Fraud risk prediction method and device based on dynamic space-time neural network model

Abstract

The invention provides a fraud risk prediction method based on a dynamic space-time neural network model. The fraud risk prediction method can be applied to the technical field of information security or cloud computing. The method comprises the steps of obtaining n pieces of business data of m customers in a historical time period under the condition that the customers agree or authorize; performing feature screening on the business data to obtain n1 feature data, where n1 is a positive integer less than or equal to n; constructing space-time diagram data based on the n1 feature data; and on the basis of the space-time diagram data, a pre-trained dynamic space-time neural network model is utilized to predict the fraud probability of the customer, and the dynamic space-time neural network model at least comprises a diagram convolutional network model and a time sequence prediction model. The invention further provides a fraud risk prediction device and equipment based on the dynamic space-time neural network model, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security or cloud computing technology, and more specifically to a fraud risk prediction method, device, equipment, medium and program product based on a dynamic spatiotemporal neural network model. Background Art

[0002] As the anti-detection awareness of fraudulent customers gradually increases, the banking industry cannot effectively identify fraudulent customers by constructing knowledge graphs to extract screening rules. Therefore, the use of machine learning technology to predict fraud risks has become common in the industry. Generally, it is mainly through constructing customer features in various dimensions, screening features through feature engineering, and then using regression tree algorithms that perform well in regression tasks. At the same time, when constructing customer features, some historical factors of variables are often considered, such as the transfer of funds for many months in history. However, in machine learning methods, these features are treated equally, ignoring their historical sequence, and it is impossible to consider the sequence evolution of the feature over time. In addition, each sample is usually regarded as an independent relationship, and the various associations between customers are not fully considered by the model. In addition, the data samples involved in the bank fund scenario are often quite large, and direct input often consumes a lot of resources. In addition, irrelevant features may also become noise and affect the model capabilities. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a fraud risk prediction method, apparatus, device, medium and program product based on a dynamic spatiotemporal neural network model to improve prediction accuracy.

[0004] According to the first aspect of the present disclosure, a fraud risk prediction method based on a dynamic spatiotemporal neural network model is provided, the method comprising: with the consent or authorization of the customer, obtaining n business data of m customers in a historical time period; performing feature screening on the business data to obtain n1 feature data, wherein n1 is a positive integer less than or equal to n; constructing spatiotemporal graph data based on the n1 feature data; and based on the spatiotemporal graph data, predicting the fraud probability of the customer using a pre-trained dynamic spatiotemporal neural network model, wherein the dynamic spatiotemporal neural network model at least includes a graph convolutional network model and a time series prediction model.

[0005] According to an embodiment of the present disclosure, the method of predicting the fraud probability of the customer based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model includes: based on the structural features of the spatiotemporal graph data at each moment, using the graph convolutional network model to perform feature aggregation on each node of the spatiotemporal graph data, extracting spatial similarity information, and obtaining new node features of each node, wherein the spatial similarity information is used to characterize the association relationship between the node and its neighboring nodes.

[0006] According to an embodiment of the present disclosure, predicting the fraud probability of the customer based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model also includes: inputting new node features of each node in the spatiotemporal graph data at each moment into the time series prediction model, and processing through the gating mechanism of the time series prediction model to extract time similarity information, wherein the time series prediction model is constructed based on a gated recurrent unit neural network; fusing the time similarity information with the spatial similarity information to obtain spatiotemporal fusion information; and predicting the fraud probability of the customer based on the spatiotemporal fusion information.

[0007] According to an embodiment of the present disclosure, training the dynamic spatiotemporal neural network model includes: dividing the spatiotemporal graph data according to a preset size to obtain multiple small batches of spatiotemporal graph data; inputting each of the small batches of spatiotemporal graph data into the dynamic spatiotemporal neural network model in sequence to obtain the fraud probability of the customer; using a loss function to calculate the difference between the statistical distribution of the predicted fraud probability and the statistical distribution of the actual fraud situation; when the difference between the statistical distribution of the fraud probability and the statistical distribution of the actual fraud situation is greater than a preset threshold, updating the parameters of the dynamic spatiotemporal neural network model through an optimizer according to the gradient of the loss function until the difference is less than or equal to the preset threshold.

[0008] According to an embodiment of the present disclosure, the method also includes: monitoring the difference between the fraud probability predicted by the dynamic spatiotemporal neural network model and the statistical distribution of the actual fraud situation; when the difference value does not decrease within k consecutive monitoring cycles, triggering an early stopping mechanism to stop the training of the dynamic spatiotemporal neural network model, where k is a positive integer; and saving the parameters of the dynamic spatiotemporal neural network model when early stopping is triggered as the optimal model parameters.

[0009] According to an embodiment of the present disclosure, the feature screening of the business data to obtain n1 feature data includes: extracting features from the n business data, converting and processing them, and obtaining n2 primary features, where n2 is less than or equal to n and greater than or equal to n1; and using an embedded method to select the n2 primary features after preliminary screening to obtain n1 feature data.

[0010] According to an embodiment of the present disclosure, the construction of the spatiotemporal graph data based on n1 feature data includes: converting the m customers at time t in the historical time period into nodes of the spatiotemporal graph data, and converting the feature data of the customers into node features; establishing corresponding edges between the nodes based on preset association rules, and assigning edge features corresponding to the association rules to each edge; constructing a single point-in-time graph data at time t according to the nodes, the node features, the edges and the edge features; and splicing the continuous single point-in-time graph data in the historical time period in chronological order to form the spatiotemporal graph data.

[0011] The second aspect of the present disclosure provides a fraud risk prediction device based on a dynamic spatiotemporal neural network model, including: an acquisition module, used to acquire n business data of m customers in a historical time period with the consent or authorization of the customers; a screening module, used to perform feature screening on the business data to obtain n1 feature data, wherein n1 is a positive integer less than or equal to n; a construction module, used to construct spatiotemporal graph data based on the n1 feature data; and a prediction module, used to predict the fraud probability of the customer based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model, wherein the dynamic spatiotemporal neural network model at least includes a graph convolutional network model and a time series prediction model.

[0012] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above-mentioned fraud risk prediction method based on the dynamic spatiotemporal neural network model.

[0013] The fourth aspect of the present disclosure also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned fraud risk prediction method based on the dynamic spatiotemporal neural network model are implemented.

[0014] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned fraud risk prediction method based on the dynamic spatiotemporal neural network model.

[0015] In the embodiments of the present disclosure, significant features are screened through feature engineering, thereby reducing input features and saving computing resources. At the same time, a dynamic spatiotemporal neural network model that combines a graph convolutional network model and a time series prediction model is used to predict the fraud risk of customers, which not only considers the sequence evolution law of features over time, but also considers the correlation between customers at a certain point in time, thereby improving the accuracy of the prediction and achieving accurate prediction of customer fraud risk. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0017] Figure 1 A schematic diagram showing an application scenario of a fraud risk prediction method, apparatus, device, medium, and program product based on a dynamic spatiotemporal neural network model according to an embodiment of the present disclosure;

[0018] Figure 2 Schematically shows a flow chart of training a dynamic spatiotemporal neural network model according to an embodiment of the present disclosure;

[0019] Figure 3 A flowchart of a fraud risk prediction method based on a dynamic spatiotemporal neural network model according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 4 A structural block diagram of a fraud risk prediction device based on a dynamic spatiotemporal neural network model according to an embodiment of the present disclosure is schematically shown; and

[0021] Figure 5 A block diagram of an electronic device according to a fraud risk prediction method based on a dynamic spatiotemporal neural network model according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0022] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0023] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0024] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0025] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0026] In the technical solution of the present invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0027] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0028] Figure 1 The application scenario diagram of the fraud risk prediction method, apparatus, device, medium and program product based on the dynamic spatiotemporal neural network model according to the embodiment of the present disclosure is schematically shown.

[0029] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0030] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0031] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0032] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0033] It should be noted that the fraud risk prediction method based on the dynamic spatiotemporal neural network model provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the fraud risk prediction device based on the dynamic spatiotemporal neural network model provided in the embodiment of the present disclosure can generally be set in the server 105. The fraud risk prediction method based on the dynamic spatiotemporal neural network model provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the fraud risk prediction device based on the dynamic spatiotemporal neural network model provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0034] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0035] The following will be based on Figure 1 The scene described by Figure 2~Figure 3 The fraud risk prediction method based on the dynamic spatiotemporal neural network model of the disclosed embodiment is described in detail.

[0036] The inventor has found through research that in the relevant technology, the prediction of fraud risk is mainly through constructing the characteristics of each dimension of the customer, filtering the characteristics through feature engineering, and then using the regression tree algorithm that performs well in regression tasks, such as the gradient boosting algorithm (XGBoost in English), the lightweight gradient boosting machine (LightGBM in English), etc. In this process, when constructing customer characteristics, some historical factors of variables are often considered, such as the fund transfer situation in history for many months, but in the machine learning method, these characteristics are usually treated equally, ignoring their historical sequence, and it is impossible to consider the sequence evolution law of the feature over time. At the same time, each sample (ie, customer) is usually regarded as an independent relationship, and the various associations between customers cannot be fully considered by the model method. In addition, the impact of data volume on algorithm training and operation is also crucial, and the data samples involved in the bank fund scenario are often quite large. Directly inputting all features into the deep learning model, although from the perspective of deep learning, the model will adaptively adjust the parameters related to the features, but it often consumes too many resources, and irrelevant features may also become noise and affect the model capability.

[0037] Therefore, the disclosed embodiment overcomes the difficulty in the prior art of simultaneously mining the impact of changes in historical sequences and the correlation between customers at a certain point in time, and provides a fraud risk prediction method based on a dynamic spatiotemporal neural network model, which can be applied to individual or corporate customers in the financial industry. Compared with the prior art, it distinguishes the impact of changes in customer characteristics in historical sequences and aggregates the correlation between customers, such as capital transactions, thereby reasonably considering more information. At the same time, combined with feature engineering and deep learning methods, it reduces input features and saves computing resources.

[0038] Figure 2 A flowchart for training a dynamic spatiotemporal neural network model according to an embodiment of the present disclosure is schematically shown.

[0039] In an embodiment of the present disclosure, training the dynamic spatiotemporal neural network model includes: dividing the spatiotemporal graph data according to a preset size to obtain multiple small batches of spatiotemporal graph data; inputting each of the small batches of spatiotemporal graph data into the dynamic spatiotemporal neural network model in sequence to obtain the fraud probability of the customer; using a loss function to calculate the difference between the statistical distribution of the predicted fraud probability and the statistical distribution of the actual fraud situation; when the difference between the statistical distribution of the fraud probability and the statistical distribution of the actual fraud situation is greater than a preset threshold, updating the parameters of the dynamic spatiotemporal neural network model through an optimizer according to the gradient of the loss function until the difference is less than or equal to the preset threshold.

[0040] Specifically, when training the dynamic spatiotemporal neural network model, a mini-batch training strategy is adopted. In this process, first, the entire spatiotemporal graph data is divided into multiple mini-batches, each of which contains a certain number of samples. For example, if the spatiotemporal graph data has 1,000 samples and the preset size of the mini-batch is selected as 100, then the data set will be divided into 10 mini-batches. Then, the model will traverse these mini-batches and output the probability of fraud for each customer.

[0041] In some exemplary embodiments, the cross entropy loss function is selected as the objective function of model training to measure the difference between the probability distribution predicted by the model and the true distribution. At the same time, according to the gradient of the loss function, the Adam gradient optimization method is selected as the optimizer to update the parameters of the model until the model performance (such as accuracy, recall rate and F1 score, etc.) is optimal. The trained model is then verified on the validation data and the hyperparameters are adjusted. Finally, the actual effect of the model is tested on the test data.

[0042] It should be noted that before training begins, training parameters and hyperparameters, such as learning rate, batch size, and number of training rounds, need to be set.

[0043] It can be understood that by dividing the spatiotemporal graph data into small batches, the amount of calculation required for each weight update is significantly reduced, making the training process more efficient, and the small batch training strategy also allows the model to train large data sets under limited memory. In addition, using the gradient of the loss function and the optimizer, the model can automatically adjust its parameters to reduce the prediction error, thereby further improving the prediction performance.

[0044] Furthermore, the method also includes: monitoring the difference between the fraud probability predicted by the dynamic spatiotemporal neural network model and the statistical distribution of the actual fraud situation; when the difference does not decrease within k consecutive monitoring cycles, triggering an early stopping mechanism to stop the training of the dynamic spatiotemporal neural network model, where k is a positive integer; and saving the parameters of the dynamic spatiotemporal neural network model when early stopping is triggered as the optimal model parameters.

[0045] Specifically, during the training process, the difference between the predicted fraud probability and the statistical distribution of the actual fraud situation is calculated to continuously monitor the performance changes on the validation set. If the performance on the validation set does not improve (that is, the difference value does not decrease) within k consecutive monitoring cycles, the early stopping mechanism is triggered according to the early listening threshold. When the early stopping mechanism is triggered, the parameters of the current model are saved as the optimal model parameters, and these parameters are used in subsequent applications or deployments.

[0046] It should be noted that the early stopping threshold (i.e. patience value) specifies the number of rounds allowed to continue training if there is no performance improvement, for example, k is 10.

[0047] It is understandable that by setting an early stopping mechanism, the dynamic spatiotemporal neural network model can be prevented from overfitting, helping the model to learn the overall rules and characteristics of the data instead of just focusing on the details and noise of the training data, thereby improving the generalization ability of the model and avoiding unnecessary consumption of computing resources.

[0048] Figure 3 The flowchart of the fraud risk prediction method based on the dynamic spatiotemporal neural network model according to an embodiment of the present disclosure is schematically shown.

[0049] like Figure 3 As shown, the fraud risk prediction method based on the dynamic spatiotemporal neural network model of this embodiment includes operations S310 to S340.

[0050] In operation S310, with the consent or authorization of the customers, n business data of m customers in a historical time period are obtained.

[0051] In an embodiment of the present disclosure, before obtaining n business data of m customers in a historical time period, the user's consent or authorization may be obtained. For example, before operation S310, a request to obtain business data may be issued to the user. When the user agrees or authorizes that the business data may be obtained, the operation S310 is performed.

[0052] In operation S320, feature screening is performed on the business data to obtain n1 feature data, where n1 is a positive integer less than or equal to n.

[0053] In operation S330, spatiotemporal graph data is constructed based on the n1 feature data.

[0054] In operation S340, based on the spatiotemporal graph data, a pre-trained dynamic spatiotemporal neural network model is used to predict the fraud probability of the customer, wherein the dynamic spatiotemporal neural network model includes at least a graph convolutional network model and a time series prediction model.

[0055] In the embodiments of the present disclosure, corresponding operation entrances may be provided for users to choose to agree or reject the automated decision results. That is, before the processing / decision of predicting the fraud probability of a customer using a pre-trained dynamic spatiotemporal neural network model, an instruction of the user to agree or reject the processing / decision input through the corresponding operation entrance may be obtained. If the user agrees to the processing / decision, the user information is processed / decided using the pre-trained dynamic spatiotemporal neural network model to predict the fraud probability of the customer, that is, step S340 is executed. If the user refuses to perform the processing / decision, the expert decision process is entered.

[0056] Specifically, first, to obtain the customer's business data, it is necessary to extract the feature data related to the business in the historical time period, and mark the customers with historical fraud as positive samples. Then, the spatiotemporal graph data is constructed based on the feature-screened business data, and the spatiotemporal graph data is input into the pre-trained dynamic spatiotemporal neural network model. In this process, the spatiotemporal graph data of the graph structure is processed using a graph convolutional neural network algorithm, that is, a graph convolutional network model, to transmit and aggregate the information of nodes and their neighboring nodes, so as to consider various types of associations between customers. Since the graph convolutional network model is a method for processing the graph structure at a static time point, and the node features (such as customer assets) and edge features (such as transfer amounts) will change over time, in the embodiment of the present disclosure, both the association between customers at each time point and the impact of historical time series changes are considered, that is, a time series prediction model is adopted, such as an autoregressive difference moving average model (ARIMA in English), a long short-term memory network model (LSTM in English), and a gated recurrent unit neural network adopted in the embodiment of the present disclosure.

[0057] It can be understood that the fraud risk prediction method based on the dynamic spatiotemporal neural network model of the embodiment of the present disclosure first screens significant features through feature engineering, and then uses a deep learning method, that is, a dynamic spatiotemporal neural network model that combines a time series prediction model and a graph convolutional network model to predict the fraud risk of customers. This achieves the simultaneous mining of the impact of historical sequence changes and the correlation between customers at different points in time while saving computing resources, further improving the accuracy of the dynamic spatiotemporal neural network model, thereby effectively improving the accuracy of the predicted fraud risk.

[0058] In an embodiment of the present disclosure, the feature screening of the business data to obtain n1 feature data includes: extracting features from the n business data, converting and processing them, and obtaining n2 primary features, where n2 is less than or equal to n and greater than or equal to n1; and using an embedded method to select the n2 primary features after preliminary screening to obtain n1 feature data.

[0059] Specifically, for the original n business data, feature extraction is first performed to convert the original data into feature representations that can be used for machine learning model training. After feature extraction, these features are converted and processed to make the features more in line with the input requirements of the model, such as eliminating the dimensional differences and distribution differences between features through normalization, standardization and discretization. The converted feature set is called n2 primary features. Among them, since some redundant or insignificant features will be merged or deleted during the conversion process, n2 is less than or equal to the original feature number n. After obtaining n2 primary features, feature selection is further performed to select the most predictive feature subset from the primary feature set.

[0060] In some exemplary embodiments, an embedded feature selection method is used, which is implemented by embedding the feature selection process into the model training process. For example, the random forest algorithm constructs multiple decision trees and evaluates the importance of each feature during the construction process, thereby selecting the feature subset that contributes most to the model prediction.

[0061] It can be understood that by filtering feature data through feature optimization and embedded feature selection and limiting the number of features, it is possible to not only improve the accuracy and efficiency of model predictions but also effectively save computing resources.

[0062] Furthermore, the construction of the spatiotemporal graph data based on the n1 feature data includes: converting the m customers at time t in the historical time period into nodes of the spatiotemporal graph data, and converting the feature data of the customers into node features; establishing corresponding edges between the nodes based on preset association rules, and assigning edge features corresponding to the association rules to each edge; constructing a single point-in-time graph data at time t according to the nodes, the node features, the edges and the edge features; and splicing the continuous single point-in-time graph data in the historical time period in chronological order to form the spatiotemporal graph data.

[0063] In the context of the banking industry, there is a large amount of capital flow and social interaction between customers, so the relationship between customers is very suitable to be represented by a graph structure. In this process, m customers are modeled as nodes on the graph structure, and the edges between the nodes on the graph are modeled according to the preset association rules (such as capital flow relationships). Specifically, firstly, the data of a single time point t is constructed. A single time point is a graph data structure, and the customer is represented by a node. That is, the m customers at time t in the historical time period are defined as nodes in the graph, and the characteristic data of these customers are defined as the characteristics of the node. Therefore, the characteristics of the m customers can be formally expressed as: , where x iRepresents the characteristics of the i-th customer. Based on the preset association rules (such as transfer, communication, etc.), corresponding edges are established between these nodes. For example, if customer i transfers money to another customer j, there is an edge [i, j]. Then, these edges are assigned features corresponding to the association rules, such as transfer amount, communication duration, etc. The edge features are represented as e i,j , all edge features constitute a set , and add the time point subscript, then the graph structure of a single time point is represented as G t ={X t ,E t Finally, multiple continuous time point data in the historical time period are spliced ​​to ensure the continuity and consistency of the graph data in the time dimension, and the spatiotemporal graph data structure G={X,E} is obtained.

[0064] It should be noted that when constructing spatiotemporal graph data, it is necessary to clarify how the time dimension is handled. For example, a subscript or time label can be added to each point in time graph data to distinguish different time points in subsequent analysis. In addition, at different time points, nodes and edges may change (for example, new customers join, old customers leave, and new transfer relationships, etc.). When constructing a spatiotemporal graph, these dynamic changes need to be considered and the graph structure needs to be updated accordingly.

[0065] It is understandable that by constructing spatiotemporal graph structure data that includes the association relationships between customers and the relationship between features changing over time, the complex relationships and network structures between customers can be more comprehensively displayed, providing richer information for subsequent fraud analysis and prediction.

[0066] Furthermore, the method of predicting the fraud probability of the customer based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model includes: based on the structural features of the spatiotemporal graph data at each moment, using the graph convolutional network model to perform feature aggregation on each node of the spatiotemporal graph data, extracting spatial similarity information, and obtaining new node features of each node, wherein the spatial similarity information is used to characterize the association relationship between the node and its neighboring nodes.

[0067] Specifically, the spatiotemporal graph data is input into the input layer of the dynamic spatiotemporal neural network model, and the input layer linearly transforms the input features (node ​​features and edge features, etc.) to increase the nonlinear ability of the model. At the same time, the input layer introduces nonlinearity by adding some activation functions. That is, H=σ(XW+b), where X represents the feature matrix composed of the spatiotemporal graph data, W represents the weight matrix, that is, the linear transformation of the input features to the next layer, b represents the bias vector, σ represents the activation function, and H represents the output of the input layer.

[0068] For the data at each moment, the graph convolution operation is performed through the graph convolution network model to aggregate the node feature h and extract the node's neighbor information. There are many forms of graph convolution, which can be expressed as follows based on the message passing framework:

[0069]

[0070] Among them, l represents the number of layers of the graph convolutional network model, The function defines how neighbor nodes pass information to the central node. For example, by i Normalize the edge features and then multiply them with the corresponding neighbor node vector h j . Defines how to aggregate information from neighboring nodes, for example, using a cumulative sum operation. (·) defines how the central node combines its current features with information from its neighbors, for example, by using a concatenation operation.

[0071] Therefore, the graph convolution form of the embodiment of the present disclosure is expressed as:

[0072]

[0073] Furthermore, because the graph structure is dynamic, that is, the neighbor nodes, node features, and edge features at different time points have dynamic changing characteristics, that is, the neighbor node N at time point t1 and time point t2 i,t1 and N i,t2 , edge feature e i,j,t1 and e i,j,t2 will change, so the graph convolution operation at each time point is processed according to the specific graph structure, that is, the structural features, at that time point (moment) t, so that the graph convolution form is expanded to:

[0074]

[0075] It should be noted that the number of layers of the graph convolutional network model can be stacked according to the actual verification results to further extract information from the graph structure.

[0076] It can be understood that the graph convolutional network model is used to aggregate features and extract spatial similarity information of each node in the spatiotemporal graph data, so that the new node features contain richer information, so that the model can more accurately capture the fraud patterns between customers.

[0077] Furthermore, the method of predicting the customer's fraud probability based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model also includes: inputting new node features of each node in the spatiotemporal graph data at each moment into the time series prediction model, and processing through the gating mechanism of the time series prediction model to extract time similarity information, wherein the time series prediction model is constructed based on a gated recurrent unit neural network; fusing the time similarity information with the spatial similarity information to obtain spatiotemporal fusion information; and predicting the customer's fraud probability based on the spatiotemporal fusion information.

[0078] In some exemplary embodiments, the time series prediction model is combined with the graph convolutional network model to form a dynamic spatiotemporal neural network model. The time series prediction model of the disclosed embodiment is constructed based on the gated recurrent unit neural network (GRU in English). GRU is a variant of the recurrent neural network. Compared with the LSTM model, the gating mechanism of GRU uses only two gates, namely the update gate and the reset gate to control the flow of information, thereby determining the combination ratio of the information at the previous time point and the information at the current time point, and the degree of influence of the characteristics of the previous time point on the current time point. While saving computing overhead, the training effect is still not weaker than LSTM. In each time step of the GRU, the standard multi-layer perceptron (MLP in English) linear transformation is replaced with the graph convolution operation of the graph convolutional network model to capture the spatial information in the graph structure.

[0079] Furthermore, to simplify the representation, the features obtained after the l-layer graph convolution processing are , omitting the superscript of the number of layers, so the spatiotemporal graph network is represented as:

[0080]

[0081]

[0082]

[0083]

[0084] in, The output of the update gate determines the combination ratio of the information at the previous time point and the information at the current time point. To reset the gate, control the characteristics of the previous time point The degree of impact on the current time point.

[0085] It can be understood that by extracting time similarity information through the time series prediction model to reflect the continuity and changing trend of customer behavior in the time series, at the same time, by integrating spatial similarity information and time similarity information, the model can more comprehensively understand the customer's behavior pattern in the space-time graph, thereby significantly improving the accuracy of the prediction.

[0086] Based on the above-mentioned fraud risk prediction method based on the dynamic spatiotemporal neural network model, the present disclosure also provides a fraud risk prediction device based on the dynamic spatiotemporal neural network model. Figure 4 The device is described in detail.

[0087] Figure 4 The structural block diagram of the fraud risk prediction device based on the dynamic spatiotemporal neural network model according to an embodiment of the present disclosure is schematically shown.

[0088] like Figure 4 As shown, the fraud risk prediction device 400 based on the dynamic spatiotemporal neural network model of this embodiment includes an acquisition module 410, a screening module 420, a construction module 430 and a prediction module 440.

[0089] The acquisition module 410 is used to acquire n business data of m customers in a historical time period with the consent or authorization of the customers. In one embodiment, the acquisition module 410 can be used to perform the operation S310 described above, which will not be described in detail here.

[0090] The screening module 420 is used to perform feature screening on the business data to obtain n1 feature data, where n1 is a positive integer less than or equal to n. In one embodiment, the screening module 420 can be used to perform the operation S320 described above, which will not be described in detail here.

[0091] The construction module 430 is used to construct the spatiotemporal graph data based on the n1 feature data. In one embodiment, the construction module 430 can be used to perform the operation S330 described above, which will not be described in detail here.

[0092] The prediction module 440 is used to predict the fraud probability of the customer based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model, wherein the dynamic spatiotemporal neural network model includes at least a graph convolutional network model and a time series prediction model. In one embodiment, the prediction module 440 can be used to perform the operation S340 described above, which will not be repeated here.

[0093] According to an embodiment of the present disclosure, the prediction module 440 is specifically used to: based on the structural features of the spatiotemporal graph data at each moment, utilize the graph convolutional network model to perform feature aggregation on each node of the spatiotemporal graph data, extract spatial similarity information, and obtain new node features of each node, wherein the spatial similarity information is used to characterize the association relationship between the node and its neighboring nodes.

[0094] According to an embodiment of the present disclosure, the prediction module 440 can also be used to: input the new node features of each node in the spatiotemporal graph data at each moment into the time series prediction model, and process it through the gating mechanism of the time series prediction model to extract time similarity information, wherein the time series prediction model is constructed based on a gated recurrent unit neural network; fuse the time similarity information with the spatial similarity information to obtain spatiotemporal fusion information; and predict the fraud probability of the customer based on the spatiotemporal fusion information.

[0095] According to an embodiment of the present disclosure, the prediction module 440 can also be used to: divide the spatiotemporal graph data according to a preset size to obtain multiple small batches of spatiotemporal graph data; input each of the small batches of spatiotemporal graph data into the dynamic spatiotemporal neural network model in sequence to obtain the fraud probability of the customer; use a loss function to calculate the difference between the statistical distribution of the predicted fraud probability and the statistical distribution of the actual fraud situation; when the difference between the statistical distribution of the fraud probability and the statistical distribution of the actual fraud situation is greater than a preset threshold, according to the gradient of the loss function, update the parameters of the dynamic spatiotemporal neural network model through the optimizer until the difference is less than or equal to the preset threshold.

[0096] According to an embodiment of the present disclosure, the prediction module 440 can also be used to: monitor the difference between the fraud probability predicted by the dynamic spatiotemporal neural network model and the statistical distribution of the actual fraud situation; when the difference value does not decrease within k consecutive monitoring cycles, trigger the early stopping mechanism to stop the training of the dynamic spatiotemporal neural network model, where k is a positive integer; and save the parameters of the dynamic spatiotemporal neural network model when the early stopping is triggered as the optimal model parameters.

[0097] According to an embodiment of the present disclosure, the screening module 420 is specifically used to: extract features from the n business data, and convert and process them to obtain n2 primary features, where n2 is less than or equal to n and greater than or equal to n1; and use an embedded method to select the n2 primary features after preliminary screening to obtain n1 feature data.

[0098] According to an embodiment of the present disclosure, the construction module 430 is specifically used to: convert the m customers at time t within the historical time period into nodes of the spatiotemporal graph data, and convert the characteristic data of the customers into node characteristics; based on preset association rules, establish corresponding edges between each of the nodes, and assign edge characteristics corresponding to the association rules to each of the edges; construct a single point-in-time graph data at time t according to the nodes, the node characteristics, the edges and the edge characteristics; and splice the continuous single point-in-time graph data within the historical time period in chronological order to form the spatiotemporal graph data.

[0099] According to an embodiment of the present disclosure, any multiple modules of the acquisition module 410, the screening module 420, the construction module 430 and the prediction module 440 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 410, the screening module 420, the construction module 430 and the prediction module 440 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 410, the screening module 420, the construction module 430 and the prediction module 440 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0100] Figure 5 A block diagram of an electronic device suitable for implementing a fraud risk prediction method based on a dynamic spatiotemporal neural network model according to an embodiment of the present disclosure is schematically shown.

[0101] like Figure 5 As shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0102] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0103] According to an embodiment of the present disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the input / output (I / O) interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.

[0104] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0105] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0106] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the fraud risk prediction method based on the dynamic spatiotemporal neural network model provided by the embodiment of the present disclosure.

[0107] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0108] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0109] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0110] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0111] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0113] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A fraud risk prediction method based on a dynamic spatiotemporal neural network model, characterized in that: The method comprises: With the customer's consent or authorization, obtain n business data of m customers in a historical period; Performing feature screening on the business data to obtain n1 feature data, where n1 is a positive integer less than or equal to n; Based on the n1 feature data, constructing spatiotemporal graph data; and Based on the spatiotemporal graph data, a pre-trained dynamic spatiotemporal neural network model is used to predict the fraud probability of the customer, wherein the dynamic spatiotemporal neural network model includes at least a graph convolutional network model and a time series prediction model.

2. The method according to claim 1, characterized in that The method of predicting the fraud probability of the customer based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model includes: Based on the structural features of the spatiotemporal graph data at each moment, the graph convolutional network model is used to perform feature aggregation on each node of the spatiotemporal graph data, extract spatial similarity information, and obtain new node features of each node, wherein the spatial similarity information is used to characterize the association relationship between the node and its neighboring nodes.

3. The method according to claim 2, characterized in that The method of predicting the fraud probability of the customer based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model further includes: Inputting new node features of each node in the spatiotemporal graph data at each moment into the time series prediction model, and processing through the gating mechanism of the time series prediction model to extract time similarity information, wherein the time series prediction model is constructed based on a gated recurrent unit neural network; Fusing the temporal similarity information with the spatial similarity information to obtain spatiotemporal fusion information; and Based on the spatiotemporal fusion information, the fraud probability of the customer is predicted.

4. The method according to claim 1, characterized in that: Training the dynamic spatiotemporal neural network model includes: Dividing the space-time graph data according to a preset size to obtain a plurality of small batches of space-time graph data; Inputting each of the small batches of spatiotemporal graph data into the dynamic spatiotemporal neural network model in sequence to obtain the fraud probability of the customer; The loss function is used to calculate the difference between the statistical distribution of the predicted fraud probability and the statistical distribution of the actual fraud situation; When the difference between the statistical distribution of the fraud probability and the statistical distribution of the actual fraud situation is greater than a preset threshold, the parameters of the dynamic spatiotemporal neural network model are updated by the optimizer according to the gradient of the loss function until the difference is less than or equal to the preset threshold.

5. The method according to claim 4, characterized in that The method further comprises: Monitoring the difference between the fraud probability predicted by the dynamic spatiotemporal neural network model and the statistical distribution of the actual fraud situation; When the difference value does not decrease within k consecutive monitoring cycles, triggering an early stopping mechanism to stop the training of the dynamic spatiotemporal neural network model, wherein k is a positive integer; and The parameters of the dynamic spatiotemporal neural network model when early stopping is triggered are saved as optimal model parameters.

6. The method according to claim 1, characterized in that The feature screening of the business data to obtain n1 feature data includes: Extracting features from the n business data, converting and processing them, and obtaining n2 primary features, where n2 is less than or equal to n and greater than or equal to n1; and Using the embedded method, the n2 primary features after the initial screening are selected to obtain n1 feature data.

7. The method according to claim 1 or 6, characterized in that: The constructing of the spatiotemporal graph data based on the n1 feature data includes: Convert the m customers at time t in the historical time period into nodes of the spatiotemporal graph data, and convert the feature data of the customers into node features; Based on a preset association rule, a corresponding edge is established between each of the nodes, and an edge feature corresponding to the association rule is assigned to each of the edges; Constructing single point-in-time graph data at time t according to the nodes, the node features, the edges and the features on the edges; and The continuous single time point graph data within the historical time period are spliced ​​in chronological order to form the space-time graph data.

8. A fraud risk prediction device based on a dynamic spatiotemporal neural network model, characterized in that: The device comprises: The acquisition module is used to obtain n business data of m customers in a historical time period with the customer's consent or authorization; A screening module, used to perform feature screening on the business data to obtain n1 feature data, where n1 is a positive integer less than or equal to n; A construction module, used to construct spatiotemporal graph data based on the n1 feature data; and A prediction module is used to predict the fraud probability of the customer based on the spatiotemporal graph data using a pre-trained dynamic spatiotemporal neural network model, wherein the dynamic spatiotemporal neural network model includes at least a graph convolutional network model and a time series prediction model.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images