product between the difference features and the attention matrix to obtain the enhanced difference matrix, which can be expressed by the following formula:

[0060] in, This is the enhanced difference matrix.

[0061] S5, calculate the norm of the difference matrix, and integrate the norms to obtain the recognition result of the user data.

[0062] In one embodiment, step S5 may include the following steps: S51, calculate the L2 norm of each row vector in the difference matrix.

[0063] Specifically, for the enhanced differential features Calculate the L2 norm of each row vector in the vector, so that... The Middle Taking a row vector as an example, its L2 norm is:

[0064] in, This represents the dimension of the row vector.

[0065] S52, input the L2-norm into the linear layer of the neural network to obtain the recognition result of the user data (i.e., determine whether the user is a normal user or an abnormal user).

[0066] Specifically, it can be expressed by the following formula:

[0067] in, and These are the learnable weights and biases in the linear layer of the neural network. It is an activation function, specifically it can be Activation function.

[0068] This application constructs a directional difference view to minimize the smooth fusion of differential information during feature extraction. Then, it further optimizes the differential features by combining feature-level attention and node-level attention in a multi-level attention mechanism. Finally, it obtains a more sensitive anomaly detection capability with high-discrimination, high-quality features, thereby improving the accuracy of identifying financial fraud users.

[0069] In a specific embodiment, steps S2-S5 of this method can be applied to a user identification model, which includes a subgraph construction module, a directional differential view module, a multi-level attention module, and an anomaly detection module.

[0070] Specifically, the acquisition and transformation module is used to acquire user data and convert it into a graph structure; the subgraph construction module is used to extract data from the graph structure to obtain the target subgraph and its adjacency matrix; the directional difference view module is used to obtain the cohesive adjacency matrix and the extended adjacency matrix based on the adjacency matrix, encode the cohesive adjacency matrix and the extended adjacency matrix respectively to obtain the first feature and the second feature, and subtract the first feature from the second feature to obtain the difference feature; the multi-level attention module is used to enhance the difference feature to obtain the enhanced difference matrix; and the anomaly detection module is used to calculate the norm of the difference matrix and integrate the norms to obtain the recognition result of the user data.

[0071] The above process is the application process of the user identification model. The training process of the user identification model will be introduced through an example below.

[0072] S61, obtain the dataset, abstract the data in the dataset into nodes and edges to form a graph structure, and perform standard labeling and division of the training and test sets.

[0073] Specifically, it can be one of the following two datasets: T-finance dataset: This dataset reflects a real transaction network graph, where each node is a unique anonymous account. Each node's attribute vector has 10 dimensions, including information such as registration date, log activity, and interaction frequency. Each edge represents a transaction record between account nodes, and the labels are determined by experts. If an account engages in fraud, money laundering, or online gambling, it will be marked as an abnormal node; otherwise, it will be a normal node.

[0074] DGraph dataset: This dataset comes from a real-world financial business scenario open-sourced by an enterprise. Each node represents a financial lending user of the enterprise, while edges represent emergency contact relationships. Node features cover 17 dimensions, including anonymized user personal information, repayment due date, and actual repayment date. Users who have previously defaulted on loan payments are marked as abnormal, while users who have never defaulted are considered normal users.

[0075] In this example, both Tfinance and DGraph have been transformed into graph-structured data. Since the data originates from the real world, the company has anonymized the data before releasing it for privacy reasons, using methods such as type conversion and numerical mapping. Then, relevant experts determined the category of each user node in the graph. The specific information of the dataset is shown in the table below: Table 1. Detailed information about the dataset

[0076] S62 inputs the graph structure corresponding to the training set into the user recognition model for training, and uses node-level attention convolution kernels and feature-level attention convolution kernels to use all target subgraphs as learning templates. During the training process, the parameters of the user recognition model are updated as backpropagation progresses, thus completing the learning process.

[0077] S63 trains the user identification model based on the loss function.

[0078] Specifically, since the range of the identification result P corresponds exactly to the case where the normal node category is labeled as 0 and the abnormal node category is labeled as 1, the binary cross-entropy (BCE) is chosen as the loss function, which can be expressed as follows:

[0079] in, For the recognition results, For tags.

[0080] S64. Input the test set into the trained user recognition model to obtain the recognition results, thereby validating the user recognition model.

[0081] The final experimental results on the Tfinance and DGraph datasets are shown in Table 2: Table 2 Experimental results for the two datasets

[0082] The horizontal axis of the table represents the names of the two financial fraud datasets, and the vertical axis represents three evaluation metrics used to measure model performance. ROC-AUC is short for the Area Under the Curve (ROC). A value closer to 1 indicates a clearer distinction between normal and abnormal classes; conversely, a lower AUC value indicates lower model accuracy. PR-AUC, short for the Precision-Recall curve, describes the trend of accuracy and regression rates as the classification threshold increases; a value closer to 1 indicates better model confidence. Macro-F1 measures the model's overall performance in recall and precision; again, a value closer to 1 indicates better model performance.

[0083] Based on the method described in the above embodiments, this embodiment will further describe it from the perspective of a financial fraud user identification device. The financial fraud user identification device can be implemented as an independent entity or integrated into an electronic device. The electronic device can be a terminal, server, or other devices. The terminal can include a tablet computer, a laptop computer, a personal computer (PC), a microprocessor box, or other devices.

[0084] Please see Figure 4 , Figure 4 This application provides a specific description of a financial fraud user identification device, which is applied in an electronic device and may include: The acquisition and transformation module is used to acquire user data and transform it into a graph structure. The subgraph construction module is used to extract data from the graph structure to obtain the target subgraph and the adjacency matrix of the target subgraph. The directional differential view module is used to obtain the cohesive adjacency matrix and the extended adjacency matrix based on the adjacency matrix, encode the cohesive adjacency matrix and the extended adjacency matrix respectively to obtain the first feature and the second feature, and subtract the first feature and the second feature to obtain the differential feature; A multi-level attention module is used to enhance the difference features to obtain the enhanced difference matrix; The anomaly detection module is used to calculate the norm of the difference matrix and integrate the norms to obtain the recognition results of the user data.

[0085] In one embodiment, the directional differential view module includes a cohesive encoder and an outward encoder. The cohesive encoder is used to encode the cohesive adjacency matrix to obtain a first feature, and the outward encoder is used to encode the outward adjacency matrix to obtain a second feature. Both the cohesive encoder and the outward encoder include several convolutional modules, activation function units, and batch normalization units.

[0086] In specific implementation, the above modules and / or units can be implemented as independent entities, or they can be arbitrarily combined and implemented as the same or several entities. For the specific implementation of the above modules and / or units, please refer to the previous method embodiments. For the specific beneficial effects that can be achieved, please also refer to the beneficial effects in the previous method embodiments, which will not be repeated here.

[0087] In addition, embodiments of this application also provide an electronic device, which may be a computer, tablet computer, or other similar device. Figure 5 As shown, the electronic device 400 includes a processor 401 and a memory 402. The processor 401 and the memory 402 are electrically connected.

[0088] The processor 401 is the control center of the electronic device 400. It connects various parts of the electronic device through various interfaces and lines. By running or loading the application program stored in the memory 402 and calling the data stored in the memory 402, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole.

[0089] In this embodiment, the processor 401 in the electronic device 400 loads the instructions corresponding to the processes of one or more application programs into the memory 402 according to the following steps, and the processor 401 runs the application programs stored in the memory 402 to realize various functions: Acquire user data and convert the user data into a graph structure; Data extraction is performed on the graph structure to obtain the target subgraph and the adjacency matrix of the target subgraph; Based on the adjacency matrix, an inner adjacency matrix and an outer adjacency matrix are obtained. The inner adjacency matrix and the outer adjacency matrix are encoded to obtain a first feature and a second feature, respectively. The first feature and the second feature are subtracted to obtain a difference feature. The difference features are enhanced to obtain the enhanced difference matrix; Calculate the norm of the difference matrix, and integrate the norms to obtain the recognition result of the user data.

[0090] This electronic device can implement the steps in any embodiment of the financial fraud user identification method provided in this application. Therefore, it can achieve the beneficial effects that any financial fraud user identification method provided in this invention can achieve. For details, please refer to the previous embodiments, which will not be repeated here.

[0091] Figure 6 A specific structural block diagram of an electronic device provided in an embodiment of the present invention is shown. This electronic device can be used to implement the financial fraud user identification method provided in the above embodiments. The electronic device 500 can be a terminal, server, or other device. The terminal can include a tablet computer, laptop computer, personal computer (PC), microprocessor box, or other devices.

[0092] RF circuit 510 is used to receive and transmit electromagnetic waves, converting electromagnetic waves into electrical signals and vice versa, thereby enabling communication with communication networks or other devices. RF circuit 510 may include various existing circuit elements used to perform these functions, such as antennas, radio frequency transceivers, digital signal processors, encryption / decryption chips, subscriber identity modules (SIM cards), memory, etc. RF circuit 510 can communicate with various networks such as the Internet, corporate intranets, and wireless networks, or communicate with other devices via wireless networks. The aforementioned wireless networks may include cellular telephone networks, wireless local area networks (WLANs), or metropolitan area networks (MANs). The aforementioned wireless networks may use various communication standards, protocols, and technologies, including but not limited to Global System for Mobile Communication (GSM), Enhanced Data GSM Environment (EDGE), Wideband Code Division Multiple Access (WCDMA), Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Wireless Fidelity (Wi-Fi) (such as IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, and / or IEEE 802.11n), Voice over Internet Protocol (VoIP), Worldwide Interoperability for Microwave Access (Wi-Max), other protocols for email, instant messaging, and short messages, and any other suitable communication protocols, including those that have not yet been developed.

[0093] The memory 520 can be used to store software programs and modules, such as the program instructions / modules corresponding to those in the above embodiments. The processor 580 executes various functional applications and data processing by running the software programs and modules stored in the memory 520, such as taking pictures with the front-facing camera, processing the captured images, and switching the display colors of the content displayed on the screen. The memory 520 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 520 may further include memory remotely located relative to the processor 580, and these remote memories can be connected to the electronic device 500 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0094] The input unit 530 can be used to receive input numeric or character information, and to generate a keyboard and mouse related to user settings and function control.

[0095] Display unit 540 can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces, which can be composed of graphics, text, icons, video, and any combination thereof. Display unit 540 may include display panel 541, which may optionally be configured in the form of LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), or other similar forms.

[0096] Audio circuitry 560, speaker 561, and microphone 562 provide an audio interface between the user and electronic device 500. Audio circuitry 560 converts received audio data into electrical signals and transmits them to speaker 561, where speaker 561 converts them into sound signals for output. Conversely, microphone 562 converts collected sound signals into electrical signals, which are then received by audio circuitry 560, converted back into audio data, and processed by processor 580. The audio data is then transmitted via RF circuitry 510 to, for example, another terminal, or output to memory 520 for further processing. Audio circuitry 560 may also include an earphone jack to facilitate communication between external headphones and electronic device 500.

[0097] Electronic device 500, through transmission module 570 (e.g., Wi-Fi module), can help users receive requests, send information, etc., providing users with wireless broadband internet access. Although transmission module 570 is shown in the figure, it is understood that it is not an essential component of electronic device 500 and can be omitted as needed without changing the essence of the invention.

[0098] The processor 580 is the control center of the electronic device 500. It connects to various parts of the phone via various interfaces and lines, and performs various functions and processes data of the electronic device 500 by running or executing software programs and / or modules stored in the memory 520, and by calling data stored in the memory 520, thereby providing overall monitoring of the electronic device. Optionally, the processor 580 may include one or more processing cores; in some embodiments, the processor 580 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor 580.

[0099] Electronic device 500 also includes a power supply 590 (such as a battery) that supplies power to various components. In some embodiments, the power supply may be logically connected to processor 580 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 590 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0100] Although not shown, the electronic device 500 also includes cameras (such as front-facing cameras and rear-facing cameras), Bluetooth modules, etc., which will not be described in detail here. Specifically, in this embodiment, the display unit of the electronic device is a touch screen display, and the mobile terminal also includes a memory and one or more programs, wherein one or more programs are stored in the memory and configured to be executed by one or more processors. One or more programs contain instructions for performing the following operations: Acquire user data and convert the user data into a graph structure; Data extraction is performed on the graph structure to obtain the target subgraph and the adjacency matrix of the target subgraph; Based on the adjacency matrix, an inner adjacency matrix and an outer adjacency matrix are obtained. The inner adjacency matrix and the outer adjacency matrix are encoded to obtain a first feature and a second feature, respectively. The first feature and the second feature are subtracted to obtain a difference feature. The difference features are enhanced to obtain the enhanced difference matrix; Calculate the norm of the difference matrix, and integrate the norms to obtain the recognition result of the user data.

[0101] In practice, the above modules can be implemented as independent entities or combined in any way to be implemented as the same or several entities. For the specific implementation of the above modules, please refer to the previous method implementation examples, which will not be repeated here.

[0102] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor. Therefore, embodiments of the present invention provide a storage medium storing multiple instructions that can be loaded by a processor to execute the steps of any embodiment of the financial fraud user identification method provided by the present invention.

[0103] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0104] Since the instructions stored in the storage medium can execute the steps in any embodiment of the financial fraud user identification method provided in the embodiments of the present invention, the beneficial effects that any financial fraud user identification method provided in the embodiments of the present invention can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0105] The foregoing has provided a detailed description of a financial fraud user identification method, apparatus, storage medium, and electronic device provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for identifying users involved in financial fraud, characterized in that, The method includes: Acquire user data and convert the user data into a graph structure; the graph structure includes multiple nodes, which are connected by edges, and the multiple nodes include a target node and its neighboring nodes; the user data is a user transaction network graph, where each node is a unique anonymous account, and the attribute vector of each node contains registration date, log activity, and interaction frequency information, and each edge represents a transaction record between account nodes; Data extraction is performed on the graph structure to obtain the target subgraph and the adjacency matrix of the target subgraph, including: randomly selecting the target node and K first-order neighbor nodes to form the target subgraph; Wherein, the target subgraph is ; in, This represents the set of all nodes contained in the target subgraph. This represents the set of all edges contained in the target subgraph. This represents the set of attributes of each node in the target subgraph. Let be the adjacency matrix of the target subgraph; Based on the adjacency matrix, an inner adjacency matrix and an outer adjacency matrix are obtained. The inner adjacency matrix and the outer adjacency matrix are encoded to obtain a first feature and a second feature, respectively. The first feature and the second feature are subtracted to obtain a difference feature. Obtaining the cohesive adjacency matrix and the extended adjacency matrix based on the adjacency matrix includes: constructing a first mask matrix and a second mask matrix; obtaining the cohesive adjacency matrix based on the first mask matrix and the adjacency matrix; and obtaining the extended adjacency matrix based on the second mask matrix and the adjacency matrix. The first mask matrix is: The second mask matrix is: The step of obtaining the cohesive adjacency matrix based on the first mask matrix and the adjacency matrix includes: performing a Hadamard product between the first mask matrix and the adjacency matrix to obtain the cohesive adjacency matrix; The step of obtaining the extended adjacency matrix based on the second mask matrix and the adjacency matrix includes: performing a Hadamard product between the second mask matrix and the adjacency matrix to obtain the extended adjacency matrix; The difference features are enhanced to obtain the enhanced difference matrix; Calculate the norm of the difference matrix, and integrate the norms to obtain the recognition result of the user data.

2. The method for identifying financial fraud users according to claim 1, characterized in that, The process of enhancing the difference features to obtain the enhanced difference matrix includes: The differential features are input into the node-level attention convolution kernel to obtain the node-level attention score; The differential features are input into the feature-level attention convolution kernel to obtain the feature-level attention score; The attention matrix is ​​obtained by multiplying the node-level attention score by the feature-level attention score; The enhanced difference matrix is ​​obtained by performing a Hadamard product between the difference features and the attention matrix.

3. The method for identifying financial fraud users according to claim 1, characterized in that, The step of calculating the norm of the difference matrix and integrating the norms to obtain the recognition result of the user data includes: Calculate the L2 norm of each row vector in the difference matrix; The L2-norm is input into the linear layer of the neural network to obtain the recognition result of the user data.

4. A financial fraud user identification device, wherein the financial fraud user identification device is used to implement the financial fraud user identification method as described in claim 1, characterized in that, include: The acquisition and conversion module is used to acquire user data and convert the user data into a graph structure; The subgraph construction module is used to extract data from the graph structure to obtain the target subgraph and the adjacency matrix of the target subgraph. The directional differential view module is used to obtain an inner adjacency matrix and an outer adjacency matrix based on the adjacency matrix, encode the inner adjacency matrix and the outer adjacency matrix respectively to obtain a first feature and a second feature, and subtract the first feature from the second feature to obtain a differential feature; A multi-level attention module is used to enhance the difference features to obtain an enhanced difference matrix; The anomaly detection module is used to calculate the norm of the difference matrix and integrate the norms to obtain the identification result of the user data.

5. The financial fraud user identification device according to claim 4, characterized in that, The directional differential view module includes a cohesive encoder and an external encoder. The cohesive encoder is used to encode the cohesive adjacency matrix to obtain a first feature, and the external encoder is used to encode the external adjacency matrix to obtain a second feature. Both the cohesive encoder and the extensible encoder include several convolutional modules, activation function units, and batch normalization units.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted to be loaded by a processor to execute the financial fraud user identification method according to any one of claims 1 to 3.

7. An electronic device, characterized in that, The device includes a processor and a memory, the processor being electrically connected to the memory, the memory being used to store instructions and data, and the processor being used to execute the steps in the financial fraud user identification method according to any one of claims 1 to 3.

Images