A method, device, equipment and storage medium for training abnormal user discovery model

Abstract

The present disclosure provides a method, apparatus, device and storage medium for training an abnormal user discovery model, including: acquiring transaction flow data, constructing transaction network graph data based on the transaction flow data, wherein the transaction network graph data includes in-bank accounts and out-of-bank accounts; extracting a user subgraph for each in-bank user based on the in-bank account, and constructing a user subgraph data set based on the user subgraph corresponding to the in-bank account; inputting the user subgraph data set into a graph autoencoder for training and learning, and obtaining an encoding method for representing each central node in the user subgraph data set; detecting the encoding method based on a first clustering method, and obtaining abnormal accounts in the user subgraph data set.

Description

Technical Field

[0001] The present disclosure relates to the financial field, and in particular to an abnormal user discovery model training method, device, equipment and storage medium. Background Art

[0002] With the development of financial technology, bank users have begun to rely more on online transactions, and users' trading behaviors have become more frequent, making it possible for illegal operations to be more safely hidden in complex online transactions. Banks and financial institutions continue to develop or purchase models or systems to detect and prevent various illegal operations to meet regulatory requirements and protect the security and stability of the financial system. Banks use technologies such as big data, machine learning, and artificial intelligence to analyze data such as customers' trading behaviors, capital flow patterns, and customer relationship networks, identify possible illegal operation risks, and take corresponding measures in a timely manner to prevent or reduce the impact of illegal operations on the financial system. In general, illegal operations are discovered by expert rules, and users' illegal operations will meet the rules set by experts, and then the user will be added to the blacklist. As the number of users increases and the trading behaviors become more and more complex, the illegal operation patterns covered by the rules summarized by manual analysis are becoming fewer and fewer, so it is necessary to provide more accurate and high-hit anti-illegal operation solutions. Designing models with wider coverage and higher efficiency to improve the mining of potential black market users is an urgent task for the financial industry.

[0003] There are many bank users, and the scale of graph data constructed through transaction records is huge, which will make the cost of deploying graph neural networks unacceptable. In addition, the self-supervised learning algorithm that only mines abnormal nodes based on the user's own characteristics ignores the topological characteristics of the account, and its representation learning ability is limited. Summary of the invention

[0004] The present disclosure provides a method, device, equipment and storage medium for training an abnormal user discovery model to at least solve the above technical problems existing in the prior art.

[0005] According to a first aspect of the present disclosure, a method for training an abnormal user discovery model is provided, the method comprising:

[0006] Acquire transaction flow data, and construct transaction network graph data based on the transaction flow data, wherein the transaction network graph data includes in-bank accounts and out-bank accounts;

[0007] Extracting a user subgraph for each in-bank user based on the in-bank account, and constructing a user subgraph dataset based on the user subgraph corresponding to the in-bank account;

[0008] Inputting the user subgraph data set into a graph autoencoder for training and learning to obtain an encoding method for representing each central node in the user subgraph data set;

[0009] The encoding method is detected based on a first clustering method to obtain abnormal accounts in the user subgraph data set.

[0010] In one possible implementation, constructing transaction network graph data based on the transaction flow data includes:

[0011] Performing statistics on the transaction flow data, obtaining transaction data of each account, and constructing account attributes of each account according to the transaction data by using feature engineering;

[0012] The transaction relationship in the transaction flow data is obtained, and the account is used as a node, the account attribute is used as a node attribute, and the transaction relationship is used as a connection edge between nodes to construct transaction network graph data.

[0013] In one possible implementation, extracting a user subgraph for each in-bank user based on the in-bank account includes:

[0014] The in-bank account is selected as the central node, and the in-bank account and the external account that have a transaction relationship with the in-bank account are selected as adjacent nodes;

[0015] Each central node and the corresponding adjacent nodes in the transaction network graph data are extracted, and a user subgraph corresponding to each user in the bank is constructed according to the transaction relationship between each central node and the adjacent nodes.

[0016] In one possible implementation manner, the step of inputting the user subgraph data set into a graph autoencoder for training and learning to obtain an encoding method for representing each central node in the user subgraph data set includes:

[0017] Selecting a node feature set corresponding to a node in the user subgraph in the user subgraph dataset, and constructing a node feature matrix based on the node feature set;

[0018] Selecting a random number of nodes in the node feature matrix and replacing them with a vector of a first value to obtain a node encoding matrix;

[0019] Calculating the message propagation weight of the user subgraph based on the node encoding matrix, and performing weighted summation of adjacent nodes in the user subgraph based on the message propagation weight to obtain the encoding representation of the central node;

[0020] Decoding the encoded representation of the central node based on a single-layer graph neural network to obtain an encoding method for the representation of the central node;

[0021] Iterative training is performed based on all central nodes in the user subgraph data set to obtain an encoding method for representing each central node in the user subgraph data set.

[0022] In one possible implementation, the detecting the encoding method based on the first clustering method to obtain abnormal accounts in the user subgraph data set includes:

[0023] Extracting the encoding method of each central node as the account feature corresponding to the central node;

[0024] The account features are clustered based on a first algorithm, the distances between the account features and the cluster centers are calculated, the distances of the accounts to the cluster centers are sorted, and a first number of accounts that are farthest from the cluster centers are determined as abnormal accounts.

[0025] According to a second aspect of the present disclosure, a device for training an abnormal user discovery model is provided, the device comprising:

[0026] A graph data construction unit, used to obtain transaction flow data, and construct transaction network graph data based on the transaction flow data, wherein the transaction network graph data includes in-bank accounts and out-bank accounts;

[0027] A user subgraph construction unit, configured to extract a user subgraph for each in-bank user based on the in-bank account, and construct a user subgraph dataset based on the user subgraph corresponding to the in-bank account;

[0028] An encoder training unit, used for inputting the user subgraph data set into a graph autoencoder for training and learning, to obtain an encoding method for representing each central node in the user subgraph data set;

[0029] An anomaly detection unit is used to detect the encoding method based on a first clustering method to obtain abnormal accounts in the user subgraph data set.

[0030] In one possible implementation, the graph data construction unit is further used to perform statistics on the transaction flow data, obtain transaction data of each account, and use feature engineering to construct account attributes of each account according to the transaction data; obtain transaction relationships in the transaction flow data, use the accounts as nodes, the account attributes as node attributes, and the transaction relationships as connecting edges between nodes to construct transaction network graph data;

[0031] The user subgraph construction unit is also used to select the in-bank account as the central node, and the in-bank account and the external account that have a transaction relationship with the in-bank account as adjacent nodes; extract each of the central nodes and the corresponding adjacent nodes in the transaction network graph data, and construct a user subgraph corresponding to each in-bank user according to the transaction relationship between each of the central nodes and the adjacent nodes.

[0032] In one possible implementation, the encoder training unit is further used to select a node feature set corresponding to a node in the user subgraph in the user subgraph data set, and construct a node feature matrix based on the node feature set; select a random number of nodes in the node feature matrix, replace them with a vector of a first value, and obtain a node encoding matrix; calculate the message propagation weight of the user subgraph based on the node encoding matrix, and perform weighted summation of adjacent nodes in the user subgraph based on the message propagation weight to obtain an encoding representation of the central node; decode the encoding representation of the central node based on a single-layer graph neural network to obtain an encoding method for the representation of the central node; perform iterative training based on all central nodes in the user subgraph data set to obtain an encoding method for the representation of each central node in the user subgraph data set;

[0033] The anomaly detection unit is also used to extract the encoding method of each central node as the account feature corresponding to the central node; cluster the account features based on a first algorithm, calculate the distance between the account features and the cluster center, sort the cluster center distances of the accounts, and determine the first number of accounts that are farthest from the cluster center as abnormal accounts.

[0034] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0035] at least one processor; and

[0036] a memory communicatively connected to the at least one processor; wherein,

[0037] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present disclosure.

[0038] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method described in the present disclosure.

[0039] The present invention discloses an abnormal user discovery model training method, device, equipment and storage medium. The transaction graph data is constructed by collecting the transaction flow of the account, and the transaction graph data is split into user subgraphs corresponding to the bank accounts. The autoencoding method is applied to the egocentric network (Ego-Networks, ego) subgraph with the bank account as the central node. The user subgraph is trained by using an encoder and a decoder to obtain an encoder model that can be used for anomaly detection, which reduces the requirements for hardware equipment and can be applied to large networks. At the same time, node attribute features are reconstructed instead of graph structure. At the same time, a shielding strategy and a scaled cosine error are used as the loss function to improve the robustness and generalization ability of the graph autoencoder.

[0040] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0042] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0043] Figure 1 The following is a schematic diagram showing the implementation process of an abnormal user discovery model training method according to an embodiment of the present disclosure. Figure 1 ;

[0044] Figure 2 The following is a schematic diagram showing the implementation process of an abnormal user discovery model training method according to an embodiment of the present disclosure. Figure 2 ;

[0045] Figure 3 A schematic diagram of the training process of the autoencoder in the embodiment of the present disclosure is shown;

[0046] Figure 4 A schematic diagram of an abnormal user discovery model training device according to an embodiment of the present disclosure is shown;

[0047] Figure 5 A schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0048] In order to make the purpose, features, and advantages of the present disclosure more obvious and easy to understand, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0049] Figure 1 The following is a schematic diagram showing the implementation process of an abnormal user discovery model training method according to an embodiment of the present disclosure. Figure 1 ,like Figure 1 As shown, the implementation process of an abnormal user discovery model training method in an embodiment of the present disclosure includes the following steps:

[0050] Step 101, obtain transaction flow data, and construct transaction network graph data based on the transaction flow data, wherein the transaction network graph data includes in-bank accounts and out-of-bank accounts.

[0051] In the disclosed embodiment, the transaction flow data includes the transaction amount, transaction time, etc. of an account within a bank. The transaction flow data is counted to obtain the transaction data of each account. Feature engineering is used to construct the account attributes of each account based on the transaction data, wherein the account attributes include the account opening time (month), account opening time (day), transaction days, activity rate within the statistical period, maximum daily transaction hours, maximum transaction hours, ratio of days to active days, and other data corresponding to the account; the transaction relationship in the transaction flow data is obtained, the account is used as a node, the account attributes are used as node attributes, and the transaction relationship is used as the connection edge between nodes to construct transaction network graph data, wherein the transaction network graph data includes in-bank accounts and out-of-bank accounts, and their corresponding transaction data.

[0052] Step 102: extract a user subgraph for each in-bank user based on the in-bank account, and construct a user subgraph dataset based on the user subgraph corresponding to the in-bank account.

[0053] In the embodiment of the present disclosure, the in-bank account is selected as the central node, and the in-bank account and the external account that have a transaction relationship with the in-bank account are used as adjacent nodes; each of the central nodes and the adjacent nodes corresponding to it are extracted from the transaction network graph data, and a user subgraph corresponding to each in-bank user is constructed according to the transaction relationship between the in-bank accounts and the external accounts, that is, the transaction relationship between each central node and the adjacent nodes. The user subgraph data set can be a set Graphs={ , .... }, is the ego subgraph with node k as the center node.

[0054] Step 103: input the user subgraph data set into a graph autoencoder for training and learning, and obtain an encoding method for representing each central node in the user subgraph data set.

[0055] In an embodiment of the present disclosure, a node feature set corresponding to a node in a user subgraph in the user subgraph data set is selected, and a node feature matrix is ​​constructed based on the node feature set; a random number of nodes in the node feature matrix are selected and replaced with a vector of a first numerical value to obtain a node encoding matrix, wherein the first numerical vector may be a vector with a value of -1; the message propagation weight of the user subgraph is calculated based on the node encoding matrix, and a weighted sum is performed on adjacent nodes in the user subgraph based on the message propagation weight to obtain an encoded representation of the central node; the encoded representation of the central node is decoded based on a single-layer graph neural network to obtain an encoding method for the representation of the central node; iterative training is performed based on all central nodes in the user subgraph data set to obtain an encoding method for the representation of each central node in the user subgraph data set.

[0056] In the disclosed embodiment, a scaled cosine error (SCE) is used as a loss function to avoid a rapid drop to near 0 resulting in failure of optimization.

[0057] Step 104: Detect the encoding method based on the first clustering method to obtain abnormal accounts in the user subgraph data set.

[0058] In an embodiment of the present disclosure, the encoding method of each central node is extracted as the account feature corresponding to the central node; the account features are clustered based on a first algorithm, the distance between the account features and the cluster center is calculated, the cluster center distances of the accounts are sorted, and a first number of accounts that are farthest from the cluster center are determined to be abnormal accounts, wherein the first number can be a value set based on experience.

[0059] Figure 2 The following is a schematic diagram showing the implementation process of an abnormal user discovery model training method according to an embodiment of the present disclosure. Figure 2 ,like Figure 2 As shown, the implementation process of an abnormal user discovery model training method in an embodiment of the present disclosure includes the following steps:

[0060] Step 201, obtaining bank transaction flow data.

[0061] In the disclosed embodiment, all daily transaction flow data of users in the bank are obtained, including the daily transaction records of users. The daily transaction records of users include accounts, counterparty accounts, transaction amounts, transaction times, etc.

[0062] Step 202: construct the user's account attributes.

[0063] In the embodiment of the present disclosure, through feature engineering, account attributes are constructed, and the transfer flow of the account is statistically calculated to obtain the following user statistical attributes: account opening time (month), account opening time (day), transaction days, activity rate within the statistical period, maximum daily transaction hours, maximum transaction hours, ratio of days to active days, fast-in and fast-out days, fast-in and fast-out ratio, cumulative number of transactions, cumulative number of deposits, cumulative number of withdrawals, number of deposits / number of withdrawals, average number of transactions per day, maximum number of transactions per day, maximum number of transactions per hour, unit score Maximum number of transfers within a minute, number of transfers during a sensitive period, number of small transactions, number of small transfers during a sensitive period, average amount per transaction, maximum transaction amount per day, maximum transaction amount per day / average amount per transaction, average daily transaction amount, maximum cumulative transaction amount per day, maximum cumulative transaction amount per day / average daily transaction amount, transaction amount during a sensitive period, cumulative transaction amount, cumulative amount in, cumulative amount out, in / out, number of counterparties, number of counterparties for incoming transactions, number of counterparties for outgoing transactions, maximum number of related counterparties per day.

[0064] Step 203, constructing transaction network graph data.

[0065] In the embodiment of the present disclosure, graph data based on the transaction network is constructed according to the transaction flow, wherein the graph data includes nodes and edges connecting the nodes, the nodes correspond to accounts in the transaction flow, including bank accounts and external accounts, the node attributes correspond to the account attributes, and the edges correspond to the transaction relationships between the accounts, such as the account Transfer to account , then the graph contains edges , Figure 3 The diagram shows a diagram of the training process of the graph autoencoder in the embodiment of the present disclosure, wherein the graph data based on the transaction network is constructed according to the transaction flow. Figure 3 As shown in the first left picture.

[0066] In the disclosed embodiment, ego subgraph sampling is performed based on graph data to construct an egocentric network, namely, an ego subgraph. The network nodes consist of a single central node (ego) and its neighbors (alters). The edges only include the edges between the central node and its neighbor nodes, and between neighbor nodes and neighbor nodes. The bank account is taken as the central node, and the ego subgraph corresponding to the bank account is extracted, namely, the nodes in the bank are composed of the ego subgraphs. and its neighbor nodes The subgraph dataset has been constructed based on the edges of these node homes. Each account in the same row corresponds to an ego subgraph with it as the central node, and finally a graph dataset consisting of multiple ego subgraphs is formed. , .... }, is the ego subgraph with node k as the center node.

[0067] Step 204, the representation of the ego subgraph is learned by the graph autoencoder to obtain the encoding method of the representation of the central node.

[0068] In the disclosed embodiment, the ego subgraph corresponding to the abnormal node has an abnormal graph structure and node attributes. The fraud-related accounts are detected for abnormality through a clustering algorithm (kmeans). When the clustering distance of the subgraph feature is far away from the cluster center, we consider that the corresponding account is an abnormal account.

[0069] In the embodiment of the present disclosure, the specific operation of representation encoding includes: given an ego subgraph =( , , ),in, is the node set of subgraph k, A k is the edge set of subgraph k, is the node feature set of subgraph k. The graph autoencoder in this scheme reconstructs the features As the goal, for any ego subgraph is the feature matrix of all its nodes. A part of the nodes is randomly selected and replaced with a vector with all values ​​of -1, such as the black nodes in the figure below. All the extracted ego subgraphs are encoded into a group of status feature vectors through the Graph Neural Network (GNN) to encode the topological information and attribute information of the ego subgraphs. The Graph Attention Networks (GAT) is selected as the encoder, and the following formula is obtained:

[0070] (1)

[0071] (2)

[0072] (3)

[0073] The MASK function in formula (1) randomly selects 20% of the nodes in all node representations and replaces their node representations with -1. Formula (2) calculates the message propagation weight in the message subgraph, where and are the masked node attributes, W and is the learnable parameter matrix, Leaky Re LU is the activation function, and soft is the normalized exponential function. is the propagation weight. Formula (3) is the message propagation and aggregation function, is the learnable parameter matrix, is a nonlinear function, is the propagation weight parameter obtained by formula (2), and the node and all neighboring nodes ∈N( )’s node features are After linear changes, according to the propagation weight Perform weighted summation.

[0074] In the embodiment of the present disclosure, the decoder is used to convert the node representation obtained by the encoder into Mapping back to input node features ,in, It can be understood as , this scheme uses a single-layer graph neural network as a decoder to restore the attribute information of the original ego subgraph. The GNN decoder can restore the input features of nodes whose features are masked by MASK based on the node distribution around the node, not just the node itself. In the decoder, the encoder-encoded representation of the initially sampled masked node is replaced with another mask identifier MASK for masking, that is, masked again, and the mask node index is the same as the encoder. Through re-masking and GNN decoder, that is, replacing the node features with a vector with all values ​​of -1, the replaced node is the same as the node whose features are replaced in the encoder, and the encoder uses the neighbor node representation (unmasked) of the masked target node to reconstruct the masked target node representation.

[0075] (4)

[0076] The MASK function in formula (4) selects the masked node in formula (1) from all node representations and replaces its node representation with -1, so that the replaced node is the same as the node whose feature is replaced in the encoder.

[0077] In the disclosed embodiment, the scaled cosine error is used as the loss function to avoid a rapid drop to near 0, which leads to failure in optimization. The scaling factor γ is a hyperparameter that can be adjusted for the data set. The scaling error can also be viewed as an adaptive sample weight adjustment, where the weight of each sample is adjusted differently for the reconstruction error. Given the original input feature X and the decoder output Z, the loss value is averaged or normalized according to the number of batch data points, and the normalization factor is set. , so the scaled cosine error is defined as the following formula:

[0078] (5)

[0079] Step 205: determine abnormal accounts according to the encoding method of the representation of the central node.

[0080] In the disclosed embodiment, after iterative training, the encoder is saved, and the ego subgraph of the validation set is encoded by the trained encoder. Belongs to Node Corresponding features, using the aggregate node feature method (READOUT method), extract the representation of the central node in the ego subgraph as the account , the whole image is characterized by the kmeans algorithm Classification, clustering account features through kmeans, calculating the distance between account features and cluster centers, sorting the distances of all accounts to cluster centers, and considering the accounts farthest from the cluster centers as the most The account is an abnormal account.

[0081] (6)

[0082] In the disclosed embodiment, a directed random graph convolutional neural network is applied to a dynamic graph. First, a transaction network is constructed based on the account and the opponent account and the account statistical features; then, the ego subgraph is sampled in the transaction network with the bank account as the central node to form a subgraph data set. Formula (1) randomly masks the feature information of the subgraph nodes to achieve data enhancement, and sends it to the GAT encoder in formula (2) and formula (3) to obtain the node representation. Formula (4) re-masks the node representation encoded by the encoder; then it is input into the GAT decoder to reconstruct the node features and obtain the reconstructed attributes of the masked nodes; the reconstructed attributes and the original attributes are input into the scaled cosine error function to calculate the loss, and the representation encoded by the encoder is sent to the support vector machine (SVM) to verify the encoder representation capability, and good results have been achieved in the experimental results.

[0083] Figure 4A schematic diagram of an abnormal user discovery model training device in an embodiment of the present disclosure is shown. Figure 4 As shown, an abnormal user discovery model training device in an embodiment of the present disclosure includes:

[0084] The graph data construction unit 401 is used to obtain transaction flow data and construct transaction network graph data based on the transaction flow data, wherein the transaction network graph data includes in-bank accounts and out-of-bank accounts.

[0085] The graph data construction unit 401 is also used to count the transaction flow data, obtain the transaction data of each account, and use feature engineering to construct the account attributes of each account based on the transaction data; obtain the transaction relationship in the transaction flow data, take the account as a node, the account attributes as a node attribute, and the transaction relationship as a connection edge between nodes to construct transaction network graph data.

[0086] The user subgraph construction unit 402 is configured to extract a user subgraph for each in-bank user based on the in-bank account, and construct a user subgraph dataset based on the user subgraph corresponding to the in-bank account.

[0087] The user subgraph construction unit 402 is also used to select the in-bank account as the central node, and the in-bank account and the external account that have a transaction relationship with the in-bank account as adjacent nodes; extract each of the central nodes and the corresponding adjacent nodes in the transaction network graph data, and construct a user subgraph corresponding to each in-bank user according to the transaction relationship between each of the central nodes and the adjacent nodes.

[0088] The encoder training unit 403 is used to input the user subgraph data set into the graph autoencoder for training and learning, so as to obtain the encoding method for representing each central node in the user subgraph data set.

[0089] The encoder training unit 403 is also used to select a node feature set corresponding to a node in the user subgraph in the user subgraph data set, and construct a node feature matrix based on the node feature set; select a random number of nodes in the node feature matrix, replace them with a vector of a first numerical value, and obtain a node encoding matrix; calculate the message propagation weight of the user subgraph based on the node encoding matrix, and perform weighted summation of adjacent nodes in the user subgraph based on the message propagation weight to obtain the encoded representation of the central node; decode the encoded representation of the central node based on a single-layer graph neural network to obtain the encoding method of the representation of the central node; perform iterative training based on all central nodes in the user subgraph data set to obtain the encoding method of the representation of each central node in the user subgraph data set.

[0090] The abnormality detection unit 404 is used to detect the encoding method based on the first clustering method to obtain abnormal accounts in the user subgraph data set.

[0091] The anomaly detection unit 404 is also used to extract the encoding method of each central node as the account feature corresponding to the central node; cluster the account features based on the first algorithm, calculate the distance between the account features and the cluster center, sort the cluster center distances of the accounts, and determine the first number of accounts that are farthest from the cluster center as abnormal accounts.

[0092] In an exemplary embodiment, the graph data construction unit 401, the user sub-graph construction unit 402, the encoder training unit 403, the anomaly detection unit 404, etc. can be implemented by one or more central processing units (CPU), graphics processing units (GPU), application-specific integrated circuits (ASIC), DSPs, programmable logic devices (PLD), complex programmable logic devices (CPLD), field programmable gate arrays (FPGA), general-purpose processors, controllers, microcontrollers (MCU), microprocessors, or other electronic components.

[0093] Regarding the device in the above embodiment, the specific manner in which each module and unit performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0094] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0095] Figure 5A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0096] like Figure 5 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 to a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0097] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0098] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as an abnormal user discovery model training method. For example, in some embodiments, an abnormal user discovery model training method may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the abnormal user discovery model training method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to execute an abnormal user discovery model training method in any other appropriate manner (eg, by means of firmware).

[0099] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0100] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0101] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0102] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0103] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0104] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0105] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0106] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0107] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A method for training an abnormal user discovery model, characterized in that: The method comprises: Acquire transaction flow data, and construct transaction network graph data based on the transaction flow data, wherein the transaction network graph data includes in-bank accounts and out-bank accounts; Extracting a user subgraph for each in-bank user based on the in-bank account, and constructing a user subgraph dataset based on the user subgraph corresponding to the in-bank account; Inputting the user subgraph data set into a graph autoencoder for training and learning to obtain an encoding method for representing each central node in the user subgraph data set; Detecting the encoding method based on a first clustering method to obtain abnormal accounts in the user subgraph data set; The step of inputting the user subgraph data set into a graph autoencoder for training and learning to obtain an encoding method for representing each central node in the user subgraph data set includes: Selecting a node feature set corresponding to a node in the user subgraph in the user subgraph dataset, and constructing a node feature matrix based on the node feature set; Selecting a random number of nodes in the node feature matrix and replacing them with a vector of a first value to obtain a node encoding matrix; Calculating the message propagation weight of the user subgraph based on the node encoding matrix, and performing weighted summation of adjacent nodes in the user subgraph based on the message propagation weight to obtain the encoding representation of the central node; Decoding the encoded representation of the central node based on a single-layer graph neural network to obtain an encoding method for the representation of the central node; Iterative training is performed based on all central nodes in the user subgraph data set to obtain an encoding method for representing each central node in the user subgraph data set.

2. The method according to claim 1, characterized in that The constructing of transaction network graph data based on the transaction flow data includes: The transaction flow data is counted to obtain the transaction data of each account, and the account attributes of each account are constructed according to the transaction data by using feature engineering, wherein the account attributes include the account opening time corresponding to the account, the activity rate within the statistical period, and the ratio of the maximum transaction hours and days to the active days; The transaction relationship in the transaction flow data is obtained, and the account is used as a node, the account attribute is used as a node attribute, and the transaction relationship is used as a connection edge between nodes to construct transaction network graph data.

3. The method according to claim 2, characterized in that The extracting a user subgraph for each in-bank user based on the in-bank account comprises: The in-bank account is selected as the central node, and the in-bank account and the external account that have a transaction relationship with the in-bank account are selected as adjacent nodes; Each central node and the corresponding adjacent nodes in the transaction network graph data are extracted, and a user subgraph corresponding to each user in the bank is constructed according to the transaction relationship between each central node and the adjacent nodes.

4. The method according to claim 1, characterized in that: The detecting the encoding method based on the first clustering method to obtain abnormal accounts in the user subgraph data set includes: Extracting the encoding method of each central node as the account feature corresponding to the central node; The account features are clustered based on a clustering algorithm, the distance between the account features and the cluster center is calculated, the cluster center distances of all the accounts are sorted, and the first number of accounts that are farthest from the cluster center are determined as abnormal accounts.

5. An abnormal user discovery model training device, characterized in that: The device comprises: A graph data construction unit, used to obtain transaction flow data, and construct transaction network graph data based on the transaction flow data, wherein the transaction network graph data includes in-bank accounts and out-bank accounts; A user subgraph construction unit, configured to extract a user subgraph for each in-bank user based on the in-bank account, and construct a user subgraph dataset based on the user subgraph corresponding to the in-bank account; An encoder training unit, used for inputting the user subgraph data set into a graph autoencoder for training and learning, to obtain an encoding method for representing each central node in the user subgraph data set; an abnormality detection unit, configured to detect the encoding method based on a first clustering method, and obtain abnormal accounts in the user subgraph data set; The encoder training unit is also used to select a node feature set corresponding to a node in the user subgraph in the user subgraph data set, and construct a node feature matrix based on the node feature set; select a random number of nodes in the node feature matrix, replace them with a vector of a first numerical value, and obtain a node encoding matrix; calculate the message propagation weight of the user subgraph based on the node encoding matrix, and perform weighted summation of adjacent nodes in the user subgraph based on the message propagation weight to obtain the encoded representation of the central node; decode the encoded representation of the central node based on a single-layer graph neural network to obtain an encoding method for the representation of the central node; perform iterative training based on all central nodes in the user subgraph data set to obtain an encoding method for the representation of each central node in the user subgraph data set.

6. The device according to claim 5, characterized in that The graph data construction unit is further used to perform statistics on the transaction flow data, obtain the transaction data of each account, and use feature engineering to construct the account attributes of each account according to the transaction data, wherein the account attributes include the account opening time corresponding to the account, the activity rate within the statistical period, and the ratio of the maximum transaction hours and days to the active days; obtain the transaction relationship in the transaction flow data, take the account as a node, the account attribute as a node attribute, and the transaction relationship as a connection edge between nodes to construct the transaction network graph data; The user subgraph construction unit is also used to select the in-bank account as the central node, and the in-bank account and the external account that have a transaction relationship with the in-bank account as adjacent nodes; extract each of the central nodes and the corresponding adjacent nodes in the transaction network graph data, and construct a user subgraph corresponding to each in-bank user according to the transaction relationship between each of the central nodes and the adjacent nodes.

7. The device according to claim 5, characterized in that The anomaly detection unit is also used to extract the encoding method of each central node as the account feature corresponding to the central node; cluster the account features based on a clustering algorithm, calculate the distance between the account features and the cluster center, sort the cluster center distances of all the accounts, and determine the first number of accounts that are farthest from the cluster center as abnormal accounts.

8. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 4.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to make a computer execute the method according to any one of claims 1-4.

Images