Dynamic abnormal subgraph discovery method in time sequence financial network

Abstract

The invention discloses a dynamic abnormal subgraph discovery method in a time sequence financial network. The method comprises the steps that a dynamic financial network is acquired, the dynamic financial network comprises nodes and edges between the nodes, and the edges between the nodes are used for representing transaction information of at least one of the nodes; the dynamic financial network is estimated through approximate linear time complexity, dense subgraphs of different time slices are obtained, chi-square calculation is carried out on each edge of the dense subgraph of each time slice, and the chi-square of each edge of each time slice is obtained; and reserving nodes corresponding to the edges of which the chi-squares are greater than or equal to the total chi-square of each time slice in the dense subgraph of each time slice. The technical problem that only static abnormal sub-graphs in a financial network can be identified and the change and trend of user transaction behaviors along with time cannot be detected in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal subgraph detection, and in particular to a method for discovering dynamic abnormal subgraphs in a time-series financial network. Background Art

[0002] Extracting anomalous subgraphs from financial networks is an important problem. Temporal anomaly subgraph discovery can capture anomalies that change over time, enabling timely identification of illegal transactions between users. This dynamic monitoring of suspicious activities is essential for maintaining the security of financial networks. As temporal anomaly detection is critical, more and more researchers are focusing on temporal fraud detection in networks. They propose to detect anomalies based on structural and temporal information that is different from normal patterns in dynamic graphs.

[0003] However, since these methods are designed for general graphs, they fail to take into account the specific transaction details between users in financial networks. Specifically, even if some nodes frequently transfer money to other nodes at a specific time, resulting in structural and temporal anomalies, these transactions may still be normal. For example, a university account may frequently issue allowances or grants to different student or faculty accounts. If the transaction information is ignored, these transactions may be mistakenly identified as abnormal subgraphs, although in reality they are completely legal.

[0004] In order to solve the above problems, it is necessary to consider transaction information. The best method currently proposed by Antibenford is to use Benford's law to evaluate illegal transactions. Benford's law stipulates that the number of The proportion of digits starting with follows a monotonically decreasing function in natural data sets (such as tax records, stock quotes, etc.), that is, Antibenford[1] also verified the existence of Benford's law in financial transactions by visualizing the distribution of the first digit in a real transaction dataset.

[0005] However, the latest work can only identify static abnormal subgraphs in financial networks because it is designed based on non-temporal graphs, which means it cannot detect changes and trends in user trading behavior over time. In this work, inspired by the static Antibenford method, a temporal Antibenford subgraph is theoretically defined. This enables the discovery of temporal abnormal subgraphs that deviate from Benford's law in dynamic financial networks with the support of a solid theoretical foundation. Summary of the invention

[0006] The embodiment of the present invention provides a method for discovering dynamic abnormal subgraphs in a time-series financial network, so as to at least solve the technical problem that the prior art can only identify static abnormal subgraphs in a financial network, but cannot detect the changes and trends of user transaction behaviors over time.

[0007] According to one aspect of an embodiment of the present invention, a method for discovering dynamic abnormal subgraphs in a time-series financial network is provided, wherein the method may include: obtaining a dynamic financial network, wherein the dynamic financial network includes nodes, edges between nodes, and the edges between nodes are used to characterize transaction information of at least one of the nodes; estimating the dynamic financial network by approximate linear time complexity to obtain dense subgraphs of different time slices, performing chi-square calculation on each edge of the dense subgraph of each time slice to obtain the chi-square of each edge of each time slice, retaining nodes corresponding to edges whose chi-square of edges in the dense subgraph of each time slice is greater than or equal to the total chi-square of each time slice, and ... The nodes corresponding to the edges in the dense subgraph whose chi-square is less than the total chi-square of each time slice are deleted to obtain the top-p abnormal subgraphs of different time slices; the top-p abnormal subgraphs of different time slices are encoded to obtain abnormal candidate subgraphs of different time slices, wherein the abnormal candidate subgraphs of different time slices contain boundaries; the nodes in the abnormal candidate subgraphs of different time slices are excluded or expanded to obtain the abnormality degree of the abnormal candidate subgraphs of different time slices; the maximum reward is obtained by maximizing the gain of the abnormality degree of the abnormal candidate subgraphs of different time slices; the abnormal candidate subgraphs of different time slices are optimized by maximizing the reward to obtain the optimized abnormal candidate subgraphs of different time slices.

[0008] Optionally, a chi-square calculation is performed on each edge of the dense subgraph of each time slice, and the chi-square expression of the dense subgraph of each time slice is obtained as follows:

[0009] in, is the chi-square of the dense subgraph at each time slice, is a dense subgraph of each time slice The first digit of the transaction amount is equal to The number of timing edges, represents the expected number of legs based on Benford's law, where the first digit of the transaction amount is equal to .

[0010] Optionally, the process of encoding the top-p abnormal subgraphs of different time slices is: extracting the nodes of the top-p abnormal subgraphs of different time slices by different node numbers to obtain positive top-p abnormal subgraph pairs and negative sample top-p abnormal subgraph pairs in the top-p abnormal subgraphs of different time slices; calculating the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs; optimizing the target loss function based on the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs.

[0011] Optionally, the expression for the similarity between positive top-p abnormal subgraph pairs is:

[0012] in, Indicates that in the snapshot The top-p abnormal subgraph at the moment Middle The encoding vector of nodes. Similarly, Indicates that in the snapshot The top-p abnormal subgraph at the moment Midpoint The encoding vector of the neighborhood of is through the snapshot The top-p abnormal subgraph at the moment Midpoint The encoding vectors of all neighbors of Calculated by the function. is in the snapshot The top-p abnormal subgraph at the moment The number of nodes. And Represents the number of snapshots sampled for each time positive top-p abnormal subgraph, Represents two positive top-p abnormal subgraphs and The financial distribution between Divergence. Positive top-p outlier subgraphs with similar financial distributions lead to lower Score.

[0013] Optionally, the expression for the similarity between negative top-p abnormal subgraph pairs is:

[0014] in, Indicates that in the snapshot Time negative top-p abnormal subgraph Nodes randomly sampled from The encoding vector of the neighborhood of . and are completely different and non-overlapping temporal negative top-p anomaly subgraphs, so the same node cannot be used for the negative top-p anomaly subgraph pair .

[0015] Optionally, based on the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs, the expression of the optimized objective loss function is:

[0016] in, Represents the temperature parameter.

[0017] Optionally, the expression of the abnormal degree of the abnormal candidate subgraphs at different time slices is:

[0018] in, For the Candidate subgraph of abnormal step The degree of abnormality, Indicated in Candidate subgraph of abnormal step The time density, ) indicates that Candidate subgraph of abnormal step , represents the abnormal candidate subgraph at time s, Indicates Candidate subgraph of abnormal step of Statistics.

[0019] Beneficial effects of the present invention: The present invention proposes a method for discovering dynamic abnormal subgraphs in time-series financial networks, encoding abnormal subgraphs by modeling subgraph structures and hidden features in financial distributions. Then, a rough prototype is detected by matching the trained anomalies through an effective pruning strategy. In addition, it is proposed to refine the abnormal subgraphs using a reinforcement learning-based method, in which the search space of the subgraph boundary is limited based on the transaction frequency, solving the technical problem that the prior art can only identify static abnormal subgraphs in financial networks and cannot detect changes and trends in user transaction behaviors over time, achieving the technical effect of identifying dynamic abnormal subgraphs in financial networks, which can be used to detect changes and trends in user transaction behaviors over time. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings: Figure 1 is a flow chart of a method for discovering dynamic abnormal subgraphs in a time-series financial network according to an embodiment of the present invention; Figure 2 is a schematic diagram of a method for discovering dynamic abnormal subgraphs in a time-series financial network according to an embodiment of the present invention; Figure 3 is a schematic diagram of determining abnormal candidate subgraphs of different time slices according to an embodiment of the present invention; Figure 4 is a schematic diagram of determining an optimized timing anomaly subgraph according to an embodiment of the present invention; Figure 5 is a schematic diagram of collecting positive and negative sample pairs according to an embodiment of the present invention; Figure 6 According to an embodiment of the present invention Schematic diagram of the results; Figure 7 is a schematic diagram of chi-square obtained from different networks according to an embodiment of the present invention; Figure 8 is a schematic diagram of efficiency comparison of different data sets according to an embodiment of the present invention; Fig. 9 is a schematic diagram of the relationship between detection time and training time and graph node scale according to different methods of an embodiment of the present invention; Fig.10 is a schematic diagram of time anomaly subgraphs detected by different methods according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only embodiments of a part of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] Example 1 According to an embodiment of the present invention, a method for discovering dynamic abnormal subgraphs in a time-series financial network is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system comprising at least one set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] Figure 1 is a flow chart of a method for discovering dynamic abnormal subgraphs in a time-series financial network according to an embodiment of the present invention. Figure 1 As shown, the method may include the following steps: Step S101, obtaining a dynamic financial network, wherein the dynamic financial network includes nodes, and edges between nodes, and the edges between nodes are used to represent transaction information between at least one of the nodes.

[0025] In the technical solution provided in the above step S101 of the present invention, Figure 2 is a schematic diagram of a method for discovering dynamic abnormal subgraphs in a time-series financial network according to an embodiment of the present invention. Figure 2 The leftmost figure is a dynamic financial network, which includes nodes and edges between nodes. The edges between nodes are used to represent transaction information between at least one of the nodes, wherein the nodes can be users.

[0026] Step S102, estimate the dynamic financial network by approximate linear time complexity to obtain dense subgraphs of different time slices, perform chi-square calculation on each edge of the dense subgraph of each time slice to obtain the chi-square of each edge of each time slice, retain the nodes corresponding to the edges whose chi-square of the edges in the dense subgraph of each time slice is greater than or equal to the total chi-square of each time slice, delete the nodes corresponding to the edges whose chi-square of the edges in the dense subgraph of each time slice is less than the total chi-square of each time slice, and obtain the top-p abnormal subgraphs of different time slices.

[0027] In the technical solution provided in the above step S102 of the present invention, Figure 3 is a schematic diagram of determining abnormal candidate subgraphs of different time slices according to an embodiment of the present invention. Figure 3 The leftmost dynamic financial network in is estimated by approximate linear time complexity, and we get Figure 3 The second dense subgraph of different time slices on the left, that is, the graph behind the temporalDS arrow, in which the temporal densest subgraph (temporalDS for short) calculates the chi-square of each edge of the dense subgraph of each time slice to obtain the chi-square of each edge of each time slice. For example, when the dense subgraph of each time slice has nodes 1, 2, and 3, nodes 1 and 2 are connected by the first edge, and nodes 1 and 3 are connected by the second edge. When the chi-square of the first edge is greater than or equal to the total chi-square of the dense subgraph of the time slice in which it is located, nodes 1 and 2 are retained. When the chi-square of the second edge is less than the total chi-square of the dense subgraph of the time slice in which it is located, node 3 is deleted. By analogy, the dense subgraphs corresponding to the nodes that will be retained are determined as the top-p abnormal subgraphs of different time slices. The top-p abnormal subgraphs of different time slices ( Figure 3 (third from the left).

[0028] Step S103, encoding the top-p abnormal subgraphs of different time slices to obtain abnormal candidate subgraphs of different time slices, wherein the abnormal candidate subgraphs of different time slices contain boundaries.

[0029] In the technical solution provided in the above step S103 of the present invention, the top-p abnormal subgraphs of different time slices are processed by an encoder to obtain abnormal candidate subgraphs of different time slices, such as Figure 3 The rightmost image in .

[0030] Step S104: excluding or expanding the nodes in the abnormal candidate subgraphs of different time slices to obtain the abnormality degrees of the abnormal candidate subgraphs of different time slices.

[0031] In the technical solution provided in the above step S104 of the present invention, Figure 4 is a schematic diagram of determining an optimized timing abnormality subgraph according to an embodiment of the present invention, such as Figure 4 As shown, for the candidate subgraph in the temporal candidate detection module , get its connected nodes: in the snapshot Node at time , in the snapshot 5 and 6, in the snapshot 9. Among them, due to In contrast, Node 1 at the time 5 and 9 have the top three transaction frequencies, so they are selected as boundaries. In general, border Should include those The node connected to the nodes in and having the highest aggregate transaction frequency, as defined below:

[0032] in, Indicates that in the snapshot Time Node and nodes The transaction frequency between Indicates that the number of nodes in the boundary cannot exceed , are all nodes of the abnormal candidate subgraph at different time slices, Represents a snapshot The abnormal candidate subgraph at time instant.

[0033] Two actions are defined, namely, exclusion and expansion. The action space of exclusion removes abnormal candidate subgraphs The nodes in the expanded action space contain the boundaries A multi-layer perceptron (MLP) is used to learn features from nodes in the action space and to transform the features of these nodes into process to select the optimal node with the highest probability. In addition, after taking a specific action, and The value of should become larger. Indicates that after taking a specific action statistics, Represents the chi-square statistic after taking a specific action. In order to guide the model towards the most abnormal direction, the gain in the degree of abnormality caused by a specific action is used as a reward.

[0034] Step S105 , obtaining a maximum reward by maximizing the gain of the abnormality degree of the abnormal candidate subgraphs of different time slices.

[0035] In the technical solution provided in step S105 of the present invention, an abnormal candidate subgraph of a time slice should satisfy Therefore, the problem is optimized by policy gradient to maximize the gain in abnormality after taking a specific action, i.e., the reward .

[0036] Step S106, optimizing the abnormal candidate subgraphs of different time slices by maximizing the reward, and optimizing the abnormal candidate subgraphs of different time slices.

[0037] In the technical solution provided in the above step S106 of the present invention, the abnormal candidate subgraphs of different time slices are optimized by optimizing the parameters by maximizing the reward, so as to obtain the optimized abnormal candidate subgraphs of different time slices.

[0038] The above method of this embodiment is further introduced below.

[0039] As an optional implementation manner, in step S102, a chi-square calculation is performed on each edge of the dense subgraph of each time slice, and the chi-square expression of the dense subgraph of each time slice is obtained as follows:

[0040] in, is the chi-square of the dense subgraph at each time slice, is a dense subgraph of each time slice The first digit of the transaction amount is equal to The number of timing edges, represents the expected number of legs based on Benford's law, where the first digit of the transaction amount is equal to .

[0041] As an optional implementation method, step S103, the process of encoding the top-p abnormal subgraphs of different time slices is: extracting the nodes of the top-p abnormal subgraphs of different time slices by different node numbers to obtain positive top-p abnormal subgraph pairs and negative sample top-p abnormal subgraph pairs in the top-p abnormal subgraphs of different time slices; calculating the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs; based on the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs, optimizing the target loss function.

[0042] In this embodiment, Figure 5is a schematic diagram of collecting positive and negative sample pairs according to an embodiment of the present invention, such as Figure 5 As shown, the nodes of the top-p abnormal subgraphs of different time slices are extracted by different node numbers to obtain positive top-p abnormal subgraph pairs and negative sample top-p abnormal subgraph pairs in the top-p abnormal subgraphs of different time slices; the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs are calculated; based on the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs, the target loss function is optimized.

[0043] As an optional implementation mode, the expression of the similarity between the top-p abnormal subgraph pairs is:

[0044] in, Indicates that in the snapshot The top-p abnormal subgraph at the moment Middle The encoding vector of nodes. Similarly, Indicates that in the snapshot The top-p abnormal subgraph at the moment Midpoint The encoding vector of the neighborhood of is through the snapshot The top-p abnormal subgraph at the moment Midpoint The encoding vectors of all neighbors of Calculated by the function. is in the snapshot The top-p abnormal subgraph at the moment The number of nodes. And Represents the number of snapshots sampled for each time positive top-p abnormal subgraph, Represents two positive top-p abnormal subgraphs and The financial distribution between Divergence. Positive top-p outlier subgraphs with similar financial distributions lead to lower Score.

[0045] As an optional embodiment, the similarity between the negative top-p abnormal subgraph pairs is expressed as:

[0046] in, Indicates that in the snapshot Time negative top-p abnormal subgraph Nodes randomly sampled from The encoding vector of the neighborhood of . and are completely different and non-overlapping temporal negative top-p anomaly subgraphs, so the same node cannot be used for the negative top-p anomaly subgraph pair .

[0047] As an optional embodiment, based on the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs, the expression of the optimization target loss function is:

[0048] in, Represents the temperature parameter.

[0049] As an optional implementation manner, in step S104, the expression of the abnormality degree of the abnormal candidate subgraphs of different time slices is:

[0050] in, For the Candidate subgraph of abnormal step The degree of abnormality, Indicated in Candidate subgraph of abnormal step The time density, ) indicates that Candidate subgraph of abnormal step , represents the abnormal candidate subgraph at time s, Indicates Candidate subgraph of abnormal step of Statistics.

[0051] In this embodiment, if Figure 4 As shown in the leftmost figure, the model selection is such as At this moment, node 9 is expanded and Always exclude actions like node 4 to get higher rewards. First, define the abnormal candidate subgraph at step i. The degree of abnormality is as follows:

[0052] in, Indicated in Candidate subgraph of abnormal step , ) indicates that Candidate subgraph of abnormal step The number of edges, represents the abnormal candidate subgraph at time s, Indicates Candidate subgraph of abnormal step of Statistics.

[0053] Experimental part: Datasets: All methods are evaluated on three real financial transaction datasets, namely ETH-Jan-18, ETH-Jan-19 and Blur. See Table 1 for details.

[0054] Table 1 Evaluation on different datasets

[0055] The ETH dataset is Ethereum blockchain data from Google BigQuery1. They contain token transactions from source addresses to receiving addresses, including the transaction amount.

[0056] The Blur dataset is a real transaction dataset from the NFT market, compiled using Etherscan API 2. It covers NFT transactions between addresses over a period of time.

[0057] Dataset preprocessing: Following the practice of AntiBenford, transactions with a value of less than 1 unit are excluded during preprocessing. Since the goal is to find abnormal subgraphs in the time network, the timestamps associated with the transactions are retained. The time graph is divided into multiple snapshots at equal time intervals, and there is a sequential relationship between these snapshots.

[0058] For each time interval, multiple transactions between two nodes are represented as a single edge. Each edge is associated with a transaction frequency and a financial distribution, which contains the number of transactions per number. This forms the input graph for the analysis.

[0059] About the exception label: Since these datasets lack inherent anomaly labels, specifically, we identify the densest temporal subgraphs satisfying ψ(S) ≥ ρT and randomly select 80 of them for the training set.

[0060] Non-temporal anomaly detection methods: Non-learning-based abnormal subgraph discovery methods include Holoscope, FlowScope, and AntiBenford.

[0061] Learning-based anomaly detection methods include CLARE, AS-GAE, GCAD, and SIGNET.

[0062] Temporal anomaly detection method: DeepSphere combines deep autoencoders and hypersphere learning algorithms to detect anomalies in dynamic graphs.

[0063] RustGraph detects anomalies by jointly learning structural-temporal dependencies in temporal graphs.

[0064] AnoGraph proposes a sketch algorithm to detect anomalies in flow graphs.

[0065] The most time-intensive subgraph discovery method: FAST-GA proposes a greedy method to detect temporally dense subgraphs.

[0066] OTCD and TopLC proposed to use scalable temporal cores for temporally cohesive subgraph mining.

[0067] Hyperparameter settings: Hyperparameters are learned by using grid search. Hyperparameter tuning is performed using grid search. The following parameters are tuned: The time interval between snapshots is selected from {5, 10, 20, 30} minutes. The maximum size of nodes in the frontier m is selected from {100, 150, 200, 250}. The range of observation window Wr for time-dense subgraphs is selected from {30, 60, 90, 120} minutes. The size of the top p candidates is selected from {100, 150, 200, 250}. The number of sampled pairs is selected from {5, 10, 15, 20}. The number of training subgraphs is selected from {20, 50, 80, 110}.

[0068] Performance metrics: Performance was evaluated using standard metrics outlined in Antibenford [1], including -Statistics, subgraph density and ,in It is a subgraph Average The value of each node. The measurement evaluates the deviation of the transaction distribution of the subgraph from Benford's law, and Calculate the mean deviation, expressed as This average is important because in larger subgraphs, larger Values ​​may cause seemingly small value. Therefore, A fair comparison of subgraphs of different sizes is provided.

[0069] In addition, according to the definition of abnormal subgraphs in Antibenford [1], if the subgraph The number of nodes is , it is considered to be an abnormal subgraph, and the abnormality degree is used As a measure. Higher Indicates a more unusual subgraph.

[0070] Effectiveness Assessment: By comparing all methods in top- The effectiveness of these The subgraph ranking of each method is based on The values ​​are sorted. In order to obtain stable results, the average results of five runs are obtained. From Tables 3, 4 and 5, it can be observed that: (1) The proposed TempASD shows higher anomaly levels than other baseline methods on all three datasets. On average, it is 755.9% more effective than the state-of-the-art methods in terms of anomaly levels. This confirms the ability of TempASD to detect temporally anomalous subgraphs in dynamic financial networks.

[0071] (2) Compared with other baseline methods, TempASD achieves the highest Although it ranks in the top 5, top 15, and top 20 on the Blur dataset The values ​​are not the highest, but their average value, that is The value is the highest. The value measures the average ,Right now , so this metric is more fair when comparing subgraphs of different sizes.

[0072] (3) TempASD’s temporal density values ​​are comparable to those of other baseline methods, although some are not the highest. However, TempASD’s anomaly degree values ​​remain consistently the highest. Some baseline methods, such as FlowScope, may have some of the highest temporal density values, but their anomaly degree values ​​are very low, indicating that they are not anomalous subgraphs at all.

[0073] (4) The anomaly degree value decreases as the value of a increases. This is because a larger a contains more subgraphs with lower anomaly degrees. However, even when the value of a is large (e.g., a=20), TempASD can still identify temporal subgraphs with higher anomaly degrees.

[0074] The TempASD model is evaluated for different hyperparameters. Since the trends of hyperparameters on the ETH-Jan-19 and Blur datasets are similar to those on ETH-Jan-18, they are omitted due to space limitations. , The trend of and density is similar to da(S). Figure 6 It is shown in result.

[0075] Snapshot interval duration: Figure 6 (a) shows that increasing the time interval achieves the best performance when the interval is 10 minutes. However, further increasing the time interval will cause the performance to degrade due to losing more detailed transaction information.

[0076] The maximum size m of nodes in the frontier: Figure 6 (b) shows that when m exceeds 150, more noise is introduced, causing the results to deteriorate.

[0077] Observation windows for time-intensive subgraphs Range: Figure 6 (c) Description Scaling beyond 60 results in larger temporal subgraphs with lower degrees of anomaly, which negatively impacts performance.

[0078] forward Size of candidates: Figure 6 (d) shows that increasing the number of candidates beyond 150 leads to more suboptimal subgraphs, thus degrading the performance.

[0079] Number of sampling pairs: Figure 6 (e) shows that increasing the number of sampled pairs beyond 10 leads to degraded performance due to possible increased noise.

[0080] Number of training subgraphs: Figure 6 (f) shows that increasing the number of training subgraphs improves the results until it reaches 80. However, the improvement diminishes when the number reaches 100. Due to the scarcity of training subgraphs, this number is not further increased in the experiments.

[0081] Ablation experiment: An ablation study is conducted on the TempASD model to evaluate the impact of its key components. The Blur dataset as well as the top-15 and top-20 results are excluded due to similar behavioral patterns. Temporal anomaly refinement (Section V.D) is omitted. Weights, i.e., transaction frequencies, are not considered in the temporal graph neural network (Section V.B). TempASDnk excludes the KL divergence of financial distributions between pairs (Section V.B). TempASDnc replaces the temporal dense subgraph with a k-ego network (Section V.C). TempASDnf randomly selects connected nodes as boundary nodes (Section V.D).

[0082] from Figure 7 In, it is observed that: 1. TempASD outperforms TempASDnr on both datasets, which demonstrates the importance of temporal anomaly refinement in improving candidates towards anomalies.

[0083] 2. TempASDnw obtains a higher density ρT than TempASD, but it obtains a very low degree of anomaly da(S), which means that this subgraph is not anomalous. This emphasizes the role of incorporating transaction frequencies in temporal graph neural networks.

[0084] 3. TempASD outperforms TempASDnk on both datasets, highlighting the effectiveness of using KL divergence in measuring transaction similarities between subgraph pairs.

[0085] 4. TempASD significantly outperforms TempASDnc on both datasets, highlighting the key role of temporal dense subgraphs in candidate discovery.

[0086] 5. TempASD outperforms TempASDnf on both datasets, highlighting the importance of using transaction frequency to select boundary nodes.

[0087] Efficiency evaluation: The evaluation was performed using a device equipped with an Intel Xeon Platinum 8370C processor, a 32-core 2.8G CPU, and an NVIDIA GeForce RTX 4090 24G GPU.

[0088] Efficiency comparison: Figure 8 (a) shows the detection time on three datasets, and Figure 8 (b) shows the training time. Non-learning based methods have zero training time since they do not involve a training phase. TempASD has the shortest detection time among the three datasets and its training time is comparable to other baseline methods.

[0089] Scalability related to the size of graph nodes: Fig. 9 (ab) show the relationship between the detection time and training time of all methods and the size of the graph nodes. The proposed TempASD shows an approximately linear relationship with the node size in the financial network on a logarithmic scale, which indicates that its time complexity is polynomial.

[0090] Scalability related to the span of the time dimension: Fig. 9 (cd) show the relationship between detection time and training time and the number of days. The node size is fixed at 500,000 to ensure that the changes are only due to the change in the time dimension. TempASD shows a nearly linear trend with respect to the number of days in dynamic financial networks.

[0091] Case Studies We investigate the interpretability of TempASD by showing subgraphs of temporal anomalies detected in the ETH-Jan-2018 dataset. Fig.10 (a). In this case study, the default snapshot time interval, i.e., ten minutes, is used. The proposed TempASD successfully identifies time-dense subgraphs spanning three time intervals (i.e., T1, T2, and T3) whose financial distribution of transaction information clearly deviates from Benford's law. In contrast, AntiBenford, which is designed for static financial networks, can only detect non-time-dense subgraphs that deviate from Benford's law. This limitation motivates the establishment of a theoretical foundation for detecting anomalous subgraphs in a temporal context. Although AnoGraph is designed for temporal networks, it does not incorporate transaction information, resulting in the detected temporal subgraphs not deviating from Benford's law, which means that the transaction information of the detected temporal subgraphs is normal.

[0092] In an embodiment of the present invention, a dynamic financial network is obtained, wherein the dynamic financial network includes nodes, edges between nodes, and the edges between nodes are used to characterize transaction information of at least one of the nodes; the dynamic financial network is estimated by approximate linear time complexity to obtain dense subgraphs of different time slices, a chi-square calculation is performed on each edge of the dense subgraph of each time slice to obtain the chi-square of each edge of each time slice, nodes corresponding to edges in the dense subgraph of each time slice whose chi-square is greater than or equal to the total chi-square of each time slice are retained, and nodes corresponding to edges in the dense subgraph of each time slice whose chi-square is less than the total chi-square of each time slice are deleted to obtain top-p abnormal subgraphs of different time slices; top-p abnormal subgraphs of different time slices are calculated. The method encodes a constant subgraph to obtain abnormal candidate subgraphs of different time slices, wherein the abnormal candidate subgraphs of different time slices contain boundaries; excludes or expands the nodes in the abnormal candidate subgraphs of different time slices to obtain the abnormality degree of the abnormal candidate subgraphs of different time slices; maximizes the gain of the abnormality degree of the abnormal candidate subgraphs of different time slices to obtain a maximized reward; optimizes the abnormal candidate subgraphs of different time slices by maximizing the reward to obtain optimized abnormal candidate subgraphs of different time slices, thereby solving the technical problem that the prior art can only identify static abnormal subgraphs in financial networks but cannot detect the changes and trends of user transaction behaviors over time, and achieves the technical effect of identifying dynamic abnormal subgraphs in financial networks, which can be used to detect the changes and trends of user transaction behaviors over time.

[0093] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0094] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0096] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0097] In addition, each functional unit in each embodiment of the present invention may be integrated into a first processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0098] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for discovering dynamic abnormal subgraphs in a time-series financial network, characterized in that: include: Acquire a dynamic financial network, wherein the dynamic financial network includes nodes, and edges between nodes, and the edges between nodes are used to represent transaction information of at least one of the nodes; The dynamic financial network is estimated by approximating linear time complexity to obtain dense subgraphs of different time slices. The chi-square of each edge of the dense subgraph of each time slice is calculated to obtain the chi-square of each edge of each time slice. The nodes corresponding to the edges in the dense subgraph of each time slice whose chi-square is greater than or equal to the total chi-square of each time slice are retained, and the nodes corresponding to the edges in the dense subgraph of each time slice whose chi-square is less than the total chi-square of each time slice are deleted to obtain the top-p abnormal subgraphs of different time slices. Encode the top-p abnormal subgraphs of different time slices to obtain abnormal candidate subgraphs of different time slices, wherein the abnormal candidate subgraphs of different time slices contain boundaries; Eliminate or expand the nodes in the abnormal candidate subgraphs of different time slices to obtain the abnormal degree of the abnormal candidate subgraphs of different time slices; The maximum reward is obtained by maximizing the gain of the abnormal degree of the abnormal candidate subgraphs at different time slices; The abnormal candidate subgraphs of different time slices are optimized by maximizing the reward, and the optimized abnormal candidate subgraphs of different time slices are obtained.

2. The method according to claim 1, characterized in that: The chi-square calculation is performed on each edge of the dense subgraph of each time slice, and the chi-square expression of the dense subgraph of each time slice is obtained as follows: in, is the chi-square of the dense subgraph at each time slice, is a dense subgraph of each time slice The first digit of the transaction amount is equal to The number of timing edges, represents the expected number of legs based on Benford's law, where the first digit of the transaction amount is equal to .

3. The method according to claim 1, characterized in that The process of encoding the top-p abnormal subgraphs of different time slices is as follows: The nodes of the top-p abnormal subgraphs of different time slices are extracted by different node numbers, and the positive top-p abnormal subgraph pairs and negative sample top-p abnormal subgraph pairs in the top-p abnormal subgraphs of different time slices are obtained; Calculate the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs; Based on the similarity between positive top-p abnormal subgraph pairs and the similarity between negative top-p abnormal subgraph pairs, the objective loss function is optimized.

4. The method according to claim 3, characterized in that The expression of the similarity between the positive top-p abnormal subgraph pairs is: in, Indicates that in the snapshot The top-p abnormal subgraph at the moment Middle The encoding vector of nodes. Similarly, Indicates that in the snapshot The top-p abnormal subgraph at the moment Midpoint The encoding vector of the neighborhood of is through the snapshot The top-p abnormal subgraph at the moment Midpoint The encoding vectors of all neighbors of Calculated by the function. is in the snapshot The top-p abnormal subgraph at the moment The number of nodes. And Represents the number of snapshots sampled for each time positive top-p abnormal subgraph, Represents two positive top-p abnormal subgraphs and The financial distribution between Divergence. Positive top-p outlier subgraphs with similar financial distributions lead to lower Score.

5. The method according to claim 3, characterized in that: The expression of the similarity between the negative top-p abnormal subgraph pairs is: in, Indicates that in the snapshot Time negative top-p abnormal subgraph Nodes randomly sampled from The encoding vector of the neighborhood of . and are completely different and non-overlapping temporal negative top-p anomaly subgraphs, so the same node cannot be used for the negative top-p anomaly subgraph pair .

6. The method according to claim 3, characterized in that The expression of the optimization objective loss function based on the similarity between the positive top-p abnormal subgraph pairs and the similarity between the negative top-p abnormal subgraph pairs is: in, Represents the temperature parameter.

7. The method according to claim 1, characterized in that The expression of the abnormal degree of the abnormal candidate subgraphs of different time slices is: in, For the Candidate subgraph of abnormal step The degree of abnormality, Indicated in Candidate subgraph of abnormal step The time density, ) indicates that Candidate subgraph of abnormal step , represents the abnormal candidate subgraph at time s, Indicates Candidate subgraph of abnormal step of Statistics.

8. A computer system, characterized in that include: One or more processors, and a computer-readable storage medium for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method of claim 1.

9. A computer-readable storage medium, characterized in that Computer executable instructions are stored, and when the instructions are executed, they are used to implement the method of claim 1.

10. A computer program product, characterized in that The invention comprises computer executable instructions, which are used to implement the method of claim 1 when being executed.

Images