Link mode aggregated graph fraud risk identification method and system

Abstract

The invention discloses a graph fraud risk identification method and system based on link mode aggregation. The method comprises the following steps: 1) constructing a relational network graph; the method comprises the following steps of (1) data acquisition, (2) variable-length link sampling, (3) position-associated unified link coding, (4) link information interaction and aggregation and (5) aggregation-associated fraud detection.By means of long-distance link sampling and coding and link information interaction and aggregation, the defects of a mainstream GNN algorithm in the aspect of processing a long-range dependency graph structure are effectively overcome.

Description

Technical Field

[0001] The present invention and a link mode aggregated graph fraud risk identification method and system belong to the field of information technology. Background Art

[0002] With the continuous evolution of information technology, the three-way interaction and integration between information network space, human social space and physical space has become increasingly intensified, resulting in a significant spillover of risks in information space to human society and physical space, and the phenomenon has become increasingly serious. Due to the sharp increase in fraud incidents, fraud detection has become an increasingly prominent research field.

[0003] Traditional expert rule methods can identify some common fraud patterns by analyzing and modeling data. However, expert rules lack universality for different fraud scenarios. Therefore, the introduction of artificial intelligence technology has become a new idea to solve the fraud problem. As an important branch of artificial intelligence technology, deep learning has powerful data processing and pattern recognition capabilities, and shows great potential for fraud detection. Considering the intricate dependencies and topological structures between nodes in fraud samples, researchers proposed Graph Neural Network (GNN) as a graph deep learning solution.

[0004] As fraudulent behavior gradually presents emerging characteristics such as intelligence, industrialization, and high concealment, the current deep graph neural network algorithms have become increasingly difficult to meet the accuracy requirements of fraud detection. For the research on fraud detection, the main difficulties of this problem are: (1) Entities between fraudulent samples usually have high-order interactions. Fraudulent behavior is not composed of a single entity or a simple relationship, but is formed by multiple entities through complex interactions. This high-order interaction relationship makes the identification and detection of fraudulent behavior more difficult, because it is necessary to consider multiple entities and their relationships at the same time, and how these relationships work together on fraudulent behavior. (2) The dependencies between fraudulent samples are intricate. These dependencies may be implicit or explicit, and together they constitute a complex network of fraudulent behavior. In this complex dependency, the change of one entity may affect multiple other entities, thereby changing the pattern of the entire fraudulent behavior. (3) The high concealment of fraudulent samples. Fraudsters may use various means to cover up their fraudulent behavior, such as using false identities, falsifying data, hiding key information, etc. These means make fraudulent behavior appear to be no different from normal behavior on the surface, thereby increasing the difficulty of identification and detection.

[0005] Nevertheless, for traditional graph neural networks, whether GCN, GraphSAGE, or GAT, they all belong to the category of local networks. Their common limitation is that they cannot effectively process graph structures with long-range dependency characteristics. This is because they mainly focus on the information of first-order neighbor nodes, and the use of global information is relatively limited, and they cannot handle tasks of full-graph scale well. In recent years, graph fraud detection technology has made significant progress, which can be mainly divided into two categories: spectral methods and spatial methods. Spectral methods focus on using different frequency components of graph signals to optimize or enhance the ability to capture and process fraud information on the graph. Compared with spectral methods, spatial methods pay more attention to the spatial relationship between nodes, and improve the detection and recognition ability of graph neural networks for fraudulent behaviors and relationships. The above methods have shown excellent performance in previous studies on graph fraud detection. However, in essence, the above methods also only consider low-order neighbor information, and their "receptive field" is relatively limited. For more hidden and complex fraudulent behaviors involving long-range link associations, they are often difficult to deal with effectively. Summary of the invention

[0006] The present invention aims to overcome the above-mentioned shortcomings of the prior art and provide a method and system for identifying graph fraud risks by link mode aggregation.

[0007] The present invention effectively makes up for the shortcomings of mainstream GNN algorithms in processing long-range dependency graph structures through long-distance link sampling encoding, link information interaction and aggregation.

[0008] A first aspect of the present invention provides a method for identifying graph fraud risks of link mode aggregation, comprising the following steps:

[0009] Step 1: Construct a relationship network diagram: For different fraud scenarios, clarify the node set, edge set, node feature set and the relationship between nodes in the scenario, and construct a relationship network diagram, in which the nodes are divided into benign and fraudulent categories;

[0010] Step 2: Sampling links of indefinite length: Starting from each node in the graph, multiple links are randomly sampled. The length of the links and the nodes they pass through are all random. Based on the importance index of the nodes on the links, the top-K links with higher representativeness and information content in characterizing the node connection mode are selected as the most valuable links.

[0011] Step 3: Unified link coding with position association: Links of different lengths selected from the variable-length link sampling are encoded into embedding vectors of the same length; in order to enhance the relative position information of node features in all nodes, a decision tree binning coding method is introduced to group the node attribute value range as the basis for position coding, and the position coding is integrated into link embedding for position labeling and feature denoising;

[0012] Step 4: Link information interaction aggregation: First, the self-attention mechanism between links is used to achieve information interaction, so that link embeddings can transmit and receive information with each other, and then automatically mine the common fraud patterns in the links; it is expected that through this carefully designed information interaction process, the fraudulent links will show a tighter clustering effect in the embedding space; then link aggregation is performed to integrate and refine the information at the link level into a representation at the node level;

[0013] Step 5: Fraud detection of aggregate associations: A fraud detector is introduced, using a layer of discriminant network to identify fraud patterns hidden in the aggregate node representation.

[0014] Preferably, the step 1 specifically includes the following steps:

[0015] S1.1 Order is a relationship network diagram. , , Represent the node set, edge set and node feature set respectively. Represents the node number, , D is the node feature number; is the true label of the node in the relationship network graph G;

[0016] S1.2 Focus on the relationship network diagram in the fraud scenario and divide the nodes in the diagram into two categories: benign and fraudulent. , Representation Node It is a fraud node, otherwise it is a benign node.

[0017] Preferably, the step 2 specifically includes the following steps:

[0018] S2.1 Starting from the randomly sampled nodes, sampling by random walk Links , each link Starting from this node, it contains Nodes connected in sequence;

[0019] S2.2 Define a binary matrix , ,in is an upper triangular matrix of all ones, is the identity matrix, from Randomly and reproducibly sample OK, get , obtain a link of indefinite length by the following operations :

[0020] (1)

[0021] S2.3 The sum of the degree centrality of the nodes that the link passes through is selected as the basis for evaluating the importance of the link. Filter out the top-K most valuable links from the links :

[0022] (2)

[0023] Preferably, the encoding of the links of different lengths selected from the variable-length link sampling into embedded vectors of the same length in step 3 specifically includes the following steps:

[0024] S3.1 For Links , the set of features of all nodes it contains is ;

[0025] S3.2 Features corresponding to the node labeled -1 Fill with all zeros;

[0026] S3.3 Concatenate the link node features in sequence to obtain the link features :

[0027] (3)

[0028] in represents the splicing operation, and the characteristic length of the link after splicing is ;

[0029] S3.4 Reduce the dimension of link features and obtain embedded representation :

[0030] (4)

[0031] in and are the learnable weights and biases, respectively.

[0032] Preferably, in order to enhance the relative position information of node features in all nodes, the decision tree binning encoding method is introduced in step 3, the node attribute value range is grouped as the basis of position encoding, and the position encoding is integrated into link embedding, and position marking and feature denoising are performed, which specifically includes the following steps:

[0033] S3.5 uses node labels as supervision and adopts decision trees to classify the features of each attribute into different leaf nodes, where the number of leaf nodes corresponds to the number of groups and the split condition value determines the range of each group;

[0034] S3.6 Using the trained decision tree for each attribute, sort all the segmentation condition values ​​in ascending order, and then use them to divide the entire range into several mutually exclusive bins. Each attribute has a corresponding bin number, so the position code of each node is obtained. ,in ;

[0035] S3.7 Standardize position codes;

[0036] S3.8 Position code corresponding to the node labeled -1 Fill with all zeros;

[0037] S3.9 Concatenate the link node position codes in sequence to obtain :

[0038] (5)

[0039] in represents the splicing operation, and the length of the link position encoding after splicing is ;

[0040] S3.10 Reduce the dimension of link position encoding to obtain :

[0041] (6)

[0042] in and are the learnable weights and biases respectively;

[0043] S3.11 Add the node feature embedding and position encoding to obtain the final node embedding representation :

[0044]

[0045] Preferably, the step 4 specifically includes the following steps:

[0046] S4.1 For a certain node, first stack the embeddings of all links starting from the node, and get :

[0047] (7)

[0048] S4.2 Implement the self-attention mechanism between link embeddings to obtain the updated embedding representation :

[0049] (8)

[0050] (9)

[0051] in, , and is a learnable transformation weight matrix;

[0052] S4.3 Link information exchange part outputs the embedding of all links starting from a single node , aggregated to obtain :

[0053] (10)

[0054] in Represents the aggregation operation, using average aggregation, and the features after aggregation Embed as updated node.

[0055] Preferably, the step 5 specifically includes the following steps:

[0056] S5.1 Through link aggregation, the updated nodes are embedded into This is fed into a fraud detector, which uses a layer of a discriminant network to produce a prediction value , represents the probability that a node is predicted to be fraudulent:

[0057] (11)

[0058] S5.2 Link information interaction does not require any supervisory signal, and the model ultimately outputs the probability that each node is fraudulent , tagged as , construct binary cross entropy loss :

[0059] (12)

[0060] S5.3 uses back-propagation gradient descent to optimize model parameters.

[0061] A second aspect of the present invention relates to a link mode aggregation graph fraud risk identification system, comprising:

[0062] The relationship network diagram construction module, for different fraud scenarios, clarifies the node set, edge set, node feature set and the relationship between nodes in the scenario, and constructs a relationship network diagram, in which the nodes are divided into two categories: benign and fraudulent;

[0063] The variable-length link sampling module takes each node in the graph as the starting point and randomly samples multiple links. The length of the link and the nodes it passes through are all random. According to the importance index of the nodes on the link, the top-K links with higher representativeness and information content in characterizing the node connection mode are selected as the most valuable links.

[0064] The position-associated unified link encoding module encodes links of different lengths selected from the variable-length link sampling into embedding vectors of the same length. In order to enhance the relative position information of node features among all nodes, the decision tree binning encoding method is introduced to group the node attribute value range as the basis for position encoding, and the position encoding is integrated into the link embedding for position labeling and feature denoising.

[0065] The link information interaction aggregation module first uses the self-attention mechanism between links to achieve information interaction, so that link embeddings can transmit and receive information with each other, and then automatically mine the common fraud patterns in the links. It is expected that through this carefully designed information interaction process, the fraudulent links will show a tighter clustering effect in the embedding space. Then, link aggregation is performed to integrate and refine the information at the link level into the representation at the node level.

[0066] The aggregate-associated fraud detection module introduces a fraud detector that uses a layer of discriminant network to identify fraud patterns hidden in the aggregate node representation.

[0067] The third aspect of the present invention relates to a device for identifying graph fraud risks through link mode aggregation, comprising a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement a method for identifying graph fraud risks through link mode aggregation of the present invention.

[0068] A fourth aspect of the present invention relates to a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements a link mode aggregated graph fraud risk identification method of the present invention.

[0069] The working principle of the present invention is: first, starting from a certain node, a number of links of different lengths are sampled through random walks, and these links may contain common fraud patterns. Furthermore, a batch of high-quality links are selected by further screening the links according to the importance of the links. Then, all links are encoded to obtain an embedded representation with uniform length and position association. Next, global link information interaction and similarity comparison are performed to explore the common laws between fraud links in order to more comprehensively reveal the association patterns between fraudulent behaviors, and then the links are aggregated after similarity weighting as the features of the central node. Finally, based on the aggregated associated features, fraud detection at the node level is achieved.

[0070] The innovation of the present invention is that the common rules between fraud links are mined through global pattern interaction and similarity comparison between several links starting from the node, so as to more comprehensively reveal the correlation patterns between fraud behaviors, and then realize fraud detection through link aggregation.

[0071] The advantages of the present invention are: it adopts long-distance link sampling encoding, link information interaction and aggregation, and targets the characteristics of high-order interaction, complex dependencies and high concealment of fraud entities in fraud scenarios, thus making up for the deficiency that the mainstream GNN algorithm cannot handle long-range dependency graph structures. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 is a flow chart of the method of the present invention.

[0073] Figure 2 It is a framework diagram of the method of the present invention.

[0074] Figure 3 The present invention is a flow chart of unified link coding for location association of the method of the present invention.

[0075] Figure 4 It is a link information interaction aggregation flow chart of the method of the present invention.

[0076] Figure 5 It is a structural schematic diagram of the device of the present invention. DETAILED DESCRIPTION

[0077] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0078] Embodiment 1:

[0079] This embodiment discloses a method for identifying risk of graph fraud by link mode aggregation, such as Figure 1 and Figure 2 As shown in the figure, a graph fraud risk identification method based on link pattern aggregation is constructed from the following four steps to perform fraud detection: first, building a relationship network graph; second, sampling links of indefinite length; third, unified link encoding associated with location; fourth, interactive aggregation of link information; and fifth, fraud detection associated with aggregation.

[0080] 1. Construct a relationship network diagram: For different fraud scenarios, clarify the node set, edge set, node feature set and the relationship between nodes in the scenario, and construct a relationship network diagram in which the nodes are divided into benign and fraudulent categories.

[0081] S1.1 Order is a relationship network diagram. , , Represent the node set, edge set and node feature set respectively. Represents the node number, , is the node feature number; It is a relationship network diagram The true label of the node;

[0082] S1.2 Focus on the relationship network diagram in the fraud scenario and divide the nodes in the diagram into two categories: benign and fraudulent. , Representation Node It is a fraud node, otherwise it is a benign node.

[0083] 2. Sampling of links of indefinite length: Starting from each node in the graph, multiple links are randomly sampled. The length of the links and the nodes they pass through are all random. Based on the importance index of the nodes on the links, the Top-K links with higher representativeness and information content in characterizing the node connection pattern are selected as the most valuable links.

[0084] S2.1 Starting from the randomly sampled nodes, sampling by random walk Links , each link Starting from this node, it contains Nodes connected in sequence;

[0085] S2.2 Define a binary matrix , ,in is an upper triangular matrix of all ones, is the identity matrix, from Randomly and reproducibly sample OK, get , obtain a link of indefinite length by the following operations :

[0086] (1)

[0087] S2.3 The sum of the degree centrality of the nodes that the link passes through is selected as the basis for evaluating the importance of the link. Filter out the top-K most valuable links from the links :

[0088] (2)

[0089] 3. Unified link coding associated with position: Links of different lengths selected from the variable-length link sampling are encoded into embedding vectors of the same length; in order to enhance the relative position information of node features in all nodes, the decision tree binning encoding method is introduced to group the node attribute value range as the basis for position coding, and the position coding is integrated into link embedding for position labeling and feature denoising, such as Figure 3 .

[0090] S3.1 For Links , the set of features of all nodes it contains is ;

[0091] S3.2 Features corresponding to the node labeled -1 Fill with all zeros;

[0092] S3.3 Concatenate the link node features in sequence to obtain the link features :

[0093] (3)

[0094] in represents the splicing operation, and the characteristic length of the link after splicing is ;

[0095] S3.4 Reduce the dimension of link features and obtain embedded representation :

[0096] (4)

[0097] in and are the learnable weights and biases, respectively.

[0098] S3.5 uses node labels as supervision and adopts decision trees to classify the features of each attribute into different leaf nodes, where the number of leaf nodes corresponds to the number of groups and the split condition value determines the range of each group;

[0099] S3.6 Using the trained decision tree for each attribute, sort all the segmentation condition values ​​in ascending order, and then use them to divide the entire range into several mutually exclusive bins. Each attribute has a corresponding bin number, so the position code of each node is obtained. ,in ;

[0100] S3.7 Standardize position codes;

[0101] S3.8 Position code corresponding to the node labeled -1 Fill with all zeros;

[0102] S3.9 Concatenate the link node position codes in sequence to obtain :

[0103] (5)

[0104] in represents the splicing operation, and the length of the link position encoding after splicing is ;

[0105] S3.10 Reduce the dimension of link position encoding to obtain :

[0106] (6)

[0107] in and are the learnable weights and biases respectively;

[0108] S3.11 Add the node feature embedding and position encoding to obtain the final node embedding representation :

[0109]

[0110] 4. Link information interaction aggregation: First, the self-attention mechanism between links is used to realize information interaction, so that link embeddings can transmit and receive information to each other, and then automatically mine the common fraud patterns in the links; it is expected that through this carefully designed information interaction process, the fraudulent links will show a tighter clustering effect in the embedding space; then link aggregation is performed to integrate and refine the information at the link level into the representation at the node level, such as Figure 4 .

[0111] S4.1 For a certain node, first stack the embeddings of all links starting from the node, and get :

[0112] (7)

[0113] S4.2 Implement the self-attention mechanism between link embeddings to obtain the updated embedding representation :

[0114] (8)

[0115] (9)

[0116] in, , and is a learnable transformation weight matrix;

[0117] S4.3 Link information exchange part outputs the embedding of all links starting from a single node , aggregated to obtain :

[0118] (10)

[0119] in Represents the aggregation operation, using average aggregation, and the features after aggregation Embed as updated node.

[0120] 5. Fraud detection with aggregate association: A fraud detector is introduced, which uses a layer of discriminant network to identify fraud patterns hidden in the aggregate node representation.

[0121] S5.1 Through link aggregation, the updated nodes are embedded into This is fed into a fraud detector, which uses a layer of a discriminant network to produce a prediction value , represents the probability that a node is predicted to be fraudulent:

[0122] (11)

[0123] S5.2 Link information interaction does not require any supervisory signal, and the model ultimately outputs the probability that each node is fraudulent , tagged as , construct binary cross entropy loss :

[0124] (12)

[0125] S5.3 uses back-propagation gradient descent to optimize model parameters.

[0126] Embodiment 2:

[0127] This embodiment relates to a social network fraud identification method using a link pattern aggregation graph fraud risk identification method of embodiment 1, such as Figure 2 The flowchart of the method for identifying fraud risk by graph aggregation of link patterns in a social network scenario is shown. The method for identifying fraud risk by graph aggregation of link patterns is constructed from the following four steps and fraud detection is performed: first, constructing a social relationship network graph; second, sampling social network links of indefinite length; third, uniform social network link encoding associated with location; fourth, interactive aggregation of social network link information; and fifth, detection of social network fraud by aggregation association. The specific implementation steps are the same as those in Example 1.

[0128] This example uses the T-Social dataset in a social network fraud scenario for verification. The T-Social dataset is designed to find abnormal accounts in social networks. It has 5.78 million nodes and 150 million edges. The training set, validation set, and test set are divided into 40.00%, 20.00%, and 40.00% respectively.

[0129] In this embodiment, in the social network fraud scenario, a graph fraud risk identification method based on link mode aggregation is compared with the traditional GNN model, spectral method and spatial method. The traditional GNN model not only considers the characteristics of the node itself, but also incorporates the information of the neighboring nodes. It usually perceives the local connection pattern by aggregating the information of the first-order neighbors to obtain more useful information. In this embodiment, two classic models, GCN and GAT, are selected. The difference between them lies in the calculation method of the weight of the neighboring nodes. GCN comprehensively considers the in-degree and out-degree, while GAT uses the attention mechanism. In addition, a graph fraud risk identification method based on link mode aggregation is also compared with the currently advanced spectral method and spatial method. Spectral methods include BWGNN and GHRN, and spatial methods include CARE-GNN, RioGNN and GDN. The spectral method involves the use of different frequency components of the graph signal. By means of adaptively combining multi-frequency signals, analyzing the spectral energy distribution and using label-aware edge indicators, a specific mechanism can be designed to optimize or enhance the capture and processing capabilities of fraud information on the graph. Spatial methods focus on the spatial relationship between nodes, and improve the detection and recognition capabilities of graph neural networks for fraudulent behaviors and relationships by using label-aware similarity metrics, reinforcement learning to select neighbors, cross-relationship aggregation, the introduction of heterogeneous networks, and new information aggregation strategies. These methods have shown good performance in previous graph fraud detection work.

[0130] Considering the imbalance of positive and negative samples in the fraud dataset, the evaluation index should take into account both precision and recall. This example uses AUC and AP as two evaluation indicators to evaluate the performance of the anti-fraud model. The verification results are as follows:

[0131]

[0132] Example 3

[0133] This embodiment relates to a link mode aggregation graph fraud risk identification system, which is used to implement a link mode aggregation graph fraud risk identification method of embodiment 1, including:

[0134] The relationship network diagram construction module, for different fraud scenarios, clarifies the node set, edge set, node feature set and the relationship between nodes in the scenario, and constructs a relationship network diagram, in which the nodes are divided into two categories: benign and fraudulent;

[0135] The variable-length link sampling module takes each node in the graph as the starting point and randomly samples multiple links. The length of the link and the nodes it passes through are all random. According to the importance index of the nodes on the link, the top-K links with higher representativeness and information content in characterizing the node connection mode are selected as the most valuable links.

[0136] The position-associated unified link encoding module encodes links of different lengths selected from the variable-length link sampling into embedding vectors of the same length. In order to enhance the relative position information of node features among all nodes, the decision tree binning encoding method is introduced to group the node attribute value range as the basis for position encoding, and the position encoding is integrated into the link embedding for position labeling and feature denoising.

[0137] The link information interaction aggregation module first uses the self-attention mechanism between links to achieve information interaction, so that link embeddings can transmit and receive information with each other, and then automatically mine the common fraud patterns in the links. It is expected that through this carefully designed information interaction process, the fraudulent links will show a tighter clustering effect in the embedding space. Then, link aggregation is performed to integrate and refine the information at the link level into the representation at the node level.

[0138] The aggregate-associated fraud detection module introduces a fraud detector that uses a layer of discriminant network to identify fraud patterns hidden in the aggregate node representation.

[0139] Example 4

[0140] like Figure 5 This embodiment relates to a link mode aggregated graph fraud risk identification device, including a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, it is used to implement a link mode aggregated graph fraud risk identification method of Example 1.

[0141] Example 5

[0142] This embodiment relates to a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, a link mode aggregation graph fraud risk identification method of embodiment 1 is implemented.

[0143] Each embodiment of the present invention is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0144] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for identifying graph fraud risks based on link mode aggregation, comprising the following steps: Step 1: Construct a relationship network diagram: For different fraud scenarios, clarify the node set, edge set, node feature set and the relationship between nodes in the scenario, and construct a relationship network diagram, in which the nodes are divided into benign and fraudulent categories; Step 2: Sampling links of indefinite length: Starting from each node in the graph, multiple links are randomly sampled. The length of the links and the nodes they pass through are all random. Based on the importance index of the nodes on the links, the top-K links with higher representativeness and information content in characterizing the node connection mode are selected as the most valuable links. Step 3: Position-associated unified link encoding: Encode the links of different lengths selected from the variable-length link sampling into embedding vectors of the same length; In order to enhance the relative position information of node features in all nodes, a decision tree binning encoding method is introduced to group the node attribute value range as the basis for position encoding, and the position encoding is integrated into link embedding for position marking and feature denoising. Step 4: Link information interaction aggregation: First, the self-attention mechanism between links is used to realize information interaction, so that link embeddings can transmit and receive information with each other, and then automatically mine the common fraud patterns in the links; It is expected that through this carefully designed information interaction process, the fraudulent links will present a tighter clustering effect in the embedding space; then link aggregation is performed to integrate and refine the information at the link level into a representation at the node level; Step 5: Fraud detection of aggregate associations: A fraud detector is introduced, using a layer of discriminant network to identify fraud patterns hidden in the aggregate node representation.

2. A method for identifying graph fraud risks based on link mode aggregation as claimed in claim 1, characterized in that: Step 1 specifically includes: S1.1 Order is a relationship network diagram. , , Represent the node set, edge set and node feature set respectively. Represents the node number, , is the node feature number; It is a relationship network diagram The true label of the node; S1.2 Focus on the relationship network diagram in the fraud scenario and divide the nodes in the diagram into two categories: benign and fraudulent. , Representation Node It is a fraud node, otherwise it is a benign node.

3. The method for identifying graph fraud risk based on link mode aggregation according to claim 1, characterized in that: Step 2 specifically includes: S2.1 Starting from the randomly sampled nodes, sampling by random walk Links , each link Starting from this node, it contains Nodes connected in sequence; S2.2 Define a binary matrix , ,in is an upper triangular matrix of all ones, is the identity matrix, from Randomly and reproducibly sample OK, get , obtain a link of indefinite length by the following operations : (1) S2.3 The sum of the degree centrality of the nodes that the link passes through is selected as the basis for evaluating the importance of the link. Filter out the top-K most valuable links from the links : （2）。 4. The method for identifying graph fraud risk based on link mode aggregation according to claim 1, characterized in that: The steps of encoding the links of different lengths selected from the variable-length link samples into embedding vectors of the same length as described in step 3 specifically include: S3.1 For Links , the set of features of all nodes it contains is ; S3.2 Features corresponding to the node labeled -1 Fill with all zeros; S3.3 Concatenate the link node features in sequence to obtain the link features : (3) in represents the splicing operation, and the characteristic length of the link after splicing is ; S3.4 Reduce the dimension of link features and obtain embedded representation : （4） in and are the learnable weights and biases, respectively.

5. The method for identifying graph fraud risk based on link mode aggregation according to claim 1, characterized in that: In order to enhance the relative position information of node features in all nodes, the decision tree binning encoding method is introduced in step 3 to group the node attribute value range as the basis for position encoding, and integrate the position encoding into link embedding to perform position marking and feature denoising, which specifically includes: S3.5 uses node labels as supervision and adopts decision trees to classify the features of each attribute into different leaf nodes, where the number of leaf nodes corresponds to the number of groups and the split condition value determines the range of each group; S3.6 Using the trained decision tree for each attribute, sort all the segmentation condition values ​​in ascending order, and then use them to divide the entire range into several mutually exclusive bins. Each attribute has a corresponding bin number, so the position code of each node is obtained. ,in ; S3.7 Standardize position codes; S3.8 Position code corresponding to the node labeled -1 Fill with all zeros; S3.9 Concatenate the link node position codes in sequence to obtain : （5） in represents the splicing operation, and the length of the link position encoding after splicing is ; S3.10 reduces the dimension of link position encoding and obtains : （6） in and are the learnable weights and biases respectively; S3.11 Add the node feature embedding and position encoding to obtain the final node embedding representation : 。 6. A method for identifying graph fraud risks based on link mode aggregation as claimed in claim 1, characterized in that: Step 4 specifically includes: S4.1 For a certain node, first stack the embeddings of all links starting from the node, and get : （7） S4.2 Implement the self-attention mechanism between link embeddings to obtain the updated embedding representation : （8） （9） in, , and is a learnable transformation weight matrix; S4.3 Link information exchange part outputs the embedding of all links starting from a single node , aggregated to obtain : （10） in Represents the aggregation operation, using average aggregation, and the features after aggregation Embed as updated node.

7. The method for identifying graph fraud risk based on link mode aggregation according to claim 1, characterized in that: The step 5 specifically comprises the following steps: S5.1 Through link aggregation, the updated nodes are embedded into This is fed into a fraud detector, which uses a layer of a discriminant network to produce a prediction value , represents the probability that a node is predicted to be fraudulent: （11） S5.2 Link information interaction does not require any supervisory signal, and the model ultimately outputs the probability of each node being fraudulent , tagged as , construct binary cross entropy loss : （12） S5.3 uses back-propagation gradient descent to optimize model parameters.

8. A link mode aggregation graph fraud risk identification system, characterized in that: include: The relationship network diagram construction module, for different fraud scenarios, clarifies the node set, edge set, node feature set and the relationship between nodes in the scenario, and constructs a relationship network diagram, in which the nodes are divided into two categories: benign and fraudulent; The variable-length link sampling module takes each node in the graph as the starting point and randomly samples multiple links. The length of the link and the nodes it passes through are all random. According to the importance index of the nodes on the link, the top-K links with higher representativeness and information content in characterizing the node connection mode are selected as the most valuable links. The position-associated unified link encoding module encodes the links of different lengths selected from the variable-length link sampling into embedding vectors of the same length; In order to enhance the relative position information of node features in all nodes, a decision tree binning encoding method is introduced to group the node attribute value range as the basis for position encoding, and the position encoding is integrated into link embedding for position marking and feature denoising. The link information interaction aggregation module first uses the self-attention mechanism between links to achieve information interaction, so that link embeddings can transmit and receive information with each other, and then automatically mine the common fraud patterns in the links; It is expected that through this carefully designed information interaction process, the fraudulent links will present a tighter clustering effect in the embedding space; then link aggregation is performed to integrate and refine the information at the link level into a representation at the node level; The aggregate-associated fraud detection module introduces a fraud detector that uses a layer of discriminant network to identify fraud patterns hidden in the aggregate node representation.

9. A link mode aggregation graph fraud risk identification device, characterized in that: It includes a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, it is used to implement a link mode aggregation graph fraud risk identification method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: A program is stored thereon, and when the program is executed by a processor, a method for identifying graph fraud risks by link mode aggregation as described in any one of claims 1-7 is implemented.

Images