Systems, methods, and computer program products for active learning in graph neural networks by hybrid uncertainty reduction

Abstract

Systems, methods, and computer program products may (i) obtain a graph comprising a plurality of edges and a plurality of nodes for the plurality of edges, each tagged node in a subset of the tagged nodes being associated with a tag, and each untagged node in a subset of the untagged nodes being not associated with a tag; (ii) training a graph neural network (GNN) using the graph and the label for each marked node, wherein training the GNN generates a prediction for each node; (iii) generating a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generating a predictive tag for each candidate node using a tag propagation algorithm; (v) selecting a candidate node in the candidate pool of candidate nodes associated with a maximum mixed entropy reduction of the graph; and (vi) providing the selected candidate nodes for marking.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Provisional Patent Application No. 63 / 338,089, filed on May 4, 2022, the disclosure of which is hereby incorporated by reference in its entirety. background 1. Technical Field

[0003] The present disclosure relates to active learning in graph neural networks and, in some non-limiting embodiments or aspects, to active learning in graph neural networks by hybrid uncertainty reduction. 2. Background technology

[0004] Graphs are powerful tools for learning knowledge from network data, where nodes represent instances that can be characterized by rich attributes, and edges encode the relationships between nodes. However, collecting sufficient amounts of labeled data can be expensive and time-consuming, which increases the challenge of extending graph neural networks to safety-critical areas such as anomaly detection. For example, data for many real-world scenarios do not have sufficient labels, which makes these scenarios difficult to model as supervised problems. In addition, many existing studies focus on independent and identically distributed data scenarios and are not designed for networked data. It is also not unimportant to choose nodes for labeling to maximize the performance of graph models, because different sets of training nodes may produce very different graph representation results. Therefore, active learning is needed to dynamically query the labels of instances with the most information from unlabeled data to address the data shortage challenge in graphs. Summary of the invention

[0005] Thus, improved systems, apparatus, products, devices, and / or methods are provided for active learning in graph neural networks via hybrid uncertainty reduction.

[0006] According to some non-limiting embodiments or aspects, a computer-implemented method is provided, comprising: (i) obtaining, using at least one processor, a graph comprising a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) training, using the at least one processor, a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the training of the GNN generates a prediction for each of the plurality of nodes; (iii) generating, using the at least one processor, a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generating, using the at least one processor, a predicted label for each candidate node in the candidate pool of candidate nodes using a label propagation algorithm; (v) selecting, using the at least one processor, a candidate node in the candidate pool of candidate nodes associated with a maximum hybrid entropy reduction of the graph, wherein the maximum hybrid entropy reduction of the graph is selected based on the prediction of each of the plurality of nodes. (vi) providing the selected candidate node for labeling using the at least one processor; (vii) receiving a new label associated with the selected candidate node using the at least one processor; (viii) adding the selected candidate node to the subset of labeled nodes as a labeled node associated with the new label using the at least one processor; and (ix) retraining the GNN using the at least one processor using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as a labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the plurality of nodes.

[0007] In some non-limiting embodiments or aspects, the method further comprises: repeating steps (iii)-(ix) a budgeted number of times using the at least one processor.

[0008] In some non-limiting embodiments or aspects, the method further includes: providing a retrained GNN after repeating steps (iii)-(ix) a budgeted number of times; receiving, using the at least one processor, another graph comprising a plurality of additional edges and a plurality of additional nodes for the plurality of additional edges; using the at least one processor, using the retrained GNN, processing the other graph by providing the other graph as an input to the GNN and receiving another prediction for each of the plurality of additional nodes as an output of the GNN; and identifying, using the at least one processor, additional nodes among the plurality of additional nodes as abnormal nodes based on another prediction for each of the plurality of additional nodes.

[0009] In some non-limiting embodiments or aspects, the plurality of additional nodes are associated with a plurality of merchants, and wherein the merchants associated with the additional nodes are identified as default risks.

[0010] In some non-limiting embodiments or aspects, the method further includes: in response to identifying the merchant as a default risk, performing at least one of the following: (i) automatically transmitting, using the at least one processor, information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) automatically suspending, using the at least one processor, processing of the transaction in a transaction processing network by canceling the transaction associated with the merchant; (iii) automatically suspending, using the at least one processor, access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

[0011] In some non-limiting embodiments or aspects, generating the candidate pool of candidate nodes from the subset of unlabeled nodes includes at least one of the following: (i) clustering the subset of unlabeled nodes into multiple clusters of unlabeled nodes, and selecting unlabeled nodes within a threshold distance from the center of each cluster in the multiple clusters for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting unlabeled nodes associated with the graph centrality that satisfies the threshold graph centrality for the candidate pool of candidate nodes; (iii) using the label propagation algorithm to generate a predicted label for each unlabeled node in the subset of unlabeled nodes, for each unlabeled node, comparing the predicted label of the unlabeled node with the prediction for the node, and selecting unlabeled nodes associated with the inconsistency between the predicted label and the prediction for the candidate pool of candidate nodes; or any combination thereof.

[0012] In some non-limiting embodiments or aspects, the GNN comprises a graph convolutional network (GCN).

[0013] According to some non-limiting embodiments or aspects, a system is provided, comprising: at least one processor, the at least one processor being programmed and / or configured to: (i) obtain a graph comprising a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) train a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the GNN is trained to generate a prediction for each of the plurality of nodes; (iii) generate a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generate a predicted label for each candidate node in the candidate pool of candidate nodes using a label propagation algorithm; (v) select a candidate node in the candidate pool of candidate nodes that is associated with a maximum mixed entropy reduction of the graph, wherein the maximum mixed entropy reduction is selected based on the label propagation algorithm for each of the plurality of nodes. The method comprises the steps of: (i) determining a current entropy of the graph based on predictions of a plurality of nodes in the candidate pool of candidate nodes, wherein, for each candidate node in the candidate pool of candidate nodes, determining an updated entropy of the graph based on the predicted label of the candidate node, and wherein, for each candidate node in the candidate pool of candidate nodes, a mixed entropy reduction of the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for the candidate node; (vi) providing the selected candidate node for labeling; (vii) receiving a new label associated with the selected candidate node; (viii) adding the selected candidate node to the subset of labeled nodes as a labeled node associated with the new label; and (ix) retraining the GNN using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as a labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the plurality of nodes.

[0014] In some non-limiting embodiments or aspects, the at least one processor is further programmed and / or configured to: repeat steps (iii)-(ix) a budgeted number of times.

[0015] In some non-limiting embodiments or aspects, the at least one processor is also programmed and / or configured to: provide a retrained GNN after repeating steps (iii)-(ix) a budget number of times; receive another graph, the other graph comprising multiple additional edges and multiple additional nodes for the multiple additional edges; use the retrained GNN to process the other graph by providing the other graph as an input to the GNN and receiving another prediction for each of the multiple additional nodes as an output of the GNN; and identify another node in the multiple additional nodes as an abnormal node based on the another prediction for each of the multiple additional nodes.

[0016] In some non-limiting embodiments or aspects, the plurality of additional nodes are associated with a plurality of merchants, and wherein the merchants associated with the additional nodes are identified as default risks.

[0017] In some non-limiting embodiments or aspects, the at least one processor is also programmed and / or configured to: in response to identifying the merchant as a default risk, perform at least one of the following: (i) automatically transmit information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) automatically suspend processing of the transaction in the transaction processing network by canceling the transaction associated with the merchant; (iii) automatically suspend access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

[0018] In some non-limiting embodiments or aspects, the at least one processor is programmed and / or configured to generate a candidate pool of candidate nodes from the subset of unlabeled nodes by at least one of the following: (i) clustering the subset of unlabeled nodes into multiple clusters of unlabeled nodes, and selecting unlabeled nodes within a threshold distance from the center of each cluster in the multiple clusters for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting unlabeled nodes associated with the graph centrality that satisfies the threshold graph centrality for the candidate pool of candidate nodes; (iii) generating a predicted label for each unlabeled node in the subset of unlabeled nodes using the label propagation algorithm, for each unlabeled node, comparing the predicted label of the unlabeled node with the prediction for the node, and selecting unlabeled nodes associated with the inconsistency between the predicted label and the prediction for the candidate pool of candidate nodes; or any combination thereof.

[0019] In some non-limiting embodiments or aspects, the GNN comprises a graph convolutional network (GCN).

[0020] According to some non-limiting embodiments or aspects, a computer program product is provided, comprising at least one non-transitory computer-readable medium, the at least one non-transitory computer-readable medium comprising program instructions, the program instructions, when executed by at least one processor, causing the at least one processor to: (i) obtain a graph comprising a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) train a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the training of the GNN generates a prediction for each node in the plurality of nodes; (iii) generate a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generate a predicted label for each candidate node in the candidate pool of candidate nodes using a label propagation algorithm; and (v) select a candidate node in the candidate pool of candidate nodes that is related to the maximum mixed entropy reduction of the graph. associated candidate nodes, wherein a current entropy of the graph is determined based on a prediction for each of the plurality of nodes, wherein, for each candidate node in the candidate pool of candidate nodes, an updated entropy of the graph is determined based on the predicted label of the candidate node, and wherein, for each candidate node in the candidate pool of candidate nodes, a mixed entropy reduction of the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for the candidate node; (vi) providing the selected candidate node for labeling; (vii) receiving a new label associated with the selected candidate node; (viii) adding the selected candidate node to the subset of labeled nodes as a labeled node associated with the new label; and (ix) retraining the GNN using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as a labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the plurality of nodes.

[0021] In some non-limiting embodiments or aspects, the program instructions, when executed by the at least one processor, further cause the at least one processor to: repeat steps (iii)-(ix) a budgeted number of times.

[0022] In some non-limiting embodiments or aspects, the program instructions, when executed by the at least one processor, further cause the at least one processor to: provide a retrained GNN after repeating steps (iii)-(ix) a budget number of times; receive another graph, the other graph comprising multiple additional edges and multiple additional nodes for the multiple additional edges; use the retrained GNN to process the other graph by providing the other graph as an input to the GNN and receiving another prediction for each of the multiple additional nodes as an output of the GNN; and identify another node in the multiple additional nodes as an abnormal node based on the another prediction for each of the multiple additional nodes.

[0023] In some non-limiting embodiments or aspects, the plurality of additional nodes are associated with a plurality of merchants, and wherein the merchants associated with the additional nodes are identified as default risks.

[0024] In some non-limiting embodiments or aspects, the program instructions, when executed by the at least one processor, also cause the at least one processor to: in response to identifying the merchant as a default risk, perform at least one of the following: (i) automatically transmitting information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) automatically suspending processing of the transaction in a transaction processing network by canceling the transaction associated with the merchant; (iii) automatically suspending access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

[0025] In some non-limiting embodiments or aspects, the program instructions, when executed by the at least one processor, cause the at least one processor to generate a candidate pool of candidate nodes from the subset of unlabeled nodes by at least one of the following: (i) clustering the subset of unlabeled nodes into multiple clusters of unlabeled nodes, and selecting, from each of the multiple clusters, an unlabeled node within a threshold distance from the center of the cluster for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with the graph centrality that satisfies the threshold graph centrality; (iii) using the label propagation algorithm to generate a predicted label for each unlabeled node in the subset of unlabeled nodes, for each unlabeled node, comparing the predicted label of the unlabeled node with the prediction for the node, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with an inconsistency between the predicted label and the prediction; or any combination thereof.

[0026] Additional non-limiting embodiments or aspects are set forth in the following numbered clauses:

[0027] Clause 1. A computer-implemented method comprising: (i) obtaining, using at least one processor, a graph comprising a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) training, using the at least one processor, a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein training the GNN generates a prediction for each of the plurality of nodes; (iii) generating, using the at least one processor, a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generating, using the at least one processor, a predicted label for each candidate node in the candidate pool of candidate nodes using a label propagation algorithm; (v) selecting, using the at least one processor, a candidate node in the candidate pool of candidate nodes that is associated with a maximum hybrid entropy reduction of the graph, wherein a current state of the graph is determined based on the prediction for each of the plurality of nodes. pre-entropy, wherein, for each candidate node in the candidate pool of candidate nodes, an updated entropy of the graph is determined based on the predicted label of the candidate node, and wherein, for each candidate node in the candidate pool of candidate nodes, a mixed entropy reduction of the graph is determined as a difference between a current entropy of the graph and an updated entropy of the graph determined for the candidate node; (vi) providing the selected candidate node for labeling using the at least one processor; (vii) receiving a new label associated with the selected candidate node using the at least one processor; (viii) adding the selected candidate node to the subset of labeled nodes as a labeled node associated with the new label using the at least one processor; and (ix) retraining the GNN using the at least one processor using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as a labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the plurality of nodes.

[0028] Clause 2. The computer-implemented method of Clause 1, further comprising: repeating steps (iii)-(ix) a budgeted number of times using the at least one processor.

[0029] Clause 3. The computer-implemented method according to clause 1 or 2 further includes: providing a retrained GNN after repeating steps (iii)-(ix) a budgeted number of times; receiving another graph using the at least one processor, the other graph comprising multiple additional edges and multiple additional nodes for the multiple additional edges; using the at least one processor, using the retrained GNN, processing the other graph by providing the other graph as an input to the GNN and receiving another prediction for each of the multiple additional nodes as an output of the GNN; and identifying another node among the multiple additional nodes as an abnormal node based on another prediction for each of the multiple additional nodes using the at least one processor.

[0030] Clause 4. The computer-implemented method of any of Clauses 1-3, wherein the plurality of additional nodes are associated with a plurality of merchants, and wherein merchants associated with the additional nodes are identified as default risks.

[0031] Clause 5. The computer-implemented method according to any one of Clauses 1-4 further includes: in response to identifying the merchant as a default risk, performing at least one of the following: (i) utilizing the at least one processor to automatically transmit information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) utilizing the at least one processor to automatically suspend processing of the transaction in a transaction processing network by canceling the transaction associated with the merchant; (iii) utilizing the at least one processor to automatically suspend access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

[0032] Clause 6. A computer-implemented method according to any one of clauses 1-5, wherein generating the candidate pool of candidate nodes from the subset of unlabeled nodes comprises at least one of the following: (i) clustering the subset of unlabeled nodes into multiple clusters of unlabeled nodes, and selecting, from each of the multiple clusters, unlabeled nodes within a threshold distance from the center of the cluster for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with the graph centrality that satisfies the threshold graph centrality; (iii) using the label propagation algorithm to generate a predicted label for each unlabeled node in the subset of unlabeled nodes, for each unlabeled node, comparing the predicted label of the unlabeled node with the prediction for the node, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with an inconsistency between the predicted label and the prediction; or any combination thereof.

[0033] Clause 7. A computer-implemented method according to any of clauses 1-6, wherein the GNN comprises a graph convolutional network (GCN).

[0034] Item 8. A system comprising: at least one processor, the at least one processor being programmed and / or configured to: (i) obtain a graph comprising a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) train a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the GNN is trained to generate a prediction for each of the plurality of nodes; (iii) generate a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generate a predicted label for each candidate node in the candidate pool of candidate nodes using a label propagation algorithm; (v) select a candidate node in the candidate pool of candidate nodes that is associated with a maximum mixed entropy reduction of the graph, wherein a prediction is determined based on the prediction for each of the plurality of nodes. The method comprises the steps of: (i) providing a selected candidate node for labeling; (ii) receiving a new label associated with the selected candidate node; (iii) adding the selected candidate node to a subset of the labeled nodes as a labeled node associated with the new label; and (ix) retraining the GNN using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as a labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the multiple nodes.

[0035] Clause 9. The system of clause 8, wherein the at least one processor is further programmed and / or configured to: repeat steps (iii)-(ix) a budgeted number of times.

[0036] Clause 10. A system according to clause 8 or 9, wherein the at least one processor is further programmed and / or configured to: provide a retrained GNN after repeating steps (iii)-(ix) a budgeted number of times; receive another graph, the other graph comprising multiple additional edges and multiple additional nodes for the multiple additional edges; use the retrained GNN to process the other graph by providing the other graph as an input to the GNN, and receive another prediction for each additional node in the multiple additional nodes as an output of the GNN; and identify another node in the multiple additional nodes as an abnormal node based on another prediction for each additional node in the multiple additional nodes.

[0037] Clause 11. The system of any of clauses 8-10, wherein the plurality of further nodes are associated with a plurality of merchants, and wherein merchants associated with the further nodes are identified as default risks.

[0038] Clause 12. A system according to any one of clauses 8-11, wherein the at least one processor is further programmed and / or configured to: in response to identifying the merchant as a default risk, perform at least one of the following: (i) automatically transmitting information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) automatically suspending processing of the transaction in a transaction processing network by canceling the transaction associated with the merchant; (iii) automatically suspending access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

[0039] Clause 13. A system according to any one of clauses 8-12, wherein the at least one processor is programmed and / or configured to generate a candidate pool of candidate nodes from the subset of unlabeled nodes by at least one of the following: (i) clustering the subset of unlabeled nodes into multiple clusters of unlabeled nodes, and selecting an unlabeled node within a threshold distance from the center of each cluster in the multiple clusters for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting an unlabeled node associated with a graph centrality that satisfies a threshold graph centrality for the candidate pool of candidate nodes; (iii) using the label propagation algorithm to generate a predicted label for each unlabeled node in the subset of unlabeled nodes, for each unlabeled node, comparing the predicted label of the unlabeled node with a prediction for the node, and selecting the unlabeled node associated with an inconsistency between the predicted label and the prediction for the candidate pool of candidate nodes; or any combination thereof.

[0040] Clause 14. A system according to any of clauses 8-13, wherein the GNN comprises a graph convolutional network (GCN).

[0041] Clause 15. A computer program product comprising at least one non-transitory computer-readable medium, the at least one non-transitory computer-readable medium comprising program instructions, the program instructions, when executed by at least one processor, cause the at least one processor to: (i) obtain a graph comprising a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) train a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the GNN is trained to generate a prediction for each node in the plurality of nodes; (iii) generate a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generate a predicted label for each candidate node in the candidate pool of candidate nodes using a label propagation algorithm; and (v) select a candidate node in the candidate pool of candidate nodes that is associated with a maximum mixed entropy reduction of the graph. , wherein a current entropy of the graph is determined based on a prediction for each of the plurality of nodes, wherein, for each candidate node in the candidate pool of candidate nodes, an updated entropy of the graph is determined based on the predicted label of the candidate node, and wherein, for each candidate node in the candidate pool of candidate nodes, a mixed entropy reduction of the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for the candidate node; (vi) providing the selected candidate node for labeling; (vii) receiving a new label associated with the selected candidate node; (viii) adding the selected candidate node to the subset of labeled nodes as a labeled node associated with the new label; and (ix) retraining the GNN using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as a labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the plurality of nodes.

[0042] Clause 16. The computer program product of Clause 15, wherein the program instructions, when executed by the at least one processor, further cause the at least one processor to: repeat steps (iii)-(ix) a budget number of times.

[0043] Clause 17. A computer program product according to clause 15 or 16, wherein the program instructions, when executed by the at least one processor, further cause the at least one processor to: provide a retrained GNN after repeating steps (iii)-(ix) a budget number of times; receive another graph, the other graph comprising multiple additional edges and multiple additional nodes for the multiple additional edges; use the retrained GNN to process the other graph by providing the other graph as an input to the GNN and receiving another prediction for each of the multiple additional nodes as an output of the GNN; and identify another node in the multiple additional nodes as an abnormal node based on the another prediction for each of the multiple additional nodes.

[0044] Clause 18. The computer program product of any of clauses 15-17, wherein the plurality of further nodes are associated with a plurality of merchants, and wherein merchants associated with the further nodes are identified as default risks.

[0045] Clause 19. A computer program product according to any one of clauses 15-18, wherein the program instructions, when executed by the at least one processor, further cause the at least one processor to: in response to identifying the merchant as a default risk, perform at least one of the following: (i) automatically transmitting information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) automatically suspending processing of the transaction in a transaction processing network by canceling the transaction associated with the merchant; (iii) automatically suspending access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

[0046] Clause 20. A computer program product according to any one of clauses 15-19, wherein the program instructions, when executed by the at least one processor, cause the at least one processor to generate a candidate pool of candidate nodes from the subset of unlabeled nodes by at least one of the following: (i) clustering the subset of unlabeled nodes into multiple clusters of unlabeled nodes, and selecting, from each of the multiple clusters, an unlabeled node within a threshold distance from the center of the cluster for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with the graph centrality that satisfies the threshold graph centrality; (iii) generating a predicted label for each unlabeled node in the subset of unlabeled nodes using the label propagation algorithm, for each unlabeled node, comparing the predicted label of the unlabeled node with a prediction for the node, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with an inconsistency between the predicted label and the prediction; or any combination thereof.

[0047] These and other features and characteristics of the present disclosure, as well as methods of operation and functions of combinations of related structural elements and parts and economies of manufacture, will become more apparent when considering the following description and the appended claims with reference to the accompanying drawings, all of which form a part of this specification, wherein like reference numerals indicate corresponding parts in the various figures. However, it is to be expressly understood that the figures are for illustration and description purposes only and are not intended as definitions of limitations. Unless the context clearly dictates otherwise, as used in this specification and claims, the singular forms "a", "an", and "the" include plural referents. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Additional advantages and details are explained in more detail below with reference to exemplary embodiments shown in the schematic drawings, in which:

[0049] Figure 1 are illustrations of non-limiting embodiments or aspects of environments in which the systems, apparatus, products, devices, and / or methods described herein may be implemented;

[0050] Figure 2 yes Figure 1 Illustrations of non-limiting embodiments or aspects of one or more devices and / or components of one or more systems;

[0051] Figures 3A-3C is a flow chart of a non-limiting embodiment or aspect of a process for active learning in a graph neural network by hybrid uncertainty reduction; and

[0052] Figure 4is an illustration of a non-limiting embodiment or aspect of a process for active learning in a graph neural network via hybrid uncertainty reduction. DETAILED DESCRIPTION

[0053] It should be understood that, except where expressly specified to the contrary, the present disclosure may employ various alternative variations and step sequences. It should also be understood that the specific devices and processes shown in the accompanying drawings and described in the following specification are merely exemplary and non-limiting embodiments or aspects. Therefore, specific dimensions and other physical characteristics associated with the embodiments or aspects disclosed herein should not be considered limiting.

[0054] The aspects, parts, elements, structures, actions, steps, functions, instructions, etc. used herein should not be understood as being critical or necessary unless explicitly described as such. Also, as used herein, the articles "a" and "an" are intended to include one or more items and can be used interchangeably with "one or more" and "at least one". In addition, as used herein, the term "set" is intended to include one or more items (e.g., related items, unrelated items, a combination of related items and unrelated items, etc.), and can be used interchangeably with "one or more" or "at least one". In the case of intending to have only one item, the term "one" or similar language is used. Moreover, as used herein, the term "having" and / or its analogs are intended to be open terms. In addition, unless otherwise explicitly stated, the phrase "based on" is intended to mean "based at least in part on".

[0055] As used herein, the term "communication" may refer to the reception, acceptance, transmission, transfer, provision, etc. of data (e.g., information, signals, messages, instructions, commands, etc.). A unit (e.g., a device, a system, a component of a device or system, a combination thereof, and / or the like) communicating with another unit means that the unit is able to directly or indirectly receive information from the other unit and / or send information to the other unit. This may refer to a direct or indirect connection (e.g., a direct communication connection, an indirect communication connection, and / or the like) that is wired and / or wireless in nature. In addition, although the information sent may be modified, processed, relayed, and / or routed between the first unit and the second unit, the two units may also communicate with each other. For example, even if the first unit passively receives information and does not actively send information to the second unit, the first unit may communicate with the second unit. As another example, if at least one intermediate unit processes the information received from the first unit and transmits the processed information to the second unit, the first unit may communicate with the second unit.

[0056] Obviously, the systems and / or methods described herein can be implemented in different forms of hardware, software, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit the implementation. Therefore, the operation and behavior of the systems and / or methods are described herein without reference to specific software code, and it should be understood that software and hardware can be designed to implement the systems and / or methods based on the description herein.

[0057] As used herein, the term "transaction service provider" may refer to an entity that receives transaction authorization requests from merchants or other entities and, in some cases, provides payment assurance through an agreement between the transaction service provider and the issuer organization. For example, a transaction service provider may include, for example The term "transaction processing system" may refer to one or more computing devices operated by or on behalf of a transaction service provider, such as a transaction processing server executing one or more software applications. A transaction processing system may include one or more processors and, in some non-limiting embodiments, may be operated by or on behalf of a transaction service provider.

[0058] As used herein, the term "account identifier" may include one or more primary account numbers (PANs), tokens, or other identifiers associated with a customer account. The term "token" may refer to an identifier used as a replacement or substitute identifier for an original account identifier such as a PAN. An account identifier may be alphanumeric, or any combination of characters and / or symbols. A token may be associated with a PAN or other original account identifier in one or more data structures (e.g., one or more databases, etc.) so that the token can be used to conduct transactions without directly using the original account identifier. In some examples, an original account identifier such as a PAN may be associated with multiple tokens for different individuals or purposes.

[0059] As used herein, the term "issuer institution", "portable financial device issuer", "issuer" or "issuer bank" may refer to one or more entities that provide one or more accounts to a user (e.g., a customer, consumer, organization, etc.) to conduct a transaction (e.g., a payment transaction), such as initiating a credit card payment transaction and / or a debit card payment transaction. For example, an issuer institution may provide an account identifier such as a PAN to a user that uniquely identifies one or more accounts associated with the user. The account identifier may be contained on a portable financial device such as a physical financial instrument (e.g., a payment card), and / or may be electronic and used for electronic payments. In some non-limiting embodiments or aspects, an issuer institution may be associated with a bank identification number (BIN) that uniquely identifies the issuer institution. As used herein, an "issuer institution system" may refer to one or more computer systems operated by or on behalf of an issuer institution, such as a server computer that executes one or more software applications. For example, an issuer institution system may include one or more authorization servers for authorizing payment transactions.

[0060] As used herein, the term "merchant" may refer to an individual or entity that provides goods and / or services or access to goods and / or services to a user (e.g., a customer) based on a transaction (e.g., a payment transaction). As used herein, the term "merchant" or "merchant system" may also refer to one or more computer systems, computing devices, and / or software applications operated by or on behalf of a merchant, such as a server computer that executes one or more software applications. As used herein, a "point of sale (POS) system" may refer to one or more computers and / or peripheral devices used by a merchant to conduct payment transactions with a user, including one or more card readers, near field communication (NFC) receivers, radio frequency identification (RFID) receivers, and / or other contactless transceivers or receivers, contact-based receivers, payment terminals, computers, servers, input devices, and / or other similar devices that can be used to initiate payment transactions. A POS system may be part of a merchant system. A merchant system may also include a merchant plug-in for facilitating online Internet-based transactions through a merchant webpage or software application. A merchant plug-in may include software that runs on a merchant server or is hosted by a third party to facilitate such online transactions.

[0061] As used herein, the term "mobile device" may refer to one or more portable electronic devices configured to communicate with one or more networks. As an example, a mobile device may include a cellular phone (e.g., a smart phone or a standard cellular phone), a portable computer (e.g., a tablet computer, a laptop computer, etc.), a wearable device (e.g., a watch, glasses, lenses, clothing, etc.), a personal digital assistant (PDA), and / or other similar devices. As used herein, the terms "client device" and "user device" refer to any electronic device configured to communicate with one or more servers or remote devices and / or systems. Client devices or user devices may include mobile devices, network-enabled appliances (e.g., network-enabled TVs, refrigerators, thermostats, etc.), computers, POS systems, and / or any other device or system capable of communicating with a network.

[0062] As used herein, the term "computing device" may refer to one or more electronic devices configured to process data. In some examples, a computing device may include necessary components to receive, process, and output data, such as a processor, a display, a memory, an input device, a network interface, and / or the like. A computing device may be a mobile device. For example, a mobile device may include a cellular phone (e.g., a smart phone or a standard cellular phone), a portable computer, a wearable device (e.g., a watch, glasses, lenses, clothing, and / or the like), a PDA, and / or other similar devices. A computing device may also be a desktop computer or other form of non-mobile computer.

[0063] As used herein, the terms "electronic wallet" and "electronic wallet application" refer to one or more electronic devices and / or software applications configured to initiate and / or conduct payment transactions. For example, an electronic wallet may include a mobile device executing an electronic wallet application, and may also include server-side software and / or databases for maintaining and providing transaction data to the mobile device. An "electronic wallet provider" may include an entity that provides and / or maintains electronic wallets for customers, such as Google Android Apple Samsung And / or other similar electronic payment systems. In some non-limiting examples, the issuing bank may be the electronic wallet provider.

[0064] As used herein, the term "payment device" may refer to a portable financial device, an electronic payment device, a payment card (e.g., a credit or debit card), a gift card, a smart card, smart media, a payroll card, a healthcare card, a wristband, a machine-readable medium containing account information, a key chain device or pendant, an RFID transponder, a retailer discount or membership card, a cellular phone, an electronic wallet mobile application, a PDA, a pager, a security card, a computer, an access card, a wireless terminal, a transponder, etc. In some non-limiting embodiments or aspects, a payment device may include volatile or non-volatile memory to store information (e.g., an account identifier, an account holder's name, etc.).

[0065] As used herein, the terms "server" and / or "processor" may refer to or include one or more computing devices that are operated by or facilitate communications and processing by multiple parties in a network environment such as the Internet, but it should be understood that communications may be facilitated through one or more public or private network environments, and that there may be various other arrangements. In addition, multiple computing devices (e.g., servers, POS devices, mobile devices, etc.) that communicate directly or indirectly in a network environment may constitute a "system." As used herein, references to "server" or "processor" may refer to previously described servers and / or processors, different servers and / or processors, and / or combinations of servers and / or processors that are stated to implement previous steps or functions. For example, as used in the specification and claims, a first server and / or first processor stated to perform a first step or function may refer to the same or different servers and / or processors stated to perform a second step or function.

[0066] As used herein, the term "acquirer" may refer to an entity that is licensed by a transaction service provider and / or approved by a transaction service provider to initiate a transaction using a portable financial device of a transaction service provider. An acquirer may also refer to one or more computer systems operated by or on behalf of an acquirer, such as a server computer (e.g., "acquirer server") that executes one or more software applications. An "acquirer" may be a merchant bank, or in some cases, a merchant system may be an acquirer. The transaction may include an original credit transaction (OCT) and an account funds transaction (AFT). A transaction service provider may authorize an acquirer to sign a merchant of a service provider to initiate a transaction using a portable financial device of a transaction service provider. An acquirer may sign a contract with a payment service provider to enable the service provider to sponsor a merchant. An acquirer may monitor the compliance of a payment service provider according to the regulations of a transaction service provider. An acquirer may perform due diligence on a payment service provider and ensure that appropriate due diligence is performed before signing a sponsored merchant. An acquirer may be responsible for all transaction service provider programs that they operate or sponsor. An acquirer can be held responsible for the actions of its payment facilitator and the merchants it or its payment facilitator sponsors.

[0067] As used herein, the term "payment gateway" may refer to an entity and / or a payment processing system operated by or on behalf of such an entity, the entity (e.g., merchant service provider, payment service provider, payment service provider, payment service provider with a contract with an acquirer, payment aggregator, etc.) providing payment services (e.g., transaction service provider payment services, payment processing services, etc.) to one or more merchants. The payment service may be associated with the use of a portable financial device managed by a transaction service provider. As used herein, the term "payment gateway system" may refer to one or more computer systems, computer devices, servers, server groups, etc. operated by or on behalf of a payment gateway.

[0068] As used herein, the term "application programming interface" (API) may refer to computer code that allows communication between different systems or (hardware and / or software) system components. For example, an API may include function calls, functions, subroutines, communication protocols, fields, etc. that can be used and / or accessed by other systems or other (hardware and / or software) system components.

[0069] As used herein, the term "user interface" or "graphical user interface" refers to a generated display, such as one or more graphical user interfaces (GUIs), with which a user can interact directly or indirectly (e.g., via keyboard, mouse, touch screen, etc.).

[0070] Provided are improved systems, apparatuses, products, devices and / or methods for active learning in graph neural networks through hybrid uncertainty reduction, which (i) obtain a graph including a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) train a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the GNN is trained to generate a prediction for each of the plurality of nodes; (iii) generate a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generate a predicted label for each candidate node in the candidate pool of candidate nodes using a label propagation algorithm; and (v) select a candidate node in the candidate pool of candidate nodes that is associated with a maximum hybrid entropy reduction of the graph, wherein the maximum hybrid entropy reduction is selected based on the prediction of each node in the plurality of nodes. (vi) providing the selected candidate node for labeling; (vii) receiving a new label associated with the selected candidate node; (viii) adding the selected candidate node to a subset of the labeled nodes as a labeled node associated with the new label; and (ix) retraining the GNN using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as a labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the multiple nodes.

[0071] In this way, non-limiting embodiments or aspects of the present disclosure may provide an active graph learning framework that actively assists in training an oracle database by integrating GNN and label propagation to estimate the impact of unlabeled nodes on graph performance improvement so that better nodes can be selected for querying, thereby improving or optimizing graph embedding performance. For example, by using an input graph with only a few nodes labeled, a GNN can be trained on the current graph data to obtain a predicted embedding of the GNN, and the graph entropy can be calculated to represent graph uncertainty. By simulating the GNN using label propagation and estimating the training results of the nodes in the labeled candidate pool, the most representative and / or valuable unlabeled nodes in improving the performance of the model can be identified from the candidate pool of candidate nodes. Therefore, a mixed uncertainty reduction for labeling different candidate nodes can be obtained, and the node with the largest reduction can be added to the training set, and the model can be retrained until the labeling budget is reached, thereby automatically filtering out insignificant nodes and reducing the computational cost and processing time for labeling.

[0072] Reference now Figure 1 , Figure 1 1 is an illustration of an example environment 100 in which the apparatus, systems, methods, and / or products described herein may be implemented. Figure 1 As shown in , environment 100 includes transaction processing network 101, user device 112 and / or communication network 114, and the transaction processing network may include merchant system 102, payment gateway system 104, acquirer system 106, transaction service provider system 108, issuer system 110. Transaction processing network 101, merchant system 102, payment gateway system 104, acquirer system 106, transaction service provider system 108, issuer system 110 and / or user device 112 may be interconnected (e.g., establish connection for communication, etc.) via wired connection, wireless connection or a combination of wired connection and wireless connection.

[0073] The merchant system 102 may include one or more devices that are capable of receiving information and / or data from the payment gateway system 104, the acquirer system 106, the transaction service provider system 108, the issuer system 110, and / or the user device 112 via the communication network 114, and / or transmitting information and / or data to the payment gateway system 104, the acquirer system 106, the transaction service provider system 108, the issuer system 110, and / or the user device 112 via the communication network 114. The merchant system 102 may include a communication connection (e.g., an NFC communication connection, an RFID communication connection, The merchant system 102 may include a device that receives information and / or data from the user device 112 and / or transmits information and / or data to the user device 112 through the communication connection (communication connection, etc.). For example, the merchant system 102 may include a computing device, such as a server, a server group, a client device, a client device group, and / or other similar devices. In some non-limiting embodiments or aspects, the merchant system 102 may be associated with a merchant described herein. In some non-limiting embodiments or aspects, the merchant system 102 may include one or more devices that can be used by a merchant to conduct payment transactions with a user, such as a computer, a computer system, and / or a peripheral device. For example, the merchant system 102 may include a POS device and / or a POS system.

[0074] The payment gateway system 104 may include one or more devices capable of receiving information and / or data from the merchant system 102, the acquirer system 106, the transaction service provider system 108, the issuer system 110, and / or the user device 112 via the communication network 114, and / or transmitting information and / or data to the merchant system 102, the acquirer system 106, the transaction service provider system 108, the issuer system 110, and / or the user device 112 via the communication network 114. For example, the payment gateway system 104 may include a computing device, such as a server, a server group, and / or other similar devices. In some non-limiting embodiments or aspects, the payment gateway system 104 is associated with the payment gateway described herein.

[0075] The acquirer system 106 may include one or more devices capable of receiving information and / or data from the merchant system 102, the payment gateway system 104, the transaction service provider system 108, the issuer system 110, and / or the user device 112 via the communication network 114, and / or transmitting information and / or data to the merchant system 102, the payment gateway system 104, the transaction service provider system 108, the issuer system 110, and / or the user device 112 via the communication network 114. For example, the acquirer system 106 may include a computing device, such as a server, a server group, and / or other similar devices. In some non-limiting embodiments or aspects, the acquirer system 106 may be associated with an acquirer as described herein.

[0076] The transaction service provider system 108 may include one or more devices that are capable of receiving information and / or data from the merchant system 102, the payment gateway system 104, the acquirer system 106, the issuer system 110, and / or the user device 112 via the communication network 114, and / or transmitting information and / or data to the merchant system 102, the payment gateway system 104, the acquirer system 106, the issuer system 110, and / or the user device 112 via the communication network 114. For example, the transaction service provider system 108 may include a computing device, such as a server (e.g., a transaction processing server, etc.), a server group, and / or other similar devices. In some non-limiting embodiments or aspects, the transaction service provider system 108 may be associated with a transaction service provider described herein. In some non-limiting embodiments or aspects, the transaction service provider system 108 may include and / or access one or more internal and / or external databases that include transaction data.

[0077] The issuer system 110 may include one or more devices that are capable of receiving information and / or data from the merchant system 102, the payment gateway system 104, the acquirer system 106, the transaction service provider system 108, and / or the user device 112 via the communication network 114, and / or transmitting information and / or data to the merchant system 102, the payment gateway system 104, the acquirer system 106, the transaction service provider system 108, and / or the user device 112 via the communication network 114. For example, the issuer system 110 may include a computing device, such as a server, a server group, and / or other similar devices. In some non-limiting embodiments or aspects, the issuer system 110 may be associated with an issuer organization described herein. For example, the issuer system 110 may be associated with an issuer organization that issues payment accounts or instruments (e.g., credit accounts, debit accounts, credit cards, debit cards, etc.) to users (e.g., users associated with the user device 112, etc.).

[0078] In some non-limiting embodiments or aspects, the transaction processing network 101 includes multiple systems in a communication path for processing transactions. For example, the transaction processing network 101 may include a merchant system 102, a payment gateway system 104, an acquirer system 106, a transaction service provider system 108, and / or an issuer system 110 in a communication path (e.g., a communication path, a communication channel, a communication network, etc.) for processing electronic payment transactions. For example, the transaction processing network 101 may process (e.g., initiate, conduct, authorize, etc.) electronic payment transactions via the communication path between the merchant system 102, the payment gateway system 104, the acquirer system 106, the transaction service provider system 108, and / or the issuer system 110.

[0079] The user device 112 may include one or more devices that can receive information and / or data from the merchant system 102, the payment gateway system 104, the acquirer system 106, the transaction service provider system 108, and / or the issuer system 110 through the communication network 114, and / or transmit information and / or data to the merchant system 102, the payment gateway system 104, the acquirer system 106, the transaction service provider system 108, and / or the issuer system 110 through the communication network 114. For example, the user device 112 may include a client device, etc. In some non-limiting embodiments or aspects, the user device 112 can communicate with the merchant system 102, the payment gateway system 104, the acquirer system 106, the transaction service provider system 108, and / or the issuer system 110 through the communication network 114. communication connection, etc.) (e.g., from merchant system 102, etc.), and / or transmit information via a short-range wireless communication connection (e.g., to merchant system 102).

[0080] In some non-limiting embodiments or aspects, the user device 112 may include one or more applications associated with the user device 112, such as applications stored, installed and / or executed on the user device 112 (e.g., mobile device applications, native applications for mobile devices, mobile cloud applications for mobile devices, e-wallet applications, peer-to-peer payment transfer applications, merchant applications, issuer applications, etc.).

[0081] The communication network 114 may include one or more wired and / or wireless networks. For example, the communication network 114 may include a cellular network (e.g., a long term evolution (LTE) network, a third generation (3G) network, a fourth generation (4G) network, a fifth generation (5G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber-based network, a cloud computing network, etc. and / or a combination of these or other types of networks.

[0082] supply Figure 1 The number and arrangement of devices and systems shown are examples. Figure 1 Additional devices and / or systems, fewer devices and / or systems, different devices and / or systems, and / or differently arranged devices and / or systems than those shown. Furthermore, the present invention may be implemented within a single device and / or system. Figure 1 two or more of the devices and / or systems shown in, or Figure 1The single device and / or system shown in the environment 100 may be implemented as multiple distributed devices and / or systems. Additionally or alternatively, a group of devices and / or systems (e.g., one or more devices or systems) of the environment 100 may perform one or more functions described as being performed by another group of devices and / or systems of the environment 100.

[0083] Reference now Figure 2 , Figure 2 is an illustration of example components of device 200. Device 200 may correspond to one or more devices of merchant system 102, one or more devices of payment gateway system 104, one or more devices of acquirer system 106, one or more devices of transaction service provider system 108, one or more devices of issuer system 110, and / or user device 112 (e.g., one or more devices of system of user device 112, etc.). In some non-limiting embodiments or aspects, one or more devices of merchant system 102, one or more devices of payment gateway system 104, one or more devices of acquirer system 106, one or more devices of transaction service provider system 108, one or more devices of issuer system 110, and / or user device 112 (e.g., one or more devices of system of user device 112, etc.) may include at least one device 200 and / or at least one component of device 200. Figure 2 As shown, apparatus 200 may include a bus 202 , a processor 204 , a memory 206 , a storage component 208 , an input component 210 , an output component 212 , and a communication interface 214 .

[0084] The bus 202 may include components that permit communication between components of the device 200. In some non-limiting embodiments or aspects, the processor 204 may be implemented in hardware, software, or a combination of hardware and software. For example, the processor 204 may include a processor (e.g., a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), etc.), a microprocessor, a digital signal processor (DSP), and / or any processing component that can be programmed to perform a function (e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), etc.). The memory 206 may include a random access memory (RAM), a read-only memory (ROM), and / or another type of dynamic or static storage device (e.g., flash memory, magnetic memory, optical memory, etc.) that stores information and / or instructions for use by the processor 204.

[0085] The storage component 208 may store information and / or software associated with the operation and use of the device 200. For example, the storage component 208 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optical disk, a solid-state disk, etc.), a compact disk (CD), a digital versatile disk (DVD), a floppy disk, a cassette, a magnetic tape, and / or another type of computer-readable medium, and a corresponding drive.

[0086] Input components 210 may include components that permit device 200 to receive information, for example, via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, buttons, switches, a microphone, etc.). Additionally or alternatively, input components 210 may include sensors for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, an actuator, etc.). Output components 212 may include components that provide output information from device 200 (e.g., a display, a speaker, one or more light emitting diodes (LEDs), etc.).

[0087] The communication interface 214 may include a transceiver-type component (e.g., a transceiver, a separate receiver and transmitter, etc.) that enables the device 200 to communicate with other devices, for example, via a wired connection, a wireless connection, or a combination of a wired connection and a wireless connection. The communication interface 214 may permit the device 200 to receive information from another device and / or provide information to another device. For example, the communication interface 214 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, Interface, cellular network interface, etc.

[0088] The device 200 can perform one or more processes described herein. The device 200 can perform these processes based on the processor 204 executing software instructions stored by a computer-readable medium such as the memory 206 and / or the storage component 208. Computer-readable media (e.g., non-transitory computer-readable media) are defined herein as non-transitory memory devices. Non-transitory memory devices include memory space located within a single physical storage device or memory space spread across multiple physical storage devices.

[0089] The software instructions may be read into the memory 206 and / or storage component 208 from another computer-readable medium or from another device via the communication interface 214. When executed, the software instructions stored in the memory 206 and / or storage component 208 may cause the processor 204 to perform one or more processes described herein. Additionally or alternatively, hard-wired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Therefore, the embodiments or aspects described herein are not limited to any specific combination of hardware circuitry and software.

[0090] The memory 206 and / or the storage component 208 may include a data storage device or one or more data structures (e.g., a database, etc.). The device 200 can receive information from the data storage device or one or more data structures in the memory 206 and / or the storage component 208, store information in the data storage device or one or more data structures, transmit information to the data storage device or one or more data structures, or search for information stored therein.

[0091] supply Figure 2 The number and arrangement of components shown in FIG. 2 are provided as examples. In some non-limiting embodiments or aspects, the device 200 may include a Figure 2 Components shown in the figure may include additional components, fewer components, different components, or differently arranged components than those shown in the figure. Additionally or alternatively, a group of components (e.g., one or more components) of the device 200 may perform one or more functions described as being performed by another group of components of the device 200.

[0092] Reference now Figures 3A-3C , Figures 3A-3C Flowchart of a non-limiting embodiment or aspect of a process 300 for active learning in a graph neural network by hybrid uncertainty reduction. In some non-limiting embodiments or aspects, one or more steps of the process 300 may be performed (e.g., completely, partially, etc.) by a transaction service provider system 108 (e.g., one or more devices of the transaction service provider system 108). In some non-limiting embodiments or aspects, one or more steps of the process 300 may be performed (e.g., completely, partially, etc.) by another device or device group that is independent of or includes the transaction service provider system 108, such as (e.g., one or more devices of the merchant system 102), the payment gateway system 104 (e.g., one or more devices of the payment gateway system 104), the acquirer system 106 (e.g., one or more devices of the acquirer system 106), the transaction service provider system 108 (e.g., one or more devices of the transaction service provider system 108, etc.), the issuer system 110 (e.g., one or more devices of the issuer system 110) and / or the user device 112.

[0093] like Figure 3A As shown, at step 302, process 300 includes obtaining a graph. For example, transaction service provider system 108 may obtain a graph including a plurality of edges and a plurality of nodes for the plurality of edges. Each labeled node in a subset of labeled nodes in the plurality of nodes may be associated with a label. Each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label. As an example, and also referring to Figure 4, which is a diagram of a non-limiting embodiment or aspect of a process for active learning in a graph neural network through hybrid uncertainty reduction 400, the transaction service provider system 108 may initialize an input graph where only nodes x i The subset of l , and the remaining nodes are not marked as y u , and the labeled nodes can be from different categories and / or can be randomly selected from the training set.

[0094] In some non-limiting embodiments or aspects, multiple nodes may be associated with multiple entities (e.g., entity attributes of multiple entities, etc.), and multiple edges may be associated with multiple relationships between multiple entities (e.g., between entities, between entity attributes of entities, etc.). In this example, multiple nodes may include independent entity sets and / or entity attribute sets, and multiple edges may include a set of relationship sets, wherein each relationship set is a collection of all links of a specific link type connecting two fixed entity types. For example, multiple nodes may include entities of multiple different entity types and / or entity attributes of multiple different entity attribute types, and / or multiple edges may include edges of multiple different relationship types. In some non-limiting embodiments or aspects, multiple nodes are associated with multiple merchants, and / or multiple edges are associated with multiple transactions between multiple merchants and / or between multiple merchants and multiple other entities, and multiple other entities are also associated with multiple nodes (e.g., multiple customers, multiple issuers, etc.).

[0095] In some non-limiting embodiments or aspects, a label can be associated with one of a plurality of predetermined categories. For example, a label can be associated with an abnormal node (e.g., a merchant associated with a default and / or default risk, etc.) or a non-abnormal node (e.g., a merchant not associated with a default and / or default risk, etc.) and / or indicate that the node is an abnormal node or a non-abnormal node.

[0096] like Figure 3A As shown in FIG. 3 , at step 304, process 300 includes training a graph neural network (GNN). For example, transaction service provider system 108 may train the GNN using the graph and the labels of each labeled node in the subset of labeled nodes. In this example, the training GNN may generate predictions for each of the plurality of nodes. As an example, and again referring to Figure 4 , the transaction service provider system 108 can train a two-layer graph convolutional network (GCN) model to train the input graph to perform the classification task, and the GCN model can incorporate information from the graph (e.g., adjacency matrix, features, and / or training labels). The transaction service provider system 108 can obtain the predicted embedding Z generated by the GNN and calculate the current graph entropy (Z) to represent the graph uncertainty.

[0097] In some non-limiting embodiments or aspects, the GNN may include a GCN (e.g., a two-layer GCN model, etc.).

[0098] The transaction service provider system 108 may train the GNN using a semi-supervised learning technique using node embeddings of the plurality of nodes and labels of a subset of labeled nodes. The training GNN may generate a plurality of predictions for the plurality of nodes. For example, the transaction service provider system 108 may provide the node embeddings (e.g., node attributes, etc.) of the plurality of nodes to the GNN as input, receive predictions for the nodes from the GNN as output, and modify one or more parameters and / or weights of the GNN according to a semi-supervised learning technique that depends on the predictions and labels.

[0099] In some non-limiting embodiments or aspects, the prediction includes a prediction of whether the node is an anomalous node (e.g., a merchant associated with default and / or default risk, etc.) or a non-anomalous node (e.g., a merchant not associated with default and / or default risk, etc.).

[0100] like Figure 3A As shown in FIG. 3 , at step 306 , process 300 includes generating a candidate pool of candidate nodes from a subset of unmarked nodes. For example, transaction service provider system 108 may generate a candidate pool of candidate nodes from a subset of unmarked nodes. As an example, and again referring to Figure 4 The transaction service provider system 108 may generate a candidate pool of candidate nodes by filtering a certain percentage (eg, 5%, etc.) of data points or nodes using K-means clustering and / or PageRank algorithms to identify density centers and graph centers of the input graph, respectively.

[0101] In some non-limiting embodiments or aspects, the transaction service provider system 108 can generate a candidate pool of candidate nodes from a subset of unlabeled nodes by at least one of the following: (i) clustering the subset of unlabeled nodes into multiple clusters of unlabeled nodes (for example, using K-means clustering, etc.), and selecting an unlabeled node within a threshold distance from the center of each cluster in the multiple clusters for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph (for example, using PageRank algorithm, etc.), and selecting unlabeled nodes associated with the graph centrality that satisfies the threshold graph centrality for the candidate pool of candidate nodes; (iii) generating a predicted label for each unlabeled node in the subset of unlabeled nodes using a label propagation algorithm, comparing the predicted label of the unlabeled node with the prediction for the node for each unlabeled node, and selecting an unlabeled node associated with an inconsistency between the predicted label and the prediction for the candidate pool of candidate nodes; or any combination thereof.

[0102] like Figure 3A As shown in FIG. 3 , at step 308, process 300 includes generating a predicted label for each candidate node using a label propagation algorithm. For example, the transaction service provider system 108 may generate a predicted label for each candidate node in the candidate node pool using a label propagation algorithm. As an example, and again referring to Figure 4 , the transaction service provider system 108 can use a label propagation algorithm to simulate the training of the GNN and generate its predicted embedding or label Z, and estimate the impact of labeling different candidate nodes on the model performance improvement of the GNN by calculating the updated graph entropy φ(Z′) and the designed mixed uncertainty reduction φ(Z)-φ(Z′) of the specific candidate node determined as the difference between the current entropy φ(Z) and the updated entropy φ(Z′). In this example, the label propagation algorithm can use the label information Y from the graph without using its feature or attribute information X.

[0103] like Figure 3A As shown in , at step 310, the process 300 includes selecting a candidate node associated with a maximum hybrid entropy reduction of the graph. For example, the transaction service provider system 108 may select a candidate node associated with a maximum hybrid entropy reduction of the graph from a candidate pool of candidate nodes. As an example, and again referring to Figure 4 , the transaction service provider system 108 may select a candidate node from the candidate pool of candidate nodes that is associated with a maximum mixed entropy reduction argmax(φ(Z)-φ(Z′)) of the graph.

[0104] As an example, the transaction service provider system 108 can use label propagation to simulate GNN training and estimate the training results of labeling each node in the "center" node to obtain an updated graph entropy to determine the mixed uncertainty reduction of labeling different candidate nodes, and select the node with the largest reduction and add it to the training set, and retrain the model until the label budget is reached.

[0105] In this example, a current entropy of the graph may be determined based on the predictions for each of the plurality of nodes. For each candidate node in the candidate pool of candidate nodes, an updated entropy of the graph may be determined based on the predicted label of the candidate node. For each candidate node in the candidate pool of candidate nodes, a mixed entropy reduction of the graph may be determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for the candidate node.

[0106] For example, we can define a system with n possible outcomes and probabilities p1, ..., p according to the following equation (1): n (For example, the current entropy of the graph H(G,Z,Y l ), the entropy of event X of the updated graph H(LP(G,Z,y), etc.):

[0107]

[0108] Therefore, for the candidate node, the mixed entropy reduction ΔH of the graph can be determined as ΔH=H(G,Z,Yl)-H(LP(G,Z,y)), and argmax(ΔH1,ΔH2,ΔH3,…,ΔHk) can be used to select the candidate node associated with the maximum mixed entropy reduction of the graph.

[0109] like Figure 3A As shown in FIG. 3 , at step 312 , process 300 includes providing the selected candidate node for labeling. For example, transaction service provider system 108 may provide the selected candidate node for training. As an example, and again referring to Figure 4 , the transaction service provider system 108 may provide the selected candidate nodes for labeling by a human expert.

[0110] like Figure 3A As shown in FIG. 3 , at step 314, process 300 includes receiving a new tag associated with the selected candidate node. For example, transaction service provider system 108 may receive a new tag associated with the selected candidate node. As an example, and again referring to Figure 4 , the transaction service provider system 108 may receive as user input a new label associated with the selected candidate node.

[0111] like Figure 3B As shown in , at step 316, the process 300 includes adding the selected candidate node to the subset of marked nodes. For example, the transaction service provider system 108 can add the selected candidate node as a marked node associated with the new label to the subset of marked nodes. In this example, the transaction service provider system 108 can delete the selected candidate node that has been added to the subset of marked nodes from the subset of unmarked nodes.

[0112] like Figure 3B As shown in , at step 318, the process 300 includes retraining the GNN. For example, the transaction service provider system 108 can retrain the GNN using the graph and the labels of each labeled node in the subset of labeled nodes, including the labels of the selected candidate nodes added to the subset of labeled nodes as labeled nodes associated with new labels. In this example, the retrained GNN can regenerate predictions for each of the plurality of nodes.

[0113] like Figure 3BAs shown in , at step 320, process 300 includes determining whether the tag budget is met. For example, the transaction service provider system 108 can determine whether the tag budget is met. For example, the transaction service provider system 108 can repeat steps 306 to 318 a budget number of times. In this example, in response to determining that the tag budget is not met, processing can return to step 306 of process 300. In this example, in response to determining that the tag budget is met, processing can proceed to step 322 of process 300. As an example, and again referring to Figure 4 , the transaction service provider system 108 may repeat steps 306 to 318 as long as N(y l )<Budget.

[0114] like Figure 3B As shown in , at step 322, the process 300 includes providing a retrained GNN. For example, the transaction service provider system 108 may provide the retrained GNN. For example, the transaction service provider system 108 may store the retrained GNN in a memory and / or a database.

[0115] like Figure 3C As shown in , at step 324, the process 300 includes receiving another graph. For example, the transaction service provider system 108 may receive another graph including a plurality of additional edges and a plurality of additional nodes for the plurality of additional edges.

[0116] In some non-limiting embodiments or aspects, a plurality of additional nodes may be associated with a plurality of additional entities (e.g., entity attributes of a plurality of additional entities, etc.), and a plurality of additional edges may be associated with a plurality of additional relationships between a plurality of additional entities (e.g., between additional entities, between entity attributes of additional entities and additional entities, etc.). In this example, a plurality of additional nodes may include independent entity sets and / or entity attribute sets, and a plurality of additional edges may include a set of relationship sets, wherein each relationship set is a collection of all links of a specific link type connecting two fixed entity types. For example, a plurality of additional nodes may include entities of a plurality of different entity types and / or entity attributes of a plurality of different entity attribute types, and / or a plurality of additional edges may include edges of a plurality of different relationship types. In some non-limiting embodiments or aspects, a plurality of additional nodes are associated with a plurality of merchants, and / or a plurality of additional edges are associated with a plurality of transactions between a plurality of merchants and / or between a plurality of merchants and a plurality of other entities also associated with a plurality of additional nodes (e.g., a plurality of customers, a plurality of issuers, etc.).

[0117] like Figure 3CAs shown in , at step 326, the process 300 includes processing another graph using the retrained GNN. For example, the transaction service provider system 108 can process another graph using the retrained GNN by providing the other graph as an input to the GNN, and receiving another prediction (e.g., another prediction embedding, etc.) for each of the plurality of additional nodes as an output of the GNN.

[0118] like Figure 3C As shown in , at 328, the process 300 includes identifying an additional node as an anomalous node. For example, the transaction service provider system 108 may identify an additional node of the plurality of additional nodes as an anomalous node based on another prediction of each additional node of the plurality of additional nodes.

[0119] like Figure 3C As shown in , at step 330, the process 300 includes performing an automatic action. For example, in response to identifying the additional node as an abnormal node, the transaction service provider system 108 can perform an automatic action. As an example, in response to identifying the merchant as a default risk, the transaction service provider system 108 can include at least one of the following: (i) automatically transmitting information associated with the merchant's account to a database to mark the account as associated with the default risk, (ii) automatically suspending the processing of transactions in the transaction processing network by canceling transactions associated with the merchant, or (iii) automatically suspending the merchant's account from accessing the transaction service provider system in the transaction processing network.

[0120] Although various embodiments or aspects have been described in detail for purposes of illustration and description, it will be understood that such detail is intended solely for that purpose and that the embodiments or aspects are not limited to the disclosed embodiments or aspects, but, on the contrary, are intended to cover modifications and equivalent arrangements within the spirit and scope of the appended claims. For example, it will be understood that the present disclosure contemplates that, to the extent possible, one or more features of any embodiment or aspect may be combined with one or more features of any other embodiment or aspect. Indeed, any of these features may be combined in a manner not specifically recited in the claims and / or disclosed in the specification. Although each dependent claim listed below may be directly dependent on only one claim, the disclosure of possible implementations includes each dependent claim in combination with each other claim in the claim set.

Claims

1. A computer-implemented method comprising: (i) obtaining, using at least one processor, a graph comprising a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) training, with the at least one processor, a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the GNN is trained to generate predictions for each of the plurality of nodes; (iii) generating, using the at least one processor, a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generating a predicted label for each candidate node in the candidate pool of candidate nodes using a label propagation algorithm using the at least one processor; (v) selecting, with the at least one processor, a candidate node from the candidate pool of candidate nodes that is associated with a maximum hybrid entropy reduction of the graph, wherein a current entropy of the graph is determined based on a prediction of each of the plurality of nodes, wherein, for each candidate node in the candidate pool of candidate nodes, an updated entropy of the graph is determined based on the predicted label of the candidate node, and wherein, for each candidate node in the candidate pool of candidate nodes, the hybrid entropy reduction of the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for the candidate node; (vi) providing, using the at least one processor, the selected candidate node for marking; (vii) receiving, with the at least one processor, a new label associated with the selected candidate node; (viii) adding, with the at least one processor, the selected candidate node as a marked node associated with the new label to the subset of marked nodes; and (ix) retraining the GNN using the at least one processor, using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as the labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the plurality of nodes.

2. The computer-implemented method of claim 1 , further comprising: Repeating steps (iii)-(ix) a predetermined number of times using the at least one processor.

3. The computer-implemented method of claim 2, further comprising: After repeating steps (iii)-(ix) a budgeted number of times, a retrained GNN is provided; receiving, with the at least one processor, another graph comprising a plurality of additional edges and a plurality of additional nodes for the plurality of additional edges; processing, with the at least one processor, the other graph using the retrained GNN by providing the other graph as an input to the GNN and receiving as an output of the GNN another prediction for each of the plurality of additional nodes; and Additional nodes of the plurality of additional nodes are identified, with the at least one processor, as anomalous nodes based on another prediction for each additional node of the plurality of additional nodes. 4 . The computer-implemented method of claim 3 , wherein the plurality of additional nodes are associated with a plurality of merchants, and wherein merchants associated with the additional nodes are identified as default risks.

5. The computer-implemented method of claim 4, further comprising: In response to identifying the merchant as a default risk, performing at least one of the following: (i) automatically transmitting, using the at least one processor, information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) automatically suspending, using the at least one processor, processing of the transaction in a transaction processing network by canceling the transaction associated with the merchant; (iii) automatically suspending, using the at least one processor, access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

6. The computer-implemented method of claim 1 , wherein generating the candidate pool of candidate nodes from the subset of unlabeled nodes comprises at least one of: (i) clustering the subset of unlabeled nodes into a plurality of clusters of unlabeled nodes, and selecting, from each of the plurality of clusters, an unlabeled node within a threshold distance from a center of the cluster for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with the graph centrality that satisfies a threshold graph centrality; (iii) generating a predicted label for each unlabeled node in the subset of unlabeled nodes using the label propagation algorithm, for each unlabeled node, comparing the predicted label of the unlabeled node with the prediction for the node, and selecting, for the candidate pool of candidate nodes, an unlabeled node associated with an inconsistency between the predicted label and the prediction; or Any combination thereof.

7. The computer-implemented method of claim 1, wherein the GNN comprises a graph convolutional network (GCN).

8. A system comprising: at least one processor programmed and / or configured to: (i) obtaining a graph including a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) training a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the GNN is trained to generate predictions for each of the plurality of nodes; (iii) generating a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generating a predicted label for each candidate node in the candidate pool of the candidate nodes using a label propagation algorithm; (v) selecting a candidate node from the candidate pool of candidate nodes that is associated with a maximum mixed entropy reduction of the graph, wherein a current entropy of the graph is determined based on a prediction of each of the plurality of nodes, wherein, for each candidate node from the candidate pool of candidate nodes, an updated entropy of the graph is determined based on the predicted label of the candidate node, and wherein, for each candidate node from the candidate pool of candidate nodes, the mixed entropy reduction of the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for the candidate node; (vi) providing the selected candidate node for labeling; (vii) receiving a new label associated with the selected candidate node; (viii) adding the selected candidate node as a marked node associated with the new label to the subset of marked nodes; and (ix) retraining the GNN using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as the labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the multiple nodes.

9. The system of claim 8, wherein the at least one processor is further programmed and / or configured to: Repeat steps (iii)-(ix) the budgeted number of times.

10. The system of claim 9, wherein the at least one processor is further programmed and / or configured to: After repeating steps (iii)–(ix) a budgeted number of times, a retrained GNN is provided; receiving another graph, the another graph comprising a plurality of additional edges and a plurality of additional nodes for the plurality of additional edges; Using the retrained GNN, processing the further graph by providing the further graph as an input to the GNN and receiving as an output of the GNN a further prediction for each of the plurality of further nodes; and Based on another prediction for each of the plurality of further nodes, another node of the plurality of further nodes is identified as an abnormal node.

11. The system of claim 10, wherein the plurality of further nodes are associated with a plurality of merchants, and wherein merchants associated with the further nodes are identified as default risks.

12. The system of claim 11, wherein the at least one processor is further programmed and / or configured to: In response to identifying the merchant as a default risk, performing at least one of the following: (i) automatically transmitting information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) automatically suspending processing of the transaction in a transaction processing network by canceling the transaction associated with the merchant; (iii) automatically suspending access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

13. The system of claim 8, wherein the at least one processor is programmed and / or configured to generate the candidate pool of candidate nodes from the subset of unlabeled nodes by at least one of: (i) clustering the subset of unlabeled nodes into a plurality of clusters of unlabeled nodes, and selecting, from each of the plurality of clusters, an unlabeled node within a threshold distance from a center of the cluster for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with the graph centrality that satisfies a threshold graph centrality; (iii) generating a predicted label for each unlabeled node in the subset of unlabeled nodes using the label propagation algorithm, for each unlabeled node, comparing the predicted label of the unlabeled node with the prediction for the node, and selecting, for the candidate pool of candidate nodes, an unlabeled node associated with an inconsistency between the predicted label and the prediction; or Any combination thereof.

14. The system of claim 8, wherein the GNN comprises a graph convolutional network (GCN).

15. A computer program product comprising at least one non-transitory computer readable medium, the at least one non-transitory computer readable medium comprising program instructions that, when executed by at least one processor, cause the at least one processor to: (i) obtaining a graph including a plurality of edges and a plurality of nodes for the plurality of edges, wherein each labeled node in a subset of labeled nodes in the plurality of nodes is associated with a label, and wherein each unlabeled node in a subset of unlabeled nodes in the plurality of nodes is not associated with a label; (ii) training a graph neural network (GNN) using the graph and the label of each labeled node in the subset of labeled nodes, wherein the GNN is trained to generate predictions for each of the plurality of nodes; (iii) generating a candidate pool of candidate nodes from the subset of unlabeled nodes; (iv) generating a predicted label for each candidate node in the candidate pool of the candidate nodes using a label propagation algorithm; (v) selecting a candidate node from the candidate pool of candidate nodes that is associated with a maximum mixed entropy reduction of the graph, wherein a current entropy of the graph is determined based on a prediction of each of the plurality of nodes, wherein, for each candidate node from the candidate pool of candidate nodes, an updated entropy of the graph is determined based on the predicted label of the candidate node, and wherein, for each candidate node from the candidate pool of candidate nodes, the mixed entropy reduction of the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for the candidate node; (vi) providing the selected candidate node for labeling; (vii) receiving a new label associated with the selected candidate node; (viii) adding the selected candidate node as a marked node associated with the new label to the subset of marked nodes; and (ix) retraining the GNN using the graph and the label of each labeled node in the subset of labeled nodes, including the label of the selected candidate node added to the subset of labeled nodes as the labeled node associated with the new label, wherein the retraining of the GNN regenerates predictions for each of the multiple nodes.

16. The computer program product of claim 15, wherein the program instructions, when executed by the at least one processor, further cause the at least one processor to: Repeat steps (iii)-(ix) the budgeted number of times.

17. The computer program product of claim 16, wherein the program instructions, when executed by the at least one processor, further cause the at least one processor to: After repeating steps (iii)–(ix) a budgeted number of times, a retrained GNN is provided; receiving another graph, the another graph comprising a plurality of additional edges and a plurality of additional nodes for the plurality of additional edges; Using the retrained GNN, processing the further graph by providing the further graph as an input to the GNN and receiving as an output of the GNN a further prediction for each of the plurality of further nodes; and Based on another prediction for each of the plurality of further nodes, another node of the plurality of further nodes is identified as an abnormal node.

18. The computer program product of claim 17, wherein the plurality of further nodes are associated with a plurality of merchants, and wherein merchants associated with the further nodes are identified as default risks.

19. The computer program product of claim 18, wherein the program instructions, when executed by the at least one processor, further cause the at least one processor to: In response to identifying the merchant as a default risk, performing at least one of the following: (i) automatically transmitting information associated with the merchant's account to a database to mark the account as associated with the default risk; (ii) automatically suspending processing of the transaction in a transaction processing network by canceling the transaction associated with the merchant; (iii) automatically suspending access of the merchant's account to a transaction service provider system in the transaction processing network; or any combination thereof.

20. The computer program product of claim 15, wherein the program instructions, when executed by the at least one processor, cause the at least one processor to generate the candidate pool of candidate nodes from the subset of unlabeled nodes by at least one of: (i) clustering the subset of unlabeled nodes into a plurality of clusters of unlabeled nodes, and selecting, from each of the plurality of clusters, an unlabeled node within a threshold distance from a center of the cluster for the candidate pool of candidate nodes; (ii) calculating the graph centrality of each unlabeled node in the subset of unlabeled nodes based on the graph, and selecting, for the candidate pool of candidate nodes, unlabeled nodes associated with the graph centrality that satisfies a threshold graph centrality; (iii) generating a predicted label for each unlabeled node in the subset of unlabeled nodes using the label propagation algorithm, for each unlabeled node, comparing the predicted label of the unlabeled node with the prediction for the node, and selecting, for the candidate pool of candidate nodes, an unlabeled node associated with an inconsistency between the predicted label and the prediction; or Any combination thereof.

Images