A fraud detection method, system, device and storage medium

Abstract

The present invention discloses a fraud detection method, system, device and storage medium, the method comprising: using a first fusion encoder, according to a heterogeneous graph, determining the target edge embedding of a target node based on different meta-path views, and determining the target node embedding based on the node attributes of the target node; and performing feature fusion on the target edge embedding and the target node embedding to obtain a graph node embedding vector; based on momentum contrastive learning, analyzing positive samples in the heterogeneous graph to obtain a positive sample node embedding vector; according to negative samples in the heterogeneous graph, indexing the negative sample node embedding vector in an offline node feature cache; calculating contrastive learning loss according to the graph node embedding vector and the positive / negative sample node embedding vector, and updating the first fusion encoder based on the contrastive learning loss gradient; and using the updated first fusion encoder to perform fraud detection. The present invention can effectively handle fraud detection tasks on heterogeneous graphs and can be widely used in the field of data processing technology.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a fraud detection method, system, device and storage medium. Background Art

[0002] With the rapid development of information technology, people have created highly interactive heterogeneous networks on the Internet, which also provide a hiding place for fraudsters. They often connect a large number of normal nodes to achieve the purpose of disguise, making it difficult for fraud detection systems to detect. Algorithms based on graph representation learning can effectively model interactive graph data. Compared with traditional anti-fraud systems based on expert knowledge, this method starts from "relationships" and can not only effectively represent implicit topological structures, but also integrate the relationships between entities into the anomaly detection task. Starting from the entire network, it can effectively identify disguised fraud entities and has great potential in graph fraud detection tasks.

[0003] So far, many graph embedding learning methods have been proposed, among which random walk, deep neural network and graph representation learning based on graph contrast learning are the most widely used technologies. The graph representation method based on random walk learns the neighborhood information of nodes by sampling paths on the topological graph, so that the node features have the ability to represent the co-occurrence relationship on the graph. This method is simple, efficient and highly scalable. It can transfer the learned graph structure feature representation to various downstream tasks. However, the graph fraud detection task is very different from the traditional node classification task. Abnormal nodes often connect a large number of normal users to achieve the purpose of disguise. It is difficult to distinguish them by relying solely on the domain information of the nodes on the graph. The graph representation method based on deep neural network first aggregates the attribute features of the connection, then obtains the feature representation of the graph through nonlinear transformation, and finally relies on the label optimization of related tasks. This method effectively utilizes the topological structure and attribute information of the graph and can learn node features with strong discriminative ability. However, due to the need for a large amount of labeled data for model optimization and the extremely unbalanced labels of the graph fraud detection task, the scalability and effect of this method on the graph fraud detection task are not ideal. Summary of the invention

[0004] In view of this, embodiments of the present invention provide a fraud detection method, system, device and storage medium, which can effectively implement fraud detection.

[0005] In one aspect, an embodiment of the present invention provides a fraud detection method, comprising:

[0006] Based on the fraud detection task, the target business data is obtained from the target system to construct a heterogeneous graph;

[0007] Using a first fusion encoder, according to the heterogeneous graph, determining a target edge embedding of a target node based on different meta-path views, and determining a target node embedding based on a node attribute of the target node; and performing feature fusion on the target edge embedding and the target node embedding to obtain a graph node embedding vector;

[0008] Based on momentum contrastive learning, the positive samples in the heterogeneous graph are analyzed to obtain the positive sample node embedding vector; wherein the positive sample represents the node connected to the target node; the positive sample node embedding vector of each node is stored in the offline node feature cache based on the node identifier;

[0009] According to the negative samples in the heterogeneous graph, the negative sample node embedding vector is indexed in the offline node feature cache; wherein the negative sample represents the node that is not connected to the target node;

[0010] Calculate contrastive learning loss according to graph node embedding vectors, positive sample node embedding vectors, and negative sample node embedding vectors, and update the first fusion encoder based on the contrastive learning loss gradient;

[0011] The updated first fusion encoder is used to perform fraud detection on the heterogeneous graph to be detected.

[0012] Optionally, the method further comprises:

[0013] Performing data conversion processing on the constructed heterogeneous graph to obtain a heterogeneous graph in a preset format;

[0014] Among them, data transformation processing includes data cleaning processing, data change processing and feature engineering processing.

[0015] Optionally, based on the fraud detection task, target business data is obtained from the target system to construct a heterogeneous graph, including:

[0016] Based on the fraud detection task, target business data is obtained from the target system; wherein the target system includes system business logs and system databases;

[0017] According to the business data, extract the target relationship of each data node of the business data;

[0018] Based on the target relationship, a heterogeneous graph is constructed to represent the business data.

[0019] Optionally, according to the heterogeneous graph, determining a target edge embedding of a target node based on different meta-path views includes:

[0020] According to the heterogeneous graph, the edge embedding representation of the target node under different attribute edges is determined based on different meta-path views;

[0021] According to the edge embedding representation of the target node under different attribute edges, combined with the importance weights of different meta-path views, the attention mechanism is used to fuse the edge embedding representations to obtain the target edge embedding of the target node.

[0022] Optionally, determining edge embedding representations of target nodes under different attribute edges based on different meta-path views includes:

[0023] Obtain all neighbor nodes of the target node, randomly sample the neighbor nodes based on a preset number; and determine the edge embedding vector of each sampled neighbor node;

[0024] Based on the edge embedding vector, the attention score of each sampled neighbor node about the target node is obtained through adaptive learning;

[0025] According to the embedding vectors and attention scores corresponding to different meta-path views, the edge embedding representation of the target node under different attribute edges is determined.

[0026] Optionally, feature fusion is performed on the target edge embedding and the target node embedding to obtain a graph node embedding vector, including:

[0027] Perform vector concatenation on the target edge embedding and the target node embedding to obtain a concatenated vector;

[0028] A multi-layer perceptron is used to perform feature fusion on the concatenated vectors of the target edge embedding and the target node embedding to obtain the graph node embedding vector.

[0029] Optionally, based on momentum contrastive learning, positive samples in the heterogeneous graph are analyzed to obtain positive sample node embedding vectors, including:

[0030] Perform momentum update on the first fusion encoder to obtain a second fusion encoder;

[0031] The second fusion encoder is used to determine the edge embedding and node embedding of the nodes of the positive sample in the heterogeneous graph, and feature fusion is performed to obtain the positive sample node embedding vector.

[0032] In another aspect, an embodiment of the present invention provides a fraud detection system, comprising:

[0033] The first module is used to obtain target business data from the target system based on the fraud detection task and construct a heterogeneous graph;

[0034] The second module is used to determine the target edge embedding of the target node based on the heterogeneous graph and different meta-path views using the first fusion encoder, and determine the target node embedding based on the node attribute of the target node; and perform feature fusion on the target edge embedding and the target node embedding to obtain a graph node embedding vector;

[0035] The third module is used to analyze the positive samples in the heterogeneous graph based on momentum contrast learning to obtain the positive sample node embedding vector; wherein the positive sample represents the node connected to the target node; the positive sample node embedding vector of each node is stored in the offline node feature cache based on the node identifier;

[0036] The fourth module is used to index the negative sample node embedding vector in the offline node feature cache according to the negative sample in the heterogeneous graph; wherein the negative sample represents the node that is not connected to the target node;

[0037] A fifth module is used to calculate a contrastive learning loss according to the graph node embedding vector, the positive sample node embedding vector and the negative sample node embedding vector, and update the first fusion encoder based on the contrastive learning loss gradient;

[0038] The sixth module is used to perform fraud detection on the heterogeneous graph to be detected by using the updated first fusion encoder.

[0039] Optionally, the system further includes:

[0040] The seventh module is used to perform data conversion processing on the constructed heterogeneous graph to obtain a heterogeneous graph in a preset format;

[0041] Among them, data transformation processing includes data cleaning processing, data change processing and feature engineering processing.

[0042] On the other hand, an embodiment of the present invention provides a fraud detection device, including a processor and a memory;

[0043] The memory is used to store programs;

[0044] The processor executes the program to implement the above method.

[0045] On the other hand, an embodiment of the present invention provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the above method.

[0046] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0047] The embodiment of the present invention first obtains target business data from a target system based on a fraud detection task and constructs a heterogeneous graph; uses a first fusion encoder to determine the target edge embedding of a target node based on different meta-path views according to the heterogeneous graph, and determines the target node embedding based on the node attributes of the target node; and performs feature fusion on the target edge embedding and the target node embedding to obtain a graph node embedding vector; the embodiment of the present invention fuses the features of node embedding and edge embedding so that supervised labels are not required when generating graph node embedding vector features, thereby reducing the time consumption of manually annotating data and improving the processing efficiency of fraud detection tasks; based on momentum contrast learning, positive samples in the heterogeneous graph are analyzed to obtain positive sample node embedding vectors; wherein the positive samples represent nodes connected to the target node; each The positive sample node embedding vector of the node is stored in the offline node feature cache based on the node identifier; the embodiment of the present invention uses momentum contrast learning to process samples, avoids the problem that supervised learning is difficult to train due to label imbalance, and improves the accuracy of fraud detection; according to the negative samples in the heterogeneous graph, the negative sample node embedding vector is indexed in the offline node feature cache; wherein the negative sample represents the node that is not connected to the target node; the contrastive learning loss is calculated according to the graph node embedding vector, the positive sample node embedding vector and the negative sample node embedding vector, and the first fusion encoder is updated based on the contrastive learning loss gradient; the embodiment of the present invention combines the contrastive loss function to perform gradient update to improve the accuracy of data processing; the updated first fusion encoder is used to perform fraud detection on the heterogeneous graph to be detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 A schematic diagram of a flow chart of a fraud detection method provided by an embodiment of the present invention;

[0050] Figure 2 A schematic diagram of the architecture of a multi-view attention fusion encoder provided by an embodiment of the present invention;

[0051] Figure 3 A schematic diagram of the architecture of a graph momentum contrast learning model provided by an embodiment of the present invention;

[0052] Figure 4 A schematic diagram of a data processing flow based on a multi-view attention fusion encoder and a graph momentum contrast learning model provided in an embodiment of the present invention;

[0053] Figure 5A schematic diagram of the structure of a fraud detection system provided by an embodiment of the present invention;

[0054] Figure 6 A schematic diagram of a fraud detection device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0056] To facilitate understanding of the technical principles of the embodiments of the present invention, the technical names that may be involved in the present invention are explained:

[0057] Graph fraud detection: Identify fraudulent behaviors of nodes on the graph, aiming to discover "strange" or "abnormal" patterns in large graphs or massive databases, and find abnormal nodes, edges or subgraphs in the graph based on graph data mining technology. It is mainly divided into: graph anomaly detection algorithms based on random walks, graph anomaly detection algorithms based on deep graph neural networks, and graph anomaly detection algorithms based on graph contrast learning.

[0058] Heterogeneous graph: Graph data structures are naturally capable of modeling complex relationships. A heterogeneous graph is a graph data structure in which the number of node and edge categories on the graph is greater than two. It retains the properties of nodes and relationships and can model real-world scenarios more accurately.

[0059] Meta-path: Meta-path can represent the composite relationship between two target objects and is widely used to capture semantic information. In a heterogeneous graph, different meta-paths constitute different perspectives of the heterogeneous graph, and each view contains its own semantic information.

[0060] Momentum contrastive learning: Contrastive learning is one of the most widely used technologies in the field of computer vision. Its main purpose is to train an encoder through proxy tasks so that similar samples are as close as possible in the encoded feature space, and unfamiliar samples are as far away as possible. It is divided into: end-to-end contrastive learning, memory storage contrastive learning, and momentum contrastive learning. The momentum contrastive learning algorithm cleverly solves the problem that negative samples in end-to-end contrastive learning are limited by training batch samples and the problem that the negative sample encoding feature vectors in memory storage contrastive learning are inconsistent through the momentum encoder updated by momentum, providing large and consistent negative sample features that can encode highly discriminative embedded features.

[0061] Random walk algorithm: This algorithm obtains the sequence of nodes through random walk, and then inputs the node sequence as a training sample into the skip-gram model to obtain embedded features with node co-occurrence information. It can effectively represent the structural information of the graph in a homogeneous graph (the number of node + edge categories is less than 2).

[0062] Graph neural network algorithm: With the development of deep learning, graph encoders based on neural networks have developed rapidly in the field of graph machine learning. They are mainly divided into the following two steps: aggregating neighbor node feature information and encoding the aggregated embedded information. Finally, the graph neural network is trained based on the supervision signal. For example: GCN, GAT, GATNE, etc.

[0063] Graph Contrastive Learning Algorithm: It introduces contrastive learning into the field of graph machine learning and uses proxy tasks to train graph encoders. Compared with the random walk algorithm, graph contrastive learning can effectively encode node attributes and graph topology features, and does not require the graph neural network algorithm to use labeled data. It has great potential in graph anomaly detection tasks.

[0064] On the one hand, if Figure 1 As shown, an embodiment of the present invention provides a fraud detection method, comprising:

[0065] S100, based on the fraud detection task, obtaining target business data from the target system and constructing a heterogeneous graph;

[0066] It should be noted that, in some embodiments, step S100 includes: based on the fraud detection task, obtaining target business data from the target system; wherein the target system includes a system business log and a system database; based on the business data, extracting the target relationship of each data node of the business data; based on the target relationship, constructing a heterogeneous graph for characterizing the business data.

[0067] Specifically, in some specific embodiments, the target relationship can be extracted based on the business data in the target system. For example, if the fraud detection task is a user's false comments, the business data related to the comments can be extracted based on the system data, and the business data can be represented using a heterogeneous graph.

[0068] In some embodiments, the method further includes the steps of: performing data conversion processing on the constructed heterogeneous graph to obtain a heterogeneous graph in a preset format; wherein the data conversion processing includes data cleaning processing, data change processing and feature engineering processing.

[0069] Specifically, in some specific embodiments, heterogeneous graph data can be converted into the input format of the multi-view attention fusion encoder through steps such as data cleaning, data transformation, and feature engineering. The neighbor node sampling process of each node can be involved, and the positive and negative sample sets of the target node can be constructed according to the designed contrastive learning algorithm.

[0070] S200, using a first fusion encoder, according to a heterogeneous graph, determining a target edge embedding of a target node based on different meta-path views, and determining a target node embedding based on a node attribute of the target node; and performing feature fusion on the target edge embedding and the target node embedding to obtain a graph node embedding vector;

[0071] It should be noted that in some embodiments, according to a heterogeneous graph, the target edge embedding of the target node is determined based on different meta-path views, including: according to the heterogeneous graph, the edge embedding representation of the target node under different attribute edges is determined based on different meta-path views; according to the edge embedding representation of the target node under different attribute edges, combined with the importance weights of different meta-path views, the attention mechanism is used to fuse the edge embedding representations to obtain the target edge embedding of the target node.

[0072] Specifically, in some specific embodiments, the target edge embedding and the target node embedding of the target node can be determined by a multi-view attention fusion encoder, and then the target edge embedding and the target node embedding are feature fused to obtain a graph node embedding vector. The implementation principle is as follows:

[0073] The first is the multi-view attention fusion encoder, which is a heterogeneous graph attention fusion encoder. The overall model architecture is shown in the figure Figure 2 As shown in the figure, since fraudulent nodes are often connected to normal nodes to achieve the purpose of disguise in the task of graph fraud detection, this encoder designs a neighbor node attention fusion mechanism to adaptively learn the corresponding weights when aggregating neighbor node features. At the same time, a multi-view attention fusion mechanism is designed for heterogeneous graphs. When fusion of views, corresponding weights are assigned to different views to learn the edge embedding of heterogeneous graphs. Finally, node and edge embeddings are considered at the same time to obtain node vector representation.

[0074] Among them, in some embodiments, the edge embedding representation of the target node under different attribute edges is determined based on different meta-path views, including: obtaining all neighbor nodes of the target node, randomly sampling the neighbor nodes based on a preset number; and determining the edge embedding vector of each sampled neighbor node; based on the edge embedding vector, obtaining the attention score of each sampled neighbor node about the target node through adaptive learning; according to the embedding vectors and attention scores corresponding to different meta-path views, determining the edge embedding representation of the target node under different attribute edges.

[0075] In some embodiments, feature fusion is performed on the target edge embedding and the target node embedding to obtain a graph node embedding vector, including: vector splicing of the target edge embedding and the target node embedding to obtain a splicing vector; and feature fusion of the splicing vector of the target edge embedding and the target node embedding using a multi-layer perceptron to obtain a graph node embedding vector.

[0076] Specifically, the specific steps of the multi-view attention fusion encoder implementation algorithm for related data processing are as follows:

[0077] 1) Neighbor node attention fusion mechanism:

[0078] The goal of the neighbor node attention fusion mechanism is to learn the embedding vector of node i so that the embedding vector contains the topological features under this view. According to the target node view formed by the meta-path, we define node i to contain |M| neighbors, and randomly sample |n| neighbors as the neighbor nodes of node i. Then, the neighbor node set of node i can be defined as N i Since |N| neighbors have different node attributes, the attention mechanism is used to fuse the neighbor features of node i:

[0079]

[0080] Among them, σ(·) is a nonlinear activation function, is the edge embedding vector of node j in the k-1th layer of edge type r, and α i,j represents the attention score of node j about node i, which is based on the edge embedding vector The specific calculation formula is as follows:

[0081]

[0082] Among them, b i is the initialized node embedding vector, is the edge embedding conversion matrix, which is responsible for converting the edge embedding dimension into the attention vector dimension, tanh(·) is the nonlinear activation function, d is the edge embedding dimension, d a is the attention vector dimension, is the neighbor node attention vector, and different attention scores are output according to different nodes and their neighbors. Finally, the node neighbor edge embedding information is aggregated to obtain the k-th layer edge embedding of node i under the attribute edge r

[0083] When calculating the attention score, the information of all neighbor nodes of a node is not aggregated. Instead, a part of them, that is, |N| neighbors, is randomly selected in each round of training to aggregate the nodes. It is worth noting that if the number of neighbors of a node is greater than the set |N|, non-repeated sampling is performed, otherwise repeated sampling is performed. In this way, it can be ensured that each node only aggregates the common neighbor node information, and different edge embedding information is provided in each round of training, thereby increasing the challenge of graph contrast learning tasks.

[0084] 2) Multi-view attention fusion mechanism:

[0085] The purpose of the multi-view attention fusion mechanism is to learn the edge embedding representation of the node in the high-order view under the meta-path structure, and use the attention mechanism to fuse the edge embedding representations under different views to obtain the final node edge embedding vector.

[0086] In the meta-path set {φ1,φ2,...,φ M Given a meta-path φ in r The corresponding view r can be obtained. For a certain node i, the k-th layer edge embedding of node i under the attribute edge r can be obtained according to the neighbor node attention fusion mechanism According to different meta-path views, M different edge embedding representations can be obtained Therefore, the embodiment of the present invention uses the view-level attention mechanism to fuse the node features under different semantic views to obtain the final node edge embedding representation

[0087]

[0088] Among them, β r Represents the meta-path φ r The importance weight is calculated as follows:

[0089]

[0090] Among them, b I is the initialized node embedding vector, is the edge embedding transformation matrix from the perspective of the meta-path, is the meta-path multi-view attention vector. It is the same as the neighbor node attention fusion mechanism. tanh(·) is the nonlinear activation function, d is the edge embedding dimension, and d A is the dimension of the attention vector. The difference is that no nonlinear activation function is used when aggregating by weight. Finally, a weight is assigned to each view based on the edge embedding representation under different views.

[0091] 3) Fusion of node embedding and edge embedding

[0092] Since both the node attributes and the topological attributes of the graph are very important in determining node fraud in the task of graph fraud detection, the embodiment of the present invention designs a node embedding and edge embedding feature fusion mechanism. Given a node i on the graph, based on the initialization node embedding representation and the edge embedding representation that aggregates neighbor features and multi-view features, Use a multi-layer perceptron (MLP) to train b i and The concatenated vectors are used for feature fusion to obtain the final graph node embedding h i , the specific calculation formula is as follows:

[0093] w h，i=W h ·[b i ||z(k) i ]

[0094] h i =W trans ·ELU(w h，i )

[0095] Among them, W h ∈R |2d|×|2d| is the hidden layer transformation matrix, d is the feature dimension of the node and edge embedding vector, w h,i is the hidden layer feature vector of the node, ELU(·) is a nonlinear activation function, providing nonlinear transformation for feature fusion, W trans ∈R |d|×|2d| is the node feature transformation matrix. Finally, the graph node embedding vector h i Normalization is performed to facilitate training optimization by graph comparison learning.

[0096] Through the multi-layer perceptron, the embedded features from its own attributes and the multi-view topological embedded features are integrated, that is, the node's own attributes are considered and combined with the structural features on the graph, which can provide more discriminative features in the task of graph fraud detection.

[0097] S300, based on momentum contrast learning, analyze the positive samples in the heterogeneous graph to obtain the positive sample node embedding vector;

[0098] It should be noted that the positive sample represents the node connected to the target node; the positive sample node embedding vector of each node is stored in the offline node feature cache based on the node identifier; in some embodiments, step S300 includes: performing momentum update on the first fusion encoder to obtain a second fusion encoder; using the second fusion encoder, determining the edge embedding and node embedding of the nodes of the positive sample in the heterogeneous graph, and performing feature fusion to obtain the positive sample node embedding vector.

[0099] S400, according to the negative samples in the heterogeneous graph, indexing the negative sample node embedding vector in the offline node feature cache;

[0100] It should be noted that negative samples represent nodes that are not connected to the target node;

[0101] Specifically, in some specific embodiments, steps S300 and S400 may be implemented by a multi-view momentum contrastive learning model to obtain positive / negative sample node embedding vectors. The principle of the multi-view momentum contrastive learning model is as follows:

[0102] The multi-view momentum contrastive learning model, based on the multi-view attention fusion encoder, proposes a definition method for positive and negative samples of heterogeneous graphs, and uses momentum contrastive learning to optimize the graph encoder, effectively solving the problems existing in graph contrastive learning.

[0103] 1) Graph Momentum Contrastive Learning Model

[0104] Graph Momentum Contrastive Learning aims to optimize the multi-view attention fusion encoder in a self-supervised manner using the momentum contrastive learning framework in the field of graph representation learning. It provides a variety of negative samples during optimization to make the embedded representation learned by the node more discriminative. The specific architecture of the model is as follows: Figure 3 shown.

[0105] Like traditional momentum contrastive learning, in the graph momentum contrastive learning model, in order to obtain large-scale and consistent negative samples, the momentum multi-view attention fusion encoder is also obtained by updating the multi-view attention fusion encoder through momentum. The specific formula is as follows:

[0106] θ GE →θ GEM (init)

[0107] m×θ GEM +(1-m)×θ GE →θ GEM

[0108] Among them, θ GE is the parameter of the multi-view attention fusion encoder, θ GEM is the parameter of the momentum graph encoder. m is the momentum update parameter, which is used to update the momentum encoder. At the beginning of training, the momentum graph encoder is initialized by the graph encoder parameters, and the momentum graph encoder is updated using the momentum update strategy in each round of training. Specifically, a large momentum value (m ≥ 99.0) is used in the model momentum update to ensure that the momentum graph encoder is updated slowly, thereby maintaining a well-consistent offline node feature cache.

[0109] When maintaining the negative sample node features, we do not define a sample queue offline like momentum contrastive learning in the traditional computer vision field. Instead, we use a dictionary-like data structure to maintain the embedding representation of the entire graph node in the offline node feature cache. In each iterative training, the node embedding features in the offline cache are updated according to the node index. The specific training process is as follows:

[0110] First, a target node on the graph and the positive sample corresponding to the target node are given. The target node is passed through a multi-view attention fusion encoder to obtain the target node embedding feature, and the positive sample corresponding to the target node is passed through a momentum graph encoder to obtain the positive sample embedding feature. Then, the negative sample of the target node is obtained by negating the positive sample index and the set of all nodes on the graph. The negative sample feature of the target node is extracted according to the index in the offline node feature cache, and the contrast loss is calculated with the positive sample feature of the target node and the target node feature to update the graph encoder. Finally, the positive sample embedding feature encoded by the momentum graph encoder in this round is updated according to the positive sample index. Specifically, it can be achieved by the following steps: First, initialize the multi-view attention fusion encoder and the momentum graph encoder, and give the target node index and the defined node positive sample set. Index the target node feature and the positive sample node feature, pass the target node feature through the multi-view attention encoder to obtain the target node embedding vector, and pass the positive sample feature through the momentum graph encoder to obtain the positive sample embedding vector. Secondly, index the negative sample embedding vector in the offline node feature cache. The contrast loss is calculated using the target node embedding vector and the positive and negative sample embedding vectors. Finally, the multi-view encoder is updated based on the loss calculation gradient, and the momentum graph encoder is updated with the momentum, and the embedding vector encoded by the positive sample is updated to the offline node feature cache.

[0111] The advantage of graph momentum contrastive learning is that a graph node embedding feature dictionary is maintained in the offline node feature cache. In each training iteration, the embedding features in the dictionary are updated, and other nodes on the graph except the positive sample of the target node are selected as negative samples, ensuring the diversity of negative samples.

[0112] 2) Definition of positive and negative samples in heterogeneous graphs

[0113] In the field of computer vision, usually an image is used as a positive sample with its augmentation, and other images are used as negative samples. Based on this, in heterogeneous graphs, we can also use the same node under different meta-path views as a positive sample pair. However, considering that the nodes are usually highly correlated due to the edge connections, this article draws on the positive sample search strategy proposed by HeCo: if two nodes are interconnected under most meta-path views, they are positive sample pairs. That is, nodes that are closely connected to the target node are defined as positive sample pairs. This positive sample discovery strategy can well reflect the local structural information of the target node on the graph.

[0114] Given nodes i and j, first define a function C i (·) is used to calculate the number of connections between these two nodes in the view corresponding to the meta-path:

[0115]

[0116] Among them, N i,r is the set of neighbor nodes of node i under edge type, that is, view type r, M is the number of views corresponding to different meta-paths, and I(·) is an indicator function that returns 1 when the input is true and 0 when the input is false. Then construct a set S i ={j|j∈VandC i (j)≠0} and according to C i (·) The values ​​are arranged in descending order, and finally the number of positive samples T is customized. pos Intercept S i The node that is most closely related to the target node i in is taken as a positive sample. Specifically, when |S I |≥T pos When S i Select the first T pos samples as positive samples of node i, when S i <T pos When S i Sampling with replacement T pos samples as positive samples. Define the positive sample set of node i as P i , except for the node set P i The other nodes outside are defined as the negative sample set N i .

[0117] 3) Graph Momentum Comparative Learning Optimization

[0118] After defining the positive and negative samples of the node, the target node is encoded according to the multi-view attention fusion encoder to obtain the node representation vector, the samples in the positive sample node set are passed through the momentum graph encoder to obtain the corresponding positive sample node embedding vector, and the corresponding negative sample node embedding vector is indexed in the offline sample feature cache according to the negative sample set.

[0119] S500, calculating contrastive learning loss according to the graph node embedding vector, the positive sample node embedding vector and the negative sample node embedding vector, and updating the first fusion encoder based on the contrastive learning loss gradient;

[0120] Specifically, in some specific embodiments, the main task of graph contrastive learning is to make the target node as similar as possible to the positive sample embedding vector and as far away from the negative sample representation vector as possible. Therefore, the contrastive learning loss function is defined as:

[0121]

[0122] Among them, sim(u,v) represents the cosine similarity of vectors u and v, and T is the temperature parameter. It is used to control the smoothness of the output category probabilities. When T decreases, the gap between the output category probabilities becomes larger, and when T increases, the gap between the output category probabilities becomes smaller (smooth).

[0123] It is not difficult to see that this contrastive learning loss is different from the traditional contrastive learning loss that only focuses on a single positive sample pair. Considering that the nodes on the graph have multiple positive sample node pairs, it is necessary to comprehensively consider the similarity of the embedding vectors of different positive sample pairs. Therefore, when calculating the contrastive learning loss, unlike the cross entropy loss, this contrastive learning loss function moves the positive sample summation operator into the logarithmic operation, thereby achieving the effect of shortening the distance between the embedding vectors of all positive sample pairs.

[0124] By comparing the losses calculated by the learning loss function, we can use optimization algorithms such as gradient descent, Adam, and AdamW to train the multi-view attention fusion encoder, and then update the momentum graph encoder by momentum updating to achieve the effect of maintaining the consistency of node feature dictionary features in the node feature cache.

[0125] Among them, some specific embodiments also include a step of evaluating the graph momentum contrast learning, which can be specifically implemented by the following steps:

[0126] The multi-view attention fusion encoder is trained by the momentum graph contrast learning algorithm to obtain the final embedding representation vector of each node on the graph. Since the embedding vector has integrated the attribute features and topological features of the graph, it can well represent the original image information. Therefore, it is only necessary to train different classification heads (logistic regression, multi-layer perceptron, etc.) based on the embedding vector according to different downstream tasks. For example, for edge classification tasks, the two node vectors connected on the edge can be concatenated together as the input of the logistic regression, and the logistic regression is trained to obtain the mapping from the concatenated vector dimension to the edge category dimension to achieve the effect of edge classification.

[0127] For the task of detecting fraudulent nodes on the graph, because the fraud category labels are seriously unbalanced, upsampling is required to balance the labels when training the classification head. Otherwise, the classification head will be biased towards the category with multiple sample labels, that is, non-fraudulent nodes, and lose the ability to distinguish fraudulent nodes. Specifically, the imbalance ratio is taken as the ratio of the number of sampling rounds of minority class nodes and majority class nodes to balance the number of positive and negative samples, so that the classifier can fully learn the characteristics of negative samples, avoid overfitting the classification head on the majority class, and ignore the information of negative samples. The imbalance ratio calculation formula is as follows:

[0128]

[0129] Among them, C1, C2 are different label categories, |C1|, |C2| are the number of samples with different labels. If IR < 1, C1 is the minority class, and IR = 1 means the class is balanced.

[0130] S600: Perform fraud detection on the heterogeneous graph to be detected by using the updated first fusion encoder.

[0131] Specifically, in order to fully explain the technical principles of the embodiments of the present invention, the above process steps are further described below in conjunction with some specific embodiments. It should be understood that the following is an explanation of the present invention and cannot be regarded as a limitation of the present invention.

[0132] like Figure 4 As shown, the embodiment of the present invention includes a multi-view attention fusion encoder and a graph momentum contrast learning algorithm, and the main data processing flow is as follows:

[0133] Step 1: System data acquisition:

[0134] Extract the target relationship based on the business data in the target system. For example, if the fraud detection task is a user's fake comments, extract the business data related to the comments based on the system data and use a heterogeneous graph to represent the business data.

[0135] Step 2: Data conversion:

[0136] The heterogeneous graph data is converted into the input format of the multi-view attention fusion encoder through steps such as data cleaning, data transformation, and feature engineering. It mainly involves the neighbor node sampling process of each node, and constructs the positive and negative sample sets of the target node according to the designed contrastive learning algorithm.

[0137] Step 3: Graph encoder training:

[0138] A multi-view attention fusion encoder is used to encode the nodes on the heterogeneous graph to obtain the node embedding vector of each node; based on the node embedding vector, a multi-view momentum contrastive learning algorithm is used to calculate the contrast loss between positive and negative node samples, and finally backpropagation is used to update the multi-view attention fusion encoder.

[0139] Step 4: Node coding and evaluation:

[0140] Use the trained multi-view attention fusion encoder to encode the nodes on the graph into embedding vectors. Use a logistic regression model to evaluate the encoder effect based on fraudulent node label data.

[0141] In summary, the embodiment of the present invention designs a multi-view attention fusion encoder, uses the graph momentum contrast learning algorithm to design a proxy task to train the multi-view encoder through self-supervised learning, so that the node encoding on the heterogeneous graph can be represented with discriminativeness, and can effectively handle the fraud detection task on the heterogeneous graph. The technical principles of the present invention include:

[0142] 1. Momentum Graph Contrastive Learning Algorithm: The momentum update strategy provides large and consistent negative sample features in the field of graph machine learning, designs proxy tasks on heterogeneous graphs, and uses the momentum contrastive learning algorithm to train and optimize the multi-view encoder. It improves the discriminability of node feature encoding on the graph and can be effectively applied to downstream tasks.

[0143] 2. Multi-view attention fusion encoder: To address the fraud disguise problem of fraud nodes on heterogeneous graphs, a neighbor node attention machine is designed to adaptively calculate the weight coefficient for each node neighbor connection, effectively fuse the connections between fraud nodes in the aggregation feature stage, and solve the fraud disguise problem to a certain extent. In the stage of fusion of semantic information of different views, weight coefficients are assigned to views connected by different meta-paths, making the fusion of views with different semantic information more reasonable.

[0144] In addition, compared with the prior art, the embodiments of the present invention have at least the following beneficial effects:

[0145] High accuracy: The graph encoder is trained by using momentum contrast learning for self-supervision, which avoids the problem of difficulty in training supervised learning caused by label imbalance and improves the accuracy of fraud detection. High efficiency: Based on the self-supervised learning algorithm, no supervised labels are required when generating node embedding features, which reduces the time consumption of manual data annotation and improves the processing efficiency of fraud detection tasks. High scalability: The present invention can use self-supervised learning to encode embedding vectors for nodes on heterogeneous graphs. The embedding vectors contain both the topological information on the graph and the attribute feature information of the nodes themselves, and can be effectively applied to downstream tasks, including node classification, connection prediction, etc. Excellent representation ability: For the heterogeneous graph fraud detection task, a multi-view attention encoder is designed, and an attention mechanism is introduced. The topological features on the graph and the attribute features of each node are comprehensively considered, and the encoded node embedding vector has high representation ability.

[0146] On the other hand, Figure 5As shown, an embodiment of the present invention provides a fraud detection system 700, including: a first module 710, which is used to obtain target business data from a target system based on a fraud detection task and construct a heterogeneous graph; a second module 720, which is used to use a first fusion encoder to determine the target edge embedding of a target node based on different meta-path views according to the heterogeneous graph, and determine the target node embedding based on the node attribute of the target node; and perform feature fusion on the target edge embedding and the target node embedding to obtain a graph node embedding vector; a third module 730, which is used to analyze positive samples in the heterogeneous graph based on momentum contrast learning to obtain a positive sample node embedding vector; wherein , positive samples represent nodes connected to the target node; the positive sample node embedding vectors of each node are stored in the offline node feature cache based on the node identifier; the fourth module 740 is used to index the negative sample node embedding vectors in the offline node feature cache according to the negative samples in the heterogeneous graph; wherein the negative samples represent nodes that are not connected to the target node; the fifth module 750 is used to calculate the contrastive learning loss according to the graph node embedding vector, the positive sample node embedding vector and the negative sample node embedding vector, and update the first fusion encoder based on the contrastive learning loss gradient; the sixth module 760 is used to use the updated first fusion encoder to perform fraud detection on the heterogeneous graph to be detected.

[0147] It should be noted that, in some embodiments, the system further includes:

[0148] The seventh module is used to perform data conversion processing on the constructed heterogeneous graph to obtain a heterogeneous graph in a preset format;

[0149] Among them, the data conversion processing includes data cleaning processing, data change processing and feature engineering processing.

[0150] The contents of the method embodiments of the present invention are all applicable to the system embodiments. The functions specifically implemented by the system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0151] like Figure 6 As shown, another aspect of the embodiment of the present invention further provides a fraud detection device 800, including a processor 810 and a memory 820;

[0152] The memory 820 is used to store programs;

[0153] The processor 810 executes the program to implement the above method.

[0154] The contents of the method embodiments of the present invention are all applicable to the device embodiments. The functions specifically implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0155] Another aspect of the embodiments of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the above method.

[0156] The contents of the method embodiments of the present invention are all applicable to the computer-readable storage medium embodiments. The functions specifically implemented by the computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0157] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0158] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented by the embodiment of the present invention. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0159] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of various functional modules in the device disclosed in the embodiment of the present invention, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0160] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0161] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution device, apparatus or device (such as a computer-based device, a device including a processor, or other device that can fetch instructions from an instruction execution device, apparatus or device and execute the instructions), or in conjunction with such instruction execution device, apparatus or device. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution device, apparatus or device, or in conjunction with such instruction execution device, apparatus or device.

[0162] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0163] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0164] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0165] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0166] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A fraud detection method, characterized in that: include: Based on the fraud detection task, the target business data is obtained from the target system to construct a heterogeneous graph; Using a first fusion encoder, according to the heterogeneous graph, determine a target edge embedding of a target node based on different meta-path views, and determine a target node embedding based on a node attribute of the target node; and perform feature fusion on the target edge embedding and the target node embedding to obtain a graph node embedding vector; Wherein, determining the target edge embedding of the target node based on different meta-path views according to the heterogeneous graph includes: According to the heterogeneous graph, determining edge embedding representations of target nodes under different attribute edges based on different meta-path views; According to the edge embedding representations of the target node under different attribute edges, combined with the importance weights of different meta-path views, the edge embedding representations are fused using an attention mechanism to obtain a target edge embedding of the target node; Based on momentum contrast learning, the positive samples in the heterogeneous graph are analyzed to obtain positive sample node embedding vectors; wherein the positive samples represent nodes connected to the target node; the positive sample node embedding vectors of each node are stored in an offline node feature cache based on node identification; The step of analyzing the positive samples in the heterogeneous graph based on momentum contrastive learning to obtain the positive sample node embedding vector includes: Performing momentum update on the first fusion encoder to obtain a second fusion encoder; Determine the edge embedding and node embedding of the nodes of the positive sample in the heterogeneous graph by using the second fusion encoder, and perform feature fusion to obtain the positive sample node embedding vector; According to the negative samples in the heterogeneous graph, a negative sample node embedding vector is indexed in an offline node feature cache; wherein the negative sample represents a node that is not connected to the target node; Calculate a contrastive learning loss according to the graph node embedding vector, the positive sample node embedding vector, and the negative sample node embedding vector, and update the first fusion encoder based on the contrastive learning loss gradient; The step of calculating the contrastive learning loss according to the graph node embedding vector, the positive sample node embedding vector, and the negative sample node embedding vector, and updating the first fusion encoder based on the contrastive learning loss gradient includes: The contrastive learning loss function is defined as: Among them, sim(u,v) represents the cosine similarity of vectors u and v, and T is the temperature parameter, which is used to control the smoothness of the output category probabilities. When T decreases, the gap between the output category probabilities becomes larger, and when T increases, the gap between the output category probabilities becomes smaller. By comparing the loss calculated by the learning loss function, the multi-view attention fusion encoder is trained using an optimization algorithm, and then the momentum map encoder is updated by momentum update; The updated first fusion encoder is used to perform fraud detection on the heterogeneous graph to be detected.

2. A fraud detection method according to claim 1, characterized in that: The method further comprises: Performing data conversion processing on the constructed heterogeneous graph to obtain a heterogeneous graph in a preset format; Among them, the data conversion processing includes data cleaning processing, data change processing and feature engineering processing.

3. A fraud detection method according to claim 1, characterized in that: Based on the fraud detection task, the target business data is obtained from the target system to construct a heterogeneous graph, including: Based on the fraud detection task, target business data is obtained from the target system; wherein the target system includes a system business log and a system database; Extracting target relationships of data nodes of the business data according to the business data; Based on the target relationship, a heterogeneous graph for representing the business data is constructed.

4. A fraud detection method according to claim 1, characterized in that: The step of determining the edge embedding representation of the target node under different attribute edges based on different meta-path views includes: Obtain all neighbor nodes of the target node, and randomly sample the neighbor nodes based on a preset number; and Determine the edge embedding vector of each of the sampled neighbor nodes; Based on the edge embedding vector, obtaining the attention score of each of the sampled neighbor nodes about the target node through adaptive learning; According to the embedding vectors and the attention scores corresponding to different meta-path views, edge embedding representations of the target node under different attribute edges are determined.

5. A fraud detection method according to claim 1, characterized in that: The step of fusing the target edge embedding and the target node embedding to obtain a graph node embedding vector includes: Performing vector concatenation on the target edge embedding and the target node embedding to obtain a concatenated vector; A multi-layer perceptron is used to perform feature fusion on the concatenated vector of the target edge embedding and the target node embedding to obtain a graph node embedding vector.

6. A fraud detection system, characterized in that: include: The first module is used to obtain target business data from the target system based on the fraud detection task and construct a heterogeneous graph; The second module is used to use the first fusion encoder to determine the target edge embedding of the target node based on different meta-path views according to the heterogeneous graph, and determine the target node embedding based on the node attribute of the target node; and perform feature fusion on the target edge embedding and the target node embedding to obtain a graph node embedding vector; Wherein, determining the target edge embedding of the target node based on different meta-path views according to the heterogeneous graph includes: According to the heterogeneous graph, determining edge embedding representations of target nodes under different attribute edges based on different meta-path views; According to the edge embedding representations of the target node under different attribute edges, combined with the importance weights of different meta-path views, the edge embedding representations are fused using an attention mechanism to obtain a target edge embedding of the target node; The third module is used to analyze the positive samples in the heterogeneous graph based on momentum contrast learning to obtain the positive sample node embedding vector; wherein the positive sample represents the node connected to the target node; the positive sample node embedding vector of each node is stored in the offline node feature cache based on the node identifier; The step of analyzing the positive samples in the heterogeneous graph based on momentum contrastive learning to obtain the positive sample node embedding vector includes: Performing momentum update on the first fusion encoder to obtain a second fusion encoder; Determine the edge embedding and node embedding of the nodes of the positive sample in the heterogeneous graph by using the second fusion encoder, and perform feature fusion to obtain the positive sample node embedding vector; A fourth module is used to index a negative sample node embedding vector in an offline node feature cache according to the negative sample in the heterogeneous graph; wherein the negative sample represents a node that is not connected to the target node; A fifth module is used to calculate a contrastive learning loss according to the graph node embedding vector, the positive sample node embedding vector and the negative sample node embedding vector, and update the first fusion encoder based on the contrastive learning loss gradient; The step of calculating the contrastive learning loss according to the graph node embedding vector, the positive sample node embedding vector, and the negative sample node embedding vector, and updating the first fusion encoder based on the contrastive learning loss gradient includes: The contrastive learning loss function is defined as: Among them, sim(u,v) represents the cosine similarity of vectors u and v, and T is the temperature parameter, which is used to control the smoothness of the output category probabilities. When T decreases, the gap between the output category probabilities becomes larger, and when T increases, the gap between the output category probabilities becomes smaller. By comparing the loss calculated by the learning loss function, the multi-view attention fusion encoder is trained using an optimization algorithm, and then the momentum map encoder is updated by momentum update; The sixth module is used to perform fraud detection on the heterogeneous graph to be detected by using the updated first fusion encoder.

7. A fraud detection device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement the method according to any one of claims 1 to 5.

Images