Fraud Detection Method Based on Edge Information Augmented Graph Neural Network

Abstract

This invention provides a fraud detection method based on edge information-enhanced graph neural networks, comprising: S1: constructing a training set, which includes entities in a social network, entity features, and relationship types between entities; S2: constructing a detection model; S3: constructing a model loss function; S4: training the detection model using the training set from S1; S5: performing fraud detection using the trained detection model and outputting the entity detection results. This addresses the problems of insufficient accuracy and low detection rate in existing fraud detection methods.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a fraud detection method based on edge information-enhanced graph neural networks. Background Technology

[0002] Today, the internet has become a popular platform for a wide range of online activities, including commenting and trading. However, the growth of online social activities has led to various forms of fraud. Therefore, fraud detection has become a critical task in protecting individual privacy and society from risks that could have adverse consequences. Fraud detection has wide applications in many fields, such as e-commerce, comment management, recommender systems, cybersecurity, and rumor detection. Traditional fraud detection methods often rely on rich node features and explicit labels, but neglect the importance of entity interactions. Furthermore, obtaining labeled data can be challenging and costly, especially in large-scale fraud detection problems.

[0003] Fraud detection methods utilizing graph neural networks (GNNs) can capture more unique features of nodes and relationships. Most GNN-based detection methods assume that fraudulent nodes tend to connect with similar nodes. However, research shows that, especially in complex heterogeneous graphs, fraudsters often disguise themselves by connecting with numerous benign nodes, thus reducing their suspiciousness. This mechanism can mask fraudulent features as the proportion of benign neighbors increases. Therefore, fraudsters may receive more information from benign users, which obscures the expression of fraudulent features, leading to insufficient ability of existing fraud detection algorithms to capture and identify fraudulent features. Moreover, most existing GNN-based methods ignore the value information in the edges connecting nodes, further hindering the algorithm model from capturing discriminative fraudulent features and indicating certain limitations of existing algorithm models in feature mining.

[0004] Therefore, there is an urgent need for an effective fraud detection method to capture more distinctive fraudster characteristics, enhance the performance of fraud detection methods, improve detection accuracy, thereby avoiding serious consequences and huge losses caused by fraudulent behavior and events, protecting the property and safety of individuals and organizations, and maintaining the stability of the network and social environment. Summary of the Invention

[0005] The purpose of this invention is to provide a fraud detection method based on edge information-enhanced graph neural networks to solve the problems of insufficient accuracy and low detection accuracy of existing fraud detection methods.

[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0007] The fraud detection method based on edge information-enhanced graph neural networks includes the following steps:

[0008] S1: Construct a training set, which includes entities in the social network, the characteristics of the entities, and the types of relationships between the entities;

[0009] S2: Construct the detection model;

[0010] S3: Construct the model loss function;

[0011] S4: Train the detection model using the training set from S1;

[0012] S5: Use the trained detection model to perform fraud detection and output the detection results of entities.

[0013] Furthermore, S2 includes:

[0014] In fraud detection,

[0015] Relational Heterogeneous Directed Graph From the set of nodes Node feature set The set of edge types ε is constituted, represented as

[0016] Among them, the node set A node represents an entity in a social network, and N is the number of nodes.

[0017] Node feature set Where, x i Let d1 represent the original feature vector of the i-th node, where d1 is the dimension of the feature space. Represents a real space of dimension d1. The set of real numbers represents the set of edges, which is the set of relation types. An edge represents a specific relationship between entities in a social network. ε consists of R different relationships, where each element ε represents a relationship between entities. r Represents the edge set under the r-th relation;

[0018] A relational heterogeneous directed graph There are R isomorphic subgraphs The combination of is represented as Represents the relation ε r The isomorphic subgraphs formed, 1≤r≤R;

[0019] S21: The detection model consists of L hidden layers and one output layer;

[0020] Perform the following operations in each hidden layer and output layer:

[0021] S22: Construct edge-based enhancement modules;

[0022] S23: Construct an attention-based feature fusion module;

[0023] S24: Construct the enhanced gate logic module;

[0024] S25: Obtain the final representation of each node in the heterogeneous graph.

[0025] Furthermore, S22 includes:

[0026] S221: In the edge-based enhancement module, for a specific relation ε r node v in i Introducing a linear layer to transform the original features x i0 Transform to relation ε r The calculation formula for public spaces is as follows:

[0027]

[0028] in, It is node v i In a specific relationship ε r Mapping features on Let represent a d-dimensional column vector with d eigenvalues, each of which is a real number. σ(·) is the ReLU activation function. Let ε represent the weight matrix and bias matrix, respectively. r Learnable parameters;

[0029] S222: Move node v i As the central node, for the central node v i neighbor node v j ,side (v i v j ) characteristics The calculation formula is as follows:

[0030]

[0031] in, Represents node v j In a specific relationship ε r Mapping features on;

[0032] Side (v) i v j Enhanced features The calculation formula is as follows:

[0033]

[0034] Where tanh(·) is the tanh activation function;

[0035] Calculate the central node v i In a specific relationship ε r Down and any neighbor node v k The edge (v) i v k Enhanced features

[0036] Furthermore, S23 includes:

[0037] S231: In the attention-based feature fusion module, for the central node v i Neighbor node v j Importance score:

[0038]

[0039] in a r It is a learnable weight vector. Indicates a r The dimension; It is a transformation matrix. W r The dimension; ||(·) represents the vector concatenation operation, For the central node v i In subgraph The set of first-order relation neighbors in the table;

[0040] S232: Obtain the importance score for the central node v by normalizing the importance scores of all neighboring nodes. i Neighbor node v j Attention coefficient The calculation formula is as follows:

[0041]

[0042] Where LeakyReLU(·) represents the activation function, v k express Any node in the middle,

[0043] This indicates that for the central node v i Neighbor node v k Attention coefficient.

[0044] Furthermore, S23 also includes:

[0045] S233: Introducing multi-head attention methods to expand the self-attention mechanism, including:

[0046] S2331: In each hidden layer, K independent attention mechanisms are used to generate the central node v.i In relation ε r Embedded representation The calculation formula is as follows:

[0047]

[0048] in, v represents the k-th head node j In a specific relationship ε r Mapping features on, Represents the k-th head neighbor node v j The attention coefficient; k represents the current attention head, σ represents the ReLU activation function, K represents the number of multi-head attention; || represents the concatenation operation;

[0049] S2332: In the output layer, the results of the multi-head attention are averaged to generate the center node v. i In relation ε r Embedded representation The calculation formula is as follows:

[0050]

[0051] Furthermore, S24 includes:

[0052] S241: In the enhancement gate logic module, the relation ε r Below, the central node v i Edge augmentation representation with all neighboring nodes Perform averaging and calculate node v i Global enhancement features The calculation formula is as follows:

[0053]

[0054] in, Represents node v i In relation ε r The total number of neighboring nodes;

[0055] S242: Using the central node v i Adaptive weights To balance The importance of each other is calculated using the following formula:

[0056]

[0057] in, It is a learnable weight vector. σ represents the dimension of the weight vector; σ(·) represents the sigmoid activation function. Representing relation ε r Below, the central node v i Update features;

[0058] S243: Repeat S221~S242, calculate node v i Update features under different relationships.

[0059] Furthermore, S25 includes:

[0060] Put all nodes v i The updated features under different relationships are concatenated and transformed into low-dimensional embedded features to generate the central node v. i low-dimensional embedding features h i The calculation formula is as follows:

[0061]

[0062] in, It is a learnable weight vector. The dimension representing the splicing features; Indicates the central node v i The splicing feature under all relationships.

[0063] Furthermore, S3 includes:

[0064] S31: In each hidden layer l, calculate the center node. Embedded features under hidden layer l L is the total number of hidden layers; then for Normalization is performed, and cross-entropy loss is used to minimize node v. i and its corresponding label y i The distance between them, while maximizing node v i The difference between the labels and their opposites is used to calculate the average loss across all layers. The calculation formula is as follows:

[0065]

[0066] in, y represents the normalized node features output by hidden layer l. i Represents node v i The tag value, The cross-entropy loss of hidden layer l is represented by 1-y. i Represents node v i The opposite label value;

[0067] S32: In the output layer, calculate the central node. Embedding features And calculate the cross-entropy loss of the last layer. The calculation formula is as follows:

[0068]

[0069] in, This represents the normalized feature of the output layer, i.e., node v. i The final expression, This represents the loss function of the output layer;

[0070] Total loss function The calculation formula is as follows:

[0071]

[0072] Where γ is the balance coefficient;

[0073] S33: Repeat S221 to S32 to obtain the final representation of each node in the heterogeneous graph.

[0074] Furthermore, S4 includes:

[0075] S41: Determine all fraudulent nodes in the training set, then randomly select the same number of nodes as the fraudulent nodes from the benign nodes, and merge the randomly selected benign nodes with all the fraudulent nodes to form a balanced training set;

[0076] S42: Preset maximum number of iterations, learning rate, weight decay value, number of multi-head attention K, number of model layers L, dropout rate, node embedding dimension, and balance coefficient;

[0077] S43: Input the nodes selected in S41 into the detection model and calculate the total loss. The model's built-in learnable parameters are updated using backpropagation to minimize the total loss. Repeat the iterative training until the predetermined number of training rounds is reached.

[0078] The beneficial effects of this invention are

[0079] 1. This invention proposes a novel gated edge augmentation graph neural network (GE-GNN), which effectively utilizes augmentation edge information by combining graph structure and node features, thereby capturing more features of fraudsters.

[0080] 2. This invention introduces enhanced edge features into the message passing mechanism to calculate the attention weights of neighboring nodes, which can capture richer information and better utilize the local network structure around the central node.

[0081] 3. The present invention designs an enhancement gate logic module that uses augmented information to calculate the clarity of the representation, which can further adaptively control the representation of edge features. Attached Figure Description

[0082] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0083] Figure 1 This is a flowchart of the invention.

[0084] Figure 2a This is a distribution chart of the number of same-family and different-family connections in the YelpChi dataset.

[0085] Figure 2b This is a distribution chart of the number of same-relative and different-relative connections in the Amazon dataset.

[0086] Figure 3 This is a visual comparison of the node embedding representations of the method of this invention and other detection methods. Detailed Implementation

[0087] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0088] This embodiment provides a fraud detection method based on edge information-enhanced graph neural networks. The complete steps are as follows:

[0089] S1: Construct the training set.

[0090] S2: Construct the detection model. The detection model consists of an edge-based enhancement module, an attention-based feature fusion module, and an enhancement gate logic module.

[0091] In the fraud detection problem, a heterogeneous directed graph consists of a set of nodes. Node feature set The set of edge types ε is constituted, represented as Among them, the node set N is the number of nodes, and the set of node features. in, x iLet d1 represent the original feature vector of the i-th node, where d1 is the dimension of the feature space. Represents a real number space of dimension d1; a set of edge (relation) types. ε consists of R different relations, where each element in ε is ε r Let r represent the edge set under the r-th relation.

[0092] A relational heterogeneous directed graph It can be viewed as a combination of R homogeneous directed graphs, denoted as: Represents the relation ε r The isomorphic subgraphs formed are 1≤r≤R.

[0093] In fraud detection, heterogeneous directed graphs of relationships are used. Decomposing the graph into multiple homogeneous directed graphs is a method where all nodes and edges are homogeneous; that is, all nodes belong to the same class, and all edges represent the same type of relationship. In such a graph, each edge is a directed edge from one node to another. This allows for more refined analysis of node behavior under different relationship types. This helps to capture patterns under specific relationship types, thereby improving the accuracy of fraud detection.

[0094] S21: The model consists of L hidden layers and one output layer.

[0095] Perform the following operations in each hidden layer:

[0096] S22: Construct edge-based enhancement modules.

[0097] See Figure 1 In this module, node features are used to obtain edge features. Nodes represent entities in a social network, such as users and comments, while edges represent specific relationships between entities, such as friendships and belonging. Enhanced representations are then obtained between the central node and each neighbor. The edge-based feature enhancement module aims to reveal the potential information between anchor nodes and their neighbors by integrating multi-source high-dimensional feature representations, thereby generating a comprehensive and composite representation for each edge. This approach ensures the full preservation and enhancement of information associated with each edge. On one hand, it clearly characterizes the relationships between anchor nodes and their different neighbors, thus facilitating the propagation process. On the other hand, the interaction patterns of anchor nodes can potentially be reflected in the fused features.

[0098] S221: Considering the existence of different types of edges in heterogeneous graphs, in social networks, edge types may include "friends," "colleagues," "family," etc.; in knowledge graphs, edge types may include "belong to," "located in," "created," etc. Therefore, edge features are usually distributed in different spaces. Thus, it is necessary to first transform the features of all nodes into a common latent space. Specifically, specific relations ε r This refers to a specific type of connection in a graph, where ε is a specific relation. r node v in i A linear layer (i.e., a simple fully connected layer) is introduced to process its original features x. i0 Transform to relation ε r The calculation formula for public spaces is as follows:

[0099]

[0100] in, It is node v i In a specific relationship ε r Mapping features on Let represent a d-dimensional column vector with d eigenvalues, each of which is a real number. σ(·) is the ReLU activation function. Let ε represent the weight matrix and bias matrix, respectively. r Learnable parameters.

[0101] S222: Obtain Next, we calculate edge features and perform edge feature enhancement. We then process node v... i As an anchor node, for anchor node v i neighbor node v j ,side (v i v j )feature The following formula can be used directly for calculation:

[0102]

[0103] in, Represents node v j In a specific relationship ε r Mapping features on.

[0104] Therefore, edge (v) i v j Enhanced features It can be obtained from the following formula:

[0105]

[0106] Where tanh(·) is the tanh activation function. Reflecting anchor node v i ε under a specific relationship r The rich information on the edge.

[0107] Calculate anchor node v i In a specific relationship ε r Down and any neighbor node v k The edge (v) i v k Enhanced features

[0108] S23: Construct an attention-based feature fusion module.

[0109] After obtaining the enhanced feature representations of each edge under different relationships, it is necessary to aggregate the information of the node's first-order relation neighbors. First-order relation neighbors typically refer to neighboring nodes directly connected to the node. Aggregation operations on adjacent node features result in a smooth transition of node features, lacking discriminative power. Furthermore, this simple summation operation ignores the correlation between adjacent nodes and cannot adaptively update the node's feature representation. To address this limitation, we employ a self-attention mechanism, which aggregates information from all neighbors and captures their distinct features.

[0110] S231: Use reinforced edge representation to compute the importance score of a node's first-order relation neighbors. Specifically, For anchor node v i In subgraph The first-order relation neighbor set in the , given the center node v i and his neighbors Then for the central node v i Neighbor v j Importance score:

[0111]

[0112] in a r It is a learnable weight vector. Indicates a r The dimension; It is a transformation matrix. W r The dimension; ||(·) represents the vector concatenation operation.

[0113] S232: For v i node v j Attention coefficient This can be obtained by normalizing the importance scores of all neighbors; the higher the attention coefficient, the stronger the neighbor's importance score. jWith the central node v i The more similar they are, the stronger the association.

[0114]

[0115] Here, LeakyReLU(·) represents the activation function. Indicates v i The set of neighbors of a node. k express Any node in the middle, This means for v i node v k Attention coefficient.

[0116] S233: In order to effectively capture hierarchical information in multidimensional features, we extend the self-attention mechanism by introducing a multi-head attention method.

[0117] S2331: In each hidden layer, K independent attention mechanisms are used, and the resulting K representation parts are concatenated to generate the central node v. i In relation ε r Embedded representation As shown below:

[0118]

[0119] in, Let j represent the neighbor node of the k-th head. Let represent the attention coefficient of the k-th head neighbor node j; k represents the current attention head, σ represents the ReLU activation function, and k represents the number of multi-head attention;

[0120] S2332: In the output layer, multi-head attention is averaged instead of concatenated to maintain the model's sensitivity in generating the central node v. i In relation ε r Embedded representation The calculation formula is as follows:

[0121]

[0122] Where σ represents the ReLU activation function.

[0123] S24: Construct the enhanced gate logic module.

[0124] To improve the effectiveness and robustness of the model, a gating strategy is adopted after the multi-head attention mechanism to balance the strength of the aggregated representation and the enhanced embedding representation. That is, in the actual network, the feature representation after entity interaction is weighted and fused with the original features before interaction in order to appropriately retain the key information in the original features.

[0125] S241: Specifically, by using relation ε r Below, the central node v i Edge augmentation representation with all neighboring nodes By averaging, node v can be calculated. i Global enhancement features The following formula:

[0126]

[0127] in, Represents node v i In relation ε r The total number of neighboring nodes.

[0128] S242: In order to capture and retain key information in the original features, the model considers the central node v i In relation ε r Embedded representation and global enhancement features The model uses a central node v i Adaptive weights To balance The importance of each other is calculated using the following formula:

[0129]

[0130] in It is a learnable weight vector. σ represents the dimension of the weight vector; σ(·) represents the sigmoid activation function. Indicates the central node v i The update features retain the original information.

[0131] S243: Repeat S221~S232, calculate node v i Update features under different relationships.

[0132] S25: Relationship-aware aggregation. In real-world networks, multiple relationships can be captured, forming complex heterogeneous graphs. However, a single relationship can form a homogeneous graph. Therefore, we process each relationship separately and finally fuse them to form the final representation of a single node in the heterogeneous graph.

[0133] After obtaining the updated features under different relations, we concatenate all the embedded features and transform them into low-dimensional embedded features. This process ultimately produces the anchor node v. i low-dimensional embedding features h i :

[0134]

[0135] in, It is a learnable weight vector. The dimension representing the splicing features; Indicates the central node v i splicing features under multiple relationships.

[0136] S3: Construct the model loss function.

[0137] Based on the above operations, the model can obtain embedded representations of nodes. However, some fraudsters may exhibit deceptive behavior, only receiving information from benign nodes, which can lead to deceptiveness and inconsistent potential behavior, deviating from the expected fraudster characteristics. Therefore, without prior experience, each layer of our model may struggle to extract valuable information from the ambiguous representations. To address this issue, we develop a layer-aware enhancement feature optimization mechanism. This approach serves two main purposes. First, relying solely on the final classification loss may make it difficult for the model parameters to extract accurate features. However, through this mechanism, we can iteratively filter features layer by layer using labeled data, thereby capturing the unique and accurate identity of the fraudster. This approach ultimately increases inter-class spacing and reduces intra-class spacing. Second, integrating this optimization mechanism into our model architecture is straightforward. In this way, the model can learn as many valuable features as possible at each layer, thereby improving the accuracy of fraud detection.

[0138] S31: Specifically, in each hidden layer l, each node is computed. For a set of nodes; embedding features at the l-th (l≤L) layer. Subsequently, we normalize the features, and at each layer, we apply cross-entropy loss. To minimize node v i and its corresponding label y i The distance between them, while maximizing node v i The difference between the label and its opposite label. Finally, the model calculates the average loss across all layers. As described below:

[0139]

[0140] in, y represents the normalized node features of the output. i Represents node v i The tag value.

[0141] S32: In the output layer, the model's output will be used as node v i The final representation.

[0142] Calculate the cross-entropy loss of the output layer Combining labeled data:

[0143]

[0144] in Represents node v i Embedded representation in the output layer y represents the normalized features output by the model's output layer and the loss function value of the output layer, respectively. i Indicates the node label.

[0145] In summary, the total loss function of our model The formula is as follows, where γ is the balance coefficient.

[0146]

[0147] S4: Training the model. To mitigate the impact of imbalanced samples during training, we employed undersampling techniques. Specifically,

[0148] S41: First, identify all fraudulent nodes in the training set. Then, randomly select the same number of nodes from the benign nodes as the fraudulent nodes. Merge the randomly selected benign nodes with all the fraudulent nodes to form a balanced training set. This is done to ensure that the number of fraudulent and benign nodes in the training set is equal, thereby mitigating the problem of class imbalance.

[0149] S42: Then, preset the maximum number of iterations, learning rate, weight decay value, number of multi-head attention K, number of model layers L, dropout rate, node embedding dimension, and balance coefficient.

[0150] S43: Input these selected nodes into the detection model and calculate the total loss. The model's built-in learnable parameters are updated using backpropagation to minimize the total loss. Then repeat the iterative training until the model converges or reaches the predetermined number of training rounds.

[0151] S5: Use the trained detection model to perform fraud detection and output the detection results of entities.

[0152] Treating fraud detection as a binary classification task on graph nodes, the model outputs two label classes, 0 and 1. Label 1 indicates that the target node is a fraudster, while label 0 indicates that it is a benign user.

[0153] The inventive point of this invention:

[0154] Most existing GNN-based methods neglect the valuable information embedded in the edges connecting nodes. Specifically, anchor nodes interact with various types of neighbors, and each connection carries rich information about both the source and target nodes. These structural representations in the latent common space not only reflect the distinct attributes of each anchor node but also contain latent categorical features. Therefore, these connection representations can provide rich feature information during the aggregation process, thus aiding in the detection of fraud patterns. Our method emphasizes the importance of leveraging edge information to improve intra-graph message propagation.

[0155] 1. First, an edge-based feature enhancement module is proposed, which enhances edge representation by aggregating the features of the center node and its neighbors.

[0156] 2. Secondly, in order to determine the attention weight of each neighbor during message passing, the model combines node features and edge information to calculate the weight of different neighbors.

[0157] 3. Furthermore, a multi-head attention mechanism is employed to capture subtle features of the node representations. Then, a gate logic mechanism is used to adaptively integrate the enhanced features into the information node representations.

[0158] 4. At the same time, considering that there are many different types of relationships in the data, the model aggregates features under different relationships to obtain the final node representation.

[0159] 5. In order to distinguish different types of nodes, this paper adopts a layer-by-layer perception optimization strategy to provide prior guidance.

[0160] Test the model using the trained model:

[0161] Comprehensive experiments were conducted on two real-world datasets to demonstrate the effectiveness of our proposed model.

[0162] Extensive experiments were conducted on two public fraud detection datasets: the YelpChi (Yelp for short) dataset and the Amazon dataset, to evaluate the performance of the GE-GNN method. The YelpChi dataset includes hotel and restaurant reviews from Yelp, which can perform spam review detection tasks. Each review consists of 32 handcrafted features, including three relationships: 1) RUR represents reviews posted by the same user; 2) RSR represents reviews with the same star rating under the same product; 3) RTR represents reviews under the same product posted in the same month.

[0163] The Amazon dataset contains product reviews under the musical instrument category. Nodes in the Amazon dataset graph represent users, with each user node having 25 manually selected features. Similar to the YelpChi dataset, it includes three types of relationships: 1) UPU represents users who have reviewed at least one of the same products; 2) USU represents users who have given at least one recommendation with the same star rating within a week; and 3) UVU represents users in the top 5% of mutual review text similarity. The dataset statistics are shown in Table 1.

[0164] We further investigated the characteristics of these two datasets. As shown in Table 1, Fraudster% represents the fraudster percentage in the dataset. Only 14.53% and 9.5% of the data in the Yelp and Amazon datasets, respectively, are fraudsters.

[0165] Table 1. Yelp and Amazon dataset parameters

[0166]

[0167] Regarding relation type imbalance, we focus on two typical relation types, consisting of same-family connections and different-family connections. Specifically, same-family connections include NN (connections between benign users) and FF (connections between fraudsters), while different-family connections include NF (connections between benign users and fraudsters). We have conducted detailed statistical analysis on these three types of connections, such as... Figure 2a The number of each of the three types of relationships in the Yelp dataset. Figure 2b Let's consider the number of each of the three types of connection relationships in the Amazon dataset. First, in both datasets, we can see that NN connections dominate, while FF connections are in the minority. This extreme imbalance makes distinguishing between benevolent users and fraudsters more complex. Furthermore, the distribution of connection types varies greatly across different relationships. For example, Figure 2a In the Yelp dataset, the number of FF and NN connections under RSR relationships are 88,406 and 2,539,220 respectively, highlighting the substantial impact of connection type on fraud detection. Similarly, the proportion of the same connection can vary significantly across different relationships. For example, the Yelp dataset contains 775,117 NF edges under RSR relationships but only 176 under RUR relationships. This observation suggests that all connection types contribute uniquely to fraud detection. Therefore, this provides valuable insights for a comprehensive analysis of dataset features and contributes to developing more effective approaches to address this challenge.

[0168] We selected eight state-of-the-art GNN-based methods to validate the practicality of our model. We divided the baseline methods into three groups: traditional GNNs, augmented GNNs, and GNN-based fraud detection methods. Traditional GNNs include GCN, SGC, and GAT; augmented GNNs include FAGCN and GPRGNN; and GNN-based fraud detection methods include GraphConsis, CARE-GNN, and PC-GNN.

[0169] For GE-GNN, the learning rate was set to 0.1 and the weight decay to 0.00005 to avoid oscillations during training, thus ensuring the model converges to better results. The dimension of the original node features was set to 8, and the number of heads was 4. We used 2 layers (L) and ran for 1000 epochs. To avoid overfitting, based on extensive experimental experience, the dropout rate for GE-GNN was set to 0.5. Based on ablation experiments, the balance coefficient γ was set to 1.2. The Adam optimizer was used for model optimization.

[0170] For baseline methods, they were implemented using the Depth Graphics Library (DGL) or source code provided by their respective authors. The GE-GNN proposed in this invention is implemented using PyTorch. All methods were executed in a Python 3.9.12 environment using a single NVIDIA A40 GPU, 40GB of RAM, and a 2.60GHz Xeon(R) Gold 6240 CPU.

[0171] The two public fraud detection datasets inherently exhibit imbalance, and the detection objective is to identify the minority of fraudsters (positive samples). In this paper, we employ three evaluation metrics: AUC, F1-macro, and Recall, with Recall being the most important for fraud detection.

[0172] We conducted a comparative analysis of the proposed GE-GNN with eight state-of-the-art baseline methods. Table 2 shows the corresponding recall, AUC, and F1 macro score, with the best results highlighted in bold. Based on these results, the following observations can be drawn.

[0173] Table 2 Performance test results of the baseline method and the method of the present invention

[0174]

[0175] In traditional GNNs, GAT outperforms GCN and SGC. This is because GAT uses an attention mechanism to evaluate the importance of neighboring nodes to the central node. Since GCN and SGC use an equal-weight strategy to assign weights to all neighboring nodes during graph convolution operations, this simplification differs from real-world scenarios, resulting in lower recognition performance. This highlights the importance of using attention mechanisms to propagate information between anchor nodes and their neighbors in graph data processing. Notably, SGC's recall on the Yelp dataset is less than 0.01, meaning it fails to capture valid and distinctive features of fraudsters and cannot correctly identify them. Enhanced GNN methods consistently outperform traditional GNNs, indicating that improved GNNs can better learn embeddings and capture more representative information. Compared to traditional GNNs, enhanced GNNs focus on leveraging the homogeneity and heterogeneity of connections between nodes; clearly, integrating additional edge information helps the model more accurately identify fraudsters. On the Yelp dataset, we observe that FAGCN outperforms GPRGNN in recall but performs poorly on other metrics. This indicates that FAGCN is more sensitive to fraudster detection than GPRGNN, but may exhibit relatively lower overall recognition performance. This is because the self-gating mechanism applied in FAGCN is more effective in identifying fraudsters on the Yelp dataset. However, observations on the Amazon dataset show the opposite, indicating that model performance is also affected by dataset features. GNN-based fraud detection models are specifically designed to address the challenge of imbalanced sampling in fraud detection. Therefore, they generally outperform traditional GNNs and achieve performance comparable to augmented GNNs. PC-GNN outperforms other GNN-based fraud detection models on most metrics, primarily due to its strategy of significantly reducing negative samples during training. Compared to augmented GNNs, PC-GNN outperforms GPRGNN and FAGCN in F1 macro score on the Yelp dataset, but performs worse in recall. This suggests that PC-GNN is less accurate in detecting fraudsters than augmented GNNs. This is because PC-GNN randomly selects samples, which may overlook important information. Compared to all baseline results, the inventive method GE-GNN demonstrates superior performance on most metrics, validating the effectiveness of our model in addressing the fraud detection challenge. Specifically, compared to GCN, GE-GNN significantly improves performance on all metrics on the Yelp dataset by 37.42%, 14.70%, and 26.18%, respectively, and on the Amazon dataset by 23.79%, 20.91%, and 16.16%. Although the improvement in metrics is slightly lower compared to enhanced GNNs and GNN-based fraud detection models, it is still substantial. Furthermore, we observe variations in the performance improvement of the inventive method across different datasets.For example, on the Yelp dataset, our model shows improvements of 23.96%, 1.85%, and 8.36% in Recall, F1 macro score, and AUC, respectively, compared to PC-GNN, while on the Amazon dataset, the improvements are 8.97%, -2.36%, and 2.00%, respectively. The average improvement of our method on the Yelp and Amazon datasets is 11.39% and 2.87%, respectively, indicating a significantly higher improvement on the Yelp dataset. However, on the Amazon dataset, we note that our model outperforms the baseline method on most metrics except for the F1 macro score. This difference may be due to benign samples being incorrectly classified as fraudsters.

[0176] We use the Yelp dataset as an illustrative example to visualize the node embeddings of several selected models. Specifically, we compare the performance of the proposed GE-GNN with GCN, GAT, and CARE-GNN. First, we obtain the node representation for each model in a 32-dimensional vector space, and then we use t-SNE to project the 32-dimensional embeddings into a 2-dimensional space for visualization. Experimental results are as follows: Figure 3 As shown.

[0177] Generally, insights can be gleaned from visualizations. Our results demonstrate that GE-GNN outperforms the selected baseline methods in distinguishing between fraudulent and legitimate nodes. Specifically, the embeddings trained by the selected baseline lack clear boundaries to differentiate node types. In contrast, the embeddings generated by GE-GNN effectively cluster fraudsters into a compact group, successfully isolating them from the majority of benign nodes.

[0178] In summary, the method of the present invention has the best performance.

[0179] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0180] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A fraud detection method based on edge information enhanced graph neural network, characterized in that, Includes the following steps: S1: Construct a training set, which includes entities in the social network, the characteristics of the entities, and the types of relationships between the entities; S2: Construct the detection model; S3: Construct the model loss function; S4: Train the detection model using the training set of S1; S5: Use the trained detection model to perform fraud detection and output the detection results of entities; S2 includes: In fraud detection, Relational Heterogeneous Directed Graph From the set of nodes Node feature set Edge type set Composition, represented as , where the set of nodes Nodes represent entities in a social network. It refers to the number of nodes and the set of node features. ,in, Indicates the first The original feature vectors of each node, It is the dimension of the feature space. The dimension is The real number space; the edge set is the set of relation types. An edge represents a specific relationship between entities in a social network. Depend on Different kinds of relationships constitute, Each element Indicates the first Edge sets under certain relations; A relational heterogeneous directed graph yes Isomorphic subgraphs The combination of is represented as Indicates the relation The isomorphic subgraph formed, 1≤ r≤R ; S21: The detection model includes One hidden layer and one output layer; Perform the following operations in each hidden layer and output layer: S22: Construct edge-based enhancement modules; S23: Construct an attention-based feature fusion module; S24: Construct the enhanced gate logic module; S25: Obtain the final representation of each node in the heterogeneous graph; S22 includes: S221: In the edge-based enhancement module, for a specific relation... Nodes in Introducing a linear layer to transform the original features Transform to relation The calculation formula for public spaces is as follows: in, It is a node In a specific relationship Mapping features on, Represent a A column vector of dimension, a column vector has There are eigenvalues, each of which is a real number. yes Activation function Let these represent the weight matrix and the bias matrix, respectively, both of which are relational. Learnable parameters; S222: Move the node As the central node, for the central node neighboring nodes ,side Features The calculation formula is as follows: in, Represents a node In a specific relationship Mapping features on; side Enhanced features The calculation formula is as follows: in, yes Activation function; Computing central node In a specific relationship Down and any neighboring node edge Enhanced features ; S23 includes: S231: In the attention-based feature fusion module, for the central node Neighbor nodes The importance score is: in It is a learnable weight vector. express The dimension; It is a transformation matrix. express The dimension; This represents a vector concatenation operation. As the central node In subgraph The set of first-order relation neighbors in the; S232: Obtain the importance score for the central node by normalizing the importance scores of all neighboring nodes. Neighbor nodes Attention coefficient The calculation formula is as follows: in, This represents the activation function. express Any node in the middle, This indicates that for the central node Neighbor nodes Attention coefficient; S23 further includes: S233: Introducing multi-head attention methods to expand the self-attention mechanism, including: S2331: In each hidden layer, K independent attention mechanisms are used to generate the central node. In relation Embedded representation The calculation formula is as follows: in, Indicates the first Head node In a specific relationship Mapping features on, Indicates the first Head neighbor node Attention coefficient; Indicates the current attention head. Represents the ReLU activation function. Indicates the amount of attention from multiple parties; Indicates a splicing operation; S2332: In the output layer, the results of the multi-head attention are averaged to generate the center node. In relation Embedded representation The calculation formula is as follows: ; S24 includes: S241: In the enhancement gate logic module, the relation Below, central node Edge augmentation representation with all neighboring nodes Perform averaging and calculate nodes. Global enhancement features The calculation formula is as follows: in, Represents a node In relation The total number of neighboring nodes; S242: Using a central node Adaptive weights To balance The importance of each other is calculated using the following formula: in, It is a learnable weight vector. Indicates the dimension of the weight vector; express Activation function Representing relations Below, central node Update features; S243: Repeat S221~S242, calculate nodes. Update features under different relationships; S3 includes: S31: In each hidden layer In the middle, the central node of the calculation In the hidden layer Embedded features Given the total number of hidden layers, then... Normalization is performed, and cross-entropy loss is used to minimize the node. and their corresponding tags The distance between them, while maximizing the node The difference between the labels and their opposites is used to calculate the average loss across all layers. The calculation formula is as follows: in, Indicates hidden layer The output is normalized node features. Represents a node The tag value, Indicates hidden layer Cross-entropy loss, Represents a node The opposite label value; S32: In the output layer, calculate the central node. Embedding features And calculate the cross-entropy loss of the last layer. The calculation formula is as follows: in, The normalized features of the output layer, i.e., the nodes. The final expression, This represents the loss function of the output layer; Total loss function The calculation formula is as follows: in, It is the balance coefficient; S33: Repeat S221~S32 to obtain the final representation of each node in the heterogeneous graph.

2. The fraud detection method based on edge information-enhanced graph neural networks according to claim 1, characterized in that, S25 includes: All nodes The updated features under different relationships are concatenated and transformed into low-dimensional embedded features to generate the central node. Low-dimensional embedding features The calculation formula is as follows: in, It is a learnable weight vector. The dimension representing the splicing features; Indicates the central node splicing features under all relationships.

3. The fraud detection method based on edge information-enhanced graph neural networks according to claim 1, characterized in that, S4 includes: S41: Determine all fraudulent nodes in the training set, then randomly select the same number of nodes as the fraudulent nodes from the benign nodes, and merge the randomly selected benign nodes with all the fraudulent nodes to form a balanced training set; S42: Preset maximum number of iterations, learning rate, weight decay value, and number of multi-head attention points. Number of model layers Dropout rate, node embedding dimension, balance coefficient; S43: Input the nodes selected in S41 into the detection model and calculate the total loss. The model's built-in learnable parameters are updated using backpropagation to minimize the total loss. Repeat the iterative training until the predetermined number of training rounds is reached.

Images