Context-based multi-financial relation graph fraud node detection method

Abstract

The invention provides a context-based multi-financial relation graph fraud node detection method, and belongs to the technical field of graph data mining. Comprising the following steps: preprocessing a data set; calculating node-level global context features; in any relation graph, the weight of any edge is calculated by utilizing node-level global context features, and noise edges are filtered; in any relation graph, using GCN to learn semantic features of any node in the specified relation graph; integrating the original features of the nodes, the global context features and the semantic features under the specified relation graph, and obtaining final feature representation of the nodes through a multilayer perceptron; and updating all trainable parameters to train the model by using cross entropy loss back propagation. According to the method, the global context features are effectively utilized to guide feature learning under different relational graphs, the global features and the node semantic features under the different relational graphs are integrated, a good fraud node recognition effect can be achieved, and high-accuracy classification on a test set can be rapidly obtained without excessive parameter adjustment.

Description

Technical Field

[0001] The present invention belongs to the technical field of graph data mining, and in particular relates to a method for detecting fraudulent nodes in a multiple financial relationship graph based on context. Background Art

[0002] With the acceleration of the transformation of banking business to the Internet, online financial services have become increasingly popular, but this has also provided more opportunities for fraudsters. Especially under the current trend of financial fraud showing a new trend of organization, gang and concealment, fraudsters conduct illegal activities by building a complex financial relationship network and taking advantage of information asymmetry and regulatory loopholes. Specifically, fraudsters may commit fraud in financial services such as credit and payment by controlling multiple accounts or identities. They take advantage of loopholes in the association graph to establish multiple closely connected nodes to hide their true identities and fraudulent purposes. For example, in some gang fraud cases, fraudsters will share some information or equipment to reduce costs, such as using the same mobile phone, IP address or company phone number, which makes them more difficult to detect and track. In order to deal with this problem, financial institutions and regulatory authorities need to use advanced technical means, such as association graphs and intelligent anti-fraud models, to identify and prevent fraud risks. By building a comprehensive risk management system and an efficient anti-fraud mechanism, suspicious fraud can be discovered and handled in a timely manner to protect the legitimate rights and interests of consumers and the stability of the financial market.

[0003] Fraud detection based on graph neural networks has been widely used in the fields of fraud loan detection and misleading review detection. For example, models based on graph neural networks are used to identify fraudulent behaviors that affect product ratings on the Taobao platform, identify users with low credit scores on e-commerce lending platforms, and identify false reviews on review websites. Another example is to detect companies that have committed illegal acts such as financial fraud in a multi-financial relationship graph established through multiple associations between companies. In the problem of fraud node detection in a multi-financial relationship graph, a financial institution is regarded as a node, and the transaction relationships between institutions are regarded as edges. Illegal institutions belong to positive nodes, and legal institutions belong to negative nodes. When an edge is established between any two nodes that satisfy a certain relationship, a relationship graph under the relationship is formed. When the number of relationships exceeds one, a multi-relationship graph is formed. In recent years, fraud detection on multi-relationship graphs has attracted widespread attention.

[0004] Semi-supervised learning is a machine learning method between supervised learning and unsupervised learning. It uses a small amount of labeled data and a large amount of unlabeled data to jointly train the model, aiming to fully explore the potential information and patterns in the unlabeled data to improve the performance and accuracy of the model. This method is particularly suitable for situations where labeled data is limited. By combining limited labeled resources and the potential of unlabeled data, it can improve model performance and explore the potential value of unlabeled data when the cost of data labeling is high. The research on semi-supervised learning can be traced back to the 1970s and has gradually received attention with the development of fields such as natural language processing, text classification, and computer vision. In the task of fraud detection, because the number of fraud samples themselves is small and difficult to detect and label, it is necessary to combine semi-supervised learning to train a model with better generalization ability.

[0005] Although some semi-supervised financial fraud models based on graph structures have emerged in financial scenarios such as e-commerce and digital currency transactions, these models have many limitations. The assumption that the real data distribution does not conform to the actual situation, as well as the need to improve the running speed and classification performance, are all areas that deserve our improvement. Summary of the invention

[0006] The purpose of the present invention is to provide a context-based method for detecting fraudulent nodes in multiple financial relationship graphs to solve the technical problems of limitations of financial fraud models in the prior art, unreasonable data analysis, and slow analysis speed.

[0007] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows:

[0008] A method for detecting fraudulent nodes in a multi-financial relationship graph based on context, comprising the following steps:

[0009] Step S1: Preprocessing of graph structure data set constructed based on financial field data: In each relationship graph, the neighbors of the node in this relationship graph are divided into 5 sets, namely: the positive node set with first-order known labels, the negative node set with first-order known labels, the positive node set with second-order known labels, the negative node set with second-order known labels, and the node set with second-order unknown labels; after performing feature pooling on each neighborhood node set, the neighborhood pooling feature matrix of the node is obtained by combining;

[0010] Step S2: Calculate global context features for each node: Generate global context features for each node using the neighborhood average feature matrix and attention mechanism;

[0011] Step S3: In each relationship graph, the weight of the edge is calculated using the global context features to filter out the noise edges: the weight of the edge is calculated using the original features of the nodes on both sides of the edge and the global context features;

[0012] Step S4: in each relationship graph, after filtering the noise edges, the semantic features under the relationship graph are calculated for each node;

[0013] Step S5: horizontally splice the node's own features, the node's global context features, and the node's semantic features under any relationship graph, and obtain the final feature representation of the node through a multi-layer perceptron;

[0014] Step S6: Use cross entropy loss back propagation to update all trainable parameters to train the model: predict the probability of a node being a positive node or a negative node; calculate the loss function by combining the probability and the true label, and update the parameter training model through gradient back propagation;

[0015] Step S7: Detect fraudulent nodes using the trained model.

[0016] Further, in step S1,

[0017] The dataset is graph structured data in is a node set, It is a matrix composed of the original features of all nodes, N represents the number of nodes, and s represents the number of dimensions of the original features. is the edge set, ε r is the edge set under the specified relationship type r, is the label set of all nodes. Usually used represents the i-th node in the graph, is the label of this node; in the graph structure G, the types of nodes are consistent, the types of edges are diverse, and there are two types of nodes, and the number of nodes in the two types is seriously unbalanced. For node v i , in the graph of relation r, the neighbors can be divided into: the set of positive nodes with first-order known labels The set of negative nodes with first-order known labels The set of positive nodes with second-order known labels Second-order known-label negative node set Second-order node set with unknown labels For node v i The node features in all neighbor node sets under all relationship graphs are averaged and pooled, and then the i-th node v is obtained after combination. i Neighborhood pooling feature matrix R represents the total number of types of relationship graphs.

[0018] Furthermore, the global context feature in step S2 is calculated in the following way:

[0019]

[0020] in represents the global context feature of the i-th node; att i,j represents the weight between the i-th node and the j-th neighbor. exp(·) is the exponential function applied to the value e; represents the neighborhood pooling feature matrix of the i-th node, E represents the standard normal distribution weight matrix, which is used to distinguish different types of neighborhood node sets; and S i After adding, we get Represents the neighborhood pooling feature matrix of the i-th node after the neighborhood is distinguished; is the neighborhood pooling feature matrix obtained by the i-th node in the j-th neighborhood after being differentiated by E, The specified dimension feature is intercepted in the i is the original feature of the i-th node, W q ,W k ,W v are all trainable weight matrices, Q i is x i In W q The features in the mapping space, K i,j yes In W k The features in the mapping space, V i,j yes In W v Mapping space features.

[0021] Furthermore, the weight of the edge in step S3 is calculated in the following way:

[0022]

[0023] Where W w is the trainable weight matrix, x i is the i-th node v i The original characteristics of is node v i The global context feature, x j is the jth node v j The original characteristics of is node v j The global context features of . Convat(·) is the concatenation function, Indicates that x i , x j , These four vectors are concatenated horizontally. Sigmoid(·) is the activation function, and its calculation formula is w i,j is node v i and node v j The weight between them ranges from 0 to 1.

[0024] Furthermore, in step S4, the semantic features are calculated in the following way:

[0025]

[0026] in is node v i Semantic features extracted from the graph with relation r. r (v i ) represents node v i The set of neighbors on the graph with relation r, N r (v j ) represents node v j The set of neighbors on the graph of relation r, w i,j is node v i and node v j The weight between i,k Represents node v i and node v k The weight between j,k Represents node v j and node v k The weight between j represents the original feature of the jth node, W r is a trainable weight matrix. Used to represent node v i The importance of Used to represent node v j degree of importance.

[0027] Furthermore, the final feature representation in step S5 is calculated in the following way:

[0028]

[0029] Where W c is the weight matrix, z i is the final feature representation of the i-th node.

[0030] Furthermore, in step S6, the probability of predicting whether the node is a positive node or a negative node after feature mapping is calculated by the following method:

[0031]

[0032] in is the predicted probability distribution of the ith node, W 1 ,W 2 is the weight matrix, b 1 ,b 2 is the bias, W 1,W 2 ,b 1 ,b 2 All are trainable parameters. σ(·) is the activation function, and the ReLU activation function is selected. ReLU(x)=max(x,0);

[0033] The loss function is calculated by combining the probability and the true label, and the parameter training model is updated through gradient back propagation. The loss function of the classification task is calculated by the following formula:

[0034]

[0035] V train Represents the set of all nodes in the training set, y i is the true label of the ith node, is the predicted probability distribution of the ith node, It is the sum of the L2 norms of all trainable parameters involved in the model, which is used to constrain the model to prevent over-fitting caused by over-training. α is a hyperparameter with a positive value range;

[0036] The trainable parameters in the model are differentiated by the loss function, and an effective model is obtained after multiple gradient updates.

[0037] Compared with the prior art, the present invention has the following beneficial technical effects:

[0038] 1. Compared with existing methods, the present invention classifies and pools the neighborhood features of all nodes in the data preprocessing stage. This processing method enables the model to effectively learn the difference between the features of two types of nodes through global context features in the special case where the distribution space of positive and negative sample features is close. Compared with the existing method of distinguishing two types of nodes based on the original features of the nodes, the present invention effectively learns new discriminative features while using a small number of parameters. The use of global context features can improve the recognition effect of fraudulent nodes on certain data sets.

[0039] 2. Compared with the existing methods, the present invention uses the commonalities of different relationship graphs to guide feature learning under different relationship graphs and calculate the weight of any edge. In view of the different noise edge ratios in different relationship graphs, previous methods have attempted to use node feature differences to distinguish noise edges. However, this method is only applicable to the assumption that the feature differences of nodes of different categories are large. The present invention uses the global context features obtained through learning to effectively distinguish and identify noise edges and achieve better noise edge filtering effects.

[0040] 3. Compared with existing methods, the present invention has higher computational efficiency and classification performance, and shows better performance and faster running speed than the baseline model in multiple data sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0042] Figure 1 Schematic diagram of the fraud detection model steps of an embodiment of the present invention.

[0043] Figure 2 This is a performance comparison chart of the present invention under different hyperparameters.

[0044] Figure 3 This is an interpretability analysis diagram of the present invention for two data sets in the example

[0045] Figure 4 A comparison chart of the running time of the present invention and multiple baseline models on the test sets of two datasets in an example. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] This embodiment provides a multi-relationship graph fraud detection model based on global context, see Figure 1 , Figure 1 Schematic diagram of the steps of the fraud detection model of an embodiment of the present invention. In all relationship graphs of step S1, the first-order neighbors and second-order neighbors of the target node (central node) are classified into: a positive node set with first-order known labels, a negative node set with first-order known labels, a positive node set with second-order known labels, a negative node set with second-order known labels, and a node set with second-order unknown labels. After obtaining the average features of each set, the global context features are learned for the target node through the attention mechanism of step S2. In steps S3-S4, in each relationship graph, the weight of the edge connecting any neighbor to the central node is calculated, and the feature representation in each relationship graph is learned through neighborhood aggregation. In steps S5-S6, the original features of the node, the global context features of the node, and the feature representations of the node in all relationship graphs are spliced ​​and learned to obtain the final feature representation, and it is predicted whether the target node is a fraudulent node.

[0048] A global context-based multi-relationship graph fraud detection method specifically includes the following steps:

[0049] Step S1: Preprocessing of graph structure data set based on financial data. The data set is graph structure data.

[0050] in is a node set, It is a matrix composed of the original features of all nodes, N represents the number of nodes, and s represents the number of dimensions of the original features; is the edge set, ε r It is the set of edges under the specified relationship type r, where R represents the total number of types of relationship graphs; is the label set of all nodes. Usually used represents the i-th node in the graph, is the label for this node. The dataset used is required to belong to a heterogeneous graph, in which the node types are consistent and the edge relationship types are diverse. The same node can have multiple relationships with any other node. When only focusing on the first relationship, it is considered that the other relationship edges do not exist, thus obtaining the first relationship graph; correspondingly, when only focusing on the Rth relationship, it is considered that the other relationship edges do not exist, thus obtaining the Rth relationship graph. When a node has neighbors based on relationship 1 and relationship R at the same time, it is considered that the node appears in both the first relationship graph and the Rth relationship graph. Depending on whether the node has fraudulent behavior or whether it is fraudulent information, the nodes are divided into two categories, and there is a serious imbalance in the number of nodes in the two categories. In the preprocessing stage, the label information is used to divide the neighborhood of all nodes into 5 node sets, namely: the positive class node set with first-order known labels The set of negative nodes with first-order known labels The set of positive nodes with second-order known labels Second-order known-label negative node set Second-order node set with unknown labels For node v i The node features in all neighborhood node sets under all relationship graphs are averaged and pooled, and the i-th node v is obtained after combination. i Neighborhood pooling feature matrix Combine the neighborhood pooling feature matrices of all nodes to obtain the global node neighborhood pooling feature matrix s represents the number of dimensions of the original features, R represents the total number of types of relationship graphs, and N represents the number of nodes that appear in any relationship graph.

[0051] Step S2: Calculate global context features for each node: Generate global context features for each node using the neighborhood pooling feature matrix and attention mechanism, calculated as follows:

[0052]

[0053] in represents the global context feature of the i-th node; att i,j represents the weight between the i-th node and the j-th neighbor. exp(·) is the exponential function applied to the value e; represents the neighborhood pooling feature matrix of the i-th node, E represents the standard normal distribution weight matrix, which is used to distinguish different types of neighborhood node sets; and S i After adding, we get Represents the neighborhood pooling feature matrix of the i-th node after the neighborhood is distinguished; is the neighborhood pooling feature matrix obtained by the i-th node in the j-th neighborhood after being differentiated by E, The specified dimension feature is obtained by intercepting it. i is the original feature of the i-th node, W q ,W k ,W v are all trainable weight matrices, Q i is x i In W q The features in the mapping space, K i,j yes In W k The features in the mapping space, V i,j yes In W v The features in the mapping space. By i , Mapped to W q , W k and W v After that, the mapping of the ith node in Q space is multiplied by the mapping of the jth neighbor in K space to obtain the attention score of the ith node to the jth neighbor. The score is normalized by softmax operation to obtain the weight between the ith node and the jth neighbor. The global context feature of the ith node is obtained by adding all weights and the corresponding neighbor mapping in V space. This process is the application of the attention mechanism.

[0054] Step S3: In each relationship graph, the weight of the edge is calculated using the global context features to filter out the noise edges: The weight of the edge is calculated using the original features of the nodes on both sides of the edge and the global context features.

[0055]

[0056] Where W w is the trainable weight matrix, x i is the i-th node v iThe original characteristics of is node v i The global context feature, x j is the jth node v j The original characteristics of is node v j The global context feature of . Concat(·) is a concatenation function. Indicates that x i , x j , These four vectors are concatenated horizontally. Sigmoid(·) is the activation function, and its calculation formula is w i,j is node v i and node v j The weight between them ranges from 0 to 1.

[0057] After assigning a weight to each edge, if the weight is closer to 1, the information transmitted by this edge is retained; if the weight is closer to 0, the information transmitted by this edge is filtered.

[0058] Step S4: In each relationship graph, after filtering the noise edges, the semantic features of the relationship graph are calculated for each node: the edge weight does not take into account the local connectivity of the node during the calculation process. For a highly connected node, the importance of any neighbor to the node and the importance of the node to any neighbor are obviously lower than those of a low-connected node. Based on this, the edge weight is improved with reference to GCN, and the product of the second norm of the importance of two adjacent nodes is used as the denominator of the edge weight. Then, the semantic feature representation of the node is obtained by multiplying and adding the features of all neighbors with the corresponding improved edge weights. The calculation method of the semantic feature representation is as follows:

[0059]

[0060] in is node v i Semantic features extracted from the graph with relation r. r (v i ) represents node v i The set of neighbors on the graph with relation r, N r (v j ) represents node v j The set of neighbors on the graph of relation r, w i,j is node v i and node v j The weight between i,k Represents node v i and node v k The weight betweenj,k Represents node v j and node v k The weight between j represents the original feature of the jth node, W r is a trainable weight matrix. Used to represent node v i The importance of Used to represent node v j degree of importance.

[0061] Learn new feature representations for all nodes in any relational graph and obtain the semantic features of the nodes in any relational graph.

[0062] Step S5: horizontally splice the node's own features, the node's global context features, and the node's semantic features under any relationship graph, and obtain the final feature representation of the node through a multi-layer perceptron MLP.

[0063]

[0064] Where W c is the weight matrix, z i is the final feature representation of the i-th node.

[0065] Step S6: Deep learning model parameter training: train the model constructed according to the above steps. The present invention combines all the above features with the initial features of the node and predicts the category of the node through a classifier to determine whether the node is a fraudulent node.

[0066] After the final feature representation of the node is multiplied by the weight matrix several times and the bias is added, the number of dimensions becomes 2, which is used to predict the probability of the node being a positive node or a negative node, calculated in the following way:

[0067]

[0068] in is the predicted probability distribution of the ith node, W 1 ,W 2 is the weight matrix, b 1 ,b 2 is the bias, W 1 ,W 2 ,b 1 ,b 2 All of them are trainable parameters. σ(·) is the activation function, and ReLU activation function is selected. ReLU(x)=max(x,0). Softmax(·) is used to control the value of the predicted probability distribution to be between 0 and 1.

[0069] The loss function is calculated by combining the probability and the true label, and the parameter training model is updated through gradient back propagation. The cross entropy loss function is calculated by the following formula:

[0070]

[0071] V train Represents the set of all nodes in the training set, y i is the true label of the ith node, is the predicted probability distribution of the ith node, It is the sum of the L2 norms of all trainable parameters involved in the model, and is used to constrain the model to prevent overfitting caused by excessive training. α is a hyperparameter with a positive value range. The larger α is, the stronger the training process is against overfitting, and the smaller α is, the weaker the training process is against overfitting. The loss function is used to derive the trainable parameters in the model, and after multiple gradient updates, an effective model GIR is obtained.

[0072] Step S7: Detect fraudulent nodes using the trained model

[0073] The trained model is used to calculate the predicted probability distribution for any node. For this two-dimensional vector, by default, when the number corresponding to the first dimension is larger, the node is considered to be a normal node, and when the number corresponding to the second dimension is larger, the node is considered to be a fraudulent node.

[0074] The overall training process of the present invention is shown in Algorithm 1 below. Given a data set that meets the requirements as data, the algorithm first obtains the global context features of the node (line 3). Then, for each relationship graph, the weight of the edge is calculated using the global context features and the node's own features (line 5). A completely new semantic feature representation is learned for the node in each relationship graph (line 6). After learning a completely new feature representation in all relationship graphs, the node's own original features, the global context features, and the completely new features learned by the node in each relationship graph are concatenated and processed to obtain the final feature representation (line 7). The new feature representation is used to predict whether the node is a fraudulent node, and the loss function of the model is calculated, and the model is optimized by back propagation (line 8).

[0075]

[0076] The present invention introduces the data set, baseline model and parameter settings in detail below.

[0077] Datasets: This example uses three datasets, all of which are constructed based on real-world financial scenario data. The YelpChi dataset is constructed using the hotel ordering data of the Yelp website. There are various deceptive reviews on the hotel ordering recommendation platform, which attempt to increase the number of bookings for certain hotels by deceiving consumers. Hotel reviews are regarded as nodes, and the edges between nodes are constructed based on three relationships: 1) RUR represents that two reviews belong to the same user; 2) RSR represents that two reviews of the same hotel give the same star rating; 3) RTR represents that two reviews of the same hotel appear in the same time period, such as the same month. The Amazon dataset is constructed based on the product review data of the Amazon shopping platform: 1) UPU represents that two users give the same rating to the same product; 2) USU represents that two users give the same star rating to the same product within a week; 3) UVU represents that the similarity of the product reviews of two users is extremely high. The Eliptic dataset describes digital currency transactions between financial institutions, which consists of two relationships: 1) ETE represents that there is a digital currency transfer in or out transaction between two financial institutions; 2) EFE represents that the two financial institutions show extremely high similarity in various financial-related indicators.

[0078] The statistics of the dataset are shown in Table 1.

[0079] Table 1: Dataset statistics table

[0080]

[0081] The present invention uses several different graph neural networks as baseline models, which are compared with the model GIR of the present invention. GCN is a graph convolutional network that processes graph data from the spectral domain perspective and aggregates the first-order neighbor features of nodes. GraphSAGE is a graph neural network model that can be applied to large-scale networks by sampling the neighborhood of non-standard nodes and using a variety of methods to aggregate the neighborhood. CARE-GNN is a graph fraud detection model that uses reinforcement learning technology to solve the problem of fraud node feature disguise and relationship disguise. FRAUDRE is a fraud detection model consisting of four parts, which are used to deal with feature inconsistency, topology inconsistency, relationship inconsistency and class imbalance. PC-GNN consists of two steps, namely "pick" and "choose" for node sampling to alleviate class imbalance problems. RioGNN is an improved model based on CARE-GNN, which also uses reinforcement learning to perform neighborhood sampling in different relationship graphs. BHetero-GHRN and Bhomo-GHRN use the relationship between graph frequency and graph heterogeneity to alleviate graph heterogeneity. GDN uses the maximum gradient to find important features of nodes and enhance the feature differences of nodes of different categories to perform fraud detection models. GAGA uses label information in the preprocessing stage to process the graph structure into a standard structure and then uses transformer to perform fraud detection.

[0082] The training was performed on the dataset. In this case, the embedding dimension was 64, the learning rate of the model parameters was 0.0005, the maximum training was 500 epochs, and the early listening mechanism was adopted. When the model trained in a certain round achieved the optimal performance in 100 consecutive epochs, the training was terminated and the model of this round was used for testing. The experiment used AUC, F1-Macro, and AP as the accuracy indicators of node classification, and compared the present invention with other centralized methods. The highest score is shown in bold, and the second highest score is shown in underline. Each experiment was trained for 5 rounds, and the average and standard deviation are shown in Table 2 and Table 3:

[0083] Table 2: Experimental data table for node classification on YelpChi and Amazon datasets

[0084]

[0085] Table 3: Experimental data table for node classification on the Eliptic dataset

[0086]

[0087]

[0088] It can be found from Table 2 and Table 3 that the model GIR of the present invention has much higher scores in the three evaluation indicators compared with other baseline models in the three data sets. The scores of AUC, AP and F1-Macro are 1%-2%, 2%-21% and 1%-10% higher than the optimal baseline model in the three data sets, respectively, which proves the superior performance of the model GIR of the present invention. The various parts of the model GIR of the present invention are removed separately, for example: the standard normal distribution weight matrix E is removed to obtain GIR woE , remove the attention mechanism to get GIR woA , remove the edge weights and calculate GIR woW , remove the global context features when calculating the edge weight to get GIR woWG In the final embedding generation process, the semantic features obtained from each relationship graph are removed to obtain GIR woR , the global context features are removed during the final embedding generation process to obtain GIR woG , and the performance of the model after removal is compared with GIR. Comparisons on three indicators with multiple baseline models on two datasets show that GIR's performance is almost stable in the top two after removing various parts, indicating the effectiveness of each component of the GIR model.

[0089] The F1 scores of the two categories of the model are compared and analyzed on the YelpChi dataset, and Table 4 is obtained:

[0090] Table 4: F1 score table of different categories on the YelpChi dataset

[0091]

[0092] From Table 4, we can see that GIR has the largest F1 score in both categories, and F1-Fraud reaches 0.7189, proving that when the number of fraudulent nodes is unbalanced with the number of normal nodes, the model GIR can still learn the features that distinguish the two types of nodes. This phenomenon once again verifies the effectiveness of the model.

[0093] Controlling different training ratios and node label rates, training was performed on the two datasets, and the training was also performed 5 times. The average and standard deviation were taken. The highest score is indicated in bold, and the second best score is indicated in underline, as shown in Table 5;

[0094] Table 5: Experimental data table of node classification under different training ratios and label rates

[0095]

[0096] The model trained by the present invention can still achieve an AUC of 97% on Amazon and an AUC of 87% on YelpChi under the conditions of low training rate and low label rate, which proves that the model can still achieve excellent classification effect under the conditions of low label and low training rate.

[0097] Adjust the model's hyperparameters, set the Embedding Size in the range of {32, 48, 64}, set the LearningRate in the range of {0.0001, 0.0005, 0.001}, set the Early Stop in the range of {10, 20, 30}, and set the Weight Decay in the range of {0.0001, 0.0005, 0.001} to compare the model's training results. Figure 2 As shown, Figure 2 (a) shows the change curves of the model's evaluation scores F1-score, GMean, and AP as the hidden layer dimension changes from 10, 20, and 30; Figure 2 (b) The change curves of the model's evaluation scores F1-score, GMean, and AP as the early stopping threshold changes from 10, 20, and 30; Figure 2 (c) shows the change curves of the model's evaluation scores F1-score, GMean, and AP as the learning rate changes from 0.001, 0.005, and 0.01; Figure 2 (d) shows the curves of the model's evaluation scores F1-score, GMean, and AP as the weight decay coefficient changes from 0.0001, 0.0005, and 0.001. Figure 2 It was found that the variation range of each evaluation index of the model did not exceed 1%, which proved the robustness of the hyperparameters designed by the model.

[0098] Visualize the weights learned by the model in different datasets Figure 3 . Figure 3 (a) in the figure shows the distribution of attention coefficients for various neighbors learned by the model in the Amazon dataset. Figure 3 (b) in the figure shows the distribution of attention coefficients for various neighbors learned by the model in the Yelp dataset. Figure 3 (c) in the figure represents the model’s attention scores for the three relationship graphs of positive and negative nodes in the Amazon dataset. Figure 3 (d) in the figure represents the model’s attention scores for the three relationship graphs of positive and negative nodes in the Yelp dataset. Figure 3 (e) in the figure represents the attention scores of the model classification task on its own features, three relationship graphs, and global context features in the Amazon dataset. Figure 3 (f) in the figure represents the attention scores of the model classification task on its own features, three relationship graphs, and global context features in the Yelp dataset.

[0099] Figure 3 Figures (a) and (b) in the figure show that positive nodes have a higher attention coefficient to positive neighbors, and negative nodes have a higher attention coefficient to negative neighbors. This phenomenon is reflected in both Amazon and Yelps datasets. Figures (c) and (d) show that the attention scores of the Amazon dataset for the three relationship graphs are almost equal, while the attention scores of the Yelp dataset for the three relationship graphs are significantly different. Analysis of the datasets shows that in Amazon, the number of nodes appearing in each relationship graph is not much different, while in the Yelp dataset, the number of nodes appearing in the RSR relationship graph is significantly more than that in the RUR graph. Correspondingly, the attention score of the model for the RSR relationship graph in the Yelp dataset is also significantly higher than that for the RUR relationship graph. Therefore, the analysis shows that the number of nodes in the relationship graph has a significant impact on the model's attention score in the relationship graph. Figures (d) and (e) show that after using the global context feature to guide the edge weight calculation, the noise edge filtering of some relationship graphs is indeed effective, so that the weight coefficient of the features learned in the corresponding relationship graph becomes larger during the final feature learning.

[0100] The average time of testing the model on the test set of different data sets is recorded and a bar chart is drawn to obtain Figure 4 .from Figure 4 It is found that the running time of the GIR model of the present invention is the shortest in both data sets, which proves that the model runs faster than the baseline model.

[0101] It is to be understood that the present invention is described by some embodiments, and it is known to those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the scope of protection of the present invention.

Claims

1. A context-based method for detecting fraudulent nodes in multiple financial relationship graphs, characterized in that: The steps include: Step S1: Preprocessing of graph structure data set constructed based on financial field data: In each relationship graph, the neighbors of the node in this relationship graph are divided into 5 sets, namely: the positive node set with first-order known labels, the negative node set with first-order known labels, the positive node set with second-order known labels, the negative node set with second-order known labels, and the node set with second-order unknown labels; after performing feature pooling on each neighborhood node set, the neighborhood pooling feature matrix of the node is obtained by combining; Step S2: Calculate global context features for each node: Generate global context features for each node using the neighborhood average feature matrix and attention mechanism; Step S3: In each relationship graph, the weight of the edge is calculated using the global context features to filter out the noise edges: the weight of the edge is calculated using the original features of the nodes on both sides of the edge and the global context features; Step S4: in each relationship graph, after filtering the noise edges, the semantic features under the relationship graph are calculated for each node; Step S5: horizontally splice the node's own features, the node's global context features, and the node's semantic features under any relationship graph, and obtain the final feature representation of the node through a multi-layer perceptron MLP; Step S6: Use cross entropy loss back propagation to update all trainable parameters to train the model: predict the probability of a node being a positive node or a negative node; The loss function is calculated by combining the probability and the true label, and the parameter training model is updated through gradient back propagation; Step S7: Detect fraudulent nodes using the trained model.

2. The method for detecting fraudulent nodes in a multi-financial relationship graph based on context according to claim 1, characterized in that: In step S1, The dataset is graph structured data in is a node set, It is a matrix composed of the original features of all nodes, N represents the number of nodes, and s represents the number of dimensions of the original features; is the edge set, ε r is the edge set under the specified relationship type r, R represents the total number of types of relationship graphs, is the label set of all nodes; represents the i-th node in the graph, is the label of this node; for node v i , in the graph of relation r, the neighbors are divided into: the set of positive nodes with first-order known labels The set of negative nodes with first-order known labels The set of positive nodes with second-order known labels Second-order known-label negative node set Second-order node set with unknown labels For node v i The node features in all neighbor node sets under all relationship graphs are averaged and pooled, and then the i-th node v is obtained after combination. i Neighborhood pooling feature matrix 3. The context-based multi-financial relationship graph fraud node detection method according to claim 2, characterized in that: The global context features in step S2 are calculated as follows: in Represents the global context feature of the i-th node; att i，j represents the weight between the i-th node and the j-th neighborhood; exp(·) is the exponential function applied to the value e; represents the neighborhood pooling feature matrix of the i-th node, E represents the standard normal distribution weight matrix, which is used to distinguish different types of neighborhood node sets; and S i After adding, we get Represents the neighborhood pooling feature matrix of the i-th node after the neighborhood is distinguished; is the neighborhood pooling feature matrix obtained by the i-th node in the j-th neighborhood after being differentiated by E, The specified dimension feature is intercepted in the i is the original feature of the i-th node, W q , W k , W v are all trainable weight matrices, Q i is x i In W q The features in the mapping space, K i，j yes In W k The features in the mapping space, V i，j yes In W v Mapping space features.

4. The context-based multi-financial relationship graph fraud node detection method according to claim 3, characterized in that: The weight of the edge in step S3 is calculated as follows: Where W w is the trainable weight matrix, x i is the i-th node v i The original characteristics of is node v i The global context feature, x j is the jth node v j The original characteristics of is node v j The global context feature of . Concat(·) is a concatenation function. Indicates that x i , x j , These four vectors are concatenated horizontally. Sigmoid(·) is the activation function, and its calculation formula is w i，j is node v i and node v j The weight between them ranges from 0 to 1.

5. The method for detecting fraudulent nodes in a multi-financial relationship graph based on context according to claim 4, characterized in that: The semantic features in step S4 are calculated in the following way: in is node v i Semantic features extracted from the graph with relation r. r (v i ) represents node v i The set of neighbors on the graph with relation r, N r (v j ) represents node v j The set of neighbors on the graph of relation r, w i，j is node v i and node v j The weight between i，k Represents node v i and node v k The weight between j，k Represents node v j and node v k The weight between j represents the original feature of the jth node, W r is a trainable weight matrix. Used to represent node v i The importance of Used to represent node v j degree of importance.

6. The context-based multi-financial relationship graph fraud node detection method according to claim 5, characterized in that: The final feature representation in step S5 is calculated as follows: Where W c is the weight matrix, z i is the final feature representation of the i-th node.

7. The context-based multi-financial relationship graph fraud node detection method according to claim 6, characterized in that: In step S6, the probability of predicting whether the node is a positive node or a negative node after feature mapping is calculated by the following method: in is the predicted probability distribution of the ith node, W1, W2 are weight matrices, b1, b2 are biases, W1, W2, b1, b2 are all trainable parameters; σ(·) is the activation function, and the ReLU activation function is selected; ReLU(x) = max(x, 0); The loss function is calculated by combining the probability and the true label, and the parameter training model is updated through gradient back propagation. The loss function of the classification task is calculated by the following formula: V train Represents the set of all nodes in the training set, y i is the true label of the ith node, is the predicted probability distribution of the ith node, It is the sum of the L2 norms of all trainable parameters involved in the model, which is used to constrain the model to prevent over-fitting caused by over-training; α is a hyperparameter with a positive value range; The trainable parameters in the model are differentiated by the loss function, and an effective model is obtained after multiple gradient updates.

Images