Joint fraud detection network training method and joint fraud detection method

Abstract

The invention discloses a training method and device of a joint fraud detection network, a joint fraud detection method and device, a joint fraud detection system, computer equipment, a computer readable storage medium and a computer program product, and the training method comprises the steps: obtaining single-party ciphertext data sent by each participant, performing embedding calculation in at least one graph embedding layer or a graph embedding layer connected with the fraud classification sub-network by using the single-party ciphertext data to obtain joint embedding data corresponding to a plurality of participants; performing fraud detection by using the fraud classification sub-network and the joint embedded data of the plurality of participants to obtain fraud detection results corresponding to the plurality of participants; and adjusting the network parameters of the fraud classification sub-network by using the preset fraud labels of the plurality of participants and the fraud detection results of the plurality of participants until a training stop condition is met.

Description

Technical Field

[0001] The present application relates to the technical field of fraud detection, and in particular to a training method and device for a joint fraud detection network, a joint fraud detection method and device, a joint fraud detection system, a computer device, a computer-readable storage medium, and a computer program product. Background Art

[0002] At present, there are various kinds of fraud on the Internet, such as increasing the popularity of videos by purchasing likes and attention; manipulating public perception by generating false product reviews; and illegally collecting coupons and fraudulent loan applications by registering fake accounts.

[0003] However, fraudsters’ fraudulent behavior is often not limited to a single party (such as a single company or platform), that is, the same fraudulent resources (such as phone numbers or IP addresses) may be used to attack multiple parties. For example, fraudsters may post false reviews for the same product on shopping platform A and shopping platform B. If each attacked platform or company performs fraud detection independently and relies only on their local business data sets, it will not be possible to effectively detect fraudulent behavior by multiple parties. However, directly using graph neural networks for detecting single-party fraud cannot detect fraudulent behavior by multiple parties.

[0004] Therefore, how to train a graph neural network that can detect fraudulent behavior by multiple parties is a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of the shortcomings of the related technologies mentioned above, the purpose of the present application is to provide a training method and device for a joint fraud detection network, a joint fraud detection method and device, a joint fraud detection system, computer equipment, computer-readable storage medium, and a computer program product to solve the technical problem of how to train a graph neural network that can detect fraudulent behavior of multiple parties.

[0006] To achieve the above-mentioned purpose and other related purposes, the first aspect of the present application provides a training method for a joint fraud detection network, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is communicatively connected to multiple participants performing joint fraud detection, and the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system. The training method includes: obtaining unilateral ciphertext data sent by each participant, and performing embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data corresponding to multiple participants; performing fraud detection using the fraud classification subnetwork and the joint embedding data of multiple participants to obtain fraud detection results corresponding to multiple participants; and adjusting the network parameters of the fraud classification subnetwork using the preset fraud labels of multiple participants and the fraud detection results of multiple participants until the training stop condition is reached.

[0007] According to a second aspect of the present application, there is provided a training device for a joint fraud detection network, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is communicatively connected to multiple participants performing joint fraud detection, and the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system. The training device includes: a joint embedding module, which is used to obtain unilateral ciphertext data sent by each participant, and perform embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork to obtain joint embedded data corresponding to multiple participants; a fraud detection module, which is used to perform fraud detection using the fraud classification subnetwork and the joint embedded data of multiple participants to obtain fraud detection results corresponding to multiple participants; and a parameter adjustment module, which is used to adjust the network parameters of the fraud classification subnetwork using preset fraud labels of multiple participants and fraud detection results of multiple participants until the training stop condition is reached.

[0008] A third aspect of the present application provides a joint fraud detection method, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is communicatively connected to multiple participants performing joint fraud detection, and the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system. The joint fraud detection method includes: obtaining unilateral ciphertext data sent by each participant, and performing embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification subnetwork to obtain joint embedded data corresponding to multiple participants; performing fraud detection using the fraud classification subnetwork and the joint embedded data of multiple participants obtained by training the joint fraud detection network using the training method of any embodiment disclosed in the first aspect of the present application to obtain fraud detection results corresponding to the multiple participants.

[0009] The fourth aspect of the present application provides a joint fraud detection device, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is communicatively connected to multiple participants performing joint fraud detection, and the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system. The joint fraud detection device includes: a joint embedding module, which is used to obtain unilateral ciphertext data sent by each participant, and perform embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork to obtain joint embedded data corresponding to multiple participants; a detection module, which is used to perform fraud detection using the fraud classification subnetwork trained by the training device of the joint fraud detection network disclosed in the second aspect of the present application and the joint embedded data of multiple participants to obtain fraud detection results corresponding to multiple participants.

[0010] A fifth aspect of the present application provides a multi-party secure computing system, comprising a plurality of computing devices, each of which is configured in a mutually untrusted computing system architecture; wherein a multi-party secure computing protocol is pre-installed in each computing device, and the multi-party secure computing protocol is used to execute, together with at least another computing device, a training method for a joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application or a joint fraud detection method as disclosed in the third aspect of the present application based on the multi-party secure computing protocol.

[0011] The sixth aspect of the present application provides a joint fraud detection system, comprising a plurality of participants and a multi-party secure computing system as disclosed in the fifth aspect of the present application, which is communicatively connected to the plurality of participants.

[0012] The seventh aspect of the present application provides a computer device, comprising: a storage device for storing at least one program; a processing device, connected to the storage device, for calling the at least one program from the storage device and executing it to implement the training method of the joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application or the joint fraud detection method disclosed in the third aspect of the present application.

[0013] The eighth aspect of the present application provides a computer-readable storage medium storing at least one program, which, when called, executes and implements the training method of the joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application or the joint fraud detection method disclosed in the third aspect of the present application.

[0014] The ninth aspect of the present application provides a computer program product, which, when executed on a computer, enables the computer to execute the training method of the joint fraud detection network as described in any embodiment disclosed in the first aspect of the present application or the joint fraud detection method as disclosed in the third aspect of the present application.

[0015] In summary, the training method and device of the joint fraud detection network, the joint fraud detection method and device, the joint fraud detection system, the computer device, the computer-readable storage medium, and the computer program product provided in the present application configure the joint fraud detection network to include at least one graph embedding layer and a fraud classification subnetwork, and use the fraud classification subnetwork and the joint embedded data of multiple participants to perform fraud detection so as to use the preset fraud labels of multiple participants and the fraud detection results of multiple participants to adjust the network parameters of the fraud classification subnetwork until the training stop condition is reached; in this way, not only can a graph neural network that can detect fraudulent behaviors of multiple parties be trained, but the data of each participant can also be protected through ciphertext calculation, and the trainable network parameters only exist in the fraud classification subnetwork, and thus only training the network parameters in the fraud classification subnetwork can speed up the training speed of the joint fraud detection network on the multi-party secure computing system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The specific features of the present application are shown in the attached claims. The features and advantages of the invention involved in the present application can be better understood by referring to the exemplary embodiments and drawings described in detail below. The drawings are briefly described as follows:

[0017] Figure 1 Shown is a schematic diagram of multiple-party fraud behavior in one embodiment of the present application.

[0018] Figure 2 Shown is a schematic diagram of a joint fraud detection system in one embodiment of the present application.

[0019] Figure 3 Shown is a structural diagram of a multi-party secure computing system in one embodiment of the present application.

[0020] Figure 4 Shown is a flowchart of a training method for a joint fraud detection network in one embodiment of the present application.

[0021] Figure 5 Shown is a schematic diagram of the configuration location of the joint fraud detection network in one embodiment of the present application.

[0022] Figure 6 Shown is a schematic diagram of the configuration location of a joint fraud detection network in another embodiment of the present application.

[0023] Figure 7 It is a schematic diagram of the process of calculating and obtaining unilateral ciphertext embedded data by a participant in a sub-embedding layer in one embodiment of the present application.

[0024] Figure 8a and Figure 8b Schematic diagrams showing unilateral embedded data obtained by different parties in one embodiment of the present application are shown respectively.

[0025] Fig. 9 Show this application Figure 8a A schematic diagram of joint embedded data of participants in one embodiment is shown.

[0026] Fig.10 Shown is a schematic diagram of a joint embedding feature corresponding to a detection party-resource node type obtained by using an acceleration method in one embodiment of the present application.

[0027] Fig.11 Shown is a structural block diagram of a training device for a joint fraud detection network in one embodiment of the present application.

[0028] Fig.12 Shown is a flowchart of a joint fraud detection method in one embodiment of the present application.

[0029] Fig.13 Shown is a structural block diagram of a joint fraud detection device in one embodiment of the present application.

[0030] Fig.14 Shown is a schematic diagram of the structure of a computer device in one embodiment of the present application. DETAILED DESCRIPTION

[0031] The following is an explanation of the implementation of the present application by means of specific embodiments. People familiar with the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification.

[0032] The present application is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The technical solutions in the embodiments of the present application are clearly and completely described. Obviously, the described embodiments are only embodiments of a part of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application. "An implementation method", "implementation method" or similar expressions mentioned in the whole text of this specification mean that the specific features, structures or characteristics described together with the implementation method are included in at least one embodiment of the present application. Therefore, in the whole text of this specification, the appearance of the phrases "in an implementation method", "in an implementation method" and similar expressions may (but not necessarily) relate to the same implementation method.

[0033] As mentioned in the background, the fraudulent behavior of the fraudster is not limited to one party, for example, see Figure 1 , which is a schematic diagram of multi-party fraud in one embodiment of the present application. As shown in the figure, user B and user C respectively give good reviews to clothing 1 on platform F, and user D also gives good reviews to clothing 1 on platform G, but the IP addresses of the three are the same, which is IP2. Then user B, user C, and user D can be identified as fraudulent users who give good reviews. If each party performs fraud detection independently, it is impossible to effectively detect fraudulent behavior of multiple parties. For example, platform G cannot detect that user D is a fraudulent user. However, it is impossible to directly use the graph neural network used to detect unilateral fraud to detect fraudulent behavior of multiple parties. Therefore, how to train a graph neural network that can detect fraudulent behavior of multiple parties is a technical problem that needs to be solved urgently.

[0034] By training a graph neural network with business data from multiple parties (multiple companies and / or platforms), a graph neural network that can be used to detect fraudulent behavior from multiple parties can be trained. However, there may be a risk of leaking / exposing business data during the training process. Therefore, in order to protect the business data of each party, the ciphertext of each party's business data can be used to perform multi-party secure computing in a multi-party secure computing system. However, the existing architecture of the graph neural network results in a low computing speed when using ciphertext for multi-party secure computing during training. Therefore, how to increase the training speed in the process of using ciphertext to train a graph neural network that can detect fraudulent behavior from multiple parties is a computational problem that needs to be solved urgently.

[0035] In view of this, in some embodiments provided in the present application, a training method for a joint fraud detection network is disclosed, wherein the joint fraud detection network is configured to include at least one graph embedding layer and a fraud classification subnetwork, and embedding calculation is performed on the unilateral ciphertext data sent by each participant in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data of multiple participants, and fraud detection is performed using the fraud classification subnetwork and multiple joint embedding data to adjust the network parameters of the fraud classification subnetwork using the preset fraud labels of multiple participants and the fraud detection results of multiple participants until the training stop condition is reached. In this way, not only can a graph neural network that can detect fraudulent behavior of multiple parties be trained, but the commercial data of each participant can also be protected by ciphertext, and since only the network parameters of the fraud classification subnetwork are trained in the graph embedding layer, the training speed of the joint fraud detection network on the multi-party secure computing system can be accelerated.

[0036] See also Figure 2 , which is a schematic diagram of a joint fraud detection system in one embodiment of the present application. As shown in the figure, the joint fraud detection system includes multiple participants 10 and a multi-party secure computing system 11 that is communicatively connected to the multiple participants 10. Each participant 10 sends its unilateral ciphertext data to the multi-party secure computing system 11, and the multi-party secure computing system 11 uses the acquired unilateral ciphertext data sent by the multiple participants 10 to execute the training method of the joint fraud detection network. Among them, the users in each participant are different. For example, the registered accounts of the same person after registering in different participants are considered to be different users. It should be noted that the multiple participants described in the present application refer to two or more participants.

[0037] In one embodiment, the participant is, for example, a company or a server of a platform. For example, the platform is a shopping platform or a service platform. For example, the company is a bank.

[0038] In one embodiment, a graph data can be determined based on the user of the participating party and the relevant information of the operation (e.g., shopping, loan) performed by the user in the participating party. Wherein, the graph data includes different types of nodes (e.g., user nodes and resource nodes). Specifically, the user of the participating party is the user node in the graph data of the participating party. For example, the user node is a registered user of the participating party. The relevant information of the operation (e.g., shopping, loan) performed by the user node in the participating party is the resource node; for example, the resource node includes the service obtained by the user in the participating party (e.g., loan service), the goods purchased by the user in the participating party, and / or the time when the user performs the operation, etc. The graph data also includes edges connecting resource nodes and user nodes. In a specific embodiment, the types of resource nodes include at least two, and then the edges in the graph data include edges corresponding to the type of each resource node. r , where r ranges from 1 to R, and there are R types of resource nodes. Examples of the types of resource nodes include commodity types (e.g., books, clothes), service types (e.g., loan services), time, identity information types (e.g., ID card number, passport number), and / or IP information. In an embodiment of the present application, the types of resource nodes may also be referred to as resource node types.

[0039] It should be noted that the type of the resource node is not limited to the above examples. The type of the resource node is related to the fraudulent behavior provided by multiple participants. For example, the fraudulent behavior provided by the participant is to comment on the same video at a similar time. Then the resource node includes the time and video of the comment.

[0040] In one embodiment, the user nodes included in the graph data are represented by user node numbers, and the resource nodes included in the graph data are represented by resource node numbers.

[0041] In one embodiment, the graph data includes the numbers of user nodes and resource nodes, the resource IDs of resource nodes, node features of each node, and one or more adjacency matrices corresponding to the types of resource nodes. Wherein, the multiple refers to two or more. In one example, the types of resource nodes include two types, and the graph data includes two adjacency matrices. In another example, the types of resource nodes may also include only one type, and the graph data includes only one adjacency matrix. It should be noted that each resource node has a number and a resource ID. In the following embodiments, an embedded feature can be referred to as an embedded feature of a resource node, also referred to as an embedded feature of a resource ID, and similar features include joint embedded features, etc.

[0042] In one embodiment, the user node numbers include N, where N is the number of user nodes. For example, each user node number is Y1 to YN The resource nodes are numbered M, where M is the number of resource nodes. For example, each resource node is numbered Z1 to Z M Any one of them. Wherein, there is no identical number in the graph data. The resource ID of the resource node represents the actual meaning of the resource node. For example, if the type of the resource node is a book, the resource ID of the resource node corresponding to the book type is exemplified by the name of the book. For another example, if the type of the resource node is clothing, the resource ID of the resource node corresponding to the clothing type is exemplified by different styles of clothing. The data dimensions of the node features of each node are the same. For example, each node feature is an H-dimensional matrix, where H is an integer. In one embodiment, the node features are related to the type of node and the statistical features of the node. In one example, the graph data includes R types of resource nodes, and the statistical features of the nodes are T-dimensional vectors. Then, each node feature includes an R+T+1-dimensional vector, one dimension indicating whether the node is a user node, R dimensions indicating which type of resource node the node belongs to, and the remaining T dimensions indicating the statistical features of the node; wherein R and T are both integers. The adjacency matrix A corresponding to a resource node of a type (or a resource node type) r The edge L that connects all resource nodes of this type to the user node r .

[0043] In one embodiment, the fraud classification subnetwork in the joint fraud detection network can be trained using the graph data and the fraud labels corresponding to the graph data; further, after the fraud classification subnetwork is trained, the fraudulent behavior existing in each participant can be detected based on the graph data of each participant and the joint fraud detection network.

[0044] However, the amount of graph data in each participant is large, which leads to a slow training and detection speed of the joint fraud detection network. In order to improve the training speed and detection speed of the joint fraud detection network, each participant uses the detection model to screen the user nodes locally to obtain normal user nodes predicted as normal users and fraud user nodes predicted as fraud users, wherein the suspicious probability of the normal user node is lower than the first preset threshold, the suspicious probability of the fraud user node is higher than the second preset threshold, and the first preset threshold is less than the second preset threshold; then, the normal user node and the fraud user node are used as user nodes in the graph data for training the joint fraud detection network, and the remaining user nodes (suspicious nodes that cannot be accurately determined as normal user nodes or fraud user nodes) are used as suspicious nodes in the graph data for detection. In other words, the user nodes whose suspicious probabilities are between the first preset threshold and the second preset threshold are used as suspicious nodes in the graph data for detection. Correspondingly, the corresponding resource nodes in the graph data for training the joint fraud detection network are resource nodes connected to the fraud user nodes and the normal user nodes, and the corresponding resource nodes in the graph data for detection are resource nodes connected to the suspicious nodes. The detection model may be any graph neural network that can detect fraudulent behavior.

[0045] Furthermore, in one embodiment, the graph data also includes a numerical value of the suspicious probability, where the suspicious probability is the probability that the user node is suspected of being a fraudulent user.

[0046] In one embodiment, each of the participants may also encrypt the graph data used for training the joint fraud detection network or the graph data used for detection based on the multi-party secure computing protocol of the multi-party secure computing system to obtain the ciphertext data of the participant's graph data. For example, the participant obtains the multi-party secure computing protocol sent by the multi-party secure computing system, and encrypts the graph data based on the multi-party secure computing protocol.

[0047] In one embodiment, see Figure 3 , which is a schematic diagram of the structure of a multi-party secure computing system in one embodiment of the present application. As shown in the figure, the multi-party secure computing system includes a plurality of computing devices, each of which is configured in a mutually untrusted computing system architecture, wherein a multi-party secure computing protocol is pre-installed in each computing device, and the multi-party secure computing protocol is used to perform secure computing with at least another computing device to perform a training method for a joint fraud detection network or a joint fraud detection method. Specifically, there is no trust between the computing devices in the mutually untrusted computing system architecture, that is, each computing device will not actively collude with other computing devices to share their own input ciphertexts, nor will it actively collude with other computing devices to share the calculation results obtained according to the received multi-party secure computing instructions.

[0048] In one example, upon receiving a multi-party secure computing instruction, each computing device performs a multi-party secure computing with at least one other computing device based on the multi-party secure computing protocol and the obtained ciphertext. Here, the multi-party secure computing system further includes a task management platform (not shown), which divides the tasks to be performed into multi-party secure computing instructions for secure computing by multiple computing devices according to the tasks to be performed (e.g., executing a training method for a joint fraud detection network) and the multi-party secure computing protocol, so as to be executed by each computing device. Examples of the multi-party secure computing instructions include instructions for instructing a computing device to obtain a ciphertext, instructions for performing mathematical calculations and / or logical calculations, and instructions for instructing a computing device to process calculation results.

[0049] In one embodiment, the ciphertext is obtained by dispersing using secret sharing technology. The secret sharing technology is to split the plaintext (such as the resource ID of the plaintext, the unilateral embedded data of the plaintext) in an appropriate manner, and each of the dispersed ciphertexts is received by a different computing device. A single computing device cannot restore the plaintext, and only a number of computing devices can work together to restore the plaintext.

[0050] In one embodiment, the multi-party secure computing protocol is set based on the distribution mode of the ciphertext and the number of the computing devices configured in the mutually untrusted computing system architecture. The multi-party secure computing protocol is different if the distribution mode of the ciphertext and the number of the computing devices configured in the mutually untrusted computing system architecture are different. In one embodiment, the multi-party secure computing protocol is a process of multi-party secure computing that indicates and schedules the corresponding computing tasks performed by each computing device in the multi-party secure computing system, which includes but is not limited to: describing the multi-party secure computing execution process of computing tasks such as addition, subtraction, multiplication or division, describing the multi-party secure computing execution process of computing tasks such as logical and, or, non, XOR, comparison, etc. In the implementation mode of the present application, the number of the computing devices is four, and the multi-party secure computing instruction is designed by the task management platform to execute the computing task based on the multi-party secure computing mode of the collaborative execution of four computing devices, wherein the computing task is used to perform data processing on the ciphertext (such as unilateral ciphertext data).

[0051] Furthermore, in order to ensure the security of communication between the computing devices, the multi-party secure computing system also includes a hardware security module that is in communication with each of the computing devices, and the hardware security module is used to provide cryptographic operations for the multi-party secure computing performed by each of the computing devices, so that each computing device, when receiving the multi-party secure computing instruction, performs multi-party secure computing with at least another computing device based on the encryption and decryption operations corresponding to the cryptographic operations, the multi-party secure computing protocol, and the obtained ciphertext to execute the training method of the joint fraud detection network or the joint fraud detection method. The cryptographic operations include generating key pairs, generating random numbers, generating authentication certificates, deriving keys, updating keys, and providing public key infrastructure.

[0052] It should be noted that, based on the aforementioned principle description of the multi-party secure computing system, those skilled in the art can clearly understand how to perform multi-party secure computing according to the tasks that need to be performed by the multi-party secure computing system (such as the training method of the joint fraud detection network and / or each step in the joint fraud detection method) and the obtained ciphertext to implement the training method of the joint fraud detection network and / or the joint fraud detection method. In the following embodiments, only the tasks / steps that need to be performed by the multi-party secure computing system are described.

[0053] See also Figure 4 , which is a flow chart of a training method for a joint fraud detection network in an embodiment of the present application, as shown in the figure, the training method for the joint fraud detection network includes step S110, step S120, and step S130. The training method for the joint fraud detection network is applied to a multi-party secure computing system, in other words, the training method for the joint fraud detection network is executed by the multi-party secure computing system.

[0054] The joint fraud detection network includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computing system. In one embodiment, the at least one graph embedding layer includes a first graph embedding layer configured in multiple participants and a second graph embedding layer configured in the multi-party secure computing system. Each participant is configured with a sub-embedding layer of the first graph embedding layer, so that each participant can use its local graph data to perform embedding calculations in the sub-embedding layer. For example, see Figure 5, which is a schematic diagram showing the configuration position of the joint fraud detection network in one embodiment of the present application. As shown in the figure, each sub-embedding layer of the first graph embedding layer is configured on the participant 10, the second graph embedding layer is configured on the multi-party secure computing system 11, and the fraud classification sub-network directly connected to the second graph embedding layer is configured on the multi-party secure computing system 11. In this way, by transferring part of the calculation of the training method or the joint fraud detection method to the local of the participant, the speed of training and detection based on ciphertext of the multi-party secure computing system can be accelerated. In another embodiment, the at least one graph embedding layer includes a first graph embedding layer and a second graph embedding layer configured on the multi-party secure computing system. For example, refer to Figure 6 , showing a schematic diagram of the configuration position of the joint fraud detection network in another embodiment of the present application. As shown in the figure, the first graph embedding layer, the second graph embedding layer directly connected to the first graph embedding layer, and the fraud classification subnetwork directly connected to the second graph embedding layer are sequentially configured on the multi-party secure computing system 11. It should be noted that, in other embodiments, all embedding calculations performed by the two graph embedding layers can also be integrated into one graph embedding layer for calculation. In the following embodiments, the example of the joint fraud detection network including two graph embedding layers is used for explanation.

[0055] In step S110, the multi-party secure computing system obtains the unilateral ciphertext data sent by each participant, and performs embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork to obtain joint embedded data corresponding to multiple participants.

[0056] In some embodiments, the unilateral ciphertext data may be the unilateral ciphertext embedded data obtained by the participant embedding and calculating its graph data in the sub-embedding layer and encrypting it, or it may be the ciphertext data of the participant's graph data. In an embodiment (for example, in Figure 5 In the embodiment shown in the figure, since the first embedding layer is configured in each participant, the embedding calculation for each participant in the first embedding layer is transferred to the embedding calculation performed by each participant in its local sub-embedding layer, so the single-party ciphertext data is the single-party ciphertext embedded data obtained after the participant performs embedding calculation and encryption on its graph data in the sub-embedding layer. In the embodiment where the at least one graph embedding layer includes the first graph embedding layer and the second graph embedding layer configured in the multi-party secure computing system (for example, in Figure 6In the embodiment shown), the unilateral ciphertext data is the ciphertext data of the participating party graph data, and then the first embedding layer performs embedding calculation based on the ciphertext data of the participating party graph data to input the result of the embedding calculation into the second graph embedding layer.

[0057] In one embodiment, see Figure 7 , which is a flow chart of a participant calculating and obtaining unilateral ciphertext embedded data in a sub-embedded layer in one embodiment of the present application. As shown in the figure, the step of the participant performing embedding calculation and encryption on its graph data in the sub-embedded layer to obtain the unilateral ciphertext embedded data includes step S210 and step S220. It should be noted that the participant uses the plaintext of its graph data to locally execute step S210 and step S220 to obtain the unilateral ciphertext embedded data.

[0058] In step S210, the participant obtains the unilateral embedding data including the embedding features of the resource nodes by using the adjacency matrix corresponding to each resource node type and the node features of each node. Specifically, the unilateral embedding data H of each participant is l It can be calculated by the following formula:

[0059]

[0060] H 1；r =A r X

[0061] Among them, H 1；r are all embedded features of the rth type of resource nodes, R is the number of resource node types in the graph data, and A r is the adjacency matrix corresponding to the rth type of resource node, X is the node feature of all nodes in the graph data, is the concatenation operation of matrices. For example, the embedding features of all resource nodes of the first type are the matrix {a1; b1}, and the embedding features of all resource nodes of the second type are the matrix {a2; b2}. After performing the concatenation operation on the two matrices, the matrix of embedded features is obtained as

[0062] In one embodiment, the embedded features include node features of user nodes connected to the resource nodes. Specifically, the sub-embedding layer can determine the connection between the resource nodes of the type r and the user nodes according to the adjacency matrix corresponding to the resource nodes of the type r, and then obtain all embedded features of the resource nodes of the type based on the node features of the user nodes connected to the resource nodes, and the unilateral embedded data can be obtained after performing a splicing operation on all embedded features of resource nodes of different types. For example, a type of adjacency matrix represents that only resource nodes X1 and X2 are included, and there is an edge connection between resource node X1 and user node U1, and there is an edge connection between resource node X2 and user nodes U1 and U2. Then the embedded feature of resource node X1 is the node feature of U1, and the embedded feature of resource node X2 is the node feature of U1 and U2.

[0063] In one specific embodiment, see Figure 8a and Figure 8b , which are schematic diagrams showing unilateral embedded data obtained by different parties in one embodiment of the present application, such as Figure 8a As shown, V1, V2, V3, and V4 are resource IDs of resource nodes, U1, U2, U3, and U4 are user nodes, and the solid lines and dotted lines represent the edges corresponding to different types of resource nodes. Figure 8a The participants can determine all embedded features H of the first type of resource nodes based on the adjacency matrix A1 corresponding to the first type of resource nodes and the node features X of all nodes in the graph data. 1；1 ={node feature of U1; node features of U1 and U3; 0; 0}, according to the adjacency matrix A2 corresponding to the second type of resource nodes and the node features X of all nodes in the graph data, all embedded features H of the second type of resource nodes can be determined 1；2 ={0; 0; node features of U3 and U4; node features of U2}, and then after performing the splicing operation, we can get Figure 8a The unilateral embedded data of the participants like Figure 8b As shown, Figure 8b The solid lines and dashed lines also represent the edges corresponding to different types of resource nodes, and Figure 8b The dashed line represents the edge and Figure 8a The edges represented by the dashed lines belong to the edges corresponding to the resource nodes of the same type, and Figure 8b The solid lines represent the edges and Figure 8a The edges represented by the solid lines belong to the edges corresponding to the resource nodes of the same type; similarly, Figure 8b The participants can determine all embedded features H of the first type of resource nodes based on the adjacency matrix A1 corresponding to the first type of resource nodes and the node features X of all nodes in the graph data. 1；1={node feature of U6; 0; node features of U7 and U8}, according to the adjacency matrix A2 corresponding to the second type of resource nodes and the node features X of all nodes in the graph data, all embedded features H of the second type of resource nodes can be determined 1；2 ={0; node features of U5 and U7; 0}, and then after performing the splicing operation, we can get Figure 8b The unilateral embedded data of the participants

[0064] In another embodiment, please continue to refer to Figure 8a and Figure 8b , set the node characteristics of each node to 1, then Figure 8a All embedded features H of the corresponding resource nodes of the first type 1；1 ={1;2;0;0}, Figure 8a All embedded features H of the corresponding second type of resource nodes 1；2 ={0;0;2;1}. Figure 8b All embedded features H of the corresponding resource nodes of the first type 1；1 ={1;0;2}, Figure 8b All embedded features H of the corresponding second type of resource nodes 1；2 ={0;2;0}.

[0065] In one embodiment, in order to improve the computing time of the local and multi-party secure computing systems of the participants, the corresponding user nodes in the graph data used by the participants when performing embedding calculations in the sub-embedding layer are the fraudulent user nodes and normal user nodes that have been screened by the participants, and the corresponding resource nodes in the graph data used are the resource nodes connected to the fraudulent user nodes and the normal user nodes. In this way, using the screened nodes in training can reduce the computing time of the local and multi-party secure computing systems of the participants. For example, the adjacency matrix and node features used in step S210 are the adjacency matrix and node features corresponding to the screened fraudulent user nodes and the normal user nodes.

[0066] In one embodiment, in order to reduce the training time of the multi-party secure computing system, the resource nodes in the graph data are also screened to use the embedding features of suspicious resource nodes as the unilateral embedding data. Among them, the suspicious resource nodes are determined by fraudulent user nodes. For example, if the number of fraudulent user nodes connected to a resource node exceeds a preset number, the resource node is regarded as a suspicious resource node. In one embodiment, the proportion of suspicious resource nodes to all resource nodes is less than a preset proportion, and the preset proportion is exemplified by 10%, 20%, 30%, 40%, or 50%. Specifically, the proportion of suspicious resource nodes to all resource nodes is controlled by adjusting the size of the preset number.

[0067] After each participant obtains the unilateral embedded data of each party, each participant executes step S220 in the sub-embedding layer.

[0068] In step S220, the participating party encrypts the unilateral embedded data according to the multi-party secure computing protocol of the multi-party secure computing system to obtain the unilateral ciphertext embedded data.

[0069] Specifically, the participating party can obtain the unilateral ciphertext embedded data after encrypting the unilateral embedded data according to the multi-party secure computing protocol. Then, the multi-party secure computing system can calculate the joint embedded data in the second graph embedding layer based on the obtained unilateral ciphertext embedded data.

[0070] In one embodiment, the multi-party secure computing protocol indicates how to obtain the ciphertext for multi-party secure computing. In one example, the ciphertext for multi-party secure computing is obtained by randomly dispersing the plaintext into several parts. For example, the multi-party secure computing protocol indicates that the ciphertext is obtained by randomly dispersing the plaintext into four parts. In the following embodiment, taking the example of randomly dividing the plaintext into four parts to obtain the ciphertext, the participating parties use the single-party embedded data H obtained in step S210 according to the multi-party secure computing protocol. l Randomly divide into four parts to achieve the unilateral embedding data H l Encryption is performed to obtain the unilateral ciphertext embedded data. l The ciphertext is randomly divided into four ciphertexts h1, h2, h3, and h4 to obtain the single-party ciphertext embedded data {h1, h2, h3, and h4}, and each ciphertext in the single-party ciphertext embedded data is sent to different computing devices in the multi-party secure computing system respectively, so that the multi-party secure computing system can perform calculations based on the single-party ciphertext embedded data.

[0071] In one embodiment, in an embodiment where the single-party ciphertext embedded data is ciphertext data of participant graph data, the ciphertext data of the participant graph data is also obtained based on a multi-party secure computing protocol of the multi-party secure computing system.

[0072] In an embodiment where the unilateral ciphertext embedded data is unilateral ciphertext embedded data, the multi-party secure computing system uses each unilateral ciphertext embedded data to perform embedding calculations in a graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data corresponding to multiple parties. In an embodiment, the joint fraud detection network includes a first graph embedding layer, a second graph embedding layer, and a fraud classification subnetwork directly connected to the second graph embedding layer, then the multi-party secure computing system uses each unilateral ciphertext embedded data to perform embedding calculations in the second graph embedding layer to obtain joint embedding data corresponding to multiple parties.

[0073] In the embodiment of the ciphertext data of the graph data of the participant in the single-party ciphertext embedded data, the multi-party secure computing system performs embedding calculations in the at least one graph embedding layer to obtain joint embedded data corresponding to the multiple participants. In one embodiment, the joint fraud detection network includes a first graph embedding layer, a second graph embedding layer, and a fraud classification subnetwork directly connected to the second graph embedding layer. The multi-party secure computing system uses the ciphertext data of the participant graph data to perform multi-party secure calculations in the first graph embedding layer to obtain the ciphertext data of the embedding features of each type of resource node in each participant, and directly inputs it into the second graph embedding layer for calculation in the second graph embedding layer to obtain the joint embedded data corresponding to the multiple participants. It should be noted that in this embodiment, since the first graph embedding layer is configured in the multi-party secure computing system, the calculations in the first graph embedding layer are also performed in ciphertext form.

[0074] In the following embodiments, the calculation of the joint embedded data is explained by taking the case where the unilateral ciphertext data is unilateral ciphertext embedded data as an example.

[0075] After obtaining the unilateral ciphertext embedding data, each unilateral ciphertext embedding data is used to perform embedding calculation in the second graph embedding layer to obtain joint embedding data corresponding to multiple participants. Specifically, in the second graph embedding layer, the resource ID of the resource node of a participant is used as the ID to be combined, and the embedding features of the resource IDs of other participants that are the same as the ID to be combined are combined with the embedding features of the ID to be combined using each unilateral ciphertext embedding data to obtain the joint embedding data corresponding to the participant; further, the above steps are repeated to obtain the joint embedding data corresponding to multiple participants. In other words, the steps of determining the ID to be combined and combining the embedding features are performed for each participant to obtain multiple joint embedding data corresponding to multiple participants.

[0076] In a specific embodiment, the embedding feature includes the node feature of the user node, and the resource IDs of all resource nodes of the participant are used as the IDs to be combined. Figure 8a , the ID of the participant to be combined is V1, V2, V3, V4. Further, the embedded features of the resource ID of other participants in the joint fraud detection system that are the same as the ID to be combined are combined with the embedded features of the ID to be combined, wherein the other participants are the remaining participants after removing the participants corresponding to the ID to be combined from all participants. When combining embedded features, it is necessary to combine the embedded features corresponding to each resource node type separately. For example, refer to Fig. 9 Combined with Figure 8a and Figure 8b , Fig. 9 Show this application Figure 8aFIG. 1 is a schematic diagram of the joint embedded data of the participants in one embodiment. As shown in the figure, the joint fraud detection system includes two participants, namely Figure 8a and Figure 8b The participants shown in the calculation Figure 8a When jointly embedding data of the participants, it is necessary to Figure 8b The embedded features of the resource ID that is the same as the ID to be combined are combined with the embedded features of the ID to be combined. Specifically, Figure 8b The embedding features of V1 in Figure 8a The embedded features of V1 in Figure 8b The embedding features of V3 in Figure 8a The embedding features of V3 in the Among them, H 2；1 is the joint embedding feature corresponding to the first type of resource node, H 2；2 is the joint embedding feature corresponding to the second type of resource node. The joint embedding feature is obtained by combining / joining the embedding features. Fig. 9 The description of the joint embedding data calculation process shown in Figure 8b The resource IDs of all resource nodes of the participants shown in the figure are used as the IDs to be combined and the embedded feature combination steps are performed to obtain Figure 8b Joint embedded data of the parties shown.

[0077] Furthermore, in one embodiment, the node characteristics of each node are set to 1, and the joint embedding characteristic represents the sum of the degree corresponding to the ID to be combined and the degree corresponding to the resource ID of other participants that is the same as the ID to be combined.

[0078] In order to improve the calculation speed of the multi-party secure computing system to obtain the joint embedded data, the multi-party secure computing system uses an acceleration method to calculate the joint embedded data of each participant. In one embodiment, the acceleration method includes steps S310, S320, S330, S340, S350, and S360.

[0079] In the following embodiments, for ease of explanation, the node characteristic of each node is set to 1 and only two participants exist in the joint fraud detection system.

[0080] In step S310, any one of the multiple participants is used as the detection party, and the resource ID of each participant and the embedded features corresponding to each resource ID that match a resource node type are preliminarily sorted using the unilateral ciphertext embedded data of the multiple participants, so that the resource ID of the detection party and the corresponding embedded features are placed in the first place. For example, see Fig.10 Combined with Figure 8aand Figure 8b , Fig.10 It is a schematic diagram showing a joint embedding feature corresponding to a detection party and a resource node type obtained by using an acceleration method in one embodiment of the present application. As shown in the figure, all participants include participant 1 and participant 2. Participant 1 and participant 2 both include two types of resource nodes. Fig.10 Participant 1 is used as the detection party and the joint embedded features of the first resource node type (resource nodes corresponding to V1 and V2) of participant 1 are obtained. In step S310, the resource IDs of participants 1 and 2 and the embedded features matching a resource node type are preliminarily sorted, and then the resource ID (V1, V2, V3, and V4) of participant 1 and the embedded features corresponding to the resource ID are ranked first, wherein, for the embedded features of the first resource node type, the embedded features (1 and 2) corresponding to the resource ID (V1 and V2) of the first resource node type are the actual embedded features corresponding to the resource node type, and the embedded features corresponding to the resource ID (V3, V4) of the second resource node type are padded with 0, which is used to ensure the consistency of the data dimension; similarly, for the embedded features of the first resource node type, the embedded features corresponding to the resource ID (V3) of the second resource node type of participant 2, which is ranked behind participant 1, also need to be padded with 0, and after executing step S310, it can be obtained Fig.10 The corresponding preliminary sorting is in the first box.

[0081] In step S320, the resource ID sorting is determined based on the result of the preliminary sorting, and the resource IDs and corresponding embedded features that need to be adjusted in all participants are inserted into the sorting of the resource IDs and corresponding embedded features of the detecting party using the resource ID sorting, so that the same resource IDs are arranged continuously; wherein the resource ID of the detecting party is ranked first in the continuously arranged same resource IDs. Fig.10 According to the preliminary sorting result of the first box, the resource IDs of the detecting party (Party 1) are sorted as V1, V2, V3, and V4 in sequence, and then the resource IDs (V1 and V3) that need to be adjusted in Party 2 and the corresponding embedded features (1 and 0) are inserted into the sorting of the resource IDs and the corresponding embedded features of the detecting party (Party 1), so that the same resource IDs (V1 and V3) are arranged consecutively, and the resource ID of the detecting party (Party 1) is ranked first in the consecutively arranged same resource IDs, for example, in two consecutively arranged V1s, the first V1 is the resource ID of the detecting party (Party 1).

[0082] In step S330, the sorted resource IDs are traversed in order, and the traversed current resource ID is compared with the preset number of adjacent resource IDs, and the embedded features corresponding to the resource IDs in the preset number of resource IDs that are the same as the current resource ID are combined with the embedded features of the current resource ID to obtain the joint embedded features corresponding to each resource ID. The preset number is related to the number of multiple participants, for example, the preset number is the number of multiple participants minus 1. Please refer to Fig.10 In the second and third boxes, in the second box, the first resource ID (V1) and the adjacent next resource ID (V1) are the same, then the embedding feature of the second resource ID (V1) is combined with the embedding feature of the first resource ID (V1), and the joint embedding feature of the first resource ID (V1) is 2. Similarly, we can get Fig.10 The joint embedding features corresponding to each resource ID shown in the third box in .

[0083] In step S340, the current resource ID and the corresponding joint embedding feature are restored to the preliminary order to determine the joint embedding feature of a type of resource ID in the detection party. Fig.10 , restore the resource ID and the corresponding joint embedding features in the third box to Figure 1 The preliminary sorting shown can obtain the resource ID in the fourth box and the corresponding joint embedding features, and then obtain the joint embedding features of the first type of resource ID / resource node in the detection party (participant 1).

[0084] In step S350, steps S310 to S340 are performed for all types of embedded features of the detection party to obtain the joint embedded data of the detection party. The joint embedded data includes joint embedded features of multiple types of resource IDs / resource nodes; further, the joint embedded data also includes node features corresponding to each resource node of the detection party.

[0085] In step S360, after each of the multiple participants is taken as the party to be detected, the joint embedded data of the multiple participants can be quickly obtained after executing steps S310 to S350.

[0086] It should be noted that the calculated joint embedded data can be distributed in the form of ciphertext in each computing device in the multi-party secure computing system, so that step S120 is performed based on the ciphertext.

[0087] In step S120, the multi-party secure computing system uses the fraud classification subnetwork to perform fraud detection on the joint embedded data of multiple participants to obtain fraud detection results corresponding to the multiple participants. In one embodiment, the fraud detection result includes whether each user node participating in the detection among the multiple participants is a fraud user or a non-fraud user. In another embodiment, the fraud detection result includes the probability that each user node participating in the detection among the multiple participants is a fraud user.

[0088] Wherein, the fraud classification subnetwork is a neural network for classification. In one embodiment, the fraud classification subnetwork includes a first MLP layer and a second MLP layer. The MLP (Multilayer Perceptron) layer is a neural network layer. In one example, the first MLP layer includes a ReLU nonlinear activation function, and the second MLP layer includes a Sigmoid nonlinear activation function. In other examples, the first MLP layer and the second MLP layer may also include other nonlinear activation functions.

[0089] In one embodiment, taking the fraud classification subnetwork including the first MLP layer and the second MLP layer as an example, the fraud detection result of each user node in each participant can be expressed by the following formula:

[0090] P = Sigmoid(ReLU(H2W1)W2)

[0091] Among them, W1 is the first network parameter of the first trainable MLP layer, W2 is the second network parameter of the second trainable MLP layer, H2 is the joint embedding data of a participant, and P is the probability that each user node in a participant is a fraudulent user.

[0092] In the embodiment of the present application, since the joint fraud detection network has no trainable network parameters before the fraud classification subnetwork (e.g., the first MLP layer); for example, the first graph embedding layer and the second graph embedding layer do not include trainable network parameters. Therefore, during training, the input of the fraud classification subnetwork will not change. This improves the speed of joint training.

[0093] In step S130, the multi-party secure computing system adjusts the network parameters of the fraud classification subnetwork using the preset fraud labels of the multiple participants and the fraud detection results of the multiple participants until the training stop condition is reached.

[0094] In one embodiment, the multi-party secure computing system calculates a loss function based on the fraud detection results of the multiple participants and the preset fraud labels of the multiple participants, and adjusts the network parameters of the fraud classification subnetwork based on the loss function. Correspondingly, the training stop condition is that the loss function converges. In a specific embodiment, the loss function is calculated using the preset fraud labels of the multiple participants and the fraud detection results of the multiple participants, and the first network parameter W1 of the first MLP layer and the second network parameter W2 of the second MLP layer are adjusted until the training stop condition is reached.

[0095] In one embodiment, the fraud label is whether a user node is a fraud user node. For example, a fraud label of 1 indicates that a user node is a fraud user node, and a fraud label of 0 indicates that a user node is not a fraud user node. In another embodiment, the fraud label is the probability that a user node is a fraud user node.

[0096] In a specific embodiment, a loss function is calculated for each training data set, and the network parameters of the fraud classification subnetwork are adjusted based on the loss function. The training data set may be a preset number of fraud detection results and corresponding fraud labels from the fraud detection results of multiple participants.

[0097] Taking the fraud label as the probability that a user node is a fraud user node as an example, the loss function of a training data set can be expressed by the following formula:

[0098] J=∑y i ln i +(1-y i )ln(1-p i )

[0099] Among them, J is the loss of a training data set, p i is the probability that each user node in the training data set is a fraudulent user node, i ranges from 1 to Z, Z is the number of fraud detection results in the training data set, and y i Fraud label for each user node in the training dataset.

[0100] The trained joint fraud detection network can be used for joint fraud detection of multiple participants. For example, after obtaining the unilateral ciphertext data sent by each participant, the joint fraud detection network can output the corresponding fraud detection results of multiple participants.

[0101] In one embodiment, see Fig.11, which is a structural block diagram of a training device for a joint fraud detection network in one embodiment of the present application. As shown in the figure, the training device 12 for the joint fraud detection network includes a joint embedding module 120, a fraud detection module 121, and a parameter adjustment module 122.

[0102] It should be understood that the joint embedding module 120, the fraud detection module 121, and the parameter adjustment module 122 can be implemented in software run by different types of processors. For example, a module of executable code may include one or more physical or logical blocks of computer instructions organized as objects, programs, or functions. However, the executable files of the modules do not have to be physically located together, but may include different commands stored in different locations, which, when logically connected together, include the module and achieve the specified goals of the module.

[0103] Of course, the module of executable code can be one or many instructions, and can even be distributed in several different code segments, distributed in different programs and distributed in multiple storage devices. Similarly, operation data can be identified and shown in the module, and the operation data can be embodied in any suitable form and organized in any suitable type of data structure. The operation data can be collected as a single data set, or can be distributed in different locations (including different storage devices), and can exist at least partially as electrical signals in a system or network. When a module or a portion of a module is implemented in software, the software portion is stored on one or more computer-readable media.

[0104] The training device 12 of the joint fraud detection network is applied to a multi-party secure computing system, which is communicatively connected to multiple participants performing joint fraud detection. The joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system.

[0105] The joint embedding module 120 is used to obtain the unilateral ciphertext data sent by each participant, and perform embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data corresponding to multiple participants.

[0106] The fraud detection module 121 is used to perform fraud detection using the fraud classification subnetwork and the joint embedded data of multiple participants to obtain fraud detection results corresponding to the multiple participants.

[0107] The parameter adjustment module 122 is used to adjust the network parameters of the fraud classification sub-network using the preset fraud labels of multiple participants and the fraud detection results of multiple participants until the training stop condition is reached.

[0108] Here, the working mode of each module in the training device 12 of the joint fraud detection network of the present application is the same as or similar to the corresponding steps in the training method of the joint fraud detection network mentioned above, and will not be repeated here.

[0109] The present application also provides a joint fraud detection method, which is applied to a multi-party secure computing system, wherein the multi-party secure computing system is in communication with multiple participants performing joint fraud detection, and the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system. The multi-party secure computing system, the participants, and the joint fraud detection network are the same or similar to those described above, and are not described in detail here.

[0110] See also Fig.12 , which is a flow chart of a joint fraud detection method in one embodiment of the present application. As shown in the figure, the joint fraud detection method includes step S410 and step S420.

[0111] In step S410, the multi-party secure computing system obtains the unilateral ciphertext data sent by each participant, and performs embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data corresponding to multiple participants. The method for calculating the joint embedding data of each participant is the same or similar to that described above and will not be repeated here.

[0112] In one embodiment, in order to improve detection efficiency, the user nodes included in the graph data used in the process of calculating the one-party ciphertext data are suspicious nodes whose suspicion probability is between a first preset threshold and a second preset threshold, and the resource nodes in the graph data used are resource nodes connected to the suspicious nodes.

[0113] In step S340, fraud detection is performed using the fraud classification subnetwork trained by the training method of the joint fraud detection network described in any of the aforementioned embodiments and the joint embedded data of multiple participants to obtain fraud detection results corresponding to the multiple participants.

[0114] In one embodiment, see Fig.13 , which is a structural block diagram of a joint fraud detection device in one embodiment of the present application. As shown in the figure, the joint fraud detection device 13 includes a joint embedding module 130 and a detection module 131.

[0115] It should be understood that the joint embedding module 130 and the detection module 131 may be implemented in software executed by different types of processors.

[0116] The joint embedding module 130 is used to obtain the unilateral ciphertext data sent by each participant, and perform embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data corresponding to multiple participants.

[0117] The detection module 131 is used to perform fraud detection using the fraud classification subnetwork trained by the training device of the joint fraud detection network described in any of the aforementioned embodiments and the joint embedded data of multiple participants to obtain fraud detection results corresponding to the multiple participants.

[0118] The present application also provides a computer-readable and writable storage medium, on which at least one program is stored. When the at least one program is called, it executes the training method of the joint fraud detection network or the joint fraud detection method described in any of the above embodiments.

[0119] In one embodiment, the present application also provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the above-mentioned related steps to implement the training method of the joint fraud detection network or the joint fraud detection method described in any of the above-mentioned embodiments.

[0120] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application.

[0121] In the embodiments provided in the present application, the computer readable and writable storage medium may include a read-only memory (ROM), a random access memory (RAM), an EEPROM, a CD-ROM or other optical disk storage device, a magnetic disk storage device or other magnetic storage device, a flash memory, a USB flash drive, a mobile hard disk, or any other medium that can be used to store the desired program code in the form of an instruction or data structure and can be accessed by a computer. In addition, any connection can be appropriately referred to as a computer-readable medium. For example, if the instruction is sent from a website, a server or other remote source using a coaxial cable, an optical fiber cable, a twisted pair, a digital subscriber line (DSL), or wireless technologies such as infrared, radio and microwaves, the coaxial cable, optical fiber cable, twisted pair, DSL, or wireless technologies such as infrared, radio and microwaves are included in the definition of the medium. However, it should be understood that computer readable and writable storage media and data storage media do not include connections, carriers, signals or other temporary media, but are intended to be non-temporary, tangible storage media. Disk and disc, as used in this application, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers.

[0122] The present application also discloses a computer device, which is used to implement the training method of the joint fraud detection network or the joint fraud detection method described in any of the above embodiments. In one embodiment, the computer device is a device capable of performing digital calculation, logic processing, and information processing on data.

[0123] See also Fig.14 , which is a schematic diagram of the structure of a computer device in an embodiment of the present application, wherein the computer device 14 includes a storage device 140 and a processing device 141 connected to the storage device 140. Furthermore, the computer device also includes an interface device 142.

[0124] In some embodiments, the storage device 140 is used to store at least one program, and the at least one program can be executed by the processing device 141 to coordinate the training method of the joint fraud detection network or the joint fraud detection method described in any of the above embodiments of the storage device 140.

[0125] Here, the storage device 140 includes, but is not limited to, a read-only memory, a random access memory, and a non-volatile memory. For example, the storage device 140 includes a flash memory device or other non-volatile solid-state storage device. In some embodiments, the storage device 140 may also include a memory away from one or more processing devices 141, such as a network attached memory accessed via an RF circuit or an external port and a communication network, wherein the communication network may be the Internet, one or more intranets, a local area network, a wide area network, a storage area network, etc., or a suitable combination thereof. The memory controller may control access to the memory by other components of the device, such as a CPU and a peripheral interface.

[0126] In some embodiments, the processing device 141 includes one or more processors. The processing device 141 can be operable to perform data read and write operations with the storage device 140. The processing device 141 includes one or more general-purpose microprocessors, one or more application-specific processors (ASICs), one or more digital signal processors, one or more field programmable logic arrays (FPGAs), or any combination thereof.

[0127] In some embodiments, the interface device 142 includes at least one interface unit, each of which is used to output a visual interface, receive a human-computer interaction event generated according to the operation of a technician, etc. For example, the interface device 142 includes but is not limited to: a serial interface such as an HDMI interface or a USB interface, or a parallel interface, etc. In one embodiment, the interface device 142 also includes a network communication unit, which is a device for data transmission using a wired or wireless network, and examples thereof include but are not limited to: an integrated circuit including a network card, a local area network module such as a WiFi module or a Bluetooth module, a wide area network module such as a mobile network, etc.

[0128] In one or more exemplary aspects, the training method of the joint fraud detection network or the joint fraud detection method described in the present application. The described functions can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, these functions can be stored or transmitted as one or more instructions or codes on a computer-readable medium. The steps of the method or algorithm disclosed in the present application can be embodied in a processor-executable software module, wherein the processor-executable software module can be located on a tangible, non-temporary computer storage medium. A tangible, non-temporary computer storage medium can be any available medium that can be accessed by a computer.

[0129] The flowchart and block diagram in the accompanying drawings described in the present application illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. Based on this, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be realized by a dedicated hardware-based system that performs a specified function or operation, or can be realized by a combination of dedicated hardware and computer instructions.

[0130] In summary, the training method and device of the joint fraud detection network, the joint fraud detection method and device, the joint fraud detection system, computer equipment, computer-readable storage medium, and computer program product provided in the present application configure the joint fraud detection network to include at least one graph embedding layer and a fraud classification subnetwork, and use the fraud classification subnetwork and multiple joint embedded data to perform fraud detection so as to use the preset fraud labels of multiple participants and the fraud detection results of multiple participants to adjust the network parameters of the fraud classification subnetwork until the training stop condition is reached; in this way, not only can a graph neural network that can detect fraudulent behaviors of multiple parties be trained, but the data of each participant can also be protected through ciphertext calculation, and the trainable network parameters only exist in the fraud classification subnetwork, and thus only training the network parameters in the fraud classification subnetwork can speed up the training speed of the joint fraud detection network on the multi-party secure computing system.

[0131] Furthermore, the training speed can be further accelerated by the participants using the detection model to screen the user nodes locally.

[0132] Furthermore, by screening the resource nodes in the graph data and using the embedding features of the suspicious resource nodes as the unilateral embedding data, the time for the multi-party secure computing system to calculate the joint embedding data can be reduced to speed up the training.

[0133] The above embodiments are merely illustrative of the principles and effects of the present application and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A training method for a joint fraud detection network, characterized in that: Applied to a multi-party secure computing system, the multi-party secure computing system is in communication with a plurality of participants performing joint fraud detection, the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system, the training method includes: Obtaining unilateral ciphertext data sent by each participant, and performing embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data corresponding to the multiple participants; Using the fraud classification subnetwork and the joint embedded data of multiple parties to perform fraud detection to obtain fraud detection results corresponding to the multiple parties; The network parameters of the fraud classification subnetwork are adjusted using the preset fraud labels of the multiple participants and the fraud detection results of the multiple participants until the training stop condition is reached.

2. The training method according to claim 1, characterized in that: The at least one graph embedding layer includes a first graph embedding layer configured in multiple participants and a second graph embedding layer configured in the multi-party secure computing system; wherein each participant is configured with a sub-embedding layer of the first graph embedding layer.

3. The training method according to claim 2, characterized in that: The one-party ciphertext data is the one-party ciphertext embedded data obtained after the participating party performs embedding calculation and encryption on its graph data in the sub-embedding layer.

4. The training method according to claim 1, characterized in that: The at least one graph embedding layer includes first and second graph embedding layers configured in the multi-party secure computing system.

5. The training method according to claim 4, characterized in that: The unilateral ciphertext data is the ciphertext data of the participating party graph data.

6. The training method according to claim 3 or 5, characterized in that: The graph data includes numbers of user nodes and resource nodes, resource IDs of resource nodes, node features of each node, and one or more adjacency matrices corresponding to types of resource nodes.

7. The training method according to claim 6, characterized in that: The user node is a user of a participant, and the resource node includes relevant information about operations performed by the user node on the participant.

8. The training method according to claim 6, characterized in that: The corresponding user nodes in the graph data are the fraudulent user nodes and normal user nodes screened by the participants, and the corresponding resource nodes in the graph data are the resource nodes connected to the fraudulent user nodes and the normal user nodes.

9. The training method according to claim 3, characterized in that: The steps of the participant performing embedding calculation and encryption on its graph data in the sub-embedding layer to obtain the unilateral ciphertext embedded data include: The participating party uses the adjacency matrix corresponding to each resource node type and the node features of each node to obtain the unilateral embedded data including the embedded features of the resource node; wherein the embedded features include the node features of the user node connected to the resource node; The unilateral embedded data is encrypted according to the multi-party secure computing protocol of the multi-party secure computing system to obtain the unilateral ciphertext embedded data.

10. The training method according to claim 9, characterized in that: The method also includes a step of screening resource nodes in the graph data to use the embedding features of suspicious resource nodes as the unilateral embedding data.

11. The training method according to claim 9, characterized in that: The unilateral ciphertext data is unilateral ciphertext embedded data, and the joint embedded data corresponding to the participating parties is obtained by embedding calculation using each unilateral ciphertext embedded data in the second graph embedding layer connected to the fraud classification subnetwork.

12. The training method according to claim 11, characterized in that: The steps of performing embedding calculation using the ciphertext embedding data of each party in the second graph embedding layer to obtain joint embedding data corresponding to multiple parties include: In the second graph embedding layer, the resource ID of the resource node of a participant is used as the ID to be combined, and the embedding features of the resource IDs of other participants that are the same as the ID to be combined are combined with the embedding features of the ID to be combined using the ciphertext embedding data of each party, so as to obtain the joint embedding data corresponding to the participant; The above steps are repeated to obtain joint embedding data corresponding to multiple parties.

13. The training method according to claim 1, characterized in that: The fraud classification subnetwork includes a first MLP layer and a second MLP layer.

14. The training method according to claim 13, characterized in that: The first MLP layer includes a ReLU nonlinear activation function, and the second MLP layer includes a Sigmoid nonlinear activation function.

15. The training method according to claim 13, characterized in that: The step of adjusting the network parameters of the fraud classification subnetwork by using the preset fraud labels of multiple participants and the fraud detection results of multiple participants until the training stop condition is reached includes: calculating the loss function by using the preset fraud labels of multiple participants and the fraud detection results of multiple participants and adjusting the first network parameters of the first MLP layer and the second network parameters of the second MLP layer until the training stop condition is reached.

16. A training device for a joint fraud detection network, characterized in that: Applied to a multi-party secure computing system, the multi-party secure computing system is in communication with a plurality of participants performing joint fraud detection, the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system, the training device includes: a joint embedding module, configured to obtain unilateral ciphertext data sent by each participant, and perform embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork, so as to obtain joint embedding data corresponding to the multiple participants; a fraud detection module, configured to perform fraud detection using the fraud classification subnetwork and the joint embedded data of the multiple parties to obtain fraud detection results corresponding to the multiple parties; The parameter adjustment module is used to adjust the network parameters of the fraud classification sub-network by using the preset fraud labels of multiple participants and the fraud detection results of multiple participants until the training stop condition is reached.

17. A joint fraud detection method, characterized in that: Applied to a multi-party secure computing system, the multi-party secure computing system is in communication with a plurality of participants performing joint fraud detection, the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system, and the joint fraud detection method includes: Obtaining unilateral ciphertext data sent by each participant, and performing embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data corresponding to the multiple participants; Fraud detection is performed using a fraud classification subnetwork trained using the training method for a joint fraud detection network as described in any one of claims 1 to 15 and the joint embedded data of multiple parties to obtain fraud detection results corresponding to the multiple parties.

18. A joint fraud detection device, characterized in that: Applied to a multi-party secure computing system, the multi-party secure computing system is communicatively connected with a plurality of participants performing joint fraud detection, the joint fraud detection network sequentially comprises at least one graph embedding layer and a fraud classification subnetwork configured in the multi-party secure computing system, the joint fraud detection device comprises: a joint embedding module, configured to obtain unilateral ciphertext data sent by each participant, and perform embedding calculation using each unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification subnetwork, so as to obtain joint embedding data corresponding to the multiple participants; A detection module is used to perform fraud detection using the fraud classification subnetwork trained by the training device of the joint fraud detection network as described in claim 16 and the joint embedded data of multiple participants to obtain fraud detection results corresponding to the multiple participants.

19. A multi-party secure computing system, characterized in that: It comprises a plurality of computing devices, each of which is configured in a mutually untrusted computing system architecture; wherein each computing device is pre-installed with a multi-party secure computing protocol, and executes the training method of the joint fraud detection network as described in any one of claims 1 to 15 or the joint fraud detection method as described in claim 17 based on the multi-party secure computing protocol with at least another computing device.

20. A joint fraud detection system, characterized in that: A multi-party secure computing system as claimed in claim 19 comprising a plurality of participants and a communication connection with the plurality of participants.

21. A computer device, characterized in that: include: A storage device for storing at least one program; A processing device, connected to the storage device, is used to call the at least one program from the storage device and implement the training method of the joint fraud detection network as described in any one of claims 1 to 15 or the joint fraud detection method as described in claim 17 when executing.

22. A computer-readable storage medium, characterized in that: At least one program is stored, and when the at least one program is called, it is executed and implements the training method of the joint fraud detection network according to any one of claims 1 to 15 or the joint fraud detection method according to claim 17.

23. A computer program product, characterized in that When the computer program product is run on a computer, the computer is enabled to execute the training method for a joint fraud detection network according to any one of claims 1 to 15 or the joint fraud detection method according to claim 17.

Images