Hidden high-risk group mining method and system based on heterogeneous graph attention network

Abstract

The invention provides an implicit high-risk group mining method and system based on a heterogeneous graph attention network, and relates to the technical field of high-risk group identification. The method comprises the steps that a test group is selected in advance, user information in the test group is collected, and a user transaction topological relation in the test group is constructed based on the user information; collecting a user behavior log of each user in the test group in real time, obtaining a real-time behavior of each node in the user transaction topological relation, and constructing heterogeneous graph sample data; constructing a suspicious behavior prediction model, and judging whether each user in the test group is suspicious; and extracting users which are judged to be suspicious in the test group, and carrying out secondary investigation on other users. And the efficiency and the accuracy of anti-fraud work can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of high-risk group identification, and in particular to a hidden high-risk group mining method and system based on a heterogeneous graph attention network. Background Art

[0002] In the Internet environment, fraud detection faces many challenges, such as extreme class imbalance, adversarial attacks by fraudsters against anti-fraud systems, and high noise information and scarce labels. These challenges make it difficult for traditional fraud detection methods to efficiently identify fraudsters, so new fraud detection methods need to be developed to address these challenges.

[0003] Heterogeneous graph neural network is a neural network model that can process graph structure data with different types of nodes and edges. It generates node embeddings by aggregating the information of neighboring nodes, which is then used for tasks such as node classification and link prediction. In the field of fraud detection, heterogeneous graph neural networks can use transaction relationships and attribute information between users to construct heterogeneous graphs, and identify suspicious users by learning node embeddings. Traditional graph neural networks are mainly based on the assumption of homogeneity, that is, the nodes and edges in the graph are of the same type. However, in practical application scenarios such as high-risk detection, data is often heterogeneous and contains multiple types of nodes and edges. This assumption of homogeneity limits the performance of traditional GNNs on heterogeneous graphs. When processing heterogeneous graphs, a common method is to convert heterogeneous graphs into homogeneous graphs through meta-paths. However, the definition of meta-paths requires the participation of domain experts, and it is difficult to exhaust the rich semantic information in heterogeneous graphs. This may cause the model to miss potential high-risk behaviors.

[0004] Therefore, it is necessary to propose a hidden high-risk group mining method based on heterogeneous graph attention network to solve the problems in background technology. Summary of the invention

[0005] Purpose of the invention: To propose a hidden high-risk group mining method based on a heterogeneous graph attention network, and further propose a system for implementing the above method to solve the above problems existing in the prior art.

[0006] First, a hidden high-risk group mining method based on heterogeneous graph attention network is proposed, which includes the following steps: S1. Preselect a test group, collect user information within the test group, and construct a user transaction topology relationship within the test group based on the user information; S2. Collect the user behavior logs of each user in the test group in real time, obtain the real-time behavior of each node in the user transaction topology, and construct heterogeneous graph sample data; S3. Build a suspicious behavior prediction model to determine whether each user in the test group is suspicious; S4. Extract the users who are judged as suspicious within the test group, and conduct a secondary check on other users.

[0007] A further improvement of the present invention is that the user information in step S1 includes user ID information, user attribute information and user transaction information; the user attribute information includes user age, gender, occupation and region; the user transaction information includes user transaction time, transaction amount and transaction type.

[0008] A further improvement of the present invention is that the step of constructing the user transaction topology relationship within the test group in step S1 includes the following specific steps: S11: extracting user ID information and user attribute information of all users in the test group, creating a node for a single user to form a node set A, wherein the node set A includes user ID information and user attribute information of all users in the test group; S12: Create an undirected edge set B, where the undirected edge set B contains user transaction information of all users in the test group; S13: construct an undirected graph E=(A,B), where the undirected graph E is the topological relationship of user transactions within the test group.

[0009] A further improvement of the present invention is that the specific content of constructing the heterogeneous graph sample data in step S2 is: presetting the collection time, obtaining the user behavior log of each user in the test group within the collection time, obtaining the real-time behavior of each node in the user transaction topology relationship, and obtaining the behavior time series sequence of each node. At the same time, based on the user behavior log of each user in the test group within the collection time, obtain the suspicious label of each node, and the suspicious label is 0 or 1. When the suspicious label is 0, it indicates that the node has no suspicious behavior within the collection time, and when the suspicious label is 1, it indicates that the node has suspicious behavior within the collection time; the undirected graph E, the behavior time series sequence of each node within the collection time, and the suspicious label of each node are combined into the heterogeneous graph sample data.

[0010] A further improvement of the present invention is that the construction of the suspicious behavior prediction model in step S3 includes the following specific steps: S31: extracting transaction statistical features of each node in the heterogeneous graph sample data, wherein the transaction statistical features include the total number of transactions, average transaction amount, comprehensive transaction amount, and transaction type distribution of each node within the collection period; and simultaneously obtaining the centrality features of each node in the heterogeneous graph sample data and the transaction intensity features between each node and its neighboring nodes; S32: The transaction statistics and centrality features of a single node, as well as the transaction intensity features between the node and its neighboring nodes are combined into a node feature vector, and the set of all node feature vectors is used as the input of a suspicious behavior prediction model. The suspicious behavior prediction model uses the suspicious behavior probability predicted by each group of node feature vectors as output, and the suspicious label value corresponding to each group of node feature vectors as the prediction target. The training target is to minimize the sum of the squares of the differences between the suspicious behavior probabilities predicted by all node feature vectors and the suspicious label values, and the training is stopped when the sum of the prediction accuracies converges. The suspicious behavior prediction model is an attention network model.

[0011] A further improvement of the present invention is that the calculation formula of the prediction accuracy in S32 is: ; In the formula, is the probability of suspicious behavior predicted by the node feature vector of the i-th node, is the suspicious label value corresponding to the node feature vector of the i-th node, The prediction accuracy between the suspicious behavior probability predicted by the node feature vector of the i-th node and the suspicious label value.

[0012] A further improvement of the present invention is that the method for judging whether each user within the test group is suspicious in S3 is: presetting a suspicious behavior probability threshold, if the suspicious behavior probability output by the suspicious behavior prediction model is greater than the suspicious behavior probability threshold, then the node is judged to be suspicious, and the user corresponding to the node is marked as a suspicious user; if the suspicious behavior probability output by the suspicious behavior prediction model is not greater than the suspicious behavior probability threshold, then the node is not suspicious, and the user corresponding to the node is marked as a safe user.

[0013] A further improvement of the present invention is that the specific content of S4 is: extracting users determined to be suspicious within the test group, and extracting the node feature vector of the node to which the suspicious user belongs, substituting the node feature vector of the node to which other users belong and the node feature vector of the node to which the suspicious user belongs into the cosine similarity formula to calculate the similarity, and marking other users whose similarity is greater than the similarity threshold as potential suspicious users.

[0014] As a second aspect of the present invention, a hidden high-risk group mining system based on a heterogeneous graph attention network is proposed, the system comprising an association mapping module, a sample construction module, a prediction screening module, and a similarity screening module; The association mapping module is used to pre-select a test group, collect user information within the test group, and construct a user transaction topology relationship within the test group based on the user information; The sample construction module is used to collect user behavior logs of each user in the test group in real time, obtain the real-time behavior of each node in the user transaction topology relationship, and construct heterogeneous graph sample data; The prediction and screening module is used to build a suspicious behavior prediction model to determine whether each user in the test group is suspicious; The similarity screening module is used to extract users who are determined to be suspicious within the test group and perform a secondary screening on other users.

[0015] As a third aspect of the present invention, a computer-readable storage medium is proposed, on which a computer program is stored. When the computer program is executed by a processor, the hidden high-risk group mining method based on the heterogeneous graph attention network disclosed in the above embodiment is implemented.

[0016] Beneficial effects: The present invention constructs a hidden high-risk group mining method based on heterogeneous graph attention network. By constructing user transaction topological relationships and heterogeneous graph sample data, the method can comprehensively capture transaction behaviors and their dynamic changes between users, which helps the model to more comprehensively understand user behavior patterns, thereby more accurately identifying suspicious users. After extracting suspicious users, the method further screens potential suspicious users by calculating the similarity between other users and suspicious users. This screening method helps to narrow the scope of investigation and improve the efficiency and accuracy of anti-fraud work. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of a hidden high-risk group mining method based on a heterogeneous graph attention network in an embodiment of the present invention; Figure 2 Schematic diagram of the structure of a hidden high-risk group mining system based on a heterogeneous graph attention network in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In the following description, a large number of specific details are provided to provide a more thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present invention, some technical features known in the art are not described.

[0019] Combination Figure 1 This embodiment discloses a method for mining hidden high-risk groups based on a heterogeneous graph attention network. The method for mining hidden high-risk groups based on a heterogeneous graph attention network includes the following specific steps: S1. Preselect a test group, collect user information within the test group, and construct a user transaction topology relationship within the test group based on the user information; S2. Collect the user behavior logs of each user in the test group in real time, obtain the real-time behavior of each node in the user transaction topology, and construct heterogeneous graph sample data; S3. Build a suspicious behavior prediction model to determine whether each user in the test group is suspicious; S4. Extract the users who are judged as suspicious within the test group, and conduct a secondary check on other users.

[0020] In this embodiment, the user information in step S1 includes user ID information, user attribute information and user transaction information; the user attribute information includes user age, gender, occupation and region; the user transaction information includes user transaction time, transaction amount and transaction type.

[0021] In this embodiment, the construction of the user transaction topology relationship within the test group in step S1 includes the following specific steps: S11: extracting user ID information and user attribute information of all users in the test group, creating a node for a single user to form a node set A, wherein the node set A includes user ID information and user attribute information of all users in the test group; S12: Create an undirected edge set B, where the undirected edge set B contains user transaction information of all users in the test group; S13: construct an undirected graph E=(A,B), where the undirected graph E is the topological relationship of user transactions within the test group.

[0022] In this embodiment, the specific content of constructing the heterogeneous graph sample data in step S2 is: presetting the collection time, obtaining the user behavior log of each user in the test group within the collection time, obtaining the real-time behavior of each node in the user transaction topology relationship, and obtaining the behavior time series sequence of each node. At the same time, based on the user behavior log of each user in the test group within the collection time, obtain the suspicious label of each node, and the suspicious label is 0 or 1. When the suspicious label is 0, it indicates that there is no suspicious behavior of the node within the collection time. When the suspicious label is 1, it indicates that there is suspicious behavior of the node within the collection time; the undirected graph E, the behavior time series sequence of each node within the collection time, and the suspicious label of each node are combined into heterogeneous graph sample data.

[0023] In this embodiment, the construction of the suspicious behavior prediction model in step S3 includes the following specific steps: S31: extracting transaction statistical features of each node in the heterogeneous graph sample data, wherein the transaction statistical features include the total number of transactions, average transaction amount, comprehensive transaction amount, and transaction type distribution of each node within the collection period; and simultaneously obtaining the centrality features of each node in the heterogeneous graph sample data and the transaction intensity features between each node and its neighboring nodes; S32: The transaction statistics and centrality features of a single node, as well as the transaction intensity features between the node and its neighboring nodes are combined into a node feature vector, and the set of all node feature vectors is used as the input of a suspicious behavior prediction model. The suspicious behavior prediction model uses the suspicious behavior probability predicted by each group of node feature vectors as output, and the suspicious label value corresponding to each group of node feature vectors as the prediction target. The training target is to minimize the sum of the squares of the differences between the suspicious behavior probabilities predicted by all node feature vectors and the suspicious label values, and the training is stopped when the sum of the prediction accuracies converges. The suspicious behavior prediction model is an attention network model.

[0024] In this embodiment, the calculation formula of the prediction accuracy in S32 is: ; In the formula, is the probability of suspicious behavior predicted by the node feature vector of the i-th node, is the suspicious label value corresponding to the node feature vector of the i-th node, The prediction accuracy between the suspicious behavior probability predicted by the node feature vector of the i-th node and the suspicious label value.

[0025] In this embodiment, the method for judging whether each user within the test group is suspicious in S3 is: presetting a suspicious behavior probability threshold, if the suspicious behavior probability output by the suspicious behavior prediction model is greater than the suspicious behavior probability threshold, then the node is judged to be suspicious, and the user corresponding to the node is marked as a suspicious user; if the suspicious behavior probability output by the suspicious behavior prediction model is not greater than the suspicious behavior probability threshold, then the node is not suspicious, and the user corresponding to the node is marked as a safe user.

[0026] In this embodiment, the specific content of S4 is: extracting users who are determined to be suspicious within the test group, and extracting the node feature vector of the node to which the suspicious user belongs, substituting the node feature vector of the node to which other users belong and the node feature vector of the node to which the suspicious user belongs into the cosine similarity formula to calculate the similarity, and marking other users whose similarity is greater than the similarity threshold as potential suspicious users.

[0027] Figure 2 The structure diagram of another embodiment of the invention is a method system for mining hidden high-risk groups based on heterogeneous graph attention network. The system includes an association mapping module, a sample construction module, a prediction and screening module, and a similarity screening module.

[0028] The association mapping module is used to pre-select a test group, collect user information within the test group, and construct a user transaction topology relationship within the test group based on the user information.

[0029] The sample construction module is used to collect the user behavior logs of each user in the test group in real time, obtain the real-time behavior of each node in the user transaction topology relationship, and construct heterogeneous graph sample data.

[0030] The prediction and investigation module is used to build a suspicious behavior prediction model to determine whether each user within the test group is suspicious.

[0031] The similarity screening module is used to extract users who are judged to be suspicious within the test group and conduct a secondary screening of other users.

[0032] In this embodiment, the user information includes user ID information, user attribute information and user transaction information; the user attribute information includes user age, gender, occupation and region; the user transaction information includes user transaction time, transaction amount and transaction type.

[0033] In this embodiment, constructing the user transaction topological relationship within the test group includes the following specific steps: first, extracting the user ID information and user attribute information of all users within the test group, creating a node set A for a single user, and the node set A includes the user ID information and user attribute information of all users within the test group; then creating an undirected edge set B, and the undirected edge set B includes the user transaction information of all users within the test group; finally, constructing an undirected graph E=(A,B), and the undirected graph E is the user transaction topological relationship within the test group.

[0034] In this embodiment, the specific contents of constructing heterogeneous graph sample data are as follows: preset a collection time, obtain the user behavior log of each user in the test group within the collection time, obtain the real-time behavior of each node in the user transaction topology relationship, obtain the behavior time series sequence of each node, and at the same time, based on the user behavior log of each user in the test group within the collection time, obtain the suspicious label of each node, the suspicious label is 0 or 1, when the suspicious label is 0, it indicates that the node has no suspicious behavior within the collection time, when the suspicious label is 1, it indicates that the node has suspicious behavior within the collection time; the undirected graph E, the behavior time series sequence of each node within the collection time and the suspicious label of each node are combined into heterogeneous graph sample data.

[0035] In this embodiment, constructing a suspicious behavior prediction model includes the following specific steps: first, extracting transaction statistical features of each node in the heterogeneous graph sample data, wherein the transaction statistical features include the total number of transactions, average transaction amount, comprehensive transaction amount, and transaction type distribution of each node within the collection period; at the same time, obtaining the centrality features of each node in the heterogeneous graph sample data and the transaction intensity features between each node and its neighboring nodes; then combining the transaction statistical features, centrality features, and transaction intensity features between a single node and its neighboring nodes into the form of a node feature vector, and using the set of all node feature vectors as the input of the suspicious behavior prediction model. The suspicious behavior prediction model uses the suspicious behavior probability predicted by each group of node feature vectors as output, and the suspicious label value corresponding to each group of node feature vectors as the prediction target, and minimizing the sum of squares of the difference between the suspicious behavior probability predicted by all node feature vectors and the suspicious label value as the training target, until the sum of the prediction accuracies reaches convergence and the training is stopped; the suspicious behavior prediction model is an attention network model.

[0036] In this embodiment, the calculation formula for prediction accuracy is: ; In the formula, is the probability of suspicious behavior predicted by the node feature vector of the i-th node, is the suspicious label value corresponding to the node feature vector of the i-th node, The prediction accuracy between the suspicious behavior probability predicted by the node feature vector of the i-th node and the suspicious label value.

[0037] In this embodiment, the method for judging whether each user within the test group is suspicious is as follows: a suspicious behavior probability threshold is preset; if the suspicious behavior probability output by the suspicious behavior prediction model is greater than the suspicious behavior probability threshold, the node is judged to be suspicious, and the user corresponding to the node is marked as a suspicious user; if the suspicious behavior probability output by the suspicious behavior prediction model is not greater than the suspicious behavior probability threshold, the node is not suspicious, and the user corresponding to the node is marked as a safe user.

[0038] In this embodiment, the implementation of the similarity screening module includes the following specific contents: extracting users who are determined to be suspicious within the test group, and extracting the node feature vector of the node to which the suspicious user belongs, substituting the node feature vector of the node to which other users belong and the node feature vector of the node to which the suspicious user belongs into the cosine similarity formula to calculate the similarity, and marking other users whose similarity is greater than the similarity threshold as potential suspicious users.

[0039] The above-mentioned parameters and steps for each unit module to implement corresponding functions in the hidden high-risk group mining system based on heterogeneous graph attention network of the present invention can refer to the parameters and steps in the embodiment of the hidden high-risk group mining method based on heterogeneous graph attention network in the above embodiment.

[0040] The hidden high-risk group mining method based on the heterogeneous graph attention network disclosed in the above embodiment can be written into a set of executable instructions for its operation logic in the actual application process, and the executable instructions are written into the storage medium and run on the electronic device. More specific examples of the computer-readable storage medium mentioned in this embodiment may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. The computer-readable storage medium may include a data signal propagated in the baseband or as part of a carrier wave, which carries a readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium can also be any readable medium other than a readable storage medium, which can send, propagate or transmit a program for use by or in combination with an instruction execution system, device or device. When the above electronic device is running, it can automatically execute the complete hidden high-risk group mining method based on heterogeneous graph attention network disclosed in any of the above embodiments. The specific method will not be described here.

[0041] As described above, although the present invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the present invention itself. Various changes may be made to it in form and detail without departing from the spirit and scope of the present invention as defined in the appended claims.

Claims

1. A hidden high-risk group mining method based on heterogeneous graph attention network, characterized by: The steps include: S1. Preselect a test group, collect user information within the test group, and construct a user transaction topology relationship within the test group based on the user information; S2. Collect the user behavior logs of each user in the test group in real time, obtain the real-time behavior of each node in the user transaction topology, and construct heterogeneous graph sample data; S3. Build a suspicious behavior prediction model to determine whether each user in the test group is suspicious; S4. Extract the users who are judged as suspicious within the test group, and conduct a secondary check on other users.

2. The method for mining hidden high-risk groups based on heterogeneous graph attention network according to claim 1 is characterized in that: The user information in step S1 includes user ID information, user attribute information and user transaction information; the user attribute information includes user age, gender, occupation and region; the user transaction information includes user transaction time, transaction amount and transaction type.

3. The method for mining hidden high-risk groups based on heterogeneous graph attention network according to claim 2 is characterized in that: The step S1 of constructing the user transaction topology relationship within the test group includes the following specific steps: S11: extracting user ID information and user attribute information of all users in the test group, creating a node for a single user to form a node set A, wherein the node set A includes user ID information and user attribute information of all users in the test group; S12: Create an undirected edge set B, where the undirected edge set B contains user transaction information of all users in the test group; S13: construct an undirected graph E=(A,B), where the undirected graph E is the topological relationship of user transactions within the test group.

4. The method for mining hidden high-risk groups based on heterogeneous graph attention network according to claim 3 is characterized in that: The specific content of constructing the heterogeneous graph sample data in step S2 is: preset the collection time, obtain the user behavior log of each user in the test group within the collection time, obtain the real-time behavior of each node in the user transaction topology relationship, and obtain the behavior time series sequence of each node. At the same time, based on the user behavior log of each user in the test group within the collection time, obtain the suspicious label of each node, and the suspicious label is 0 or 1. When the suspicious label is 0, it indicates that there is no suspicious behavior of the node within the collection time. When the suspicious label is 1, it indicates that there is suspicious behavior of the node within the collection time; the undirected graph E, the behavior time series sequence of each node within the collection time, and the suspicious label of each node are combined into heterogeneous graph sample data.

5. The method for mining hidden high-risk groups based on heterogeneous graph attention network according to claim 4 is characterized in that: The construction of the suspicious behavior prediction model in step S3 includes the following specific steps: S31: extracting transaction statistical features of each node in the heterogeneous graph sample data, wherein the transaction statistical features include the total number of transactions, average transaction amount, comprehensive transaction amount, and transaction type distribution of each node within the collection period; and simultaneously obtaining the centrality features of each node in the heterogeneous graph sample data and the transaction intensity features between each node and its neighboring nodes; S32: The transaction statistics and centrality features of a single node, as well as the transaction intensity features between the node and its neighboring nodes are combined into a node feature vector, and the set of all node feature vectors is used as the input of a suspicious behavior prediction model. The suspicious behavior prediction model uses the suspicious behavior probability predicted by each group of node feature vectors as output, and the suspicious label value corresponding to each group of node feature vectors as the prediction target. The training target is to minimize the sum of the squares of the differences between the suspicious behavior probabilities predicted by all node feature vectors and the suspicious label values, and the training is stopped when the sum of the prediction accuracies converges. The suspicious behavior prediction model is an attention network model.

6. The method for mining hidden high-risk groups based on heterogeneous graph attention network according to claim 5 is characterized in that: The calculation formula of the prediction accuracy in S32 is: ； In the formula, is the probability of suspicious behavior predicted by the node feature vector of the i-th node, is the suspicious label value corresponding to the node feature vector of the i-th node, The prediction accuracy between the suspicious behavior probability predicted by the node feature vector of the i-th node and the suspicious label value.

7. The method for mining hidden high-risk groups based on heterogeneous graph attention network according to claim 6 is characterized in that: The method for judging whether each user within the test group is suspicious in S3 is: presetting a suspicious behavior probability threshold, if the suspicious behavior probability output by the suspicious behavior prediction model is greater than the suspicious behavior probability threshold, then the node is judged to be suspicious, and the user corresponding to the node is marked as a suspicious user; if the suspicious behavior probability output by the suspicious behavior prediction model is not greater than the suspicious behavior probability threshold, then the node is not suspicious, and the user corresponding to the node is marked as a safe user.

8. The method for mining hidden high-risk groups based on heterogeneous graph attention network according to claim 7 is characterized in that: The specific content of S4 is: extracting users who are determined to be suspicious within the test group, and extracting the node feature vector of the node to which the suspicious user belongs, substituting the node feature vector of the node to which other users belong and the node feature vector of the node to which the suspicious user belongs into the cosine similarity formula to calculate the similarity, and marking other users whose similarity is greater than the similarity threshold as potential suspicious users.

9. A system for mining hidden high-risk groups based on heterogeneous graph attention networks, used to implement the method for mining hidden high-risk groups based on heterogeneous graph attention networks as described in any one of claims 1 to 8, characterized in that: The system comprises: The association mapping module is used to pre-select a test group, collect user information within the test group, and construct a user transaction topology relationship within the test group based on the user information; The sample construction module is used to collect the user behavior logs of each user in the test group in real time, obtain the real-time behavior of each node in the user transaction topology, and construct heterogeneous graph sample data; The prediction and investigation module is used to build a suspicious behavior prediction model to determine whether each user in the test group is suspicious; The similarity screening module is used to extract users who are judged to be suspicious within the test group and conduct a secondary screening of other users.

Images