Anti-gang fraud detection method based on neural network

Abstract

The invention relates to the technical field of fraud detection, and provides an anti-gang fraud detection method based on a neural network, and the method comprises the following steps: S1, constructing a heterogeneous graph which comprises various types of nodes and edges, the types of the nodes comprise a mobile phone number, an identity card number, an IP address and equipment information, and the edges represent the relation between entities; s2, generating a pseudo label matrix by using a label propagation method; s3, predicting labels of unlabeled nodes by using the heterogeneous graph neural network model to obtain a predicted pseudo label matrix; and S4, carrying out weighted average on the two pseudo-label matrixes to obtain a final pseudo-label matrix. By means of the technical scheme, the technical problems that in the related technology, when a pre-loan anti-fraud system deals with gang fraud, annotation data is lacked, various types of nodes and edges are difficult to process, and time sequence information cannot be processed are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of fraud detection, and in particular to an anti-gang fraud detection method based on a neural network. Background Art

[0002] Group fraud in financial risk control refers to the behavior of multiple people who, through mutual collaboration, exploit the risk loopholes of financial institutions, obtain loans or other financial services through fraudulent means such as stealing or impersonating other people's accounts, and attempt to evade repayment responsibilities. This type of fraud, with its organizational and large-scale characteristics, can initiate fraudulent applications in batches at a low cost in a very short period of time, while using technical means to conceal their true identities and behavior trajectories, greatly increasing the difficulty of fraud detection and posing a serious threat to the security and stability of the financial system.

[0003] Existing anti-fraud methods mainly introduce machine learning models and combine them with expert rules to prevent and control overall risks. Machine learning models are mainly trained through supervised learning, and can predict the fraud probability of new transactions based on the characteristics of fraudulent transactions and normal transactions marked in historical data. Expert rules are a series of rules and standards based on professional knowledge and experience. By combining machine learning models, anti-fraud systems can more accurately and comprehensively identify and prevent fraudulent behavior. Although existing anti-fraud methods perform well in predicting individual risks, they still face some challenges when dealing with group fraud. These challenges are mainly reflected in the following two aspects:

[0004] (1) Sample independence problem: Traditional supervised learning methods usually treat each sample independently, ignoring the potential relationship between samples. However, group fraud often involves the collaboration of multiple individuals, and there are complex connections and collaboration patterns between these individuals. Existing models have difficulty capturing and processing these connections, resulting in insufficient performance in identifying group fraud.

[0005] (2) Non-Euclidean data processing: The relationship network in gang fraud is usually located in non-Euclidean space. These network data include social relationships, transaction relationships, etc. These data are difficult to be effectively processed using traditional Euclidean space methods (such as vectorization, matrix decomposition, etc.). Summary of the invention

[0006] The present invention proposes an anti-gang fraud detection method based on neural network, which solves the technical problems faced by the pre-loan anti-fraud system in related technologies when dealing with gang fraud, such as lack of labeled data, difficulty in processing multiple types of nodes and edges, and inability to process time series information.

[0007] The technical solution of the present invention is as follows:

[0008] A neural network-based anti-gang fraud detection method, the method comprising the following steps:

[0009] S1. Construct a heterogeneous graph, including multiple types of nodes and edges. Node types include mobile phone numbers, ID numbers, IP addresses, and device information. Edges represent the relationships between entities.

[0010] S2, generate a pseudo label matrix using label propagation method;

[0011] S3. Use the heterogeneous graph neural network model to predict the labels of unlabeled nodes and obtain the predicted pseudo-label matrix;

[0012] S4. Perform weighted averaging on the two pseudo-label matrices to obtain the final pseudo-label matrix.

[0013] Optionally, the heterogeneous graph neural network model includes the following steps:

[0014] A1. Use multi-head attention mechanism to extract feature representations of different relationships between nodes;

[0015] A2. Calculate the weight coefficient of the meta-path and weight the importance of different paths;

[0016] A3. Take the weighted sum of the meta-path coefficient and the node-level embedding to calculate the final node embedding.

[0017] Optionally, the temporal neural network model includes the following steps:

[0018] B1. Prepare time series data, including the frequency, time interval and dwell time of loan application submission;

[0019] B2. Construct time feature sequence;

[0020] B3. Use the Temporal Convolutional Network (TCN) model to process the time feature sequence and generate the embedding of the time series features.

[0021] Optionally, the total loss function is a weighted sum of the labeled loss and the pseudo-label loss, wherein the labeled loss is calculated using the cross entropy loss, and the cross entropy loss calculation formula is:

[0022] ι binary (p, y) = -(ylog(p) + (1-y)log(1-p)), where y is the true label and p is the predicted probability value output by the model.

[0023] Optionally, the label propagation method includes the following steps:

[0024] C1. Define the label matrix, initialize the labels of the labeled nodes, and initialize the labels of the unlabeled nodes to zero;

[0025] C2, construct a similarity matrix and initialize it using the Jaccard coefficient;

[0026] C3. Calculate the new label vector of the unlabeled node using the weighted sum method. The calculation formula for the new label vector of the unlabeled node is:

[0027] Among them, N(i) represents the set of neighbor nodes of node i, i represents an unlabeled node, and the label vector of the center is Y i (t+1) , It is the formula of weighted summation method.

[0028] Optionally, the training of the heterogeneous graph neural network model includes the following steps:

[0029] D1. Use some labeled data to train the model;

[0030] D2. Use cross entropy loss as the loss function;

[0031] D3. Adjust the optimizer parameters in the model according to the loss value.

[0032] Optionally, the construction of the timing network TCN model includes the following steps:

[0033] E1. Create the basic TCN block, including the one-dimensional causal convolution layer, the batch normalization layer, and the activation function layer;

[0034] E2. Build multiple TCN blocks and connect them using residual connections;

[0035] E3. Output the result through the fully connected layer.

[0036] Optionally, in step A1, the calculation formula of the multi-head attention mechanism is:

[0037] Among them, || represents the feature vector of splicing node i and splicing node j, is the attention vector, represents the scaling factor, σ represents the activation function, Represents the attention of neighbor node j in transmitting messages to primary node i under the original path φ.

[0038] Optionally, in step A2, the calculation formula of the meta-path weight coefficient is:

[0039] Where σ is the activation function, W p 、b p is a learnable parameter, h i is the feature vector of the node.

[0040] Optionally, in step C2, the Jaccard coefficient calculation formula is:

[0041] Among them, A and B are the neighbor sets of two nodes.

[0042] The working principle and beneficial effects of the present invention are:

[0043] In terms of diversity processing: complex association relationships are represented by heterogeneous graphs, and multi-head attention mechanisms are used to process multi-type nodes and edges, which can better capture and analyze features in non-Euclidean spaces and improve the ability to detect gang fraud.

[0044] In terms of capturing time dependencies: Using the TCN model to process the temporal feature sequence of user behavior can effectively capture temporal aggregation behaviors and further improve the detection effect of the model.

[0045] In terms of accuracy improvement: By using the label propagation algorithm and heterogeneous graph neural network model, we can make full use of limited annotated data, generate pseudo labels and perform weighted averaging to improve the fraud identification performance when annotated data is scarce. By combining the heterogeneous graph neural network model and the TCN model, the outputs of the two are spliced ​​and integrated through the fully connected layer to obtain a more comprehensive feature representation, thus improving the overall detection effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The preferred implementation modes will be described below in a clear and understandable manner with reference to the accompanying drawings to further illustrate the above-mentioned characteristics, technical features, advantages and implementation methods of the present invention.

[0047] Figure 1 A schematic diagram of a process of gang fraud detection;

[0048] Figure 2 A schematic diagram of a process for alleviating the problem of lack of labeled data in gang fraud;

[0049] Figure 3 A schematic diagram of the effect of using a heterogeneous graph neural network model to predict a pseudo-label matrix for alleviating the problem of lack of labeled data in gang fraud;

[0050] Figure 4 A schematic diagram of a process constructed based on a meta-path subgraph;

[0051] Figure 5 A schematic diagram of a model that integrates heterogeneous graph neural network and TCN;

[0052] Figure 6 The figure is a schematic diagram of the structure of a device used for gang fraud detection. DETAILED DESCRIPTION

[0053] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings and other implementation methods can be obtained based on these drawings without creative work.

[0054] In order to simplify the drawings, only the parts related to the invention are schematically shown in each figure, and they do not represent the actual structure of the product. In addition, in order to simplify the drawings and facilitate understanding, in some figures, only one of the parts with the same structure or function is schematically shown, or only one of them is marked. In this article, "one" not only means "only one", but also means "more than one", and "several" includes "two" and "more than two".

[0055] In this document, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0056] In addition, in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0057] Reference Figure 1 to Figure 6 , is an embodiment of the present invention, and proposes

[0058] A neural network-based anti-gang fraud detection method, the method comprising the following steps:

[0059] S1. Construct a heterogeneous graph, including multiple types of nodes and edges. Node types include mobile phone numbers, ID numbers, IP addresses, and device information. Edges represent the relationships between entities.

[0060] S2, generate a pseudo label matrix using label propagation method;

[0061] S3. Use the heterogeneous graph neural network model to predict the labels of unlabeled nodes and obtain the predicted pseudo-label matrix;

[0062] S4. Perform weighted averaging on the two pseudo-label matrices to obtain the final pseudo-label matrix.

[0063] Optionally, the heterogeneous graph neural network model includes the following steps:

[0064] A1. Use multi-head attention mechanism to extract feature representations of different relationships between nodes;

[0065] A2. Calculate the weight coefficient of the meta-path and weight the importance of different paths;

[0066] A3. Take the weighted sum of the meta-path coefficient and the node-level embedding to calculate the final node embedding.

[0067] Optionally, the temporal neural network model includes the following steps:

[0068] B1. Prepare time series data, including the frequency, time interval and dwell time of loan application submission;

[0069] B2. Construct time feature sequence;

[0070] B3. Use the Temporal Convolutional Network (TCN) model to process the time feature sequence and generate the embedding of the time series features.

[0071] Optionally, the total loss function is a weighted sum of the labeled loss and the pseudo-label loss, wherein the labeled loss is calculated using the cross entropy loss, and the cross entropy loss calculation formula is:

[0072] ι binary (p, y) = -(ylog(p) + (1-y)log(1-p)), where y is the true label and p is the predicted probability value output by the model.

[0073] Optionally, the label propagation method includes the following steps:

[0074] C1. Define the label matrix, initialize the labels of the labeled nodes, and initialize the labels of the unlabeled nodes to zero;

[0075] C2, construct a similarity matrix and initialize it using the Jaccard coefficient;

[0076] C3. Calculate the new label vector of the unlabeled node using the weighted sum method. The calculation formula for the new label vector of the unlabeled node is:

[0077] Among them, N(i) represents the set of neighbor nodes of node i, i represents an unlabeled node, and the label vector of the center is Y i (t+1) , It is the formula of weighted summation method.

[0078] Optionally, the training of the heterogeneous graph neural network model includes the following steps:

[0079] D1. Use some labeled data to train the model;

[0080] D2. Use cross entropy loss as the loss function;

[0081] D3. Adjust the optimizer parameters in the model according to the loss value.

[0082] Optionally, the construction of the timing network TCN model includes the following steps:

[0083] E1. Create the basic TCN block, including the one-dimensional causal convolution layer, the batch normalization layer, and the activation function layer;

[0084] E2. Build multiple TCN blocks and connect them using residual connections;

[0085] E3. Output the result through the fully connected layer.

[0086] Optionally, in step A1, the calculation formula of the multi-head attention mechanism is:

[0087] Among them, || represents the feature vector of splicing node i and splicing node j, is the attention vector, represents the scaling factor, σ represents the activation function, Represents the attention of neighbor node j in transmitting messages to primary node i under the original path φ.

[0088] Optionally, in step A2, the calculation formula of the meta-path weight coefficient is:

[0089] Where σ is the activation function, W p 、b p is a learnable parameter, h i is the feature vector of the node.

[0090] Optionally, in step C2, the Jaccard coefficient calculation formula is:

[0091] Among them, A and B are the neighbor sets of two nodes.

[0092] like Figure 1 As shown, the embodiment of this specification provides a risk assessment method for gang fraud, which may include the following steps:

[0093] Step S102: A method for detecting gang fraud to alleviate the lack of labeled data, such as Figure 2As shown in the figure, we first need to construct a heterogeneous graph, and then use limited labeled data combined with the results of the label propagation algorithm and the heterogeneous graph neural network model to generate a pseudo label matrix, including the following steps:

[0094] Step S202: The gang fraud detection method for alleviating the lack of annotated data needs to extract related entities in the data source, build edges according to the relationship between the entities, convert them into a heterogeneous graph, and annotate the nodes.

[0095] Among them, the entities that need to be associated include mobile phone numbers, ID numbers, IP addresses, and device information. Each mobile phone number node represents a mobile phone number and may be associated with multiple devices; the ID number node represents an individual's identity and may be associated with multiple mobile phone numbers or devices; the IP address node represents a network access point and may be associated with multiple devices; the device information node represents the device used, such as a mobile phone, a computer, etc., which may be associated with multiple mobile phone numbers, ID numbers, or IP addresses. The edges include the association between mobile phone numbers and mobile phone numbers, indicating the communication connection between two mobile phone numbers; the association between mobile phone numbers and ID numbers, indicating the ownership of mobile phone numbers; the association between mobile phone numbers and device information, indicating that a mobile phone number is used on a certain device; the association between device information and IP, indicating that a certain device accesses the network through a certain IP address. The heterogeneous graph refers to a graph structure containing multiple types of nodes and edges. Complex associations can be effectively represented and captured through heterogeneous graphs. To annotate the heterogeneous graph, it is necessary to annotate the labels of various nodes. For example, annotating a mobile phone number node with 1 indicates "fraud" or 0 indicates "non-fraud".

[0096] When the labeled data is limited, the pseudo label matrix Y is obtained by using the label propagation method in semi-supervised learning. label_prop , the pseudo label matrix Y is predicted using the heterogeneous graph neural network model model_pred , perform weighted averaging on the two pseudo labels to obtain the final pseudo label matrix Y final , including the following steps:

[0097] Step S204: The pseudo label matrix Y is obtained by using the label propagation algorithm label_prop ,include:

[0098] Define the label matrix and build a label matrix The rows represent nodes, the columns represent label categories, the labels of labeled nodes are initialized according to known information, and the labels of unlabeled nodes are initialized to zero;

[0099] Initialize the similarity matrix and construct a graph similarity matrix S, where S i，j Represents the similarity between node i and node j, and uses the Jaccard coefficient to initialize the similarity matrix;

[0100] The Jaccard coefficient refers to the similarity between node i and node j, which is defined as the ratio of their common neighbors to the union of all their neighbors. The formula is as follows, where |N(i)∩N(j)| is the number of common neighbors of node i and node j, and |N(i)∪N(j)| is the size of the union of all their neighbors:

[0101]

[0102] Initialize label matrix Y label_prop , for unlabeled node i, calculate its new label vector The calculation formula is as follows, where N(i) represents the set of neighbor nodes of node i. It is a weighted sum method, which represents the label information propagated by node i from its neighboring nodes;

[0103]

[0104] Step S206: The pseudo label matrix Y is obtained by using the neural network model prediction model_pred ,include:

[0105] Constructing a heterogeneous graph neural network model, which will be described in detail in a method for detecting gang fraud for processing multiple types of nodes and edges in step S104;

[0106] Use some labeled data to train the heterogeneous graph neural network model, use cross entropy loss as the loss function, and continuously adjust the optimizer parameters in the model according to the loss value during the training process to achieve more accurate results. The acc value, that is, the accuracy rate changes during the model training process. Figure 3 As shown in (a), Figure 3 The distribution of nodes in (b) reflects the model’s ability to distinguish between fraudulent and non-fraudulent mobile phone number nodes.

[0107] The cross entropy loss calculation formula is as follows, y is the true label, and p is the predicted probability value output by the model;

[0108]

[0109] Use the trained model to predict the unlabeled nodes, get the predicted values ​​of the unlabeled nodes, and construct the pseudo label matrix Y model_pred ;

[0110] Step S208: The pseudo label matrix Y label_prop and Y model_pred Weighted average to get the final pseudo label matrix Y final ,include:

[0111] The cross-validation method is used to determine the value of the weight α, and the weight α is used to perform weighted averaging on the two pseudo labels to obtain the final pseudo label matrix. The calculation formula is as follows, where α is the weight of the label propagation algorithm and 1-α is the weight predicted by the initial model;

[0112] Y final =αY label_prop +(1-α)Y model_pred

[0113] The cross-validation method comprises:

[0114] Set different α values, set α from 0 to 1, and take a value every 0.1, for a total of 11 values: α∈{0.0,0.1,0.2,…,1.0};

[0115] Use 5-fold cross validation to divide the data set into five subsets. In each iteration, select one of the subsets as the validation set and the remaining four subsets as the training set.

[0116] In each iteration, the accuracy of the model on the validation set is calculated, and the average accuracy of the five iterations is taken as the average accuracy of α in all compromises, and the α value with the best performance is selected.

[0117] Step S104: A gang fraud detection method for processing multiple types of nodes and edges, comprising:

[0118] Initialize the node feature matrix. The node feature is a vector used to represent the attributes of each node. In the gang fraud scenario, it is necessary to construct the node features of mobile phone number, ID number, IP node and device information. Among them, the node features of mobile phone number include: number of calls, call duration, call frequency, and geographic location code; the node features of ID number include: number of registrations, that is, the number of mobile phone numbers registered with the ID number, the time of the most recent registration of the mobile phone number, the registration interval, and the address code of the ID number; the IP node features include: geographic location information, the network type of the IP address, such as public network, private network, etc., historical behavior characteristics, such as the historical access pattern and fraud behavior record of the IP address, and security assessment, such as whether there is a risk or has been blacklisted.

[0119] The meta-path-based subgraph construction uses a heterogeneous graph constructed in a group fraud detection method to alleviate the lack of labeled data, such as Figure 4 As shown in (a), multiple groups of meta-paths are selected, each of which represents the relationship between nodes of a specific type, such as Figure 4 (b) As shown in Figure 2. According to the meta-path, nodes and edges are sampled from the heterogeneous graph to generate the corresponding subgraph, as shown in Figure 2. Figure 4As shown in (c), features are extracted for nodes in each subgraph based on the node feature matrix, and the extracted features are input into the heterogeneous graph neural network model for prediction.

[0120] A multi-head attention mechanism is applied to the nodes on each subgraph to extract feature representations of different relationships between nodes, including:

[0121] is the node feature h i Add the self-attention mechanism, the formula is as follows. Due to the heterogeneity of different types of nodes in the heterogeneous graph, the feature transformation matrix W is required φ Map the features of different types of nodes into a unified feature space.

[0122] Represents the feature vector of the concatenated node i and node j, the concatenated vector and the attention vector Perform a dot product. represents the scaling factor, which is the square root of the feature vector dimension. Scaling the dot product result helps ensure that the gradient of the softmax output is within a reasonable range. σ is the activation function. The weight coefficient is normalized by the softmax function. represents the attention of neighbor node j in transmitting messages to primary node i under meta-path φ.

[0123]

[0124] Concatenate multiple attention heads, where is the neighbor node feature h j Multiply by the attention factor The weighted sum of is the embedding of node i in the learned meta-path Φ, and σ is the activation function. It means concatenating the outputs of the first to the Kth attention heads in sequence.

[0125]

[0126] Add weights to the paths on each subgraph, weight the importance of different paths, make the model focus on more important paths, use multi-head attention, and average the outputs of multi-head attention, including:

[0127] Calculate the weight coefficient α of the meta-path Φ In order to learn the weight of each meta-path, we need to first transform the embedding of each node under the meta-path through the Relu nonlinear activation function, and then transform the transformed feature vector with the attention vector q kPerform a dot product and calculate the attention score. After that, for each attention head k, sum and average the attention scores of all nodes. Next, sum and average the results of all attention heads k. Finally, normalize the results through the softmax function to get the weight coefficient α Φ , the formula is as follows. Where K is the number of attention heads, N is the number of all nodes, q k , W k and b k are the parameters that can be learned during training, is the embedding of node i under the meta-path Φ.

[0128]

[0129] Calculate the final node embedding H and transform the meta-path coefficient α Φ With node-level embedding To do the weighted sum, the formula is as follows, where is the subgraph Φ generated under the meta-path p p The set of all nodes in

[0130] is the node feature vector set after the initial node feature vector passes through the heterogeneous graph neural network, that is, H = {h1, h2...h n}.

[0131]

[0132] Based on the above node-level attention and path-level attention, a basic heterogeneous graph neural network block is constructed, which is called the HGN block here, including a one-dimensional heterogeneous graph convolution layer, a Batch Normalization layer, and an activation function layer; multiple HGN blocks are constructed and connected using residual connections.

[0133] Specifically, define the HGNConvModel class, which inherits from the nn.Module class and defines the initialization __init__ function. The initialization function completes the assignment of each member variable. The function parameter list includes the input feature dimension in_feats, the output feature dimension out_feats, the number of heads in the multi-head attention mechanism num_heads, and whether the node's in-degree is allowed to be zero allow_zero_in_degree. Define the learnable parameters fc and attn_fc. fc is a fully connected layer that maps the input feature dimension in_feats to out_feats*num_heads. Each attention head will get an independent feature vector of the size out_feats. attn_fc is also a fully connected layer used to calculate the attention score. It maps the concatenated dimension of the two node features (2*out_feats) to a scalar, representing the attention score.

[0134] Furthermore, the HeteroGraphModel class is defined, which inherits from the nn.Module class and defines the initialization __init__ function. The initialization function completes the assignment of each member variable. The function parameter list includes the input feature dimension in_feats, the hidden layer feature dimension hidden_feats, the output feature dimension out_feats, the number of heads in the multi-head attention mechanism num_heads, and the set of different types of edges in the heterogeneous graph etypes. In the __init__ method, super(HeteroGraphModel, self).__init__() is called to initialize the parent class. During the initialization process, self.conv is used to define the heterogeneous graph convolution layer, and HGNConv is used as the convolution operation for each edge type. HGNConv maps the input feature dimension in_feats to the hidden layer feature dimension hidden_feats, and uses num_heads for multi-head attention calculation. Use self.bn to define the batch normalization layer BatchNormalization Layer, which acts on the hidden features after the multi-head attention splicing, and the input dimension is hidden_feats*num_heads. Stack multiple self.conv and self.bn and use residual connections to prevent gradient explosion during training.

[0135] Furthermore, the forward propagation process forward method of the network is defined, that is, the architecture of the heterogeneous graph neural network HeteroGraph. The forward method receives the input feature input as input, passes the input feature input through the heterogeneous graph convolution layer conv, and calculates the new feature h of each node. The ReLU activation function is applied to the features of each node type to introduce nonlinearity. Batch normalization is applied to the features of each node type using the bn layer. The batch normalized feature h is passed through the next heterogeneous graph convolution layer conv to calculate the new feature. The ReLU activation function and batch normalization layer are applied again.

[0136] Step S106: A gang fraud detection method for processing temporally aggregated behaviors, comprising:

[0137] Prepare time series data, including the frequency, time interval, and dwell time of loan application submissions. For example, count the number of loan applications submitted within a certain time window, such as every 10 minutes, calculate the time interval between two consecutive loan application submissions, and the dwell time of each page embedding point.

[0138] Construct a time feature sequence, including the frequency of submitting loan applications, the time interval between two consecutive loan application submissions, and the dwell time of each tracking point on the page. For the frequency of submitting loan applications, it is necessary to define a time window, such as the number of times a user submits a loan application within ten minutes. Use the sliding window technology to update the window at a certain interval and count the number of applications within the window. Arrange these counts in chronological order to form a sequence; for the time interval between two consecutive loan application submissions, calculate the time difference between the two loan submissions, and sort all the time differences in the order of the time series; for the dwell time of each tracking point on the page, extract the trigger time of each tracking point from the user interaction log, and for each tracking point, calculate the time difference from the user entering the tracking point to leaving, and arrange these dwell times in chronological order. Combine the above three time feature sequences into a three-dimensional tensor, designed as a tensor with a shape of (time step, number of features, 1). Among them, the first dimension represents the time step, the second dimension represents different feature types (application frequency, time interval, dwell time), and the third dimension can be used to save specific values.

[0139] Build a time series network TCN model, use TCN to process time feature sequences, and generate embeddings of time series features, including: creating basic TCN blocks, including one-dimensional causal convolution layers, batch normalization layers, and activation function layers; build multiple TCN blocks and connect them using residual connections.

[0140] Specifically, define the TCN class, which inherits from the nn.Module class and defines the initialization __init__ function. The initialization function completes the assignment of each member variable. The function parameter list includes the input feature dimension input_size, the number of output channels of each layer num_channels, the size of the convolution kernel kernel_size, and the dropout used to prevent overfitting. In the __init__ method, super(TCN, self).__init__() is called to initialize the parent class. During the initialization process, self.conv is used to define the number of input channels of the convolution layer as input_size and the number of output channels as num_channels[0]. The convolution kernel size is kernel_size, the expansion coefficient is 1, and the padding size is kernel_size-1. Use self.bn to define the batch normalization layer Batch Normalization Layer, with an input dimension of num_channels[0]. Stack multiple self.conv and self.bn, and use residual connections to prevent gradient explosion during training. The subsequent expansion coefficients of self.conv are 2 and 4, that is, 2 to the power of n.

[0141] Furthermore, the network's forward propagation process forward method is defined, that is, the architecture of the heterogeneous graph neural network TCN. The forward method receives the input feature input as input, passes the input feature input through the conv layer, and calculates the new feature h. The ReLU activation function is applied to the new feature to introduce nonlinearity. Batch normalization is applied to the new feature using the bn layer. The batch normalized feature h is passed through the next conv layer to calculate the new feature. The ReLU activation function and batch normalization layer are applied again.

[0142] like Figure 6 As shown in the figure, the heterogeneous graph neural network model and TCN model are called to process the input features respectively, and then the processed features are spliced, the spliced ​​features are mapped to the output space through the fully connected layer, and the final output result is returned.

[0143] Step S106: define a total loss function, perform back propagation and optimizer parameter update according to the total loss function during model training, including:

[0144] Define the total loss function, the total loss Marked loss and pseudo-label loss The weighted sum of

[0145] λ is the weight coefficient, and the formula is as follows.

[0146]

[0147] Among them, the loss has been marked Using cross entropy loss, the calculation formula is as follows, y true is the true label, and p is the predicted probability value output by the model.

[0148]

[0149] Among them, the loss has been marked Using cross entropy loss, the calculation formula is as follows, y pseudo is the pseudo label, and p is the predicted probability value output by the model.

[0150]

[0151] In terms of training, the open source framework PyTorch is used for neural network training: SGD is used as the optimizer, the learning rate is set to 0.005, and the attention vector q k The dimension of is set to 128, the number of attention heads K is set to 10, and the epoch is set to 150.

[0152] Step S108: Use the trained model to identify the risk of gang fraud, such as Figure 6 As shown, a computer-readable storage medium 302 and a processor 304 are provided. The storage medium is configured to carry and execute a trained model. Specifically, the storage medium includes a memory for storing model code and model training weights 306 and a processor capable of model reasoning. When the processor executes the model code stored in the memory, it can implement the method steps and functions previously described in detail in step 102, step 104, and step 106.

[0153] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A neural network-based anti-gang fraud detection method, characterized in that: The method comprises the following steps: S1. Construct a heterogeneous graph, including multiple types of nodes and edges. Node types include mobile phone numbers, ID numbers, IP addresses, and device information. Edges represent the relationships between entities. S2, generate a pseudo label matrix using label propagation method; S3. Use the heterogeneous graph neural network model to predict the labels of unlabeled nodes and obtain the predicted pseudo-label matrix; S4. Perform weighted averaging on the two pseudo-label matrices to obtain the final pseudo-label matrix.

2. According to the neural network-based anti-gang fraud detection method of claim 1, it is characterized in that: The heterogeneous graph neural network model includes the following steps: A1. Use multi-head attention mechanism to extract feature representations of different relationships between nodes; A2. Calculate the weight coefficient of the meta-path and weight the importance of different paths; A3. Take the weighted sum of the meta-path coefficient and the node-level embedding to calculate the final node embedding.

3. According to the neural network-based anti-gang fraud detection method of claim 1, it is characterized in that: The temporal neural network model comprises the following steps: B1. Prepare time series data, including the frequency, time interval and dwell time of loan application submission; B2, construct time feature sequence; B3. Use the Temporal Convolutional Network (TCN) model to process the time feature sequence and generate the embedding of the time series features.

4. The neural network-based anti-gang fraud detection method according to claim 1, characterized in that: The total loss function is the weighted sum of the labeled loss and the pseudo-label loss, where the labeled loss is calculated using the cross entropy loss. The cross entropy loss calculation formula is: ι binary (p, y) = -(ylog(p) + (1-y)log(1-p)), where y is the true label and p is the predicted probability value output by the model.

5. The neural network-based anti-gang fraud detection method according to claim 1, characterized in that: The label propagation method comprises the following steps: C1. Define the label matrix, initialize the labels of the labeled nodes, and initialize the labels of the unlabeled nodes to zero; C2, construct a similarity matrix and initialize it using the Jaccard coefficient; C3. Calculate the new label vector of the unlabeled node using the weighted sum method. The calculation formula for the new label vector of the unlabeled node is: Among them, N(i) represents the set of neighbor nodes of node i, i represents an unlabeled node, and the label vector of the center is Y i (t+1) , It is the formula of weighted summation method.

6. The neural network-based anti-gang fraud detection method according to claim 1, characterized in that: The training of the heterogeneous graph neural network model includes the following steps: D1. Use some labeled data to train the model; D2. Use cross entropy loss as the loss function; D3. Adjust the optimizer parameters in the model according to the loss value.

7. The neural network-based anti-gang fraud detection method according to claim 1, characterized in that: The construction of the timing network TCN model includes the following steps: E1. Create the basic TCN block, including the one-dimensional causal convolution layer, the batch normalization layer, and the activation function layer; E2. Build multiple TCN blocks and connect them using residual connections; E3. Output the result through the fully connected layer.

8. The neural network-based anti-gang fraud detection method according to claim 1, characterized in that: In step A1, the calculation formula of the multi-head attention mechanism is: Among them, || represents the feature vector of splicing node i and splicing node j, is the attention vector, represents the scaling factor, σ represents the activation function, Represents the attention of neighbor node j in transmitting messages to primary node i under the original path φ.

9. The neural network-based anti-gang fraud detection method according to claim 1, characterized in that: In step A2, the calculation formula of the meta-path weight coefficient is: Where σ is the activation function, W p , b p is a learnable parameter, h i is the feature vector of the node.

10. The neural network-based anti-gang fraud detection method according to claim 1, characterized in that: In step C2, the Jaccard coefficient calculation formula is: Among them, A and B are the neighbor sets of two nodes.

Images