Training Method of Joint Fraud Detection Network and Joint Fraud Detection Method

Abstract

This application discloses a training method and apparatus for a joint fraud detection network, a joint fraud detection method and apparatus, a joint fraud detection system, a computer device, a computer-readable storage medium, and a computer program product. The training method includes: acquiring unilateral encrypted data sent by each participant, and performing embedding calculations using each unilateral encrypted data in at least one graph embedding layer or in a graph embedding layer connected to a fraud classification sub-network to obtain joint embedding data corresponding to multiple participants; performing fraud detection using the fraud classification sub-network and the joint embedding data of multiple participants to obtain fraud detection results corresponding to multiple participants; and adjusting the network parameters of the fraud classification sub-network using preset fraud labels of multiple participants and fraud detection results of multiple participants until the training stop condition is met.

Description

Technical Field

[0001] This application relates to the field of fraud detection technology, specifically to a training method and apparatus for a joint fraud detection network, a joint fraud detection method and apparatus, a joint fraud detection system, computer equipment, a computer-readable storage medium, and a computer program product. Background Technology

[0002] Currently, various fraudulent activities exist on the internet. For example, some people buy likes and followers to increase the popularity of videos; others manipulate public perception by generating fake product reviews; and still others register fake accounts to illegally collect coupons and make fraudulent loan applications.

[0003] However, fraudsters' actions are often not limited to a single party (e.g., a single company or platform); the same fraudulent resources (e.g., phone numbers or IP addresses) may be used to attack multiple parties. For example, a fraudster might post fake reviews for the same product on shopping platform A and shopping platform B. If each attacked platform or company performs fraud detection independently, relying solely on their local business datasets, then multi-party fraud cannot be effectively detected. However, directly utilizing graph neural networks, which are used to detect single-party fraud, is ineffective for detecting multi-party fraud.

[0004] Therefore, how to train a graph neural network that can detect fraudulent activities from multiple parties is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] In view of the shortcomings of the above-mentioned related technologies, the purpose of this application is to provide a training method and apparatus for a joint fraud detection network, a joint fraud detection method and apparatus, a joint fraud detection system, a computer device, a computer-readable storage medium, and a computer program product, so as to solve the technical problem of how to train a graph neural network capable of detecting fraudulent behavior from multiple parties.

[0006] To achieve the above and other related objectives, a first aspect of this application provides a training method for a joint fraud detection network, applied to a multi-party secure computing system. The multi-party secure computing system is communicatively connected to multiple parties performing joint fraud detection. The joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computing system. The training method includes: acquiring unilateral encrypted data sent by each party, and performing embedding computation using each unilateral encrypted data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to the multiple parties; performing fraud detection using the fraud classification sub-network and the joint embedding data of the multiple parties to obtain fraud detection results corresponding to the multiple parties; and adjusting the network parameters of the fraud classification sub-network using preset fraud labels of the multiple parties and the fraud detection results of the multiple parties until a training termination condition is met.

[0007] A second aspect of this application provides a training apparatus for a joint fraud detection network, applied to a multi-party secure computing system. The multi-party secure computing system is communicatively connected to multiple parties performing joint fraud detection. The joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computing system. The training apparatus includes: a joint embedding module, used to acquire unilateral encrypted data sent by each party and perform embedding computation using each unilateral encrypted data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to the multiple parties; a fraud detection module, used to perform fraud detection using the fraud classification sub-network and the joint embedding data of the multiple parties to obtain fraud detection results corresponding to the multiple parties; and a parameter adjustment module, used to adjust the network parameters of the fraud classification sub-network using preset fraud labels of the multiple parties and the fraud detection results of the multiple parties until a training stop condition is reached.

[0008] A third aspect of this application provides a joint fraud detection method applied to a multi-party secure computing system. The multi-party secure computing system is communicatively connected to multiple parties performing joint fraud detection. The joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computing system. The joint fraud detection method includes: acquiring unilateral encrypted data sent by each party, and performing embedding computation using each unilateral encrypted data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to the multiple parties; and performing fraud detection using the fraud classification sub-network trained by the training method of the joint fraud detection network as disclosed in any embodiment of the first aspect of this application and the joint embedding data of the multiple parties to obtain fraud detection results corresponding to the multiple parties.

[0009] This application provides a joint fraud detection device applied to a multi-party secure computing system. The multi-party secure computing system is communicatively connected to multiple parties performing joint fraud detection. The joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computing system. The joint fraud detection device includes: a joint embedding module, configured to acquire unilateral encrypted data sent by each party and perform embedding calculations using each unilateral encrypted data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to the multiple parties; and a detection module, configured to perform fraud detection using the fraud classification sub-network trained by the training device of the joint fraud detection network disclosed in the second aspect of this application and the joint embedding data of the multiple parties to obtain fraud detection results corresponding to the multiple parties.

[0010] The fifth aspect of this application provides a multi-party secure computation system, including multiple computing devices, each of which is configured in a mutually untrusted computing system architecture; wherein each computing device has a pre-configured multi-party secure computation protocol, and performs a training method for a joint fraud detection network as described in any embodiment of the first aspect of this application or a joint fraud detection method as disclosed in the third aspect of this application based on the multi-party secure computation protocol.

[0011] The sixth aspect of this application provides a joint fraud detection system, including multiple parties and a multi-party secure computing system as disclosed in the fifth aspect of this application, which is communicatively connected to the multiple parties.

[0012] A seventh aspect of this application provides a computer device, comprising: a storage device for storing at least one program; and a processing device connected to the storage device for calling and executing the at least one program from the storage device to implement a training method for a joint fraud detection network as described in any embodiment of the first aspect of this application or a joint fraud detection method as disclosed in the third aspect of this application.

[0013] The eighth aspect of this application provides a computer-readable storage medium storing at least one program that, when invoked, executes and implements a training method for a joint fraud detection network as described in any embodiment disclosed in the first aspect of this application or a joint fraud detection method as disclosed in the third aspect of this application.

[0014] The ninth aspect of this application provides a computer program product that, when run on a computer, causes the computer to perform a training method for a joint fraud detection network as described in any embodiment of the first aspect of this application or a joint fraud detection method as disclosed in the third aspect of this application.

[0015] In summary, the training method and apparatus, joint fraud detection system, computer equipment, computer-readable storage medium, and computer program product of the joint fraud detection network provided in this application configure the joint fraud detection network to include at least one graph embedding layer and a fraud classification sub-network. Fraud detection is performed using the fraud classification sub-network and joint embedding data from multiple participants. The network parameters of the fraud classification sub-network are adjusted using preset fraud labels and fraud detection results from multiple participants until a training stop condition is met. This not only trains a graph neural network capable of detecting fraudulent behavior from multiple parties, but also protects the data of each participant through encrypted computation. Furthermore, the trainable network parameters exist only in the fraud classification sub-network, thus accelerating the training speed of the joint fraud detection network on a multi-party secure computing system by training only the network parameters in the fraud classification sub-network. Attached Figure Description

[0016] The specific features involved in this application are shown in the appended claims. A better understanding of the features and advantages of the invention can be achieved by referring to the exemplary embodiments and accompanying drawings described in detail below. A brief description of the drawings is as follows:

[0017] Figure 1 The diagram shown illustrates multiple fraudulent activities in one embodiment of this application.

[0018] Figure 2 The diagram shown is a schematic representation of a joint fraud detection system in one embodiment of this application.

[0019] Figure 3 The diagram shown is a structural schematic of a multi-party secure computing system according to one embodiment of this application.

[0020] Figure 4 The diagram shown is a flowchart illustrating a training method for a joint fraud detection network in one embodiment of this application.

[0021] Figure 5 This is a schematic diagram showing the configuration location of the joint fraud detection network in one embodiment of this application.

[0022] Figure 6 This is a schematic diagram showing the location of the joint fraud detection network configuration in another embodiment of this application.

[0023] Figure 7 The diagram illustrates the process by which a participant calculates unilateral ciphertext embedding data in a sub-embedding layer, according to one embodiment of this application.

[0024] Figure 8a and Figure 8b The diagrams show unilateral embedded data obtained by different parties in one embodiment of this application.

[0025] Figure 9 This application is displayed. Figure 8a The diagram shows the joint embedded data of the participating parties in one embodiment.

[0026] Figure 10 The diagram shows a joint embedding feature corresponding to a resource node type obtained by using an acceleration method in one embodiment of this application.

[0027] Figure 11 The diagram shown is a structural block diagram of a training apparatus for a joint fraud detection network according to one embodiment of this application.

[0028] Figure 12 The diagram shown is a flowchart of a joint fraud detection method in one embodiment of this application.

[0029] Figure 13 The diagram shown is a structural block diagram of a combined fraud detection device according to one embodiment of this application.

[0030] Figure 14 The diagram shown is a structural schematic of a computer device according to one embodiment of this application. Detailed Implementation

[0031] The following specific embodiments illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification.

[0032] The present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. The technical solutions in the embodiments of the present application are clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, and not all of them. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present application. The terms "an embodiment," "implementation," or similar wording used throughout this specification mean that a specific feature, structure, or characteristic described together with an implementation is included in at least one embodiment of the present application. Therefore, throughout the entire specification, the phrases "in an embodiment," "in an implementation," and similar wording may (but do not necessarily) refer to the same implementation.

[0033] As described in the background section, fraudulent activities by fraudsters are not limited to one party; for example, please refer to [link to relevant documentation]. Figure 1 The figure illustrates a multi-party fraud scheme in one embodiment of this application. As shown, users B and C both leave positive reviews for clothing item 1 on platform F, and user D also leaves a positive review for clothing item 1 on platform G. However, all three users share the same IP address (IP2). Therefore, users B, C, and D can be identified as fraudulent users engaging in fake reviews. If each party performs fraud detection independently, multi-party fraud cannot be effectively detected. For example, platform G cannot detect that user D is a fraudulent user. However, it is not possible to directly use a graph neural network designed for detecting single-party fraud to detect multi-party fraud. Therefore, how to train a graph neural network capable of detecting multi-party fraud is a pressing technical problem.

[0034] By training graph neural networks using business data from multiple parties (multiple companies and / or platforms), a graph neural network capable of detecting multi-party fraud can be obtained. However, there is a risk of leaking / exposing business data during the training process. Therefore, to protect the business data of each party, multi-party secure computation can be performed using the encrypted data of each party in a multi-party secure computation system. However, the existing architecture of graph neural networks results in low computation speed when using encrypted data for multi-party secure computation during training. Therefore, improving the training speed in the process of training a graph neural network capable of detecting multi-party fraud using encrypted data is a computational problem that urgently needs to be solved.

[0035] In view of this, some embodiments of this application disclose a training method for a joint fraud detection network. The joint fraud detection network is configured to include at least one graph embedding layer and a fraud classification subnetwork. In the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification subnetwork, embedding computation is performed on the unilateral ciphertext data sent by each participant to obtain joint embedding data of multiple participants. Fraud detection is performed using the fraud classification subnetwork and the multiple joint embedding data. The network parameters of the fraud classification subnetwork are adjusted using preset fraud labels of multiple participants and fraud detection results of multiple participants until the training stop condition is reached. In this way, not only can a graph neural network capable of detecting fraudulent behavior of multiple parties be trained, but also the business data of each participant can be protected through ciphertext. Moreover, since only the network parameters of the fraud classification subnetwork are trained in the graph embedding layer, the training speed of the joint fraud detection network on a multi-party secure computing system can be accelerated.

[0036] Please see Figure 2 The figure shows a schematic diagram of a joint fraud detection system in one embodiment of this application. As shown, the joint fraud detection system includes multiple participants 10 and a multi-party secure computing system 11 communicatively connected to the multiple participants 10. Each participant 10 sends its unilateral encrypted data to the multi-party secure computing system 11, and the multi-party secure computing system 11 uses the acquired unilateral encrypted data sent by the multiple participants 10 to execute the training method of the joint fraud detection network. The users in each participant are different; for example, registered accounts of the same person registered with different participants are considered different users. It should be noted that the multiple participants mentioned in this application refer to two or more participants.

[0037] In one embodiment, the participating party is, for example, a company's or platform's server. For example, the platform could be a shopping platform or a service platform. For example, the company could be a bank.

[0038] In one embodiment, graph data can be determined based on information about the participants' users and the operations they perform within the participants (e.g., shopping, loans). The graph data includes different types of nodes (e.g., user nodes and resource nodes). Specifically, the participants' users are the user nodes in the participants' graph data; for example, the user nodes are the participants' registered users. Information about the operations performed by the user nodes within the participants (e.g., shopping, loans) constitutes the resource nodes; for example, the resource nodes include services obtained by the users from the participants (e.g., loan services), goods purchased by the users from the participants, and / or the time the users performed the operations. The graph data also includes edges connecting resource nodes and user nodes. In a specific embodiment, the resource nodes include at least two types, and therefore the edges in the graph data include edges L corresponding to the type of each resource node. r Where r takes values ​​from 1 to R, and there are a total of R types of resource nodes. Examples of resource node types include product type (e.g., books, clothes), service type (e.g., loan service), time, identity information type (e.g., ID card number, passport number), and / or IP information. In embodiments of this application, the type of resource node may also be referred to as a resource node type.

[0039] It should be noted that the types of resource nodes are not limited to the examples above. The types of resource nodes are related to fraudulent activities provided by multiple participants. For example, if the fraudulent activity provided by the participants is commenting on the same video within a similar timeframe, then the resource node includes the time of the comment and the video itself.

[0040] In one embodiment, the user nodes included in the graph data are represented by user node numbers, and the resource nodes included in the graph data are represented by resource node numbers.

[0041] In one embodiment, the graph data includes the IDs of user nodes and resource nodes, the resource IDs of resource nodes, node features of each node, and one or more adjacency matrices corresponding to the types of resource nodes. Here, "multiple" refers to two or more. In one example, the resource node types include two types, so the graph data includes two adjacency matrices. In another example, the resource node types may include only one type, so the graph data includes only one adjacency matrix. It should be noted that each resource node has an ID and a number. In the following embodiments, an embedding feature can be called the embedding feature of the resource node or the embedding feature of the resource ID; similarly, joint embedding features are also included.

[0042] In one embodiment, the user node is numbered N, where N is the total number of user nodes. For example, each user node is numbered Y1 to Y...N Any one of them. The resource node is numbered M times, where M is the total number of resource nodes. For example, each resource node could be numbered Z1 to Z... M Any one of the following. Wherein, there are no duplicate numbers in the graph data. The resource ID of the resource node represents the actual meaning of the resource node. For example, if the type of the resource node is "book," then the resource ID of the resource node corresponding to the "book" type is, for example, the name of the book. Similarly, if the type of the resource node is "clothing," then the resource ID of the resource node corresponding to the "clothing" type is, for example, different styles of clothing. The data dimensions of the node features of each node are the same. For example, each node feature is an H-dimensional matrix, where H is an integer. In one embodiment, the node features are related to the node type and the node's statistical characteristics. In one example, the graph data includes R types of resource nodes, and the node's statistical characteristics are T-dimensional vectors. Then, each node feature includes an R+T+1-dimensional vector, one dimension indicating whether the node is a user node, R dimensions indicating which type of resource node the node belongs to, and the remaining T dimensions representing the node's statistical characteristics; where R and T are both integers. The adjacency matrix A corresponding to a type (or a resource node type) of resource nodes. r This includes the edges L connecting all resource nodes and user nodes of this type. r .

[0043] In one embodiment, the fraud classification subnetwork in the joint fraud detection network can be trained using the graph data and the fraud labels corresponding to the graph data; furthermore, after the fraud classification subnetwork is trained, fraudulent behavior in each participant can be detected based on the graph data of each participant and the joint fraud detection network.

[0044] However, the large amount of graph data in each participant's graph results in slow training and detection speeds for the joint fraud detection network. To improve the training and detection speeds, each participant uses a detection model locally to filter user nodes, identifying normal user nodes predicted as legitimate users and fraudulent user nodes predicted as fraudulent users. The suspicious probability of normal user nodes is below a first preset threshold, while the suspicious probability of fraudulent user nodes is above a second preset threshold, and the first preset threshold is less than the second preset threshold. Then, the normal and fraudulent user nodes are used as user nodes in the graph data for training the joint fraud detection network. The remaining user nodes (suspicious nodes whose identity cannot be accurately determined) are used as suspicious nodes in the graph data for detection. In other words, user nodes with suspicious probabilities between the first and second preset thresholds are used as suspicious nodes in the graph data for detection. Correspondingly, the resource nodes in the graph data used for training the joint fraud detection network are those connected to the fraudulent and legitimate user nodes, and the resource nodes in the graph data used for detection are those connected to the suspicious nodes. The detection model can be any graph neural network capable of detecting fraudulent behavior.

[0045] Furthermore, in one embodiment, the graph data also includes a value of the suspicious probability, which is the probability that a user node is suspected of being a fraudulent user.

[0046] In one embodiment, each participant may further encrypt its graph data used for training the joint fraud detection network or for detection based on the multi-party secure computation protocol of the multi-party secure computation system to obtain encrypted graph data of the participant. For example, the participant obtains the multi-party secure computation protocol sent by the multi-party secure computation system and encrypts the graph data based on the multi-party secure computation protocol.

[0047] In one embodiment, please refer to Figure 3 The figure shows a schematic diagram of a multi-party secure computation system in one embodiment of this application. As shown, the multi-party secure computation system includes multiple computing devices, each configured in a mutually untrusted computing system architecture. Each computing device has a pre-installed multi-party secure computation protocol and performs secure computation with at least one other computing device based on the multi-party secure computation protocol to execute a training method for a joint fraud detection network or a joint fraud detection method. Specifically, there is no trust between the computing devices in the mutually untrusted computing system architecture; that is, each computing device will not actively collude with other computing devices to share its own input ciphertext, nor will it actively collude with other computing devices to share the computation results obtained according to the received multi-party secure computation instructions.

[0048] In one example, upon receiving a multi-party secure computation instruction, each computing device, together with at least one other computing device, performs a multi-party secure computation based on the multi-party secure computation protocol and the obtained ciphertext. Here, the multi-party secure computation system further includes a task management platform (not shown), which, according to the task to be executed (e.g., executing a training method for a joint fraud detection network) and the multi-party secure computation protocol, divides the task to be executed into multi-party secure computation instructions for secure computation by multiple computing devices, for each computing device to execute. Examples of multi-party secure computation instructions include instructions instructing computing devices to obtain ciphertext, instructions to perform mathematical and / or logical calculations, and instructions instructing computing devices to process the calculation results, etc.

[0049] In one embodiment, the ciphertext is obtained by distributing it using a secret sharing technique. The secret sharing technique involves splitting the plaintext (e.g., the resource ID of the plaintext, or one-sided embedded data of the plaintext) in an appropriate manner. Each of the distributed ciphertexts is received by a different computing device. A single computing device cannot recover the plaintext; only by several computing devices working together can the plaintext be recovered.

[0050] In one embodiment, the multi-party secure computation protocol is set based on the distribution method of the ciphertext and the number of computing devices configured in a mutually untrusted computing system architecture. Different distribution methods of the ciphertext and different numbers of computing devices configured in a mutually untrusted computing system architecture result in different multi-party secure computation protocols. In one embodiment, the multi-party secure computation protocol is a process for instructing and scheduling corresponding computing tasks executed by each computing device in a multi-party secure computation system. This includes, but is not limited to: multi-party secure computation execution processes describing mathematical calculations such as addition, subtraction, multiplication, or division; and multi-party secure computation execution processes describing logical calculations such as logical AND, OR, NOT, XOR, and comparison. In the embodiments of this application, the number of computing devices is four, and the multi-party secure computation instructions are designed by a task management platform to execute computing tasks based on a multi-party secure computation method where the four computing devices collaboratively execute. The computing task, for example, is used to process ciphertext (e.g., one-sided ciphertext data).

[0051] Furthermore, to ensure the security of communication between the computing devices, the multi-party secure computation system also includes a hardware security module communicatively connected to each of the computing devices. This hardware security module provides cryptographic operations for the multi-party secure computation performed by each computing device. Upon receiving a multi-party secure computation instruction, each computing device, together with at least one other computing device, performs multi-party secure computation based on encryption / decryption operations corresponding to the cryptographic operations, the multi-party secure computation protocol, and the obtained ciphertext. This executes a training method for a joint fraud detection network or a joint fraud detection method. The cryptographic operations include generating key pairs, generating random numbers, generating authentication certificates, deriving keys, updating keys, and providing public key infrastructure.

[0052] It should be noted that, based on the foregoing principle description of the multi-party secure computation system, those skilled in the art can clearly understand how to perform multi-party secure computation to implement the training method and / or joint fraud detection method of the joint fraud detection network, according to the tasks that the multi-party secure computation system needs to perform (e.g., the training method of the joint fraud detection network and / or each step in the joint fraud detection method) and the obtained ciphertext. In the following embodiments, only the tasks / steps that the multi-party secure computation system needs to perform are described.

[0053] Please see Figure 4 The figure shows a flowchart illustrating a training method for a joint fraud detection network in one embodiment of this application. As shown, the training method includes steps S110, S120, and S130. The training method is applied to a multi-party secure computation system; in other words, the training method is executed by the multi-party secure computation system.

[0054] The joint fraud detection network includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computation system. In one embodiment, the at least one graph embedding layer includes a first graph embedding layer configured among multiple participants and a second graph embedding layer configured in the multi-party secure computation system. Each participant is configured with a sub-embedding layer of the first graph embedding layer, allowing each participant to perform embedding computations in the sub-embedding layer using its locally obtained graph data. For example, see [link to relevant documentation]. Figure 5The figure shows a schematic diagram illustrating the configuration of the joint fraud detection network in one embodiment of this application. As shown, each sub-embedded layer of the first graph embedding layer is configured on the participant 10, the second graph embedding layer is configured on the multi-party secure computing system 11, and the fraud classification sub-network directly connected to the second graph embedding layer is configured on the multi-party secure computing system 11. Thus, by transferring part of the computation of the training method or the joint fraud detection method to the local location of the participant, the training and detection speed of the multi-party secure computing system based on ciphertext can be accelerated. In another embodiment, the at least one graph embedding layer includes a first graph embedding layer and a second graph embedding layer configured on the multi-party secure computing system. For example, please refer to... Figure 6 The figure shows a schematic diagram illustrating the configuration of the joint fraud detection network in another embodiment of this application. As shown, the first graph embedding layer, the second graph embedding layer directly connected to the first graph embedding layer, and the fraud classification sub-network directly connected to the second graph embedding layer are sequentially configured on the multi-party secure computing system 11. It should be noted that in other embodiments, all embedding calculations performed by the two graph embedding layers can also be integrated into a single graph embedding layer for calculation. In the following embodiments, the joint fraud detection network including two graph embedding layers is used as an example for illustration.

[0055] In step S110, the multi-party secure computation system obtains the unilateral ciphertext data sent by each participant, and performs embedding computation using the unilateral ciphertext data in the at least one graph embedding layer or in the graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to multiple participants.

[0056] In some embodiments, the unilateral ciphertext data may be unilateral ciphertext embedded data obtained by the participating party performing embedding computation on its graph data and encrypting it in the sub-embedding layer, or it may be ciphertext data of the participating party's graph data. In embodiments where the at least one graph embedding layer includes a first graph embedding layer configured in multiple participating parties and a second graph embedding layer configured in the multi-party secure computation system (e.g., in...), Figure 5 In the illustrated embodiment, since the first embedding layer is configured in each participant, the embedding computation for each participant in the first embedding layer is transferred to the embedding computation performed by each participant in its local sub-embedding layer. Therefore, the unilateral ciphertext data is the unilateral ciphertext embedding data obtained by the participant performing embedding computation on its graph data in the sub-embedding layer and then encrypting it. In embodiments where the at least one graph embedding layer includes a first graph embedding layer and a second graph embedding layer configured in the multi-party secure computation system (e.g., in...), Figure 6In the embodiment shown, the unilateral ciphertext data is the ciphertext data of the participant graph data. Then, the first embedding layer performs embedding calculation based on the ciphertext data of the participant graph data, and inputs the result of the embedding calculation into the second graph embedding layer.

[0057] In one embodiment, please refer to Figure 7 The figure shows a flowchart illustrating the process by which a participant calculates unilateral ciphertext embedding data in a sub-embedding layer according to one embodiment of this application. As shown, the steps by which the participant performs embedding calculations on its graph data and encrypts it in the sub-embedding layer to obtain the unilateral ciphertext embedding data include steps S210 and S220. It should be noted that the participant uses the plaintext of its graph data to perform steps S210 and S220 locally to obtain the unilateral ciphertext embedding data.

[0058] In step S210, the participating parties utilize the adjacency matrix corresponding to each resource node type and the node features of each node to obtain the unilateral embedding data including the embedding features of the resource nodes. Specifically, the unilateral embedding data H of each participating party... l It can be calculated using the following formula:

[0059]

[0060] H 1；r =A r X

[0061] Among them, H 1；r Let A be the embedding features of the r-th type of resource node, R be the number of resource node types in the graph data, and A be the embedding features of the r-th type of resource node. r Let X be the adjacency matrix corresponding to the r-th type of resource node, and let X be the node characteristics of all nodes in the graph data. This refers to the matrix concatenation operation. For example, if the embedding features of all resource nodes of the first type are matrix {a1; b1}, and the embedding features of all resource nodes of the second type are matrix {a2; b2}, then performing a concatenation operation on the two matrices yields the matrix of embedding features.

[0062] In one embodiment, the embedding features include the node features of user nodes connected to the resource nodes. Specifically, the sub-embedding layer determines the connection between resource nodes of type r and user nodes based on the adjacency matrix corresponding to the resource nodes of type r. Then, based on the node features of user nodes connected to the resource nodes, it obtains all embedding features of resource nodes of that type. The unilateral embedding data is obtained by concatenating all embedding features of resource nodes of different types. For example, if an adjacency matrix of type r represents only resource nodes X1 and X2, where resource node X1 is connected to user node U1 by an edge, and resource node X2 is connected to both user nodes U1 and U2 by an edge, then the embedding feature of resource node X1 is the node feature of U1, and the embedding feature of resource node X2 is the node features of both U1 and U2.

[0063] In one specific embodiment, please refer to Figure 8a and Figure 8b The following are schematic diagrams showing unilateral embedded data obtained by different parties in one embodiment of this application, such as... Figure 8a As shown, V1, V2, V3, and V4 are the resource IDs of resource nodes, and U1, U2, U3, and U4 are user nodes. Solid lines and dashed lines represent edges corresponding to different types of resource nodes, respectively. Figure 8a Based on the adjacency matrix A1 corresponding to the resource node of type 1 and the node features X of all nodes in the graph data, the participating parties can determine all the embedding features H of the resource node of type 1. 1；1 = {Node features of U1; Node features of U1 and U3; 0; 0}, Based on the adjacency matrix A2 corresponding to the resource nodes of the second type and the node features X of all nodes in the graph data, all embedded features H of the resource nodes of the second type can be determined. 1；2 ={0; 0; node features of U3 and U4; node features of U2}, and then perform a concatenation operation to obtain Figure 8a Unilateral embedded data of the participating parties like Figure 8b As shown, Figure 8b The solid and dashed lines also represent edges corresponding to different types of resource nodes, and Figure 8b The middle dashed line represents the edge and Figure 8a The dashed lines represent edges belonging to the same type of resource nodes, and... Figure 8b The middle solid line represents the edge and Figure 8a Solid lines represent edges that belong to resource nodes of the same type; similarly, Figure 8b Based on the adjacency matrix A1 corresponding to the resource node of type 1 and the node features X of all nodes in the graph data, the participating parties can determine all the embedding features H of the resource node of type 1. 1；1={Node features of U6; 0; Node features of U7 and U8}, based on the adjacency matrix A2 corresponding to the resource nodes of the second type and the node features X of all nodes in the graph data, all embedded features H of the resource nodes of the second type can be determined. 1；2 ={0; node features of U5 and U7; 0}, and then after performing the splicing operation, we can obtain Figure 8b Unilateral embedded data of the participating parties

[0064] In another embodiment, please continue to refer to Figure 8a and Figure 8b If the node characteristics of each node are all set to 1, then Figure 8a All embedded features H of the corresponding type 1 resource node 1；1 ={1; 2; 0; 0}, Figure 8a All embedded features H of the corresponding second type of resource node 1；2 ={0; 0; 2; 1}. Figure 8b All embedded features H of the corresponding type 1 resource node 1；1 ={1; 0; 2}, Figure 8b All embedded features H of the corresponding second type of resource node 1；2 ={0; 2; 0}.

[0065] In one embodiment, to improve the computation time of the participant's local and multi-party secure computing systems, the user nodes in the graph data used by the participant during embedding computation in the sub-embedding layer are fraudulent and normal user nodes selected by the participant, and the resource nodes in the graph data used are resource nodes connected to the fraudulent and normal user nodes. Thus, using the selected nodes during training can reduce the computation time of the participant's local and multi-party secure computing systems. For example, the adjacency matrix and node features used in step S210 are the adjacency matrix and node features corresponding to the selected fraudulent and normal user nodes.

[0066] In one embodiment, to reduce the training time of the multi-party secure computation system, resource nodes in the graph data are further filtered to use the embedding features of suspicious resource nodes as the unilateral embedding data. Suspicious resource nodes are determined through fraudulent user nodes. For example, if a resource node is connected to more than a preset number of fraudulent user nodes, then that resource node is considered a suspicious resource node. In one embodiment, the proportion of suspicious resource nodes among all resource nodes is less than a preset proportion, such as 10%, 20%, 30%, 40%, or 50%. Specifically, the proportion of suspicious resource nodes among all resource nodes is controlled by adjusting the preset number.

[0067] After each participant obtains its own unilateral embedding data, each participant executes step S220 in the sub-embedding layer.

[0068] In step S220, the participating parties encrypt the unilateral embedded data according to the multi-party secure computing protocol of the multi-party secure computing system to obtain the unilateral ciphertext embedded data.

[0069] Specifically, the participating parties can obtain the unilateral ciphertext embedded data by encrypting the unilateral embedded data according to the multi-party secure computation protocol. Then, the multi-party secure computation system can perform joint embedded data computation in the second graph embedding layer based on the obtained unilateral ciphertext embedded data.

[0070] In one embodiment, the multi-party secure computation protocol indicates how to obtain the ciphertext used for multi-party secure computation. In one example, the ciphertext used for multi-party secure computation is obtained by randomly distributing plaintext into several parts. For example, the multi-party secure computation protocol indicates that the ciphertext is obtained by randomly distributing plaintext into four parts. In the following embodiment, the example of obtaining ciphertext by randomly dividing plaintext into four parts is used as an example. The participating parties, according to the multi-party secure computation protocol, use the unilateral embedded data H obtained in step S210. l The data is randomly divided into four parts to achieve unilateral embedding of data H. l Encryption is performed to obtain the unilateral ciphertext embedded data. For example, the unilateral embedded data H... l The data is randomly divided into four ciphertexts h1, h2, h3, and h4 to obtain one-sided ciphertext embedding data {h1, h2, h3, h4}. Each ciphertext in the one-sided ciphertext embedding data is sent to different computing devices in the multi-party secure computing system so that the multi-party secure computing system can perform calculations based on the one-sided ciphertext embedding data.

[0071] In one embodiment, where the unilateral ciphertext embedded data is ciphertext data of the participant graph data, the ciphertext data of the participant graph data is also obtained based on the multi-party secure computation protocol of the multi-party secure computation system.

[0072] In embodiments where the unilateral ciphertext embedding data is unilateral ciphertext embedding data, the multi-party secure computation system performs embedding computation using each unilateral ciphertext embedding data in a graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to multiple participants. In one embodiment, the joint fraud detection network includes a first graph embedding layer, a second graph embedding layer, and a fraud classification sub-network directly connected to the second graph embedding layer. In this case, the multi-party secure computation system performs embedding computation using each unilateral ciphertext embedding data in the second graph embedding layer to obtain joint embedding data corresponding to multiple participants.

[0073] In an embodiment of the ciphertext embedding of participant graph data, the multi-party secure computation system performs embedding computation in at least one graph embedding layer to obtain joint embedding data corresponding to the multiple participants. In one embodiment, the joint fraud detection network includes a first graph embedding layer, a second graph embedding layer, and a fraud classification sub-network directly connected to the second graph embedding layer. The multi-party secure computation system uses the ciphertext data of the participant graph data to perform multi-party secure computation in the first graph embedding layer to obtain ciphertext data of the embedding features of each type of resource node in each participant, and directly inputs this data into the second graph embedding layer for computation to obtain joint embedding data corresponding to the multiple participants. It should be noted that in this embodiment, since the first graph embedding layer is configured within the multi-party secure computation system, the computation in the first graph embedding layer is also performed in ciphertext form.

[0074] In the following embodiments, the calculation of joint embedded data is explained using the example that the unilateral ciphertext data is unilateral ciphertext embedded data.

[0075] After obtaining the unilateral encrypted embedding data, embedding calculations are performed in the second graph embedding layer using each unilateral encrypted embedding data to obtain joint embedding data corresponding to multiple participants. Specifically, in the second graph embedding layer, the resource ID of a participant's resource node is used as the ID to be combined, and the embedding features of resource IDs in other participants that are the same as the ID to be combined are combined with the embedding features of the ID to be combined using each unilateral encrypted embedding data to obtain joint embedding data corresponding to that participant; further, the above steps are repeated to obtain joint embedding data corresponding to multiple participants. In other words, for each participant, the steps of determining the ID to be combined and combining the embedding features are performed to obtain multiple joint embedding data corresponding to multiple participants.

[0076] In one specific embodiment, the embedding feature includes the node feature of the user node, and the resource IDs of all resource nodes of the participating party are used as the IDs to be combined. For example, please participate... Figure 8a The participating party's IDs to be combined are V1, V2, V3, and V4. Further, the embedding features of resource IDs from other participating parties in the joint fraud detection system that share the same ID as the ID to be combined are combined with the embedding features of the ID to be combined. These other participating parties are the remaining parties after removing the party corresponding to the ID to be combined. When combining embedding features, it is necessary to combine them separately for each resource node type. For example, please refer to... Figure 9 and combined Figure 8a and Figure 8b , Figure 9 This application is displayed. Figure 8aThe diagram illustrates the joint embedded data of the participating parties in one embodiment. As shown, the joint fraud detection system includes two participating parties, namely... Figure 8a and Figure 8b The participating parties shown are in the calculation Figure 8a When jointly embedding data among participating parties, it is necessary to... Figure 8b The embedding features of resource IDs that are identical to the ID to be combined are combined with the embedding features of the ID to be combined. Specifically, the embedding features of the resource IDs are combined with the embedding features of the IDs to be combined. Figure 8b Embedding features of V1 and Figure 8a Combining the embedding features of V1, Figure 8b Embedding features of V3 and Figure 8a The embedding features of V3 are combined to obtain joint embedding data. Among them, H 2；1 H represents the joint embedding feature corresponding to the first type of resource node. 2；2 This refers to the joint embedding feature corresponding to the second type of resource node. The joint embedding feature is obtained by combining / concatenating embedding features. Based on... Figure 9 The description of the joint embedded data computation process shown will... Figure 8b The resource IDs of all resource nodes of the participating parties shown are used as the IDs to be combined, and the embedding feature combination step is performed to obtain the result. Figure 8b The joint embedded data of the participating parties is shown.

[0077] Furthermore, in one embodiment, the node feature of each node is set to 1, then the joint embedding feature represents the sum of the degree corresponding to the ID to be combined and the degree corresponding to the resource ID that is the same as the ID to be combined in other participants.

[0078] To improve the computation speed of a multi-party secure computation system (MPC) in obtaining joint embedded data, the MPC utilizes an acceleration method to compute the joint embedded data for each participant. In one embodiment, the acceleration method includes steps S310, S320, S330, S340, S350, and S360.

[0079] In the following embodiments, for ease of explanation, the node feature of each node is set to 1 and there are only two participants in the joint fraud detection system as an example.

[0080] In step S310, any one of the multiple participants is selected as the detector. The resource ID of each participant and the embedding features corresponding to each resource ID that match a resource node type are preliminarily sorted using the unilateral encrypted embedding data of the multiple participants, so that the resource ID and corresponding embedding features of the detector are placed first. For example, please refer to... Figure 10 and combined Figure 8aand Figure 8b , Figure 10 The figure shows a schematic diagram of the joint embedding features corresponding to the resource node type of the detection party obtained by the acceleration method in one embodiment of this application. As shown in the figure, all participants include participant 1 and participant 2, and both participant 1 and participant 2 include two types of resource nodes. Figure 10 This involves using participant 1 as the detector and calculating the joint embedding features of the first type of resource node (resource nodes corresponding to V1 and V2) for participant 1. In step S310, the resource IDs of participant 1 and participant 2, along with the embedding features matching a resource node type, are initially sorted. Then, the resource IDs (V1, V2, V3, and V4) and their corresponding embedding features for participant 1 are placed first. Specifically, for the embedding features of the first type of resource node, the embedding features (1 and 2) corresponding to the resource IDs (V1 and V2) of the first type of resource node are the actual embedding features corresponding to that resource node type. The embedding features corresponding to the resource IDs (V3 and V4) of the second type of resource node are padded with 0s to ensure data dimension consistency. Similarly, for the embedding features of the first type of resource node, the embedding feature corresponding to the resource ID (V3) of the second type of resource node in participant 2, which is ranked after participant 1, also needs to be padded with 0s. After executing step S310, the following steps are obtained: Figure 10 The initial sorting corresponding to the first box in the middle.

[0081] In step S320, the resource ID ranking is determined based on the preliminary ranking result. Using this resource ID ranking, all resource IDs requiring adjustment from all participants and their corresponding embedded features are inserted into the ranking of the detection party's resource IDs and corresponding embedded features, ensuring that identical resource IDs are arranged consecutively. Among the consecutively arranged identical resource IDs, the detection party's resource ID is ranked first. Please refer to [link to relevant documentation]. Figure 10 Based on the initial sorting result of the first box, the resource IDs of the detection party (participant 1) are sorted in order as V1, V2, V3, and V4. Then, the resource IDs (V1 and V3) and corresponding embedding features (1 and 0) that need to be adjusted in participant 2 are inserted into the sorting of the resource IDs and corresponding embedding features of the detection party (participant 1). This results in the same resource IDs (V1 and V3) being arranged consecutively, and the resource ID of the detection party (participant 1) is ranked first among the consecutively arranged same resource IDs. For example, in two consecutively arranged V1s, the V1 ranked first is the resource ID of the detection party (participant 1).

[0082] In step S330, the sorted resource IDs are traversed sequentially, and each current resource ID is compared with a preset number of its adjacent resource IDs. The embedding features corresponding to the resource IDs that are identical to the current resource ID among the preset number of resource IDs are combined with the embedding features of the current resource ID to obtain a joint embedding feature corresponding to each resource ID. The preset number is related to the number of multiple participants; for example, the preset number is the number of multiple participants minus 1. Please refer to [link to relevant documentation]. Figure 10 In the second and third boxes, in the second box, the first resource ID (V1) and its adjacent next resource ID (V1) are the same. Therefore, the embedding feature of the second resource ID (V1) is combined with the embedding feature of the first resource ID (V1), resulting in a joint embedding feature of 2 for the first resource ID (V1). This process continues, yielding the following... Figure 10 The joint embedding features corresponding to each resource ID shown in the third box.

[0083] In step S340, the current resource ID and its corresponding joint embedding features are restored to the initial sorting to determine the joint embedding features of a type of resource ID in the detection process. Please refer to [link to relevant documentation]. Figure 10 Restore the resource ID and corresponding joint embedding feature in the third box to Figure 1 The preliminary sorting shown can yield the resource IDs and corresponding joint embedding features in the fourth box, and then the joint embedding features of the first type of resource IDs / resource nodes in the detection party (participant 1) can be obtained.

[0084] In step S350, steps S310 to S340 are performed for all types of embedding features of the detection party to obtain the joint embedding data of the detection party. The joint embedding data includes joint embedding features of multiple types of resource IDs / resource nodes; furthermore, the joint embedding data also includes node features corresponding to each resource node of the detection party.

[0085] In step S360, after each of the multiple participants is designated as the party to be detected, steps S310 to S350 are executed to quickly obtain the joint embedded data of the multiple participants.

[0086] It should be noted that the calculated joint embedding data can be distributed in the form of ciphertext in each computing device of the multi-party secure computing system, so as to execute step S120 based on the ciphertext.

[0087] In step S120, the multi-party secure computation system utilizes a fraud classification subnetwork to perform fraud detection on the joint embedded data of multiple participants to obtain fraud detection results corresponding to the multiple participants. In one embodiment, the fraud detection result includes whether each user node participating in the detection among the multiple participants is a fraudulent user or a non-fraudulent user. In another embodiment, the fraud detection result includes the probability that each user node participating in the detection among the multiple participants is a fraudulent user.

[0088] The fraud classification subnetwork is a neural network used for classification. In one embodiment, the fraud classification subnetwork includes a first MLP layer and a second MLP layer. The MLP (Multilayer Perceptron) layer is a neural network layer. In one example, the first MLP layer includes a ReLU non-linear activation function, and the second MLP layer includes a Sigmoid non-linear activation function. In other examples, the first and second MLP layers may also include other non-linear activation functions.

[0089] In one embodiment, taking the fraud classification subnetwork as an example, which includes a first MLP layer and a second MLP layer, the fraud detection result of each user node in each participating party can be expressed by the following formula:

[0090] P = Sigmoid(ReLU(H2W1)W2)

[0091] Where W1 is the first network parameter of the trainable first MLP layer, W2 is the second network parameter of the trainable second MLP layer, H2 is the joint embedding data of a participant, and P is the probability that each user node in a participant is a fraudulent user.

[0092] In this embodiment, the joint fraud detection network has no trainable network parameters before the fraud classification sub-network (e.g., the first MLP layer); for example, the first and second graph embedding layers do not include trainable network parameters. Therefore, the input to the fraud classification sub-network does not change during training, thereby improving the speed of joint training.

[0093] In step S130, the multi-party secure computation system uses the preset fraud labels of multiple participants and the fraud detection results of multiple participants to adjust the network parameters of the fraud classification sub-network until the training stop condition is met.

[0094] In one embodiment, the multi-party security computation system calculates a loss function based on the fraud detection results of the multiple participants and the preset fraud labels of the multiple participants. The network parameters of the fraud classification sub-network are then adjusted based on the loss function. Correspondingly, the training stopping condition is that the loss function converges. In a specific embodiment, the loss function is calculated using the preset fraud labels of the multiple participants and the fraud detection results of the multiple participants, and the first network parameter W1 of the first MLP layer and the second network parameter W2 of the second MLP layer are adjusted until the training stopping condition is reached.

[0095] In one embodiment, the fraud label represents whether a user node is a fraudulent user node. For example, a fraud label of 1 indicates that a user node is a fraudulent user node, and a fraud label of 0 indicates that a user node is not a fraudulent user node. In another embodiment, the fraud label represents the probability that a user node is a fraudulent user node.

[0096] In one specific embodiment, for each training dataset, a loss function is calculated, and the network parameters of the fraud classification sub-network are adjusted based on the loss function. The training dataset can be a preset number of fraud detection results and their corresponding fraud labels from the fraud detection results of multiple participants.

[0097] Taking the probability that a user node labeled as fraudulent is a fraudulent user node as an example, the loss function of a training dataset can be expressed by the following formula:

[0098] J=∑y i ln p i +(1-y i )ln(1-p i )

[0099] Where J is the loss of a training dataset, p i y is the probability that each user node in the training dataset is a fraudulent user node, where i ranges from 1 to Z, Z is the number of fraud detection results in the training dataset, and y is the probability that each user node in the training dataset is a fraudulent user node. i Fraud labels for each user node in the training dataset.

[0100] The trained joint fraud detection network can be used for joint fraud detection by multiple parties. For example, after obtaining the unilateral encrypted data sent by each party, the joint fraud detection network can output the fraud detection results corresponding to multiple parties.

[0101] In one embodiment, please refer to Figure 11The figure shows a structural block diagram of a training device for a joint fraud detection network in one embodiment of this application. As shown, the training device 12 for the joint fraud detection network includes a joint embedding module 120, a fraud detection module 121, and a parameter adjustment module 122.

[0102] It should be understood that the joint embedding module 120, fraud detection module 121, and parameter tuning module 122 can be implemented in software running on different types of processors. For example, a module of executable code may include one or more physical or logical blocks of computer instructions organized as objects, programs, or functions. However, the executable files of the modules do not necessarily have to be physically located together, but may include different commands stored in different locations that, when logically connected together, encompass the module and implement the specified objectives of the module.

[0103] Of course, the executable code module can be one or more instructions, and can even be distributed across several different code segments, different programs, and multiple storage devices. Similarly, computational data can be identified and represented within the module, and can be embodied in any suitable form and organized in any suitable data structure. The computational data can be collected as a single dataset, or can be distributed across different locations (including different storage devices), and can exist at least partially as electrical signals within a system or network. When the module or a portion thereof is implemented in software, the software portion is stored on one or more computer-readable media.

[0104] The training device 12 of the joint fraud detection network is applied to a multi-party secure computing system, which is communicatively connected to multiple parties performing joint fraud detection. The joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computing system.

[0105] The joint embedding module 120 is used to obtain the unilateral ciphertext data sent by each participant, and to perform embedding calculations using each unilateral ciphertext data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification subnetwork, so as to obtain joint embedding data corresponding to multiple participants.

[0106] The fraud detection module 121 is used to perform fraud detection by utilizing the fraud classification subnetwork and the joint embedded data of multiple participants to obtain fraud detection results corresponding to multiple participants.

[0107] The parameter adjustment module 122 is used to adjust the network parameters of the fraud classification sub-network using the preset fraud labels of multiple participants and the fraud detection results of multiple participants, until the training stop condition is met.

[0108] Here, the operation of each module in the training device 12 of the joint fraud detection network of this application is the same as or similar to the corresponding steps in the training method of the joint fraud detection network described above, and will not be repeated here.

[0109] This application also provides a joint fraud detection method applied to a multi-party secure computing system. The multi-party secure computing system is communicatively connected to multiple participating parties performing joint fraud detection. The joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computing system. The multi-party secure computing system, participating parties, and joint fraud detection network are the same as or similar to those described above, and will not be repeated here.

[0110] Please see Figure 12 The figure shows a flowchart of a joint fraud detection method in one embodiment of this application. As shown, the joint fraud detection method includes steps S410 and S420.

[0111] In step S410, the multi-party secure computation system acquires the unilateral encrypted data sent by each participant and performs embedding computation using each unilateral encrypted data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to multiple participants. The method for calculating the joint embedding data of each participant is the same as or similar to that described above, and will not be repeated here.

[0112] In one embodiment, in order to improve detection efficiency, the user nodes included in the graph data used in the process of calculating the unilateral encrypted data are suspicious nodes with a suspicious probability between a first preset threshold and a second preset threshold, and the resource nodes in the graph data used are resource nodes connected to the suspicious nodes.

[0113] In step S340, fraud detection is performed using the fraud classification sub-network trained by the training method of the joint fraud detection network as described in any of the foregoing embodiments and the joint embedding data of multiple participants to obtain fraud detection results corresponding to multiple participants.

[0114] In one embodiment, please refer to Figure 13 The figure shows a structural block diagram of a joint fraud detection device in one embodiment of the present application. As shown, the joint fraud detection device 13 includes a joint embedding module 130 and a detection module 131.

[0115] It should be understood that the joint embedding module 130 and the detection module 131 can be implemented in software running by different types of processors.

[0116] The joint embedding module 130 is used to acquire the unilateral ciphertext data sent by each participant, and to perform embedding calculations using each unilateral ciphertext data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification subnetwork, so as to obtain joint embedding data corresponding to multiple participants.

[0117] The detection module 131 is used to perform fraud detection using the fraud classification sub-network trained by the training device of the joint fraud detection network described in any of the foregoing embodiments and the joint embedded data of multiple participants, so as to obtain fraud detection results corresponding to multiple participants.

[0118] This application also provides a computer-readable and writable storage medium having at least one program stored thereon, which, when invoked, executes the training method or joint fraud detection method of the joint fraud detection network described in any of the above embodiments.

[0119] In one embodiment, this application also provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned related steps to implement the training method or joint fraud detection method of the joint fraud detection network described in any of the above embodiments.

[0120] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0121] In the embodiments provided in this application, the computer-readable and writable storage medium may include read-only memory (ROM), random access memory (RAM), EEPROM, CD-ROM or other optical disc storage devices, disk storage devices or other magnetic storage devices, flash memory, USB flash drive, portable hard drive, or any other medium capable of storing desired program code in the form of instructions or data structures and accessible by a computer. Additionally, any connection may be appropriately referred to as a computer-readable medium. For example, if instructions are transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of the medium. However, it should be understood that computer-readable and writable storage media and data storage media do not include connections, carrier waves, signals, or other transient media, but are intended for non-transient, tangible storage media. The disks and optical discs used in the application include compact discs (CDs), laser discs, optical discs, digital multifunction discs (DVDs), floppy disks, and Blu-ray discs, where disks typically copy data magnetically, while optical discs use lasers to copy data optically.

[0122] This application also discloses a computer device for implementing the training method or joint fraud detection method of the joint fraud detection network described in any of the above embodiments. In one embodiment, the computer device is a device capable of performing digital calculations, logical processing, and information processing on data.

[0123] Please see Figure 14 The image shows a schematic diagram of a computer device 14 according to one embodiment of this application. The computer device 14 includes a storage device 140 and a processing device 141 connected to the storage device 140. Furthermore, the computer device also includes an interface device 142.

[0124] In some embodiments, the storage device 140 is used to store at least one program that can be executed by the processing device 141 to coordinate the training method or joint fraud detection method of the joint fraud detection network described in any of the above embodiments of the storage device 140.

[0125] Here, storage device 140 includes, but is not limited to, read-only memory, random access memory, and non-volatile memory. For example, storage device 140 includes flash memory or other non-volatile solid-state storage devices. In some embodiments, storage device 140 may also include memory remote from one or more processing devices 141, such as network-attached memory accessed via RF circuitry or external ports and communication networks, wherein the communication network may be the Internet, one or more intranets, local area networks, wide area networks, storage area networks, etc., or suitable combinations thereof. A memory controller can control access to memory by other components of the device, such as the CPU and peripheral interfaces.

[0126] In some embodiments, the processing device 141 includes one or more processors. The processing device 141 is operatively capable of performing data read and write operations with the storage device 140. The processing device 141 includes one or more general-purpose microprocessors, one or more application-specific integrated circuits (ASICs), one or more digital signal processors, one or more field-programmable logic arrays (FPGAs), or any combination thereof.

[0127] In some embodiments, the interface device 142 includes at least one interface unit, each interface unit being used to output a visual interface, receive human-computer interaction events generated according to the operation of a technician, etc. For example, the interface device 142 includes, but is not limited to, serial interfaces such as HDMI interfaces or USB interfaces, or parallel interfaces, etc. In one embodiment, the interface device 142 further includes a network communication unit, which is a device for data transmission using wired or wireless networks, examples of which include, but are not limited to, integrated circuits including network cards, local area network modules such as WiFi modules or Bluetooth modules, and wide area network modules such as mobile networks, etc.

[0128] In one or more exemplary aspects, the training method or joint fraud detection method of the joint fraud detection network described in this application. The described functions can be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored or transmitted as one or more instructions or code onto a computer-readable medium. The steps of the methods or algorithms disclosed in this application can be embodied in processor-executable software modules, wherein the processor-executable software modules can reside on tangible, non-transitory computer storage media. Tangible, non-transitory computer storage media can be any available medium accessible to a computer.

[0129] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Accordingly, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified function or operation, or by a combination of dedicated hardware and computer instructions.

[0130] In summary, the training method and apparatus, joint fraud detection system, computer equipment, computer-readable storage medium, and computer program product of the joint fraud detection network provided in this application configure the joint fraud detection network to include at least one graph embedding layer and a fraud classification sub-network. Fraud detection is performed using the fraud classification sub-network and multiple joint embedding data. The network parameters of the fraud classification sub-network are adjusted using preset fraud labels from multiple participants and the fraud detection results from multiple participants until the training stops. This not only trains a graph neural network capable of detecting fraudulent behavior from multiple parties, but also protects the data of each participant through encrypted computation. Furthermore, the trainable network parameters exist only in the fraud classification sub-network, thus accelerating the training speed of the joint fraud detection network on a multi-party secure computing system by training only the network parameters in the fraud classification sub-network.

[0131] Furthermore, by having participants locally use detection models to filter user nodes, the training speed can be further accelerated.

[0132] Furthermore, by filtering resource nodes in the graph data and using the embedding features of suspicious resource nodes as the unilateral embedding data, the time required for the multi-party secure computation system to compute the joint embedding data can be reduced, thereby accelerating the training speed.

[0133] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A training method for a joint fraud detection network, characterized in that, An application is made in a multi-party secure computation system, wherein the multi-party secure computation system is communicatively connected to multiple parties performing joint fraud detection, and the joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computation system, wherein the training method includes: The process involves acquiring unilateral encrypted data sent by each participant and performing embedding calculations using each unilateral encrypted data in at least one graph embedding layer or in a graph embedding layer connected to the fraud classification subnetwork to obtain joint embedding data corresponding to multiple participants. The step of performing embedding calculations using each unilateral encrypted data to obtain joint embedding data corresponding to a participant includes: taking any one of the multiple participants as the detector; using the unilateral encrypted embedding data of the multiple participants to perform a preliminary sorting of the resource ID of each participant and the embedding features corresponding to each resource ID that match a resource node type, so that the resource ID of the detector and its corresponding embedding features are at the top; determining the resource ID sorting based on the preliminary sorting result; and using the resource ID sorting to insert the resource IDs and their corresponding embedding features that need adjustment from all participants into the sorting of the resource IDs and their corresponding embedding features of the detector, so that identical resource IDs are arranged consecutively; sequentially traversing the sorted resource IDs and matching the current traversed resource ID with its corresponding embedding feature. The system compares a preset number of neighboring resource IDs, combines the embedding features of resource IDs that are identical to the current resource ID with the embedding features of the current resource ID to obtain a joint embedding feature for each resource ID; restores the current resource ID and its corresponding joint embedding features to the initial sorting to determine the joint embedding features of a type of resource ID in the detection party; determines the corresponding joint embedding features for all types of embedding features of the detection party to obtain the joint embedding data of the detection party; the at least one graph embedding layer includes a first graph embedding layer configured in multiple participating parties and a second graph embedding layer configured in the multi-party secure computing system; wherein, each participating party is configured with a sub-embedding layer of the first graph embedding layer, and the unilateral ciphertext data is the unilateral ciphertext embedding data obtained by the participating party performing embedding calculations and encrypting its graph data in the sub-embedding layer; the graph data includes the numbers of user nodes and resource nodes, the resource IDs of resource nodes, the node features of each node, and one or more adjacency matrices corresponding to the type of resource node; Fraud detection is performed using a fraud classification subnetwork and joint embedded data from multiple participants to obtain fraud detection results corresponding to multiple participants; The network parameters of the fraud classification subnetwork are adjusted using the pre-set fraud labels of multiple participants and the fraud detection results of multiple participants until the training stops.

2. The training method according to claim 1, characterized in that, The user node is a user of the participating party, and the resource node includes information related to the operations performed by the user node on the participating party.

3. The training method according to claim 1, characterized in that, The user nodes in the graph data are fraudulent user nodes and normal user nodes selected by the participants, and the resource nodes in the graph data are resource nodes connected to the fraudulent user nodes and normal user nodes.

4. The training method according to claim 1, characterized in that, The steps for the participating parties to perform embedding calculations on their graph data in the sub-embedding layer and then encrypt it to obtain the unilateral ciphertext embedded data include: The participants use the adjacency matrix corresponding to each resource node type and the node features of each node to obtain unilateral embedding data including the embedding features of the resource nodes; wherein, the embedding features include the node features of user nodes connected to the resource nodes. The unilateral embedded data is encrypted according to the multi-party secure computation protocol of the multi-party secure computation system to obtain the unilateral ciphertext embedded data.

5. The training method according to claim 4, characterized in that, It also includes the step of filtering resource nodes in the graph data to use the embedding features of suspicious resource nodes as the unilateral embedded data.

6. The training method according to claim 4, characterized in that, The unilateral ciphertext data is unilateral ciphertext embedding data, and the joint embedding data corresponding to the participating parties is obtained by embedding calculations using each unilateral ciphertext embedding data in the second graph embedding layer connected to the fraud classification sub-network.

7. The training method according to claim 6, characterized in that, The steps for performing embedding computation using the ciphertext embedding data of each party in the second graph embedding layer to obtain joint embedding data corresponding to multiple participants include: In the second graph embedding layer, embedding calculations are performed using the ciphertext embedding data of each party to obtain the joint embedding data corresponding to that party. Repeat the above steps to obtain joint embedded data corresponding to multiple participants.

8. The training method according to claim 1, characterized in that, The fraud classification subnetwork includes a first MLP layer and a second MLP layer.

9. The training method according to claim 8, characterized in that, The first MLP layer includes a ReLU nonlinear activation function, and the second MLP layer includes a Sigmoid nonlinear activation function.

10. The training method according to claim 8, characterized in that, The step of adjusting the network parameters of the fraud classification sub-network using the pre-set fraud labels of multiple participants and the fraud detection results of multiple participants until the training stopping condition is reached includes: calculating the loss function using the pre-set fraud labels of multiple participants and the fraud detection results of multiple participants, and adjusting the first network parameters of the first MLP layer and the second network parameters of the second MLP layer until the training stopping condition is reached.

11. A training device for a joint fraud detection network, characterized in that, An application is made in a multi-party secure computation system, which is communicatively connected to multiple parties performing joint fraud detection. The joint fraud detection network sequentially includes at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computation system. The training device includes: A joint embedding module is used to acquire unilateral encrypted data sent by each participant, and to perform embedding calculations using each unilateral encrypted data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to multiple participants. The step of performing embedding calculations using each unilateral encrypted data to obtain joint embedding data corresponding to a participant includes: taking any one of the multiple participants as a detector, using the unilateral encrypted embedding data of the multiple participants to perform a preliminary sorting of the resource ID of each participant and the embedding features corresponding to each resource ID that match a resource node type, so that the resource ID of the detector and its corresponding embedding features are at the top; determining the resource ID sorting based on the preliminary sorting result, and using the resource ID sorting, inserting the resource IDs and corresponding embedding features of all participants that need adjustment into the sorting of the resource IDs and corresponding embedding features of the detector, so that identical resource IDs are arranged consecutively; sequentially traversing the sorted resource IDs, and setting the current traversed resource ID as the current resource ID. Each resource ID is compared with a preset number of adjacent resource IDs. The embedding features corresponding to the resource IDs that are the same as the current resource ID are combined with the embedding features of the current resource ID to obtain the joint embedding features corresponding to each resource ID. The current resource ID and its corresponding joint embedding features are restored to the initial sorting to determine the joint embedding features of a type of resource ID in the detection party. For the embedding features of all types of the detection party, the corresponding joint embedding features are determined to obtain the joint embedding data of the detection party. The at least one graph embedding layer includes a first graph embedding layer configured in multiple participating parties and a second graph embedding layer configured in the multi-party secure computing system. Each participating party is configured with a sub-embedding layer of the first graph embedding layer. The unilateral ciphertext data is the unilateral ciphertext embedding data obtained by the participating party embedding and encrypting its graph data in the sub-embedding layer. The graph data includes the numbers of user nodes and resource nodes, the resource IDs of resource nodes, the node features of each node, and one or more adjacency matrices corresponding to the type of resource node. The fraud detection module is used to perform fraud detection by utilizing the fraud classification subnetwork and the joint embedded data of multiple participants to obtain fraud detection results corresponding to multiple participants; The parameter adjustment module is used to adjust the network parameters of the fraud classification sub-network using the preset fraud labels of multiple participants and the fraud detection results of multiple participants, until the training stopping condition is met.

12. A joint fraud detection method, characterized in that, An application is made in a multi-party secure computation system, wherein the multi-party secure computation system is communicatively connected to multiple parties performing joint fraud detection, the joint fraud detection network sequentially including at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computation system, and the joint fraud detection method includes: Each participant sends unilateral ciphertext data, and each unilateral ciphertext data is used for embedding calculation in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification sub-network to obtain joint embedding data corresponding to multiple participants. Fraud detection is performed using a fraud classification subnetwork trained by the training method of the joint fraud detection network as described in any one of claims 1-10 and joint embedding data of multiple participants to obtain fraud detection results corresponding to multiple participants.

13. A combined fraud detection device, characterized in that, An application is made in a multi-party secure computation system, wherein the multi-party secure computation system is communicatively connected to multiple parties performing joint fraud detection, the joint fraud detection network sequentially including at least one graph embedding layer and a fraud classification sub-network configured in the multi-party secure computation system, and the joint fraud detection device includes: A joint embedding module is used to acquire the unilateral ciphertext data sent by each participant, and to perform embedding calculations using the unilateral ciphertext data in the at least one graph embedding layer or in a graph embedding layer connected to the fraud classification sub-network, so as to obtain joint embedding data corresponding to multiple participants. The detection module is used to perform fraud detection using the fraud classification subnetwork trained by the training device of the joint fraud detection network as described in claim 11 and the joint embedded data of multiple participants, so as to obtain fraud detection results corresponding to multiple participants.

14. A multi-party secure computation system, characterized in that, The system includes multiple computing devices configured in a mutually untrusted computing system architecture; wherein each computing device has a pre-configured multi-party secure computing protocol and performs, with at least one other computing device, a training method for a joint fraud detection network as described in any one of claims 1-10 or a joint fraud detection method as described in claim 12 based on the multi-party secure computing protocol.

15. A joint fraud detection system, characterized in that, The multi-party secure computing system as described in claim 14 includes multiple participating parties and communication connections with said multiple participating parties.

16. A computer device, characterized in that, include: Storage device for storing at least one program; A processing device, connected to the storage device, is configured to implement, when calling and executing the at least one program from the storage device, the training method for the joint fraud detection network as described in any one of claims 1-10 or the joint fraud detection method as described in claim 12.

17. A computer-readable storage medium, characterized in that, The system stores at least one program that, when invoked, executes and implements the training method for the joint fraud detection network as described in any one of claims 1-10 or the joint fraud detection method as described in claim 12.

18. A computer program product, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the training method for the joint fraud detection network as described in any one of claims 1-10 or the joint fraud detection method as described in claim 12.

Images