Fraud detection method based on side information enhanced graph neural network

Abstract

The invention provides a fraud detection method based on a side information enhanced graph neural network, and the method comprises the steps: S1, constructing a training set which comprises entities in a social network, features of the entities, and relation types between the entities; s2, constructing a detection model; s3, constructing a model loss function; s4, training a detection model by using the training set in the S1; and S5, performing fraud detection by using the trained detection model, and outputting a detection result of the entity. The problems that an existing fraud detection method is insufficient in precision and low in detection accuracy are solved.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a fraud detection method based on side information enhanced graph neural network. Background Art

[0002] Nowadays, the Internet has become a popular platform for a wide range of online activities, including comments and transactions. However, the growth of online social activities has led to various frauds. Therefore, fraud detection has become a critical task to protect personal privacy and protect society from risks that may lead to adverse consequences. Fraud detection has a wide range of applications in many fields, such as e-commerce, comment management, recommendation systems, network security, rumor detection, etc. Traditional fraud detection methods often rely on rich node features and clear labels, but ignore the importance of entity interactions. In addition, obtaining labeled data can be challenging and costly, especially in large-scale fraud detection problems.

[0003] Fraud detection methods using graph neural networks can capture more unique features of nodes and relationships. Most detection methods based on graph neural networks assume that fraudulent nodes are more likely to establish connections with similar nodes. However, studies have shown that, especially in complex heterogeneous graphs, fraudsters often disguise themselves by establishing connections with many benign nodes to reduce their own suspiciousness. When the proportion of benign neighbors increases, this mechanism may mask fraud characteristics. Therefore, fraudsters may receive more information from benign users, which masks the expression of fraud characteristics, resulting in the insufficient capture and identification capabilities of existing fraud detection algorithms for fraud characteristics. Moreover, most existing GNN-based methods ignore the value information in the edges connecting nodes, which further hinders the algorithm model from capturing discriminative fraud features, and also shows that the existing algorithm model has certain limitations in feature mining.

[0004] Therefore, there is an urgent need for an effective fraud detection method to capture more discriminative fraudster features, enhance the performance of fraud detection methods, and improve detection accuracy, so as to avoid serious consequences and huge losses caused by fraudulent behaviors and incidents, protect the property and security of individuals and organizations, and maintain the stability of the network and social environment. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide a fraud detection method based on side information enhanced graph neural network to solve the problems of insufficient precision and low detection accuracy of existing fraud detection methods.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] The fraud detection method based on edge information enhanced graph neural network includes the following steps:

[0008] S1: Construct a training set, which includes entities in the social network, entity features, and relationship types between entities;

[0009] S2: Build a detection model;

[0010] S3: construct model loss function;

[0011] S4: Use the training set of S1 to train the detection model;

[0012] S5: Use the trained detection model to perform fraud detection and output the detection results of the entity.

[0013] Further, the S2 includes:

[0014] In fraud detection,

[0015] Relational Heterogeneous Directed Graph By node collection Node feature set The edge type set ε is composed of

[0016] Among them, the node set Nodes represent entities in social networks, N is the number of nodes,

[0017] Node feature set Among them, x i represents the original feature vector of the i-th node, d1 is the dimension of the feature space, represents the real number space of dimension d1, represents the set of real numbers; the edge set is the set of relationship types Edges represent specific relationships between entities in a social network. ε is composed of R different relationships, and each element ε in ε r represents the edge set under the rth relationship;

[0018] A relational heterogeneous directed graph There are R isomorphic subgraphs The combination of Represented by the relationship ε r The isomorphic subgraphs formed, 1≤r≤R;

[0019] S21: The detection model includes L hidden layers and one output layer;

[0020] In each hidden layer and output layer, perform the following operations:

[0021] S22: construct edge-based enhancement module;

[0022] S23: Constructing attention-based feature fusion module;

[0023] S24: build enhanced gate logic module;

[0024] S25: Get the final representation of each node in the heterogeneous graph.

[0025] Further, the S22 includes:

[0026] S221: In the edge-based enhancement module, for a specific relationship ε r Node v in i , introduce a linear layer to transform the original feature x i0 Transform to the relation ε r The public space is calculated as follows:

[0027]

[0028] in, is node v i In a specific relationship ε r The mapping features on represents a d-dimensional column vector, the column vector has d eigenvalues, each eigenvalue is a real number, σ(·) is the ReLU activation function, Represent the weight matrix and bias matrix respectively, both of which are related to ε r The learnable parameters of

[0029] S222: Set node v i As the central node, for the central node v i Neighbor node v j , edge (v i , v j ) The calculation formula is as follows:

[0030]

[0031] in, Represents node v j In a specific relationship ε r Mapping features on ;

[0032] Edge (v i , v j ) The calculation formula is as follows:

[0033]

[0034] Where tanh(·) is the tanh activation function;

[0035] Computing center node v i In a specific relationship ε r Next, with any neighbor node v k The edge (v i , v k )

[0036] Further, the S23 includes:

[0037] S231: In the attention-based feature fusion module, for the central node v i Neighbor node v j The importance score is:

[0038]

[0039] in a r is a learnable weight vector, Indicates a r Dimensions; is the transformation matrix, W r The dimension of ; ||(·) represents the vector concatenation operation, The central node v i In the subgraph The set of first-order relation neighbors in ;

[0040] S232: By normalizing the importance scores of all neighboring nodes, we obtain the importance score of the central node v i , neighbor node v j The attention coefficient The calculation formula is as follows:

[0041]

[0042] Among them, LeakyReLU(·) represents the activation function, v k express Any node in

[0043] For the central node v i , neighbor node v k The attention coefficient.

[0044] Furthermore, the S23 further includes:

[0045] S233: Introducing multi-head attention methods to extend the self-attention mechanism, including:

[0046] S2331: In each hidden layer, K independent attention mechanisms are used to generate the central node vi In the relationship ε r The embedding representation is The calculation formula is as follows:

[0047]

[0048] in, Node v represents the kth head j In a specific relationship ε r The mapping features on represents the kth neighbor node v j The attention coefficient; k represents the current attention head, σ represents the ReLU activation function, K represents the number of multi-head attention; || represents the concatenation operation;

[0049] S2332: In the output layer, the results of the multi-head attention are averaged to generate the central node v i In the relationship ε r The embedding representation is The calculation formula is as follows:

[0050]

[0051] Further, the S24 includes:

[0052] S241: In the enhanced gate logic module, the relationship ε r Next, the central node v i Enhanced representation of edges with all neighboring nodes Average and calculate node v i Global enhancement features The calculation formula is as follows:

[0053]

[0054] in, Represents node v i In the relationship ε r The total number of neighbor nodes under;

[0055] S242: Use central node v i The adaptive weight To balance The importance between them is calculated as follows:

[0056]

[0057] in, is a learnable weight vector, represents the dimension of the weight vector; σ(·) represents the sigmoid activation function, Represents the relationship ε r Next, the central node v i Update features of

[0058] S243: Repeat S221 to S242 to calculate node v i Update features under different relations.

[0059] Further, the S25 includes:

[0060] Set all nodes v i The updated features under different relations are connected and converted into low-dimensional embedding features to generate the central node v i The low-dimensional embedding feature h i , the calculation formula is as follows:

[0061]

[0062] in, is a learnable weight vector, Represents the dimension of the splicing feature; Represents the central node v i The splicing features under all relations.

[0063] Further, the S3 includes:

[0064] S31: In each hidden layer l, calculate the central node Embedded features under hidden layer l L is the total number of hidden layers; then Normalize and use cross entropy loss to minimize the node v i and its corresponding label y i The distance between nodes, while maximizing the i The difference between the labels and their counterparts, and finally the average loss of all layers is calculated The calculation formula is as follows:

[0065]

[0066] in, represents the normalized node features output by the hidden layer l, y i Represents node v i The label value of represents the cross entropy loss of hidden layer l, 1-y i Represents node v i The opposite label value of ;

[0067] S32: In the output layer, calculate the central node Embedding features And calculate the cross entropy loss of the last layer The calculation formula is as follows:

[0068]

[0069] in, Represents the normalized features of the output layer, i.e., node v i The final expression of represents the loss function of the output layer;

[0070] Total loss function The calculation formula is as follows:

[0071]

[0072] Among them, γ is the balance coefficient;

[0073] S33: Repeat S221 to S32 to obtain the final representation of each node in the heterogeneous graph.

[0074] Further, the S4 includes:

[0075] S41: determine all fraudulent nodes in the training set, randomly select the same number of nodes as the fraudulent nodes from the benign nodes, and merge the randomly selected benign nodes with all the fraudulent nodes to form a balanced training set;

[0076] S42: preset maximum number of iterations, learning rate, weight decay value, number of multi-head attention K, number of model layers L, dropout rate, node embedding dimension, and balance coefficient;

[0077] S43: Input the nodes selected in S41 into the detection model and calculate the total loss And update the model's built-in learnable parameters through back-propagation to minimize the total loss The iterative training is repeated until the predetermined number of training rounds is reached.

[0078] The beneficial effects of the present invention are

[0079] 1. This paper proposes a new gated edge enhanced graph neural network (GE-GNN), which effectively utilizes the enhanced edge information by combining graph structure and node features, thereby capturing more characteristics of fraudsters.

[0080] 2. The present invention introduces enhanced edge features into the message passing mechanism to calculate the attention weights of neighboring nodes, which can capture richer information and better utilize the local network structure around the central node.

[0081] 3. The present invention designs an enhanced gate logic module, which uses augmented information to calculate the clarity of expression and can further adaptively control the expression of edge features. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0083] Figure 1 It is a flow chart of the present invention.

[0084] Figure 2a It is the distribution diagram of the number of same-kin and different-kin connection relationships in the YelpChi dataset.

[0085] Figure 2b This is a distribution diagram of the number of same-kin and different-kin connections in the Amazon dataset.

[0086] Figure 3 It is a visual comparison diagram of the node embedding representation of the method of the present invention and other detection methods. DETAILED DESCRIPTION

[0087] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0088] This embodiment provides a fraud detection method based on edge information enhanced graph neural network, and the complete steps are as follows:

[0089] S1: Build a training set.

[0090] S2: Build a detection model. The detection model consists of an edge-based enhancement module, an attention-based feature fusion module, and an enhancement gate logic module.

[0091] In the fraud detection problem, a heterogeneous directed graph consists of a set of nodes Node feature set The edge type set ε is composed of Among them, the node set , N is the number of nodes, node feature set in, x irepresents the original feature vector of the i-th node, d1 is the dimension of the feature space, Represents a real number space with dimension d1; edge (relation) type set ε is composed of R different relations, and each element ε in ε r Represents the edge set under the rth relationship.

[0092] A relational heterogeneous directed graph It can be regarded as a combination of R homogeneous directed graphs, expressed as Represented by the relationship ε r The isomorphic subgraphs formed, 1≤r≤R.

[0093] In fraud detection, by Decompose into multiple homogeneous directed graphs. A homogeneous directed graph means that the nodes and edges in the graph are homogeneous, that is, all nodes in the graph belong to the same category, and all edges are also the same type of relationship. In such a graph, each edge is a directed edge pointing from one node to another. This allows for a more detailed analysis of node behavior under different relationship types. This helps capture patterns under specific relationship types, thereby improving the accuracy of fraud detection.

[0094] S21: The model consists of L hidden layers and one output layer.

[0095] In each hidden layer, do the following:

[0096] S22: Construct edge-based enhancement module.

[0097] See also Figure 1 In this module, node features are used to obtain edge features. Nodes are represented as entities in social networks, including users, comments, etc. Edges represent specific relationships between entities in social networks, including friend relationships, belonging, etc. Enhanced representations are then obtained between the central node and each neighbor. The edge-based feature enhancement module aims to reveal the potential information between the anchor node and its neighbors by integrating multi-source high-dimensional feature representations, thereby generating a comprehensive and composite representation for each edge. This approach ensures that the information associated with each edge is fully preserved and enhanced. On the one hand, it clearly characterizes the relationship between the anchor node and different neighbors, thereby facilitating the propagation process. On the other hand, the interaction pattern of the anchor node can be potentially reflected in the fused features.

[0098] S221: Considering that there are different types of edges in heterogeneous graphs, in social networks, edge types may include "friends", "colleagues", "family", etc.; in knowledge graphs, edge types may include "belong to", "located in", "created", etc. Therefore, the features of edges are usually distributed in different spaces. Therefore, it is necessary to first transform the features of all nodes into a common latent space. Specifically, the specific relationship ε r Refers to a specific type of connection in the graph, for a specific relationship ε r Node v in i , introduce a linear layer (i.e. a simple fully connected layer) to transform its original feature x i0 Transform to the relation ε r The public space is calculated as follows:

[0099]

[0100] in, is node v i In a specific relationship ε r The mapping features on represents a d-dimensional column vector, which has d eigenvalues, each of which is a real number. σ(·) is the relu activation function. Represent the weight matrix and bias matrix respectively, both of which are related to ε r The learnable parameters of .

[0101] S222: Get After that, we calculate the edge features and perform edge feature enhancement. i As an anchor node, for the anchor node v i Neighbor node v j , edge (v i , v j )feature It can be calculated directly using the following formula:

[0102]

[0103] in, Represents node v j In a specific relationship ε r The mapping features on .

[0104] Therefore, the edge (v i , v j ) Enhanced Features It can be obtained by the following formula:

[0105]

[0106] Among them, tanh(·) is the tanh activation function, Reflects the anchor node v i Under certain conditions, ε r Rich information on the edge.

[0107] Calculate the anchor node v i In a specific relationship ε r Next, with any neighbor node v k The edge (v i , v k ) Enhanced Features

[0108] S23: Construct an attention-based feature fusion module.

[0109] After obtaining the enhanced feature representation of each edge under different relations, it is necessary to aggregate the information of the first-order relational neighbors of the node. The first-order relational neighbors usually refer to the neighboring nodes directly connected to the node. The aggregation operation of the features of adjacent nodes leads to a smooth transition of node features and is not discriminative. At the same time, this simple summation operation ignores the correlation between adjacent nodes and cannot adaptively update the feature representation of the node. To address this limitation, we adopt a self-attention mechanism, which aggregates information from all neighbors and captures their different features.

[0110] S231: Use enhanced edge representation to calculate the importance score of the first-order relationship neighbors of the node. Specifically, is the anchor node v i In the subgraph The first-order relationship neighbor set in, given the central node v i and its neighbors Then for the central node v i Neighbor v j The importance score is:

[0111]

[0112] in a r is a learnable weight vector, Indicates a r Dimensions; is the transformation matrix, W r The dimension of ; ||(·) represents the vector concatenation operation.

[0113] S232: For v i Node v j The attention coefficient It can be obtained by normalizing the importance scores of all neighbors. The larger the attention coefficient, the more important the neighbor v is. jWith the central node v i The more similar they are, the stronger the association.

[0114]

[0115] Where LeakyReLU(·) represents the activation function. Indicates v i The node's neighbor set. k express Any node in Indicates that for v i Node v k The attention coefficient.

[0116] S233: In order to effectively capture the hierarchical information in multi-dimensional features, we extend the self-attention mechanism by introducing a multi-head attention method.

[0117] S2331: In each hidden layer, K independent attention mechanisms are used and the resulting K representation parts are concatenated to generate a central node v i In the relationship ε r The embedding representation is As shown below:

[0118]

[0119] in, The neighbor node j of the kth head is represented by, represents the attention coefficient of the k-th neighbor node j; k represents the current attention head, σ represents the ReLU activation function, and k represents the number of multi-head attention heads;

[0120] S2332: In the output layer, multi-head attention is averaged instead of concatenated to maintain the sensitivity of the model to generate the central node v i In the relationship ε r The embedding representation is The calculation formula is as follows:

[0121]

[0122] Among them, σ represents the ReLU activation function.

[0123] S24: Construct enhancement gate logic module.

[0124] In order to improve the effectiveness and robustness of the model, a gating strategy is used after the multi-head attention mechanism to balance the aggregated representation and enhance the representation strength of the embedding. That is, in the actual network, the feature representation after entity interaction is weightedly fused with the original features before the interaction to properly retain the key information in the original features.

[0125] S241: Specifically, by r Next, the central node v i Enhanced representation of edges with all neighboring nodes By averaging, we can calculate node v i Global enhancement features The following formula:

[0126]

[0127] in, Represents node v i In the relationship ε r The total number of neighbor nodes.

[0128] S242: In order to capture and retain the key information in the original features, the model considers the central node v i In the relationship ε r The embedding representation is and global enhancement features The model uses the central node v i The adaptive weight To balance The importance between them is calculated as follows:

[0129]

[0130] in is a learnable weight vector, represents the dimension of the weight vector; σ(·) represents the sigmoid activation function, Represents the central node v i Update features that preserve the original information.

[0131] S243: Repeat S221 to S232 to calculate node v i Update features under different relations.

[0132] S25: Relationship-aware aggregation. In actual networks, multiple relationships can be captured to form a complex heterogeneous graph, while one relationship can form a homogeneous graph. Therefore, we process each relationship separately and finally fuse the relationships to form the final representation of a single node in the heterogeneous graph.

[0133] After obtaining the updated features under different relations, we concatenate all the embedded features and convert them into low-dimensional embedded features. This process finally produces the anchor node v i The low-dimensional embedding feature h i :

[0134]

[0135] in, is a learnable weight vector, Represents the dimension of the splicing feature; Represents the central node v i Concatenating features under multiple relations.

[0136] S3: Construct model loss function.

[0137] Based on the above operations, the model is able to obtain the embedded representation of the nodes. However, some fraudsters may exhibit disguised behaviors and only receive information from benign nodes, which may lead to deceptive and different potential performances, deviating from the expected fraudster characteristics. Therefore, without prior experience, each layer of our model may have difficulty extracting valuable information from the ambiguous representation. To address this issue, we developed a layer-aware enhanced feature optimization mechanism. There are two main reasons for this approach. First, relying solely on the final classification loss may make it difficult for the model parameters to extract accurate features. However, with this mechanism, we can iteratively filter features layer by layer using labeled data to capture the unique and accurate identity of the fraudster. This method can ultimately increase the inter-class distance and reduce the intra-class distance. Second, it is simple to integrate this optimization mechanism into our model architecture. In this way, the model can learn valuable features as much as possible at each layer, thereby improving the accuracy of fraud detection.

[0138] S31: Specifically, in each hidden layer l, calculate each node is a node set; the embedding feature at the lth (l≤L) layer Then, we normalize the features and use cross entropy loss at each layer. To minimize the node v i and its corresponding label y i The distance between nodes, while maximizing the i and the difference between its opposite label. Finally, the model calculates the average loss of all layers As described below:

[0139]

[0140] in, Represents the normalized node features of the output, y i Represents node v i The label value of .

[0141] S32: In the output layer, the output of the model will be used as node v i final expression of .

[0142] Calculate the output layer cross entropy loss Combine labeled data:

[0143]

[0144] in Represents node v i The embedding representation at the output layer is Represents the normalized features of the output layer of the model and the loss function value of the output layer, y i Represents a node label.

[0145] In summary, the total loss function of our model is The formula is as follows, where γ is the balance coefficient.

[0146]

[0147] S4: Training model. In order to mitigate the impact of sample imbalance during training, we use undersampling technology. Specifically,

[0148] S41: First determine all the fraudulent nodes in the training set, then randomly select the same number of nodes as the fraudulent nodes from the benign nodes, merge the randomly selected benign nodes with all the fraudulent nodes to form a balanced training set. This is done to make the number of fraudulent nodes and benign nodes in the training set equal, thereby alleviating the problem of class imbalance.

[0149] S42: Then, preset the maximum number of iterations, learning rate, weight decay value, number of multi-head attention K, number of model layers L, dropout rate, node embedding dimension, and balance coefficient.

[0150] S43: Input these selected nodes into the detection model and calculate the total loss And update the model's built-in learnable parameters through back-propagation to minimize the total loss Then the iterative training is repeated until the model converges or the predetermined number of training rounds is reached.

[0151] S5: Use the trained detection model to perform fraud detection and output the detection results of the entity.

[0152] The fraud detection problem is regarded as a binary classification task on graph nodes, and the model outputs two label classes, 0 and 1, where label 1 indicates that the target node is a fraudster, while label 0 indicates that it is a benign user.

[0153] The invention points of the present invention:

[0154] Most existing GNN-based methods ignore the valuable information embedded in the edges connecting nodes. Specifically, anchor nodes interact with various types of neighbors, each connection carries rich information about the source and target nodes, and these structural representations in the latent common space can not only reflect the different attributes of each anchor node, but also contain latent category features. Therefore, these connection representations can provide rich feature information during the aggregation process, which is helpful for detecting fraud patterns. Our method emphasizes the importance of leveraging edge information to improve message propagation within the graph.

[0155] 1. First, an edge-based feature enhancement module is proposed to enhance the edge representation by aggregating the features of the central node and its neighbors.

[0156] 2. Secondly, in order to determine the attention weight of each neighbor during the message passing process, the model combines node features and edge information to calculate the weights of different neighbors.

[0157] 3. In addition, a multi-head attention mechanism is adopted to capture the subtle hierarchical features of node representation. Then, a gate logic mechanism is used to adaptively integrate the enhanced features into the informative node representation.

[0158] 4. At the same time, considering that there are many different types of relationships in the data, the model aggregates the features under different relationships to obtain the final node representation.

[0159] 5. In order to distinguish different types of nodes, this paper adopts a layer-by-layer perception optimization strategy to provide prior guidance.

[0160] Use the trained model to test the model:

[0161] Comprehensive experiments are conducted on two real-world datasets, demonstrating the effectiveness of our proposed model.

[0162] Extensive experiments are conducted on two public fraud detection datasets: the YelpChi (referred to as Yelp) dataset and the Amazon dataset to evaluate the performance of the proposed method GE-GNN. The YelpChi dataset includes hotel and restaurant reviews from Yelp, which can perform spam review detection tasks. Each review consists of 32 manual features, including three types of relations: 1) RUR represents reviews posted by the same user; 2) RSR represents reviews with the same star rating under the same product; 3) RTR represents reviews under the same product posted in the same month.

[0163] The Amazon dataset is a collection of product reviews under the category of musical instruments. The nodes in the Amazon dataset graph represent users, and each user node has 25 manual features. Similar to the YelpChi dataset, it includes three types of relationships: 1) UPU indicates that a user has commented on at least one of the same products; 2) USU indicates a recommended user who has given at least one star rating within a week; 3) UVU represents the top 5% of users in terms of mutual review text similarity. The statistics of the dataset are shown in Table 1.

[0164] We further study the characteristics of these two datasets. As shown in Table 1, Fraudster% represents the fraudster ratio of the dataset. There are only 14.53% and 9.5% fraudsters in the Yelp and Amazon datasets, respectively.

[0165] Table 1 Parameters of Yelp dataset and Amazon dataset

[0166]

[0167] For the imbalance of relationship types, we focus on two typical relationship types, which are composed of same-kinship connections and different-kinship connections. Specifically, same-kinship connections include: NN (connections between good users) and FF (connections between fraudsters), while different-kinship connections include NF (between good users and fraudsters). We have made detailed statistics on these three types of connection relationships, such as Figure 2a is the number of three relationships in the Yelp dataset, Figure 2b is the number of three types of connections in the Amazon dataset. First, in both datasets, we can see that NN connections dominate, while FF connections are in the minority. This extreme imbalance makes it more complicated to distinguish between good-intentioned users and fraudsters. In addition, the distribution of connection types varies greatly among different relationships. For example, Figure 2a In , the number of FF-connected relations and NN-connected relations under RSR relations are 88,406 and 2,539,220, respectively, highlighting the substantial impact of the connection type on fraud detection. Similarly, the proportion of the same connection can vary greatly between different relations. For example, the Yelp dataset contains 775,117 NF edges under RSR relations, but only 176 under RUR relations. This observation suggests that all connection types have unique contributions to fraud detection. Therefore, this comprehensive analysis of the dataset characteristics provides valuable insights and helps to take more effective approaches to address this challenge.

[0168] We selected eight state-of-the-art GNN-based methods to verify the practicality of our model. We divided the baseline methods into three groups: traditional GNN, enhanced GNN, and GNN-based fraud detection methods. Traditional GNN includes: GCN, SGC, GAT; enhanced GNN includes: FAGCN, GPRGNN; GNN-based fraud detection methods include: GraphConsis, CARE-GNN, PC-GNN.

[0169] For GE-GNN, the learning rate is set to 0.1 and the weight decay is 0.00005 to avoid oscillation during training, thus ensuring that the model converges to better results. The dimension of the original features of the nodes is set to 8 and the number of heads is 4. We use 2 layers (L) and run 1000 epochs. To avoid overfitting, the dropout rate of GE-GNN is set to 0.5 based on extensive experimental experience. According to the ablation experiment, the balance coefficient γ is set to 1.2. The Adam optimizer is used for model optimization.

[0170] For the baseline methods, the Deep Graph Library (DGL) or the source code provided by the respective authors was used to implement them. The GE-GNN proposed in this invention is implemented using PyTorch. All methods are executed in Python 3.9.12 environment, using a single NVIDIA A40 GPU, 40GB RAM and 2.60GHz Xeon(R) Gold 6240CPU.

[0171] The two public fraud detection datasets inherently exhibit imbalance, where the detection goal is to identify fraudsters (positive samples) who belong to the minority. In this paper, we adopt three evaluation metrics: AUC, F1-macro, and Recall, among which Recall is the most important for the fraud detection problem.

[0172] We perform a comparative analysis of the proposed GE-GNN with eight state-of-the-art baseline methods. Table 2 shows the corresponding recall, AUC, and F1 macro scores, with the best results in bold. Based on these results, the following observations can be made.

[0173] Table 2 Performance test results of baseline method and method of the present invention

[0174]

[0175] Among traditional GNNs, GAT outperforms GCN and SGC. This is because GAT uses an attention mechanism to evaluate the importance of neighboring nodes to the central node. Since GCN and SGC adopt an equal weight strategy to assign to all neighbor nodes when performing graph convolution operations, this simplification is different from the real-world situation, so the recognition performance is low; this highlights the importance of using attention mechanisms to propagate information between anchor nodes and their neighbors in graph data processing. It is worth noting that the recall rate of SGC on the Yelp dataset is less than 0.01, which means that SGC cannot capture the effective and discriminative features of fraudsters and cannot correctly identify them. The enhanced GNN method consistently outperforms traditional GNNs, which shows that the improved GNN can better learn embeddings and capture more representative information. Compared with traditional GNNs, the enhanced GNN focuses on exploiting the homogeneity and heterogeneity of connections between nodes. It is obvious that integrating the additional information of the edges can help the model identify fraudsters more accurately. On the Yelp dataset, we observe that FAGCN outperforms GPRGNN in terms of recall, but performs poorly in other indicators. This indicates that FAGCN is more sensitive than GPRGNN in detecting fraudsters, but may show relatively lower overall recognition performance. This is because the self-gating mechanism applied in FAGCN is more effective in identifying fraudsters on the Yelp dataset. However, the opposite is observed for the Amazon dataset, which suggests that model performance is also affected by the characteristics of the dataset. GNN-based fraud detection models are specifically designed to address the challenge of unbalanced sampling in fraud detection. Therefore, they generally perform better than traditional GNNs and achieve comparable performance to enhanced GNNs. PC-GNN outperforms other GNN-based fraud detection models in most metrics, mainly due to its strategy of significantly reducing negative samples during training. Compared with enhanced GNN, PC-GNN outperforms GPRGNN and FAGCN in F1 macro score on the Yelp dataset, but performs lower in Recall. This indicates that PC-GNN is not as accurate as enhanced GNN in detecting fraudsters. This is because PC-GNN selects samples randomly, which may ignore important information. Compared with the results of all baselines, our method GE-GNN shows superior performance on most indicators, which verifies the effectiveness of our model in solving the challenge of fraud detection. Specifically, compared with GCN, GE-GNN significantly improves the performance of all indicators on the Yelp dataset by 37.42%, 14.70% and 26.18%, respectively, and on the Amazon dataset by 23.79%, 20.91% and 16.16%. Although the increase in indicators is slightly lower compared to the enhanced GNN and GNN-based fraud detection models, it is still significant. In addition, we observed that there are differences in the performance improvement of our method in different datasets.For example, on the Yelp dataset, our model shows 23.96%, 1.85%, and 8.36% improvements in Recall, F1 macro score, and AUC, respectively, over PC-GNN, while on the Amazon dataset, they are 8.97%, -2.36%, and 2.00%, respectively. The average improvement of our method on the Yelp dataset and Amazon dataset is 11.39% and 2.87%, respectively, indicating significantly higher improvements on the Yelp dataset. However, on the Amazon dataset, we notice that our model outperforms the baseline method on most metrics except the F1 macro score. This difference may be due to benign samples being misclassified as fraudsters.

[0176] We use the Yelp dataset as an illustrative example to visualize the node embeddings of several selected models. Specifically, we compare the performance of the proposed GE-GNN with GCN, GAT, and CARE-GNN. First, we obtain node representations for each model in a 32-dimensional vector space, and then we use t-SNE to project the 32-dimensional embeddings into a 2-dimensional space for visualization. The experimental results are shown in Figure 3 shown.

[0177] In general, insights can be drawn from the visualizations. Our results show that GE-GNN outperforms the selected baseline methods in distinguishing fraudulent nodes from legitimate nodes. Specifically, the embeddings trained by the selected baselines lack clear boundaries to distinguish node types. In contrast, the embeddings generated by GE-GNN effectively cluster the fraudsters in a compact cluster, successfully isolating them from the majority of benign nodes.

[0178] In summary, the method of the present invention has the best performance.

[0179] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0180] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A fraud detection method based on edge information enhanced graph neural network, characterized in that: The following steps are involved: S1: Construct a training set, which includes entities in the social network, entity features, and relationship types between entities; S2: Build a detection model; S3: construct model loss function; S4: Use the training set of S1 to train the detection model; S5: Use the trained detection model to perform fraud detection and output the detection results of the entity.

2. The fraud detection method based on edge information enhanced graph neural network according to claim 1, characterized in that: The S2 includes: In fraud detection, Relational Heterogeneous Directed Graph By node collection Node feature set The edge type set ε is composed of Among them, the node set Nodes represent entities in social networks, N is the number of nodes, Node feature set Among them, x i represents the original feature vector of the i-th node, d1 is the dimension of the feature space, Represents a real number space with dimension d1; the edge set is the relationship type set Edges represent specific relationships between entities in a social network. ε is composed of R different relationships, and each element ε in ε r represents the edge set under the rth relationship; A relational heterogeneous directed graph There are R isomorphic subgraphs The combination of }; Represented by the relationship ε r The isomorphic subgraphs formed, 1≤r≤R; S21: The detection model includes L hidden layers and one output layer; In each hidden layer and output layer, perform the following operations: S22: construct edge-based enhancement module; S23: Constructing attention-based feature fusion module; S24: build enhanced gate logic module; S25: Get the final representation of each node in the heterogeneous graph.

3. The fraud detection method based on edge information enhanced graph neural network according to claim 2 is characterized in that: The S22 includes: S221: In the edge-based enhancement module, for a specific relationship ε r Node v in i , introduce a linear layer to transform the original feature x i0 Transform to the relation ε r The public space is calculated as follows: in, is node v i In a specific relationship ε r The mapping features on represents a d-dimensional column vector, which has d eigenvalues, each of which is a real number. σ(·) is the ReLU activation function. Represent the weight matrix and bias matrix respectively, both of which are related to ε r The learnable parameters of S222: Set node v i As the central node, for the central node v i Neighbor node v j , edge (v i , v j ) The calculation formula is as follows: in, Represents node v j In a specific relationship ε r Mapping features on ; Edge (v i , v j ) The calculation formula is as follows: Where tanh(·) is the tanh activation function; Computing center node v i In a specific relationship ε r Next, with any neighbor node v k The edge (v i , v k ) 4. The fraud detection method based on edge information enhanced graph neural network according to claim 3 is characterized in that: The S23 includes: S231: In the attention-based feature fusion module, for the central node v i Neighbor node v j The importance score is: in a r is a learnable weight vector, Indicates a r Dimensions; is the transformation matrix, W r The dimension of ; ||(·) represents the vector concatenation operation, The central node v i In the subgraph The set of first-order relation neighbors in ; S232: By normalizing the importance scores of all neighboring nodes, we obtain the importance score of the central node v i , neighbor node v j The attention coefficient The calculation formula is as follows: Among them, LeakyReLU(·) represents the activation function, v k express Any node in For the central node v i , neighbor node v k The attention coefficient.

5. The fraud detection method based on edge information enhanced graph neural network according to claim 4 is characterized in that: The S23 further includes: S233: Introducing multi-head attention methods to extend the self-attention mechanism, including: S2331: In each hidden layer, K independent attention mechanisms are used to generate the central node v i In the relationship ε r The embedding representation is The calculation formula is as follows: in, Node v represents the kth head j In a specific relationship ε r The mapping features on represents the kth neighbor node v j The attention coefficient; k represents the current attention head, σ represents the ReLU activation function, K represents the number of multi-head attention; || represents the concatenation operation; S2332: In the output layer, the results of the multi-head attention are averaged to generate the central node v i In the relationship ε r The embedding representation is The calculation formula is as follows:

6. The fraud detection method based on edge information enhanced graph neural network according to claim 5, characterized in that: The S24 includes: S241: In the enhanced gate logic module, the relationship ε r Next, the central node v i Enhanced representation of edges with all neighboring nodes Average and calculate node v i Global enhancement features The calculation formula is as follows: in, Represents node v i In the relationship ε r The total number of neighbor nodes under; S242: Use central node v i The adaptive weight To balance The importance between them is calculated as follows: in, is a learnable weight vector, represents the dimension of the weight vector; σ(·) represents the sigmoid activation function, Represents the relationship ε r Next, the central node v i Update features of S243: Repeat S221 to S242 to calculate node v i Update features under different relations.

7. The fraud detection method based on edge information enhanced graph neural network according to claim 6, characterized in that: The S25 includes: Set all nodes v i The updated features under different relations are connected and converted into low-dimensional embedding features to generate the central node v i The low-dimensional embedding feature h i , the calculation formula is as follows: in, is a learnable weight vector, Represents the dimension of the splicing feature; Represents the central node v i The splicing features under all relations.

8. The fraud detection method based on edge information enhanced graph neural network according to claim 7, characterized in that: The S3 includes: S31: In each hidden layer l, calculate the central node v i ∈V is the embedded feature in the hidden layer l L is the total number of hidden layers; then Normalize and use cross entropy loss to minimize the node v i and its corresponding label y i The distance between nodes, while maximizing the i The difference between the labels and their counterparts, and finally the average loss of all layers is calculated The calculation formula is as follows: in, represents the normalized node features output by the hidden layer l, y i Represents node v i The label value of represents the cross entropy loss of hidden layer l, 1-y i Represents node v i The opposite label value of ; S32: In the output layer, calculate the central node Embedding features And calculate the cross entropy loss of the last layer The calculation formula is as follows: in, Represents the normalized features of the output layer, i.e., node v i The final expression of represents the loss function of the output layer; Total loss function The calculation formula is as follows: Among them, γ is the balance coefficient; S33: Repeat S221 to S32 to obtain the final representation of each node in the heterogeneous graph.

9. The fraud detection method based on edge information enhanced graph neural network according to claim 8, characterized in that: The S4 includes: S41: determine all fraudulent nodes in the training set, randomly select the same number of nodes as the fraudulent nodes from the benign nodes, and merge the randomly selected benign nodes with all the fraudulent nodes to form a balanced training set; S42: preset maximum number of iterations, learning rate, weight decay value, number of multi-head attention K, number of model layers L, dropout rate, node embedding dimension, and balance coefficient; S43: Input the nodes selected in S41 into the detection model and calculate the total loss And update the model's built-in learnable parameters through back-propagation to minimize the total loss The iterative training is repeated until the predetermined number of training rounds is reached.

Images