Data processing method and device applied to joint fraud detection network

Abstract

The invention discloses a data processing method and device applied to a joint fraud detection network, a training method and device of the joint fraud detection network, a joint fraud detection method and device, a multi-party security computing system and a joint fraud detection system. The data processing method comprises the following steps: acquiring single-party ciphertext embedded data of each participant; in a joint graph embedding layer of the joint fraud detection network, taking any one of a plurality of participants as a detection party, and sorting resource IDs of the plurality of participants and embedding characteristics which correspond to the resource IDs and are matched with a resource node type based on the single-party ciphertext embedding data, so that the same resource IDs are continuously arranged; and traversing the sorted resource IDs in sequence, and determining joint embedding features, corresponding to the resource node types, of the detection party by using the embedding features corresponding to the same resource IDs, so as to obtain joint embedding data of the detection party by using the determined joint embedding features corresponding to the plurality of resource node types of the detection party.

Description

Technical Field

[0001] The present application relates to the technical field of fraud detection, and specifically to a data processing method and device applied to a joint fraud detection network, a training method and device for a joint fraud detection network, a joint fraud detection method and device, a multi-party secure computing system, and a joint fraud detection system. Background Art

[0002] Graph Neural Network (GNN) can learn graph data and extract and explore information in graph data to meet graph learning tasks such as clustering, classification, prediction, segmentation, and generation. It has been widely used in social network analysis, fraud detection, recommendation systems, and bioinformatics.

[0003] Taking fraud detection as an example, there are various frauds on the Internet. However, the frauds of fraudsters are often not limited to a single party (such as a single company or platform), that is, the same fraud resources (such as phone numbers or IP addresses) may be used to attack multiple parties. For example, fraudsters may post false reviews for the same product on shopping platform A and shopping platform B. By using the commercial data of multiple parties (multiple companies and / or platforms) to train graph neural networks, a graph neural network for detecting multi-party fraud can be obtained.

[0004] However, there may be a risk of leaking / exposing business data during the training process; therefore, in order to protect the business data of each party, a multi-party secure computing system and the ciphertext of each party's business data can be used for multi-party secure computing. However, when the amount of data processed by the multi-party secure computing system (for example, data involving millions of users) is large, it will lead to low computing efficiency, which in turn makes the training efficiency of the graph neural network very low.

[0005] Therefore, how to improve the training efficiency of graph neural networks trained using multi-party secure computing systems to detect multi-party fraud is a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of the shortcomings of the related technologies mentioned above, the purpose of the present application is to provide a data processing method and device for a joint fraud detection network, a training method and device for a joint fraud detection network, a joint fraud detection method and device, a multi-party secure computing system, and a joint fraud detection system, so as to solve the technical problem of how to improve the training efficiency of a graph neural network used to detect multi-party fraud using a multi-party secure computing system.

[0007] To achieve the above-mentioned purpose and other related purposes, the first aspect of the present application provides a data processing method applied to a joint fraud detection network, wherein a joint graph embedding layer in the joint fraud detection network is configured in a multi-party secure computing system, and the multi-party secure computing system is communicatively connected with multiple participants performing joint fraud detection, and the data processing method comprises: obtaining unilateral ciphertext embedding data of each participant; wherein the unilateral ciphertext embedding data includes a ciphertext of a resource ID and a ciphertext of a corresponding embedding feature; in the joint graph embedding layer, taking any one of the multiple participants as a detection party, and sorting the resource IDs of the multiple participants and the embedding features corresponding to each resource ID and matching a resource node type based on the unilateral ciphertext embedding data, so that the same resource IDs are arranged continuously; traversing the sorted resource IDs in order and using the embedding features corresponding to the same resource ID to determine the joint embedding features of the detection party corresponding to the resource node type, so as to obtain the joint embedding data of the detection party using the determined joint embedding features corresponding to multiple resource node types of the detection party.

[0008] The second aspect of the present application provides a data processing device applied to a joint fraud detection network, wherein a joint graph embedding layer in the joint fraud detection network is configured in a multi-party secure computing system, and the multi-party secure computing system is communicatively connected to multiple participants performing joint fraud detection, and the data processing device includes: an acquisition module, used to acquire the single-party ciphertext embedded data of each participant; wherein the single-party ciphertext embedded data includes the ciphertext of the resource ID and the ciphertext of the corresponding embedded feature; a sorting module, used to, in the joint graph embedding layer, take any one of the multiple participants as a detection party, and sort the resource IDs of the multiple participants and the embedded features corresponding to each resource ID and matching a resource node type, so that the same resource IDs are arranged continuously; a joint embedded data calculation module, used to traverse the sorted resource IDs in order and use the embedded features corresponding to the same resource ID to determine the joint embedded features of the detection party corresponding to the resource node type, so as to obtain the joint embedded data of the detection party using the determined joint embedded features corresponding to multiple resource node types of the detection party.

[0009] A third aspect of the present application provides a training method for a joint fraud detection network, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is communicatively connected to multiple parties performing joint fraud detection, and the joint fraud detection network includes a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification subnetwork connected to the joint graph embedding layer. The training method includes: inputting the joint embedding data of multiple parties obtained by using the data processing method applied to the joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application into the fraud classification subnetwork to obtain fraud detection results for the multiple parties; and adjusting the parameters of the joint fraud detection network using the preset fraud labels of the multiple parties and the fraud detection results until the training stop condition is reached.

[0010] The fourth aspect of the present application provides a training device for a joint fraud detection network, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is communicatively connected to multiple participants performing joint fraud detection, and the joint fraud detection network includes a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification subnetwork connected to the joint graph embedding layer. The training device includes: a detection module, which is used to input the joint embedding data of multiple participants obtained by using a data processing device applied to a joint fraud detection network as disclosed in the second aspect of the present application into the fraud classification subnetwork in the joint fraud detection network to obtain fraud detection results for multiple participants; a parameter adjustment module, which is used to adjust the parameters of the joint fraud detection network using preset fraud labels of multiple participants and the fraud detection results until the training stop condition is reached.

[0011] A fifth aspect of the present application provides a joint fraud detection method, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is communicatively connected to multiple participants performing joint fraud detection, and the joint fraud detection network includes a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification subnetwork connected to the joint graph embedding layer. The joint fraud detection method includes: obtaining unilateral ciphertext embedding data of each participant, and obtaining the joint embedded data of multiple participants using the data processing method applied to the joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application; and performing fraud detection on the joint embedded data of multiple participants using the fraud classification subnetwork trained by the training method of the joint fraud detection network disclosed in the third aspect of the present application to obtain fraud detection results corresponding to the multiple participants.

[0012] The sixth aspect of the present application provides a joint fraud detection device, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is communicatively connected to multiple participants performing joint fraud detection, and the joint fraud detection network includes a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification subnetwork connected to the joint graph embedding layer. The joint fraud detection device includes: a joint embedding module, which is used to obtain the single-party ciphertext embedding data of each participant, and obtain the joint embedded data of multiple participants using the data processing device applied to the joint fraud detection network as disclosed in the second aspect of the present application; a detection module, which is used to perform fraud detection on the joint embedded data of multiple participants using the fraud classification subnetwork trained by the training device of the joint fraud detection network disclosed in the fourth aspect of the present application to obtain fraud detection results corresponding to the multiple participants.

[0013] The seventh aspect of the present application provides a multi-party secure computing system, including multiple computing devices, each of which is configured in a mutually untrusted computing system architecture; wherein a multi-party secure computing protocol is pre-installed in each computing device, and the multi-party secure computing protocol is used to execute with at least another computing device based on the multi-party secure computing protocol a data processing method applied to a joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application, a training method for a joint fraud detection network as disclosed in the third aspect of the present application, or a joint fraud detection method as disclosed in the fifth aspect of the present application.

[0014] An eighth aspect of the present application provides a joint fraud detection system, comprising a plurality of participants and a multi-party secure computing system as disclosed in the seventh aspect of the present application, which is communicatively connected to the plurality of participants.

[0015] The ninth aspect of the present application provides a computer device, comprising: a storage device for storing at least one program; a processing device, connected to the storage device, for calling the at least one program from the storage device and executing it to implement the data processing method applied to the joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application, the training method of the joint fraud detection network as disclosed in the third aspect of the present application, or the joint fraud detection method as disclosed in the fifth aspect of the present application.

[0016] The tenth aspect of the present application provides a computer-readable storage medium storing at least one program, which, when called, executes and implements the data processing method applied to a joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application, the training method of the joint fraud detection network as disclosed in the third aspect of the present application, or the joint fraud detection method as disclosed in the fifth aspect of the present application.

[0017] The eleventh aspect of the present application provides a computer program product. When the computer program product runs on a computer, the computer executes the data processing method applied to the joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application, the training method of the joint fraud detection network as disclosed in the third aspect of the present application, or the joint fraud detection method as disclosed in the fifth aspect of the present application.

[0018] In summary, the data processing method and device applied to a joint fraud detection network, the training method and device of a joint fraud detection network, the joint fraud detection method and device, the multi-party secure computing system, and the joint fraud detection system provided by the present application sort the resource IDs of the multiple participants and the embedded features corresponding to each resource ID and matching a resource node type so that the same resource IDs are arranged continuously; then, the sorted resource IDs are traversed in sequence and the embedded features corresponding to the same resource IDs are used to determine the joint embedded features of the detection party corresponding to the resource node type, so as to obtain the joint embedded data of the detection party using the joint embedded features corresponding to the multiple resource node types of the determined detection party; in this way, by arranging the same resource ID continuously, it is not necessary to traverse the resource IDs of all participants multiple times when calculating the joint embedded features corresponding to a resource node type, but only needs to be traversed once, thereby improving the calculation efficiency of the joint embedded data to improve the training efficiency of the joint fraud detection network trained using the multi-party secure computing system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The specific features of the present application are shown in the attached claims. The features and advantages of the invention involved in the present application can be better understood by referring to the exemplary embodiments and drawings described in detail below. The drawings are briefly described as follows:

[0020] Figure 1 Shown is a schematic diagram of multiple-party fraud behavior in one embodiment of the present application.

[0021] Figure 2 Shown is a schematic diagram of a joint fraud detection system in one embodiment of the present application.

[0022] Figure 3 Shown is a structural diagram of a multi-party secure computing system in one embodiment of the present application.

[0023] Figure 4 Shown is a flowchart of a training method for a joint fraud detection network in one embodiment of the present application.

[0024] Figure 5 Shown is a schematic diagram of the configuration location of the joint fraud detection network in one embodiment of the present application.

[0025] Figure 6 Shown is a schematic diagram of the configuration location of a joint fraud detection network in another embodiment of the present application.

[0026] Figure 7 It is a schematic diagram of the process of calculating and obtaining unilateral ciphertext embedded data by a participant in a sub-embedding layer in one embodiment of the present application.

[0027] Figure 8a and Figure 8b Schematic diagrams showing unilateral embedded data obtained by different parties in one embodiment of the present application are shown respectively.

[0028] Fig. 9 Shown is a flow chart of a data processing method applied to a joint fraud detection network in one embodiment of the present application.

[0029] Fig.10 Shown is a schematic diagram of a joint embedding feature corresponding to a resource node type of a detection party obtained by using a data processing method applied to a joint fraud detection network in one embodiment of the present application.

[0030] Fig.11 Shown is a flowchart of a joint fraud detection method in one embodiment of the present application.

[0031] Fig.12 Shown is a structural block diagram of a data processing device applied to a joint fraud detection network in one embodiment of the present application.

[0032] Fig.13 Shown is a structural block diagram of a training device for a joint fraud detection network in one embodiment of the present application.

[0033] Fig.14 Shown is a structural block diagram of a joint fraud detection device in one embodiment of the present application.

[0034] Fig.15 Shown is a schematic diagram of the structure of a computer device in one embodiment of the present application. DETAILED DESCRIPTION

[0035] The following is an explanation of the implementation of the present application by means of specific embodiments. People familiar with the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification.

[0036] The present application is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The technical solutions in the embodiments of the present application are clearly and completely described. Obviously, the described embodiments are only embodiments of a part of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application. "An implementation method", "implementation method" or similar expressions mentioned in the whole text of this specification mean that the specific features, structures or characteristics described together with the implementation method are included in at least one embodiment of the present application. Therefore, in the whole text of this specification, the appearance of the phrases "in an implementation method", "in an implementation method" and similar expressions may (but not necessarily) relate to the same implementation method.

[0037] As mentioned in the background, the fraudulent behavior of the fraudster is not limited to one party, for example, see Figure 1 , which is a schematic diagram of multi-party fraud in one embodiment of the present application. As shown in the figure, user B and user C respectively give good reviews to clothing 1 on platform F, and user D also gives good reviews to clothing 1 on platform G, but the IP addresses of the three are the same, all IP2, so user B, user C, and user D can be identified as fraudulent users who give good reviews. If each party performs fraud detection independently, it is impossible to effectively detect fraudulent behavior of multiple parties. For example, platform G cannot detect that user D is a fraudulent user.

[0038] By using the business data of multiple parties (multiple companies and / or platforms) to train a graph neural network, a graph neural network for detecting multi-party fraud can be trained. However, there may be a risk of leaking / exposing business data during the training process; therefore, in order to protect the business data of each party, the ciphertext of each party's business data can be used in a multi-party secure computing system to perform multi-party secure computing. When the amount of data processed by the multi-party secure computing system is large, it will lead to low computing efficiency. For example, the business data of multiple participants involves data of more than millions of users. The data of a large number of users leads to low efficiency of multi-party secure computing. Therefore, how to improve the training efficiency of graph neural networks trained using a multi-party secure computing system for detecting multi-party fraud is a technical problem that needs to be solved urgently.

[0039] In view of this, some embodiments provided in the present application disclose a data processing method applied to a joint fraud detection network, wherein a joint graph embedding layer in the joint fraud detection network is configured in a multi-party secure computing system, and the multi-party secure computing system is communicatively connected with multiple participants performing joint fraud detection. First, in the joint graph embedding layer, any one of the multiple participants is used as a detection party, and based on the acquired unilateral ciphertext embedding data of each participant, the resource IDs of the multiple participants and the embedding features corresponding to each resource ID and matching a resource node type are sorted so that the same resource IDs are arranged continuously; then , traverse the sorted resource IDs in order and use the embedding features corresponding to the same resource ID to determine the detection party to obtain the joint embedding features corresponding to the resource node type, so as to use the joint embedding features corresponding to multiple resource node types of the determined detection party to obtain the joint embedding data of the detection party; in this way, by arranging the same resource IDs continuously, it is not necessary to traverse the resource IDs of all participating parties multiple times when calculating the joint embedding features corresponding to a resource node type, but only one traversal is required, thereby improving the calculation efficiency of the joint embedding data to improve the training efficiency of the joint fraud detection network trained by the multi-party secure computing system.

[0040] See also Figure 2 , which is a schematic diagram of a joint fraud detection system in one embodiment of the present application. As shown in the figure, the joint fraud detection system includes multiple participants 10 and a multi-party secure computing system 11 that is communicatively connected to the multiple participants 10. Each participant 10 sends its unilateral ciphertext data to the multi-party secure computing system 11, and the multi-party secure computing system 11 uses the acquired unilateral ciphertext data sent by the multiple participants 10 to execute the training method of the joint fraud detection network. Among them, the users in each participant are different. For example, the registered accounts of the same person after registering in different participants are considered to be different users. It should be noted that the multiple participants described in the present application refer to two or more participants.

[0041] In one embodiment, the participant is, for example, a company or a server of a platform. For example, the platform is a shopping platform or a service platform. For example, the company is a bank.

[0042] In one embodiment, a graph data can be determined based on the user of the participating party and the relevant information of the operation (e.g., shopping, loan) performed by the user in the participating party. Wherein, the graph data includes different types of nodes (e.g., user nodes and resource nodes). Specifically, the user of the participating party is the user node in the graph data of the participating party. For example, the user node is a registered user of the participating party. The relevant information of the operation (e.g., shopping, loan) performed by the user node in the participating party is the resource node; for example, the resource node includes the service obtained by the user in the participating party (e.g., loan service), the goods purchased by the user in the participating party, and / or the time when the user performs the operation, etc. The graph data also includes edges connecting resource nodes and user nodes. In a specific embodiment, the types of resource nodes include at least two, and then the edges in the graph data include edges corresponding to the type of each resource node. r , where r ranges from 1 to R, and there are R types of resource nodes. Examples of the types of resource nodes include commodity types (e.g., books, clothes), service types (e.g., loan services), time, identity information types (e.g., ID card number, passport number), and / or IP information. In an embodiment of the present application, the types of resource nodes may also be referred to as resource node types.

[0043] It should be noted that the type of the resource node is not limited to the above examples. The type of the resource node is related to the fraudulent behavior provided by multiple participants. For example, the fraudulent behavior provided by the participant is to comment on the same video at a similar time. Then the resource node includes the time and video of the comment.

[0044] In one embodiment, the user nodes included in the graph data are represented by user node numbers, and the resource nodes included in the graph data are represented by resource node numbers.

[0045] In one embodiment, the graph data includes the numbers of user nodes and resource nodes, the resource IDs of resource nodes, node features of each node, and one or more adjacency matrices corresponding to the types of resource nodes. Wherein, the multiple refers to two or more. In one example, the types of resource nodes include two types, and the graph data includes two adjacency matrices. In another example, the types of resource nodes may also include only one type, and the graph data includes only one adjacency matrix. It should be noted that each resource node has a number and a resource ID. In the following embodiments, an embedded feature can be referred to as an embedded feature of a resource node, also referred to as an embedded feature of a resource ID, and similar features include joint embedded features, etc.

[0046] In one embodiment, the user node numbers include N, where N is the number of user nodes. For example, each user node number is Y1 to YN The resource nodes are numbered M, where M is the number of resource nodes. For example, each resource node is numbered from Z1 to Z M Any one of them. Wherein, the same number does not exist in the graph data. The resource ID of the resource node represents the actual meaning of the resource node. For example, if the type of the resource node is a book, the resource ID of the resource node corresponding to the book type is exemplified by the name of the book. For another example, if the type of the resource node is clothing, the resource ID of the resource node corresponding to the clothing type is exemplified by different styles of clothing. The data dimensions of the node features of each node are the same. For example, each node feature is an H-dimensional matrix, where H is an integer. In one embodiment, the node features are related to the type of node and the statistical features of the node. In one example, the graph data includes R types of resource nodes, and the statistical features of the nodes are T-dimensional vectors. Then each node feature includes an R+T+1-dimensional vector, one dimension indicating whether the node is a user node, R dimensions indicating which type of resource node the node belongs to, and the remaining T dimensions representing the statistical features of the node; wherein R and T are both integers. The adjacency matrix A corresponding to a type of resource node r The edge L that connects all resource nodes of this type to the user node r .

[0047] In one embodiment, the fraud classification subnetwork in the joint fraud detection network can be trained using the graph data and the fraud labels corresponding to the graph data; further, after the fraud classification subnetwork is trained, the fraudulent behavior existing in each participant can be detected based on the graph data of each participant and the joint fraud detection network.

[0048] However, the amount of graph data in each participant is large, which leads to a slow training and detection speed of the joint fraud detection network. In order to improve the training speed and detection speed of the joint fraud detection network, each participant uses the detection model to screen the user nodes locally to obtain normal user nodes predicted as normal users and fraud user nodes predicted as fraud users, wherein the suspicious probability of the normal user node is lower than the first preset threshold, the suspicious probability of the fraud user node is higher than the second preset threshold, and the first preset threshold is less than the second preset threshold; then, the normal user node and the fraud user node are used as user nodes in the graph data for training the joint fraud detection network, and the remaining user nodes (suspicious nodes that cannot be accurately determined as normal user nodes or fraud user nodes) are used as suspicious nodes in the graph data for detection. In other words, the user nodes whose suspicious probabilities are between the first preset threshold and the second preset threshold are used as suspicious nodes in the graph data for detection. Correspondingly, the corresponding resource nodes in the graph data for training the joint fraud detection network are resource nodes connected to the fraud user nodes and the normal user nodes, and the corresponding resource nodes in the graph data for detection are resource nodes connected to the suspicious nodes. The detection model may be any graph neural network that can detect fraudulent behavior.

[0049] Furthermore, in one embodiment, the graph data also includes a numerical value of the suspicious probability, where the suspicious probability is the probability that the user node is suspected of being a fraudulent user.

[0050] In one embodiment, each of the participants may also encrypt the graph data used for training the joint fraud detection network or the graph data used for detection based on the multi-party secure computing protocol of the multi-party secure computing system to obtain the ciphertext graph data of the participant's graph data. For example, the participant obtains the multi-party secure computing protocol sent by the multi-party secure computing system, and encrypts the graph data based on the multi-party secure computing protocol to obtain the ciphertext graph data.

[0051] In one embodiment, see Figure 3, which is a schematic diagram of the structure of a multi-party secure computing system in one embodiment of the present application. As shown in the figure, the multi-party secure computing system includes multiple computing devices, each of which is configured in a mutually untrusted computing system architecture, wherein a multi-party secure computing protocol is pre-installed in each computing device, and secure computing is performed with at least another computing device based on the multi-party secure computing protocol to execute a data processing method applied to a joint fraud detection network, a training method for a joint fraud detection network, or a joint fraud detection method. Specifically, there is no trust between the computing devices in the mutually untrusted computing system architecture, that is, each computing device will not actively collude with other computing devices to share their own input ciphertexts, nor will it actively collude with other computing devices to share the calculation results obtained according to the received multi-party secure computing instructions.

[0052] In one example, upon receiving a multi-party secure computing instruction, each computing device performs a multi-party secure computing with at least one other computing device based on the multi-party secure computing protocol and the obtained ciphertext. Here, the multi-party secure computing system further includes a task management platform (not shown), which divides the task to be performed into multi-party secure computing instructions for secure computing by multiple computing devices according to the task to be performed (e.g., executing a data processing method applied to a joint fraud detection network) and the multi-party secure computing protocol, so as to be executed by each computing device. Examples of the multi-party secure computing instructions include instructions for instructing a computing device to obtain a ciphertext, instructions for performing mathematical calculations and / or logical calculations, and instructions for instructing a computing device to process a calculation result, etc.

[0053] In one embodiment, the ciphertext is obtained by dispersing using secret sharing technology. The secret sharing technology is to split the plaintext (such as the resource ID of the plaintext, the embedded features of the plaintext) in an appropriate manner, and each of the dispersed ciphertexts is received by a different computing device. A single computing device cannot restore the plaintext, and only a number of computing devices can work together to restore the plaintext.

[0054] In one embodiment, the multi-party secure computing protocol is set based on the distribution mode of the ciphertext and the number of the computing devices configured in the mutually untrusted computing system architecture. The multi-party secure computing protocol is different if the distribution mode of the ciphertext and the number of the computing devices configured in the mutually untrusted computing system architecture are different. In one embodiment, the multi-party secure computing protocol is a process of instructing and scheduling multi-party secure computing of corresponding computing tasks performed by each computing device in the multi-party secure computing system, which includes but is not limited to: describing the multi-party secure computing execution process of computing tasks such as addition, subtraction, multiplication or division, describing the multi-party secure computing execution process of computing tasks such as logical and, or, non, XOR, comparison, etc. In the implementation mode of the present application, the number of the computing devices is four, and the multi-party secure computing instruction is designed by the task management platform to execute the computing task based on the multi-party secure computing mode of the collaborative execution of four computing devices, wherein the computing task is used to perform data processing on the ciphertext (such as single-party ciphertext embedded data).

[0055] Furthermore, in order to ensure the security of communication between the computing devices, the multi-party secure computing system also includes a hardware security module that is in communication with each of the computing devices, and the hardware security module is used to provide cryptographic operations for the multi-party secure computing performed by each of the computing devices, so that each computing device, when receiving the multi-party secure computing instruction, performs multi-party secure computing with at least another computing device based on the encryption and decryption operations corresponding to the cryptographic operations, the multi-party secure computing protocol, and the obtained ciphertext, so as to execute the data processing method applied to the joint fraud detection network, the training method of the joint fraud detection network, or the joint fraud detection method. The cryptographic operations include generating key pairs, generating random numbers, generating authentication certificates, deriving keys, updating keys, and providing public key infrastructure.

[0056] It should be noted that, based on the aforementioned principle description of the multi-party secure computing system, those skilled in the art can clearly understand how to perform multi-party secure computing according to the tasks that the multi-party secure computing system needs to perform (e.g., a data processing method applied to a joint fraud detection network, a training method for a joint fraud detection network, and / or each step in the joint fraud detection method) and the acquired ciphertext to implement the data processing method applied to the joint fraud detection network, the training method for the joint fraud detection network, and / or the joint fraud detection method. In the following embodiments, only the tasks / steps that the multi-party secure computing system needs to perform are described.

[0057] See also Figure 4, which is a flow chart of a training method for a joint fraud detection network in one embodiment of the present application, as shown in the figure, the training method for the joint fraud detection network includes step S110 and step S120. The training method for the joint fraud detection network is applied to a multi-party secure computing system, in other words, the training method for the joint fraud detection network is executed by the multi-party secure computing system.

[0058] In one embodiment, the joint fraud detection network includes a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification sub-network connected to the joint graph embedding layer. In a specific embodiment, the joint fraud detection network sequentially includes a single-party graph embedding layer configured in multiple participants, the joint graph embedding layer, and a fraud classification sub-network configured in the multi-party secure computing system; wherein each participant is configured with a sub-embedding layer of the single-party graph embedding layer, so that each participant uses its local graph data to perform embedding calculations in the sub-embedding layer. For example, see Figure 5 , which is a schematic diagram showing the configuration position of the joint fraud detection network in one embodiment of the present application. As shown in the figure, each sub-embedding layer of the unilateral graph embedding layer is configured on the participating party 10, the joint graph embedding layer is configured on the multi-party secure computing system 11, and the fraud classification sub-network directly connected to the joint graph embedding layer is configured on the multi-party secure computing system 11. In this way, by transferring part of the calculation of the training method or the joint fraud detection method to the local of the participating party, the speed of training and detection based on ciphertext of the multi-party secure computing system can be accelerated. In another specific embodiment, the joint fraud detection network sequentially includes a unilateral graph embedding layer, the joint graph embedding layer, and a fraud classification sub-network configured on the multi-party secure computing system. For example, refer to Figure 6 , showing a schematic diagram of the configuration position of the joint fraud detection network in another embodiment of the present application. As shown in the figure, the unilateral graph embedding layer, the joint graph embedding layer directly connected to the unilateral graph embedding layer, and the fraud classification subnetwork directly connected to the joint graph embedding layer are sequentially configured on the multi-party secure computing system 11.

[0059] In one embodiment, there are no trainable network parameters in the unilateral graph embedding layer and the joint graph embedding layer, so that the training speed of the joint fraud detection network can be accelerated. In another embodiment, the unilateral graph embedding layer and / or the joint graph embedding layer may also include trainable first network parameters. For example, the first network parameters may be introduced by the ReLU nonlinear activation function between the unilateral graph embedding layer and the joint graph embedding layer.

[0060] In step S110, the multi-party secure computing system inputs the joint embedded data of multiple participants obtained by using the data processing method applied to the joint fraud detection network into the fraud classification subnetwork to obtain fraud detection results of the multiple participants.

[0061] In one embodiment, the data processing method applied to the joint fraud detection network obtains the unilateral ciphertext embedded data of each participant, and uses the unilateral ciphertext embedded data to calculate the joint embedded data of multiple participants. In the embodiment where the unilateral graph embedding layer is configured for the multiple participants, the unilateral ciphertext embedded data is obtained by the participant after embedding and encrypting its graph data in the sub-embedding layer. In the embodiment where the unilateral graph embedding layer is configured in a multi-party secure computing system, the unilateral ciphertext embedded data is obtained by embedding and calculating the ciphertext graph data of the participant in the unilateral graph embedding layer of the multi-party secure computing system, wherein the ciphertext graph data is obtained after the participant encrypts its graph data, and then each participant sends its ciphertext graph data to the multi-party secure computing system for the multi-party secure computing system to calculate the unilateral ciphertext embedded data.

[0062] In one embodiment, see Figure 7 , which is a flow chart of a participant calculating and obtaining unilateral ciphertext embedded data in a sub-embedded layer in one embodiment of the present application. As shown in the figure, the step of the participant performing embedding calculation and encryption on its graph data in the sub-embedded layer to obtain the unilateral ciphertext embedded data includes step S210 and step S220. It should be noted that the participant uses the plaintext of its graph data to locally execute step S210 and step S220 to obtain the unilateral ciphertext embedded data.

[0063] In step S210, the participant obtains the unilateral embedding data including the embedding features of the resource nodes by using the adjacency matrix corresponding to each resource node type and the node features of each node. Specifically, the unilateral embedding data H of each participant is l It can be calculated by the following formula:

[0064]

[0065] H 1；r =A r X

[0066] Among them, H 1；r are all embedded features of the rth type of resource nodes, R is the number of resource node types in the graph data, and A r is the adjacency matrix corresponding to the rth type of resource node, X is the node feature of all nodes in the graph data, is the concatenation operation of matrices. For example, the embedding features of all resource nodes of the first type are the matrix {a1; b1}, and the embedding features of all resource nodes of the second type are the matrix {a2; b2}. After performing the concatenation operation on the two matrices, the matrix of embedded features is obtained as

[0067] In one embodiment, the embedded features include node features of user nodes connected to the resource nodes. Specifically, the sub-embedding layer can determine the connection between the resource nodes of the type r and the user nodes according to the adjacency matrix corresponding to the resource nodes of the type r, and then obtain all embedded features of the resource nodes of the type based on the node features of the user nodes connected to the resource nodes, and the unilateral embedded data can be obtained after performing a splicing operation on all embedded features of resource nodes of different types. For example, a type of adjacency matrix represents that only resource nodes X1 and X2 are included, and there is an edge connection between resource node X1 and user node U1, and there is an edge connection between resource node X2 and user nodes U1 and U2, then the embedded feature of resource node X1 is the node feature of U1, and the embedded feature of resource node X2 is the node feature of U1 and U2.

[0068] In one specific embodiment, see Figure 8a and Figure 8b , which are schematic diagrams showing unilateral embedded data obtained by different parties in one embodiment of the present application, such as Figure 8a As shown, V1, V2, V3, and V4 are resource IDs of resource nodes, U1, U2, U3, and U4 are user nodes, and the solid lines and dotted lines represent the edges corresponding to different types of resource nodes. Figure 8a The participants can determine all embedded features H of the first type of resource nodes based on the adjacency matrix A1 corresponding to the first type of resource nodes and the node features X of all nodes in the graph data. 1；1 ={node feature of U1; node features of U1 and U3; 0; 0}, according to the adjacency matrix A2 corresponding to the second type of resource nodes and the node features X of all nodes in the graph data, all embedded features H of the second type of resource nodes can be determined 1；2 ={0; 0; node features of U3 and U4; node features of U2}, and then after performing the splicing operation, we can get Figure 8a Unilateral embedded data of the participants like Figure 8b As shown, Figure 8b The solid lines and dashed lines also represent the edges corresponding to different types of resource nodes, and Figure 8b The dashed line represents the edge and Figure 8a The edges represented by the dashed lines belong to the edges corresponding to the resource nodes of the same type, and Figure 8b The solid lines represent the edges and Figure 8aThe edges represented by the solid lines belong to the edges corresponding to the resource nodes of the same type; similarly, Figure 8b The participants can determine all embedded features H of the first type of resource nodes based on the adjacency matrix A1 corresponding to the first type of resource nodes and the node features X of all nodes in the graph data. 1；1 ={node feature of U6; 0; node features of U7 and U8}, according to the adjacency matrix A2 corresponding to the second type of resource nodes and the node features X of all nodes in the graph data, all embedded features H of the second type of resource nodes can be determined 1；2 ={0; node features of U5 and U7; 0}, and then after performing the splicing operation, we can get Figure 8b The unilateral embedded data of the participants It should be noted that the 0 in all embedded features of a type of resource node is used for padding to ensure the consistency of the data dimensions of the embedded features corresponding to all resource node types. In other words, the resource node corresponding to the embedded feature of 0 in all embedded features of a type of resource node does not belong to the resource node of this type. For example, H in the above embodiment 1；1 ={node feature of U6; 0; node features of U7 and U8}, where 0 indicates that V3, V1 and V5 are resource IDs of resource nodes of different types.

[0069] In another embodiment, please continue to refer to Figure 8a and Figure 8b , set the node characteristics of each node to 1, then Figure 8a All embedded features H of the corresponding resource nodes of the first type 1；1 ={1;2;0;0}, Figure 8a All embedded features H of the corresponding second type of resource nodes 1；2 ={0;0;2;1}. Figure 8b All embedded features H of the corresponding resource nodes of the first type 1；1 ={1;0;2}, Figure 8b All embedded features H of the corresponding second type of resource nodes 1；2 ={0;2;0}.

[0070] In one embodiment, in order to improve the computing time of the local and multi-party secure computing systems of the participants, the corresponding user nodes in the graph data used by the participants when performing embedding calculations in the sub-embedding layer are the fraudulent user nodes and normal user nodes that have been screened by the participants, and the corresponding resource nodes in the graph data used are the resource nodes connected to the fraudulent user nodes and the normal user nodes. In this way, using the screened nodes in training can reduce the computing time of the local and multi-party secure computing systems of the participants. For example, the adjacency matrix and node features used in step S210 are the adjacency matrix and node features corresponding to the screened fraudulent user nodes and the normal user nodes.

[0071] In one embodiment, in order to reduce the training time of the multi-party secure computing system, the resource nodes in the graph data are also screened to use the embedding features of suspicious resource nodes as the unilateral embedding data. Among them, the suspicious resource nodes are determined by fraudulent user nodes. For example, if the number of fraudulent user nodes connected to a resource node exceeds a preset number, the resource node is regarded as a suspicious resource node. In one embodiment, the proportion of suspicious resource nodes to all resource nodes is less than a preset proportion, and the preset proportion is exemplified by 10%, 20%, 30%, 40%, or 50%. Specifically, the proportion of suspicious resource nodes to all resource nodes is controlled by adjusting the size of the preset number.

[0072] After each participant obtains the unilateral embedded data of each party, each participant executes step S220 in the sub-embedding layer.

[0073] In step S220, the participating party encrypts the unilateral embedded data according to the multi-party secure computing protocol of the multi-party secure computing system to obtain the unilateral ciphertext embedded data.

[0074] Specifically, the participating party can obtain the unilateral ciphertext embedded data after encrypting the unilateral embedded data according to the multi-party secure computing protocol. Furthermore, the multi-party secure computing system can calculate the joint embedded data in the joint graph embedding layer based on the obtained unilateral ciphertext embedded data.

[0075] In one embodiment, the multi-party secure computing protocol indicates how to obtain the ciphertext for multi-party secure computing. In one example, the ciphertext for multi-party secure computing is obtained by randomly dispersing the plaintext into several parts. For example, the multi-party secure computing protocol indicates that the ciphertext is obtained by randomly dispersing the plaintext into four parts. In the following embodiment, taking the example of randomly dividing the plaintext into four parts to obtain the ciphertext, the participating parties use the single-party embedded data H obtained in step S210 according to the multi-party secure computing protocol. l Randomly divide into four parts to achieve the unilateral embedding data H lEncryption is performed to obtain the unilateral ciphertext embedded data. l The ciphertext is randomly divided into four ciphertexts h1, h2, h3, and h4 to obtain the single-party ciphertext embedded data {h1, h2, h3, and h4}, and each ciphertext in the single-party ciphertext embedded data is sent to different computing devices in the multi-party secure computing system respectively, so that the multi-party secure computing system can perform calculations based on the single-party ciphertext embedded data.

[0076] In one embodiment, in the embodiment where the single-party ciphertext embedded data is the ciphertext graph data of the participating party, the ciphertext graph data of the participating party is also obtained based on the multi-party secure computing protocol of the multi-party secure computing system.

[0077] Furthermore, the multi-party secure computing system utilizes the data processing method applied to the joint fraud detection network and the single-party ciphertext embedding data to obtain the joint embedding data of the participants, so as to speed up the training of the joint fraud detection network.

[0078] To this end, this application also provides a data processing method applied to a joint fraud detection network, see Fig. 9 , which is a flow chart of a data processing method applied to a joint fraud detection network in one embodiment of the present application. As shown in the figure, the data processing method applied to a joint fraud detection network includes step S310, step S320, and step S330.

[0079] In step S310, the multi-party secure computing system obtains the unilateral ciphertext embedded data of each participant.

[0080] Specifically, in an embodiment where the unilateral graph embedding layer is configured in the multiple participants, each participant sends the calculated unilateral ciphertext embedding data to the multi-party secure computing system so that the multi-party secure computing system can obtain the unilateral ciphertext embedding data. In other words, the joint graph embedding layer of the multi-party secure computing system can obtain the unilateral ciphertext embedding data. In an embodiment where the unilateral graph embedding layer is configured in the multi-party secure computing system, the multi-party secure computing system inputs the unilateral ciphertext embedding data calculated in the unilateral graph embedding layer into the joint graph embedding layer so that the joint graph embedding layer can obtain the unilateral ciphertext embedding data; further, after the joint graph embedding layer obtains the unilateral ciphertext embedding data, the joint embedding data of the participants / detection parties can be calculated in the joint graph embedding layer.

[0081] In one embodiment, the one-way ciphertext embedded data includes the ciphertext of the resource ID and the ciphertext of the corresponding embedded feature.

[0082] In step S320, the multi-party secure computing system takes any one of the multiple participants as a detection party in the joint graph embedding layer, and sorts the resource IDs of the multiple participants and the embedding features corresponding to each resource ID and matching a resource node type based on the ciphertext embedding data of each party, so that the same resource IDs are arranged consecutively.

[0083] In one embodiment, the joint fraud detection system includes multiple participants, and any one of the participants is used as a detection party. Further, based on the unilateral ciphertext embedded data of each participant, the resource IDs of the multiple participants and the embedded features corresponding to each resource ID that match a resource node type are sorted so that the same resource IDs are arranged continuously. In one embodiment, the embedded features corresponding to each resource ID are related to the resource node type. Specifically, for a resource node type, the embedded features of the resource IDs that do not belong to the resource node type in each resource ID are 0.

[0084] In a specific embodiment, the step of sorting the resource IDs of the multiple participants and the embedded features corresponding to each resource ID and matching a resource node type based on the unilateral ciphertext embedded data of each participant includes step S3200, step S3201, and step S3202.

[0085] In step S3200, the resource ID of each participant and the embedded features corresponding to each resource ID and matching a resource node type are preliminarily sorted based on the unilateral ciphertext embedded data, so that the resource ID of the detecting party and the corresponding embedded features are placed first. Fig.10 Combined with Figure 8a and Figure 8b , Fig.10 A schematic diagram of a joint embedding feature corresponding to a resource node type of a detection party obtained by using a data processing method applied to a joint fraud detection network in one embodiment of the present application is shown. As shown in the figure, all participants include participant 1 and participant 2, and participant 1 and participant 2 both include two types of resource nodes. Fig.10Participant 1 is used as the detection party and the joint embedded features of the first resource node type (the type corresponding to V1 and V2) of participant 1 are obtained. The resource IDs of participants 1 and 2 and the embedded features corresponding to the resource IDs that match a resource node type are used to preliminarily sort the resource IDs of the two participants and the corresponding embedded features, and then the resource IDs (V1, V2, V3, and V4) of participant 1 and the embedded features corresponding to the resource IDs are ranked first. Among them, among the embedded features corresponding to the first resource node type, the embedded features corresponding to the resource IDs (V1 and V2) (node ​​features of U1, node features of U1 and U3) are the actual embedded features, and the embedded features corresponding to the resource IDs (V3, V4) are padded with 0, which is used to ensure the consistency of the data dimension; similarly, the embedded features corresponding to the resource ID (V3) of participant 2, which is ranked behind participant 1, also need to be padded with 0, such as Fig.10 As shown, the resource ID in the first box and the order of the embedded features corresponding to the resource ID are the results of the preliminary ordering. In this embodiment, the first position refers to the first position among multiple participants.

[0086] In step S3201, based on the result of the preliminary sorting, the resource ID sorting of the detection party is determined. The resource ID sorting is the arrangement order of multiple resource IDs. For example, see Fig.10 ,The preliminary sorting results in the first box show that the resource IDs of the ,detecting party are sorted as V1, V2, V3, and V4.

[0087] In step S3202, using the resource ID sorting, the resource IDs that need to be adjusted among all participants and the corresponding embedded features that match a resource node type are inserted into the sorting of the resource IDs of the detecting party and the corresponding embedded features that match a resource node type, so that the same resource IDs are arranged consecutively.

[0088] The resource IDs of all participants that need to be adjusted and the corresponding embedded features are determined using the resource ID of the detecting party. In one embodiment, the resource IDs of all participants that need to be adjusted are the resource IDs of all the remaining participants after removing the detecting party that are the same as the resource ID of the detecting party, and the embedded features that need to be adjusted are the embedded features corresponding to the resource IDs that need to be adjusted. For example, according to Fig.10 From the results of the preliminary sorting shown, it can be seen that the resource IDs that need to be adjusted and the corresponding embedded features that match a resource node type are V1 and V3 and their corresponding embedded features that match a resource node type (node ​​features of U6, node features of U7 and U8).

[0089] Please continue reading Fig.10, insert the resource ID (V1 and V3) that needs to be adjusted and the corresponding embedded features (node ​​features of U6, node features of U7 and U8) into the sorting of the resource ID and the corresponding embedded features of the detecting party (participant 1), so that the same resource ID (V1, and V3) are arranged continuously. In one embodiment, V1 and the corresponding embedded features of participant 2 are inserted to the back of V1 and the corresponding embedded features (node ​​features of U6) of participant 1. Similarly, V3 and the corresponding embedded features (node ​​features of U7 and U8) of participant 2 can be inserted to the back of V3 and the corresponding embedded features of participant 1, so that the same resource ID (V1, and V3) and the corresponding embedded features are arranged continuously. In other embodiments, the resource ID and the corresponding embedded features of participant 2 can also be inserted to the front of the resource ID and the corresponding embedded features of participant 1.

[0090] Further, in one embodiment, the resource ID of the detecting party is ranked first among the same resource IDs arranged consecutively. Fig.10 , the resource ID of the detecting party (Participant 1) is ranked first among the consecutively arranged identical resource IDs. For example, among two consecutively arranged V1s, the first V1 is the resource ID of the detecting party (Participant 1). For another example, among two consecutively arranged V3s, the first V3 is the resource ID of the detecting party (Participant 1). In this embodiment, the first position refers to the first position among multiple identical resource IDs.

[0091] In step S330, the sorted resource IDs are traversed in sequence and the joint embedding features corresponding to the resource node types of the detection party are determined using the embedding features corresponding to the same resource ID, so as to obtain the joint embedding data of the detection party using the joint embedding features corresponding to the multiple resource node types of the determined detection party.

[0092] In one embodiment, the steps of sequentially traversing the sorted resource IDs and determining the joint embedded features of the detecting party corresponding to the resource node type using the embedded features corresponding to the same resource IDs include steps S3300, S3301, and S3302. In the following embodiments, the traversal of the sorted resource IDs from front to back is used as an example for explanation, but in other embodiments, those skilled in the art may also traverse the sorted resource IDs from back to front based on the changes in the insertion method shown above (for example, inserting the same resource ID and corresponding embedded features as those of the detecting party to the front side of the resource ID and corresponding embedded features of the detecting party).

[0093] In step S3300 , the sorted resource IDs are traversed in order and the current resource ID traversed is compared with a preset number of adjacent resource IDs.

[0094] The preset number is related to the number of the multiple participants. In one embodiment, the preset number is the number of the multiple participants minus 1.

[0095] In one embodiment, each resource ID is traversed in order from front to back, and the current resource ID being traversed is compared with a preset number of resource IDs adjacent to the back side thereof. Fig.10 As shown, the preset number is 1, then each resource ID is compared with a resource ID behind it, for example, the first traversed resource ID is V1, and V1 is compared with a resource ID (V1) behind it.

[0096] In step S3301, the embedded features that match a resource node type and correspond to the resource ID that is the same as the current resource ID among the preset number of resource IDs are combined with the embedded features of the current resource ID to obtain a joint embedded feature corresponding to each resource ID and the resource node type. Fig.10 In the second and third boxes, in the second box, the first resource ID (V1) and the adjacent subsequent resource ID (V1) are the same, then the embedded feature (node ​​feature of U1) corresponding to the second resource ID (V1) and matching a resource node type is combined with the embedded feature (node ​​feature of U6) corresponding to the first resource ID (V1), and then the joint embedded feature corresponding to the first resource ID (V1) and the resource node type is obtained as (node ​​features of U1 and U6), and so on, the following can be obtained. Fig.10 The third box in FIG. 4 shows the joint embedding features corresponding to each resource ID and the resource node type.

[0097] In step S3302, the current resource ID and the corresponding joint embedding feature are restored to the preliminary order to obtain the joint embedding feature corresponding to the resource node type of the detection party.

[0098] Specifically, after the initial sorting is restored, the multiple joint embedding features corresponding to the detection party at the front are used as the joint embedding features of the detection party corresponding to the resource node type. Fig.10 , restore the resource ID and the corresponding joint embedding features in the third box to Fig.10 The preliminary sorting shown in the first box can obtain the resource ID in the fourth box and the corresponding joint embedding features, and then the joint embedding features corresponding to the first resource node type of the detecting party (Party 1) {node features of U1 and U6; node features of U1 and U3; 0; 0} can be obtained.

[0099] Further, for each resource node type of the detection party, the steps of sorting and combining the embedded features are performed to obtain the joint embedded features corresponding to the multiple resource node types of the detection party. Specifically, in one embodiment, for each resource node type, steps S3200, step S3201, step S3202, step S3300, step S3301, and step S3302 are performed to obtain the joint embedded features corresponding to the multiple resource node types of the detection party.

[0100] Furthermore, the multi-party secure computing system can obtain the joint embedded data of the detecting party using the joint embedded features corresponding to the multiple resource node types of the determined detecting party. For example, the joint embedded features corresponding to the multiple resource node types can be directly used as the joint embedded data of the detecting party. For another example, the joint embedded features corresponding to the multiple resource node types and the node features corresponding to each resource node of the detecting party can be used together as the joint embedded data of the detecting party.

[0101] In one embodiment, the data processing method applied to the joint fraud detection network further includes a step of using multiple participants as the detection parties to obtain joint embedded data of the multiple detection parties. Specifically, each participant is used as a detection party, and the steps of sorting and combining embedded features are performed for each resource node type of each participant, so as to obtain the joint embedded data of the multiple participants based on the joint embedded features corresponding to the multiple resource node types of each participant.

[0102] After obtaining the joint embedded data of the multiple participants, the joint embedded data of the multiple participants are input into the fraud classification subnetwork to obtain the fraud detection results of the multiple participants. In one embodiment, the fraud detection results include whether each user node participating in the detection among the multiple participants is a fraud user or a non-fraud user. In another embodiment, the fraud detection results include the probability that each user node participating in the detection among the multiple participants is a fraud user.

[0103] Wherein, the fraud classification subnetwork is a neural network for classification. In one embodiment, the fraud classification subnetwork includes a first MLP layer and a second MLP layer. The MLP (Multilayer Perceptron) layer is a neural network layer. In one example, the first MLP layer includes a ReLU nonlinear activation function, and the second MLP layer includes a Sigmoid nonlinear activation function. In other examples, the first MLP layer and the second MLP layer may also include other nonlinear activation functions.

[0104] In one embodiment, taking the fraud classification subnetwork including the first MLP layer and the second MLP layer as an example, the fraud detection result of each user node in each participant can be expressed by the following formula:

[0105] P = Sigmoid(ReLU(H2W1)W2)

[0106] Among them, W1 is the second network parameter of the trainable first MLP layer, W2 is the third network parameter of the trainable second MLP layer, H2 is the joint embedding data of a participant, and P is the probability that each user node in a participant is a fraudulent user.

[0107] In step S120, the multi-party secure computing system uses the preset fraud labels of multiple participants and the fraud detection results to adjust the parameters of the joint fraud detection network until the training stop condition is reached.

[0108] In one embodiment, the multi-party secure computing system calculates a loss function based on the fraud detection results of the multiple participants and the preset fraud labels of the multiple participants, and adjusts the network parameters of the fraud classification subnetwork based on the loss function. Correspondingly, the training stop condition is that the loss function achieves convergence. In a specific embodiment, the trainable network parameters in the joint fraud detection network only include the second network parameter W1 of the first MLP layer and the third network parameter W2 of the second MLP layer. The loss function is calculated using the preset fraud labels of the multiple participants and the fraud detection results of the multiple participants, and the second network parameter W1 and the third network parameter W2 are adjusted until the training stop condition is reached. In another specific embodiment, the joint fraud detection network includes the first network parameter, the second network parameter W1, and the third network parameter W2. The loss function is calculated using the preset fraud labels of the multiple participants and the fraud detection results of the multiple participants, and the first network parameter, the second network parameter W1, and the third network parameter W2 are adjusted until the training stop condition is reached.

[0109] In one embodiment, the fraud label is whether a user node is a fraud user node. For example, a fraud label of 1 indicates that a user node is a fraud user node, and a fraud label of 0 indicates that a user node is not a fraud user node. In another embodiment, the fraud label is the probability that a user node is a fraud user node.

[0110] In a specific embodiment, a loss function is calculated for each training data set, and network parameters in the joint fraud detection network are adjusted based on the loss function. The training data set may be a preset number of fraud detection results and corresponding fraud labels from fraud detection results of multiple participants.

[0111] Taking the fraud label as the probability that a user node is a fraud user node as an example, the loss function of a training data set can be expressed by the following formula:

[0112] J=∑y i ln i +(1-y i )ln(1-p i )

[0113] Among them, J is the loss of a training data set, p i is the probability that each user node in the training data set is a fraudulent user node, i ranges from 1 to Z, Z is the number of fraud detection results in the training data set, and y i Fraud label for each user node in the training dataset.

[0114] The trained joint fraud detection network can be used for joint fraud detection of multiple parties. For example, the joint graph embedding layer of the joint fraud detection network uses the single-party ciphertext embedding data to calculate the joint embedding data of multiple parties, and performs fraud detection based on the joint embedding data of multiple parties.

[0115] See also Fig.11 , which is a flow chart of a joint fraud detection method in one embodiment of the present application. As shown in the figure, the joint fraud detection method includes step S410 and step S420.

[0116] In step S410, the multi-party secure computing system obtains the unilateral ciphertext embedded data of each participant, and obtains the joint embedded data of multiple participants using the data processing method applied to the joint fraud detection network described in any of the above embodiments.

[0117] In one embodiment, in order to improve detection efficiency, the user nodes included in the graph data used in the process of calculating the one-party ciphertext data described in step S410 are suspicious nodes whose suspicion probability is between a first preset threshold and a second preset threshold, and the resource nodes in the graph data used are resource nodes connected to the suspicious nodes.

[0118] In step S420, the fraud classification sub-network trained by the training method of the joint fraud detection network described in any of the above embodiments performs fraud detection on the joint embedded data of multiple participants to obtain fraud detection results corresponding to the multiple participants.

[0119] In one embodiment, see Fig.12 , which is a structural block diagram of a data processing device applied to a joint fraud detection network in one embodiment of the present application. As shown in the figure, the data processing device 12 includes an acquisition module 120, a sorting module 121, and a joint embedded data calculation module 122.

[0120] It should be understood that the acquisition module 120, the sorting module 121, and the joint embedded data calculation module 122 can be implemented in software run by different types of processors. For example, a module of executable code may include one or more physical or logical blocks of computer instructions, which are organized as objects, programs, or functions. However, the executable files of the modules do not have to be physically located together, but may include different commands stored in different locations, which, when logically connected together, include the modules and achieve the specified goals of the modules.

[0121] The acquisition module 120 is used to acquire the unilateral ciphertext embedded data of each participant; wherein the unilateral ciphertext embedded data includes the ciphertext of the resource ID and the ciphertext of the corresponding embedded feature.

[0122] The sorting module 121 is used to take any one of the multiple participants as a detection party in the joint graph embedding layer, and sort the resource IDs of the multiple participants and the embedded features corresponding to each resource ID and matching a resource node type based on the unilateral ciphertext embedded data, so that the same resource IDs are arranged consecutively.

[0123] The joint embedded data calculation module 122 is used to traverse the sorted resource IDs in sequence and use the same resource ID and the embedded features corresponding to the same resource ID to determine the joint embedded features of the detection party corresponding to the resource node type, so as to obtain the joint embedded data of the detection party by using the joint embedded features corresponding to the multiple resource node types of the determined detection party.

[0124] Here, the working mode of each module in the data processing device 12 of the present application is the same as or similar to the corresponding steps in the above-mentioned data processing method applied to the joint fraud detection network, and will not be repeated here.

[0125] In one embodiment, see Fig.13 , which is a structural block diagram of a training device for a joint fraud detection network in an embodiment of the present application, as shown in the figure, the training device 13 for the joint fraud detection network includes a detection module 130 and a parameter adjustment module 131. It should be understood that the detection module 130 and the parameter adjustment module 131 can be implemented in software run by different types of processors.

[0126] The detection module 130 is used to input the joint embedded data of multiple participants obtained by using the data processing device applied to the joint fraud detection network into the fraud classification subnetwork in the joint fraud detection network to obtain fraud detection results of multiple participants.

[0127] The parameter adjustment module 131 is used to adjust the parameters of the joint fraud detection network using the preset fraud labels of multiple participants and the fraud detection results until the training stop condition is reached.

[0128] Here, the working mode of each module in the training device 13 of the joint fraud detection network of the present application is the same as or similar to the corresponding steps in the training method of the joint fraud detection network mentioned above, and will not be repeated here.

[0129] In one embodiment, see Fig.14 , which is a structural block diagram of a joint fraud detection device in an embodiment of the present application, as shown in the figure, the joint fraud detection device 14 includes a joint embedding module 140 and a detection module 141. It should be understood that the joint embedding module 140 and the detection module 141 can be implemented in software run by different types of processors.

[0130] The joint embedding module 140 is used to obtain the unilateral ciphertext embedding data of each participant, and obtain the joint embedding data of multiple participants using the data processing device applied to the joint fraud detection network.

[0131] The detection module 141 is used to perform fraud detection on the joint embedded data of multiple participants using the fraud classification sub-network trained by the training device of the joint fraud detection network to obtain fraud detection results corresponding to the multiple participants.

[0132] The present application also provides a computer-readable and writable storage medium on which at least one program is stored. When called, the at least one program executes the data processing method applied to the joint fraud detection network, the training method of the joint fraud detection network, or the joint fraud detection method described in any of the above embodiments.

[0133] In one embodiment, the present application also provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the above-mentioned related steps to implement the data processing method applied to a joint fraud detection network, the training method of a joint fraud detection network, or the joint fraud detection method described in any of the above-mentioned embodiments.

[0134] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application.

[0135] In the embodiments provided in the present application, the computer readable and writable storage medium may include a read-only memory (ROM), a random access memory (RAM), an EEPROM, a CD-ROM or other optical disk storage device, a magnetic disk storage device or other magnetic storage device, a flash memory, a USB flash drive, a mobile hard disk, or any other medium that can be used to store the desired program code in the form of an instruction or data structure and can be accessed by a computer. In addition, any connection can be appropriately referred to as a computer-readable medium. For example, if the instruction is sent from a website, a server or other remote source using a coaxial cable, an optical fiber cable, a twisted pair, a digital subscriber line (DSL), or wireless technologies such as infrared, radio and microwaves, the coaxial cable, optical fiber cable, twisted pair, DSL, or wireless technologies such as infrared, radio and microwaves are included in the definition of the medium. However, it should be understood that computer readable and writable storage media and data storage media do not include connections, carriers, signals or other temporary media, but are intended to be non-temporary, tangible storage media. Disk and disc, as used in this application, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers.

[0136] The present application also discloses a computer device, which is used to implement the data processing method applied to the joint fraud detection network, the training method of the joint fraud detection network, or the joint fraud detection method described in any of the above embodiments. In one embodiment, the computer device is a device capable of performing digital calculations, logical processing, and information processing on data.

[0137] See also Fig.15 , which is a schematic diagram of the structure of a computer device in an embodiment of the present application, wherein the computer device 15 includes a storage device 150 and a processing device 151 connected to the storage device 150. Furthermore, the computer device also includes an interface device 152.

[0138] In some embodiments, the storage device 150 is used to store at least one program, and the at least one program can be executed by the processing device 151 to coordinate the data processing method applied to the joint fraud detection network, the training method of the joint fraud detection network or the joint fraud detection method described in any of the above embodiments of the storage device 150.

[0139] Here, the storage device 150 includes, but is not limited to, a read-only memory, a random access memory, and a non-volatile memory. For example, the storage device 150 includes a flash memory device or other non-volatile solid-state storage device. In some embodiments, the storage device 150 may also include a memory away from one or more processing devices 151, such as a network attached memory accessed via an RF circuit or an external port and a communication network, wherein the communication network may be the Internet, one or more intranets, a local area network, a wide area network, a storage area network, etc., or a suitable combination thereof. The memory controller may control access to the memory by other components of the device, such as a CPU and a peripheral interface.

[0140] In some embodiments, the processing device 151 includes one or more processors. The processing device 151 can be operable to perform data read and write operations with the storage device 150. The processing device 151 includes one or more general-purpose microprocessors, one or more application-specific processors (ASICs), one or more digital signal processors, one or more field programmable logic arrays (FPGAs), or any combination thereof.

[0141] In some embodiments, the interface device 152 includes at least one interface unit, each of which is used to output a visual interface, receive a human-computer interaction event generated according to the operation of a technician, etc. For example, the interface device 152 includes but is not limited to: a serial interface such as an HDMI interface or a USB interface, or a parallel interface, etc. In one embodiment, the interface device 152 also includes a network communication unit, which is a device for data transmission using a wired or wireless network, and examples thereof include but are not limited to: an integrated circuit including a network card, a local area network module such as a WiFi module or a Bluetooth module, a wide area network module such as a mobile network, etc.

[0142] In one or more exemplary aspects, the data processing method applied to the joint fraud detection network, the training method of the joint fraud detection network, or the joint fraud detection method described in the present application can be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored or transmitted as one or more instructions or codes on a computer-readable medium. The steps of the method or algorithm disclosed in the present application can be embodied in a processor-executable software module, wherein the processor-executable software module can be located on a tangible, non-temporary computer storage medium. A tangible, non-temporary computer storage medium can be any available medium that can be accessed by a computer.

[0143] The flowchart and block diagram in the accompanying drawings described in the present application illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. Based on this, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be realized by a dedicated hardware-based system that performs a specified function or operation, or can be realized by a combination of dedicated hardware and computer instructions.

[0144] In summary, the data processing method and device applied to a joint fraud detection network, the training method and device of a joint fraud detection network, the joint fraud detection method and device, the multi-party secure computing system, and the joint fraud detection system provided by the present application sort the resource IDs of the multiple participants and the embedded features corresponding to each resource ID and matching a resource node type so that the same resource IDs are arranged continuously; the sorted resource IDs are traversed in sequence and the embedded features corresponding to the same resource IDs are used to determine the joint embedded features of the detection party corresponding to the resource node type, so as to obtain the joint embedded data of the detection party using the determined joint embedded features corresponding to the multiple resource node types of the detection party; in this way, by arranging the same resource ID continuously, it is not necessary to traverse the resource IDs of all participants multiple times when calculating the joint embedded features corresponding to a resource node type, but only needs to be traversed once, thereby improving the calculation efficiency of the joint embedded data to improve the training efficiency of the joint fraud detection network trained using the multi-party secure computing system.

[0145] Furthermore, by using the detection model to screen the user nodes locally, the training speed can be further accelerated. Furthermore, by screening the resource nodes in the graph data and using the embedding features of the suspicious resource nodes as the single-party embedding data, the time for the multi-party secure computing system to calculate the joint embedding data can be reduced to speed up the training speed.

[0146] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A data processing method applied to a joint fraud detection network, characterized in that: The joint graph embedding layer in the joint fraud detection network is configured in a multi-party secure computing system, the multi-party secure computing system is communicatively connected with a plurality of participants in the joint fraud detection, and the data processing method includes: Obtaining the unilateral ciphertext embedded data of each participant; wherein the unilateral ciphertext embedded data includes the ciphertext of the resource ID and the ciphertext of the corresponding embedded feature; In the joint graph embedding layer, any one of the multiple participants is used as a detection party, and the resource IDs of the multiple participants and the embedding features corresponding to each resource ID and matching a resource node type are sorted based on the ciphertext embedding data of each single party, so that the same resource IDs are arranged continuously; The sorted resource IDs are traversed in sequence and the embedded features corresponding to the same resource ID are used to determine the joint embedded features of the detection party corresponding to the resource node type, so as to obtain the joint embedded data of the detection party using the joint embedded features corresponding to multiple resource node types of the determined detection party.

2. The data processing method according to claim 1, characterized in that: The joint fraud detection network sequentially includes a unilateral graph embedding layer configured in multiple participants, the joint graph embedding layer, and a fraud classification sub-network configured in the multi-party secure computing system, wherein each participant is configured with a sub-embedding layer of the unilateral graph embedding layer.

3. The data processing method according to claim 2, characterized in that: The one-party ciphertext embedded data is obtained after the participating party performs embedding calculation and encryption on its graph data in the sub-embedding layer.

4. The data processing method according to claim 1, characterized in that: The joint fraud detection network sequentially includes a single-party graph embedding layer configured in the multi-party secure computing system, the joint graph embedding layer, and a fraud classification sub-network.

5. The data processing method according to claim 4, characterized in that: The unilateral ciphertext embedded data is obtained by embedding calculation using the ciphertext graph data of the participating party in the unilateral graph embedding layer; wherein the ciphertext graph data is obtained by encrypting the graph data of the participating party.

6. The data processing method according to claim 3 or 5, characterized in that: The graph data includes numbers of user nodes and resource nodes, resource IDs of resource nodes, node features of each node, and one or more adjacency matrices corresponding to types of resource nodes.

7. The data processing method according to claim 6, characterized in that: The user node is a user of a participant, and the resource node includes relevant information about operations performed by the user node on the participant.

8. The data processing method according to claim 1, characterized in that: The embedded features corresponding to the resource ID include node features of the user node connected to the resource node corresponding to the resource ID.

9. The data processing method according to claim 1, characterized in that: The step of determining the joint embedding features corresponding to multiple resource node types of the detection party includes: for each resource node type of the detection party, performing the steps of sorting and embedding feature combination to obtain the joint embedding features corresponding to multiple resource node types of the detection party.

10. The data processing method according to claim 1 or 9, characterized in that: The method also includes the step of using multiple participants as the detection parties respectively to obtain joint embedded data of the multiple detection parties.

11. The data processing method according to claim 1, characterized in that: The step of sorting the resource IDs of the multiple participants and the embedded features corresponding to each resource ID and matching a resource node type based on each unilateral ciphertext embedded data so that the same resource IDs are arranged continuously includes: Preliminarily sorting the resource ID of each participant and the embedded features corresponding to each resource ID and matching a resource node type based on the ciphertext embedded data of each party, so that the resource ID of the detecting party and the corresponding embedded features are placed first; Based on the result of the preliminary sorting, determining the resource ID sorting of the detecting party; By utilizing the resource ID sorting, the resource IDs that need to be adjusted among all participants and the corresponding embedded features that match a resource node type are inserted into the sorting of the resource ID of the detecting party and the corresponding embedded features that match a resource node type, so that the same resource IDs are arranged consecutively; wherein the resource IDs that need to be adjusted among all participants and the corresponding embedded features are determined by utilizing the resource ID of the detecting party.

12. The data processing method according to claim 11, characterized in that: Among the same resource IDs arranged consecutively, the resource ID of the detecting party is ranked first.

13. The data processing method according to claim 1, characterized in that: The step of sequentially traversing the sorted resource IDs and using the embedded features corresponding to the same resource IDs to determine the joint embedded features of the detection party corresponding to the resource node type includes: Traversing the sorted resource IDs in order and comparing the traversed current resource ID with a preset number of adjacent resource IDs; wherein the preset number is related to the number of the multiple participants; Combining the embedded features that match a resource node type and correspond to the resource IDs that are the same as the current resource ID among the preset number of resource IDs with the embedded features of the current resource ID to obtain a joint embedded feature corresponding to each resource ID and the resource node type; The current resource ID and the corresponding joint embedding feature are restored to the preliminary order to obtain the joint embedding feature corresponding to the resource node type of the detection party.

14. The data processing method according to claim 1 or 13, characterized in that: Traverse the sorted resource IDs from front to back.

15. A data processing device applied to a joint fraud detection network, characterized in that: The joint graph embedding layer in the joint fraud detection network is configured in a multi-party secure computing system, the multi-party secure computing system is communicatively connected with a plurality of participants performing joint fraud detection, and the data processing device comprises: An acquisition module, used to acquire the unilateral ciphertext embedded data of each participant; wherein the unilateral ciphertext embedded data includes the ciphertext of the resource ID and the ciphertext of the corresponding embedded feature; A sorting module, used to take any one of the multiple participants as a detection party in the joint graph embedding layer, and sort the resource IDs of the multiple participants and the embedding features corresponding to each resource ID and matching a resource node type based on the ciphertext embedding data of each single party, so that the same resource IDs are arranged continuously; The joint embedded data calculation module is used to traverse the sorted resource IDs in sequence and use the embedding features corresponding to the same resource ID to determine the joint embedded features of the detection party corresponding to the resource node type, so as to obtain the joint embedded data of the detection party using the joint embedded features corresponding to multiple resource node types of the determined detection party.

16. A method for training a joint fraud detection network, characterized in that: Applied to a multi-party secure computing system, the multi-party secure computing system is communicatively connected to a plurality of participants performing joint fraud detection, the joint fraud detection network comprises a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification subnetwork connected to the joint graph embedding layer, the training method comprises: Inputting the joint embedded data of multiple participants obtained by the data processing method applied to the joint fraud detection network as described in any one of claims 1 to 14 into the fraud classification subnetwork to obtain fraud detection results of the multiple participants; The parameters of the joint fraud detection network are adjusted using the preset fraud labels of multiple participants and the fraud detection results until a training stop condition is reached.

17. A training device for a joint fraud detection network, characterized in that: Applied to a multi-party secure computing system, the multi-party secure computing system is communicatively connected to a plurality of participants performing joint fraud detection, the joint fraud detection network comprises a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification subnetwork connected to the joint graph embedding layer, the training device comprises: a detection module, configured to input the joint embedded data of multiple participants obtained by using the data processing device applied to the joint fraud detection network as claimed in claim 15 into the fraud classification subnetwork in the joint fraud detection network, so as to obtain fraud detection results of the multiple participants; The parameter adjustment module is used to adjust the parameters of the joint fraud detection network by using the preset fraud labels of multiple participants and the fraud detection results until the training stop condition is reached.

18. A joint fraud detection method, characterized in that: Applied to a multi-party secure computing system, the multi-party secure computing system is communicatively connected with a plurality of participants performing joint fraud detection, the joint fraud detection network comprises a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification subnetwork connected to the joint graph embedding layer, the joint fraud detection method comprises: Obtaining unilateral ciphertext embedded data of each participant, and obtaining joint embedded data of multiple participants using the data processing method applied to a joint fraud detection network as described in any one of claims 1 to 14; The fraud classification subnetwork trained by the training method of the joint fraud detection network as described in claim 16 performs fraud detection on the joint embedded data of multiple participants to obtain fraud detection results corresponding to the multiple participants.

19. A joint fraud detection device, characterized in that: Applied to a multi-party secure computing system, the multi-party secure computing system is communicatively connected to a plurality of participants performing joint fraud detection, the joint fraud detection network comprises a joint graph embedding layer configured in the multi-party secure computing system and a fraud classification subnetwork connected to the joint graph embedding layer, the joint fraud detection device comprises: a joint embedding module, used to obtain the unilateral ciphertext embedding data of each participant, and obtain the joint embedding data of multiple participants using the data processing device for a joint fraud detection network as claimed in claim 15; A detection module is used to perform fraud detection on the joint embedded data of multiple participants using the fraud classification sub-network trained by the training device of the joint fraud detection network as described in claim 17 to obtain fraud detection results corresponding to the multiple participants.

20. A multi-party secure computing system, characterized in that: It comprises a plurality of computing devices, each of which is configured in a mutually distrustful computing system architecture; wherein each computing device is pre-installed with a multi-party secure computing protocol, and executes, together with at least another computing device, the data processing method applied to a joint fraud detection network as described in any one of claims 1 to 14, the training method for a joint fraud detection network as described in claim 16, or the joint fraud detection method as described in claim 18 based on the multi-party secure computing protocol.

21. A joint fraud detection system, characterized in that: A multi-party secure computing system as claimed in claim 20 comprising a plurality of participants and being communicatively connected with the plurality of participants.

22. A computer device, characterized in that: include: A storage device for storing at least one program; A processing device, connected to the storage device, is used to call the at least one program from the storage device and implement the data processing method applied to the joint fraud detection network as described in any one of claims 1 to 14, the training method of the joint fraud detection network as described in claim 16, or the joint fraud detection method as described in claim 18 when executing.

23. A computer-readable storage medium, characterized in that: At least one program is stored, and when the at least one program is called, it is executed and implements the data processing method applied to the joint fraud detection network as described in any one of claims 1-14, the training method of the joint fraud detection network as described in claim 16, or the joint fraud detection method as described in claim 18.

24. A computer program product, characterized in that When the computer program product runs on a computer, the computer executes the data processing method applied to a joint fraud detection network as described in any one of claims 1 to 14, the training method of a joint fraud detection network as described in claim 16, or the joint fraud detection method as described in claim 18.

Images