Community discovery gang fraud prediction method and system based on relational data

Abstract

The invention provides a community discovery gang fraud prediction method and system based on relational data, and relates to the technical field of artificial intelligence, and the method comprises the steps: carrying out the preprocessing of obtained original relational data, and constructing a key relational data set; mapping the key relation data set to a low-dimensional vector space by adopting a graph embedding algorithm to obtain an embedded relation data set; fusing the node attribute features embedded in the relational data set, and identifying a plurality of potential fraud gangs; performing similarity calculation on each potential fraud gang and a pre-constructed fraud gang model to obtain a suspected fraud gang; and according to the behavior characteristics of the suspected fraudulent gang, obtaining the anomaly degree of the suspected fraudulent gang behavior, and if the anomaly degree of the suspected fraudulent gang behavior exceeds a preset anomaly degree threshold, determining that the suspected fraudulent gang is a fraudulent gang. According to the method, through multi-dimensional feature analysis and multi-model fusion, a complex fraud gang is effectively identified, and the accuracy and efficiency of fraud risk prevention and control are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a community discovery and gang fraud prediction method and system based on relational data. Background Art

[0002] In some business scenarios, fraudulent behaviors in complex relationship networks have obvious clustering patterns. That is, a certain group structure is formed between nodes, and then the group structure with obvious clustering patterns forms a community structure. In massive data, there are multiple different community structures, among which low-risk community structures have a lower risk of group fraud, while high-risk community structures have a higher risk of group fraud.

[0003] When using graph mining to identify high-risk fraud gangs, all users in the database are mined and divided into communities through various relationship media to identify fraud gangs with higher fraud risks. However, due to the uneven quality of each sample in the database, which contains a lot of redundant information, and the traditional community discovery algorithm only considers the connection relationship between each node, the prediction of fraud gangs is inaccurate and inefficient. Summary of the invention

[0004] In order to overcome the above-mentioned deficiencies of the prior art, the present invention provides a community discovery group fraud prediction method based on relationship data, comprising: Preprocess the acquired raw relational data and construct a key relational data set; Mapping the key relationship data set to a low-dimensional vector space using a graph embedding algorithm to obtain an embedded relationship data set; By integrating the node attribute features in the embedded relational dataset and using the community discovery algorithm, multiple potential fraud gangs can be identified; Calculate the similarity between each potential fraud group and the pre-built fraud group model, and determine the potential fraud group whose similarity exceeds the preset similarity threshold as a suspected fraud group; Based on the behavioral characteristics of the suspected fraud gang, a gang behavior portrait is constructed, and an anomaly detection algorithm is used to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portrait. If the abnormality of the suspected fraud gang's behavior exceeds the preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang.

[0005] Optionally, preprocess the acquired raw relationship data to construct a key relationship data set, including: Clean and standardize the original relational data, remove missing values, outliers and duplicate data, and obtain standardized original relational data; Use feature selection algorithms to determine the key feature indicators of a specified business and filter out feature subsets related to fraudulent behavior from standardized raw relational data; The key relationship data set is constructed through correlation analysis and redundancy calculation of feature subsets.

[0006] Optionally, a graph embedding algorithm is used to map the key relationship dataset into a low-dimensional vector space to obtain an embedded relationship dataset, including: A graph embedding algorithm is used to map the key relationship data set into a low-dimensional vector space, and the global topological structure information of the key relationship data set is obtained through a random walk strategy. The embedded relation dataset is obtained based on the global topological structure information.

[0007] Optionally, after using a graph embedding algorithm to map the key relationship data set to a low-dimensional vector space to obtain an embedded relationship data set, the method further includes: Performing a relational network analysis on the embedded relational data set to obtain a relational network of the embedded relational data set; Using data augmentation techniques, virtual nodes or edges are added to the relational network to obtain an updated embedded relational dataset.

[0008] Optionally, the node attribute features in the embedded relational dataset are integrated and a community discovery algorithm is used to identify multiple potential fraud gangs, including: An attribute-aware community discovery algorithm is used to identify multiple potential fraud gangs based on the attribute similarity and connection relationships of node attribute features in embedded relational datasets.

[0009] Optionally, the node attribute features in the embedded relationship dataset are integrated and a community discovery algorithm is used to identify potential fraud gangs, including: A community discovery algorithm based on graph neural networks is used to identify multiple potential fraud gangs based on the node attribute characteristics in the embedded relationship data set and the node neighborhood information results obtained by graph convolution operations.

[0010] Optionally, a similarity calculation is performed between each potential fraud group and a pre-built fraud group model, and a potential fraud group whose similarity exceeds a preset similarity threshold is determined as a suspected fraud group, including: Based on the behavior characteristics and network structure characteristics of each potential fraud gang, a feature vector of each potential fraud gang is obtained; Extract typical fraud behavior features and typical network structure features from the pre-built fraud gang model to obtain the feature vector of the fraud gang; Using a similarity calculation method, the similarity between the feature vector of the potential fraud gang and the feature vector of the fraud gang is calculated; Potential fraud groups whose similarity between feature vectors exceeds a preset similarity threshold are determined as suspected fraud groups.

[0011] Optionally, after determining that the suspected fraud gang is a fraud gang, the method further includes: For identified fraud gangs, an ensemble learning method is used to fuse the prediction results of multiple heterogeneous models based on graph structure, behavioral characteristics, and time series data; Determine the weight of each heterogeneous model based on the historical data of multiple heterogeneous models; By adding up the weights, the final fraud gang determination result is obtained.

[0012] Optionally, after obtaining the final fraud gang determination result, the method further includes: For identified fraud gangs, an incremental learning strategy is adopted. Combined with the final fraud gang determination results, newly discovered fraud samples are dynamically added to the training set regularly to update the pre-built fraud gang model.

[0013] Based on the same inventive concept, the present invention also provides a community discovery group fraud prediction system based on relationship data, the system comprising: A key relationship data set construction module is used to pre-process the acquired original relationship data and construct a key relationship data set; An embedded relationship data set acquisition module is used to map the key relationship data set into a low-dimensional vector space using a graph embedding algorithm to obtain an embedded relationship data set; Potential fraud gang identification module, which is used to integrate the node attribute features in the embedded relationship data set and use the community discovery algorithm to identify multiple potential fraud gangs; A suspected fraud gang determination module is used to calculate the similarity between each potential fraud gang and a pre-built fraud gang model, and determine the potential fraud gang whose similarity exceeds a preset similarity threshold as a suspected fraud gang; The fraud gang identification module is used to construct a gang behavior portrait based on the behavioral characteristics of the suspected fraud gang, and use an anomaly detection algorithm to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portrait. If the abnormality of the suspected fraud gang's behavior exceeds a preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang.

[0014] Optional, key relationship dataset building module, specifically used for: Clean and standardize the original relational data, remove missing values, outliers and duplicate data, and obtain standardized original relational data; Use feature selection algorithms to determine the key feature indicators of a specified business and filter out feature subsets related to fraudulent behavior from standardized raw relational data; The key relationship data set is constructed through correlation analysis and redundancy calculation of feature subsets.

[0015] Optionally, embed a relational dataset acquisition module, specifically used for: A graph embedding algorithm is used to map the key relationship data set into a low-dimensional vector space, and the global topological structure information of the key relationship data set is obtained through a random walk strategy. The embedded relation dataset is obtained based on the global topological structure information.

[0016] Optionally, the system further includes an embedded relationship data set updating module, which is specifically used to: Performing a relational network analysis on the embedded relational data set to obtain a relational network of the embedded relational data set; Using data augmentation techniques, virtual nodes or edges are added to the relational network to obtain an updated embedded relational dataset.

[0017] Optionally, the potential fraud group identification module is specifically used for: An attribute-aware community discovery algorithm is used to identify multiple potential fraud gangs based on the attribute similarity and connection relationships of node attribute features in embedded relational datasets.

[0018] Optionally, the potential fraud group identification module is specifically used for: A community discovery algorithm based on graph neural networks is used to identify multiple potential fraud gangs based on the node attribute characteristics in the embedded relationship data set and the node neighborhood information results obtained by graph convolution operations.

[0019] Optionally, the suspected fraud gang identification module is specifically used for: Based on the behavior characteristics and network structure characteristics of each potential fraud gang, a feature vector of each potential fraud gang is obtained; Extract typical fraud behavior features and typical network structure features from the pre-built fraud gang model to obtain the feature vector of the fraud gang; Using a similarity calculation method, the similarity between the feature vector of the potential fraud gang and the feature vector of the fraud gang is calculated; Potential fraud groups whose similarity between feature vectors exceeds a preset similarity threshold are determined as suspected fraud groups.

[0020] Optionally, the system further includes a determination result obtaining module, which is specifically used to: For identified fraud gangs, an ensemble learning method is used to fuse the prediction results of multiple heterogeneous models based on graph structure, behavioral characteristics, and time series data; Determine the weight of each heterogeneous model based on the historical data of multiple heterogeneous models; By adding up the weights, the final fraud gang determination result is obtained.

[0021] Optionally, the system further includes a fraud gang model update module, which is specifically used to: For identified fraud gangs, an incremental learning strategy is adopted. Combined with the final fraud gang determination results, newly discovered fraud samples are dynamically added to the training set regularly to update the pre-built fraud gang model.

[0022] Based on the same inventive concept, the present invention also provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the above-mentioned community discovery and gang fraud prediction method based on relational data is implemented.

[0023] Based on the same inventive concept, the present invention also provides a readable storage medium on which an execution program is stored. When the execution program is executed, a community discovery and gang fraud prediction method based on relational data as described above is implemented.

[0024] Compared with the closest prior art, the present invention has the following beneficial effects: The present invention provides a community discovery group fraud prediction method based on relational data, comprising: preprocessing the acquired original relational data to construct a key relational data set; using a graph embedding algorithm to map the key relational data set to a low-dimensional vector space to obtain an embedded relational data set; fusing the node attribute features in the embedded relational data set, using a community discovery algorithm to identify multiple potential fraud gangs; calculating the similarity between each potential fraud gang and a pre-constructed fraud gang model, and determining the potential fraud gang whose similarity exceeds a preset similarity threshold as a suspected fraud gang; constructing a gang behavior portrait according to the behavior characteristics of the suspected fraud gang, and using an anomaly detection algorithm to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portrait, and if the abnormality of the suspected fraud gang's behavior exceeds the preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang. The present invention provides optimization processing for original relationship data, and combines the attribute characteristics between nodes in the relationship data to obtain potential fraud gangs, and then determines the fraud gangs through similarity calculation and behavior feature extraction with a pre-built fraud gang model. Through multi-dimensional feature analysis and multi-model fusion, it can effectively identify complex fraud gang behaviors and significantly improve the accuracy and efficiency of fraud risk prevention and control. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 The present invention provides a flow chart of a community discovery and gang fraud prediction method based on relational data; Figure 2 A structural diagram of a community discovery and gang fraud prediction system based on relational data provided by the present invention; Figure 3 A schematic diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0026] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0027] Embodiment 1: The present invention provides a community discovery group fraud prediction method based on relationship data, specifically, Figure 1 A flow chart of a community discovery and gang fraud prediction method based on relational data provided by an embodiment of the present invention includes the following steps as shown in the figure: S1: Preprocess the acquired raw relationship data and construct a key relationship data set; S2: Mapping the key relationship dataset to a low-dimensional vector space using a graph embedding algorithm to obtain an embedded relationship dataset; S3: Integrate node attribute features in embedded relational datasets and use community discovery algorithms to identify multiple potential fraud gangs; S4: Calculate the similarity between each potential fraud group and the pre-built fraud group model, and determine the potential fraud group whose similarity exceeds the preset similarity threshold as a suspected fraud group; S5: Based on the behavioral characteristics of the suspected fraud gang, a gang behavior portrait is constructed, and an anomaly detection algorithm is used to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portrait. If the abnormality of the suspected fraud gang's behavior exceeds the preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang.

[0028] The present invention provides optimization processing for original relationship data, and combines the attribute characteristics between nodes in the relationship data to obtain potential fraud gangs, and then determines the fraud gangs through similarity calculation and behavior feature extraction with a pre-built fraud gang model. Through multi-dimensional feature analysis and multi-model fusion, it can effectively identify complex fraud gang behaviors and significantly improve the accuracy and efficiency of fraud risk prevention and control.

[0029] In the present invention, the original relationship data contains a lot of noise and invalid information, and these redundant information will interfere with the effect of the subsequent community discovery algorithm, resulting in distortion of the identified community structure. In order to solve this problem, in this embodiment, the obtained original relationship data is first preprocessed to construct a key relationship data set.

[0030] The process of constructing a key relationship data set includes: cleaning and standardizing the original relationship data, removing missing values, outliers and duplicate data from the original relationship data, and obtaining standardized original relationship data; using a feature selection algorithm to determine the key feature indicators of a specified business, and filtering out feature subsets related to fraudulent behavior from the standardized original relationship data; and constructing a key relationship data set through correlation analysis and redundancy calculation of the feature subsets.

[0031] That is, use data preprocessing technology to clean and standardize the original relational data, remove missing values, outliers and duplicate data, obtain standardized original relational data, and improve data quality; determine key feature indicators based on business needs and expert knowledge, and use feature selection algorithms such as filtering, wrapping or embedding to automatically screen out feature subsets with a high correlation with fraudulent behavior; remove noise and redundant information in feature subsets through correlation analysis and redundancy calculation, reduce data dimensions, and reduce computing overhead; In a specific implementation, after obtaining the original relational data, data preprocessing technology is used to clean and standardize the data. Outliers are identified through anomaly detection algorithms such as LOF (Local Outlier Factor), and fields with missing value ratios exceeding a preset ratio are directly removed. The remaining missing values ​​are filled with the highest frequency value or average value, and the hash algorithm is used to remove duplicates to improve data quality; according to business needs and expert knowledge, key feature indicators are determined, and feature selection algorithms such as mRMR (Max-Relevance and Min-Redundancy) are used to automatically screen out feature subsets with high correlation with fraudulent behavior, and the correlation between features is calculated through PPMCC (Pearson Product-Moment Correlation Coefficient), and features with redundancy exceeding the preset value are removed to reduce data dimensions.

[0032] After constructing the key relationship data set, a graph embedding algorithm is used to map the key relationship data set to a low-dimensional vector space to obtain an embedded relationship data set, including: using a graph embedding algorithm to map the key relationship data set to a low-dimensional vector space, and obtaining global topological structure information of the key relationship data set through a random walk strategy; and obtaining an embedded relationship data set based on the global topological structure information.

[0033] Specifically, according to the characteristics of the key relationship data set, select a suitable graph embedding algorithm, such as DeepWalk, Node2Vec or LINE (Large-scale Information Network Embedding), etc., to map the nodes to a low-dimensional vector space; in the graph embedding process, a random walk strategy is used to capture the high-order similarities between nodes and retain the global topological structure information of the network; at the same time, by optimizing the objective function, such as maximizing the node co-occurrence probability or minimizing the reconstruction error, the graph embedding model is trained to obtain a low-dimensional vector representation of the node; the embedded node vector is post-processed, such as L2 norm (Euclidean Norm) normalization or mean centering (Mean Centering) to improve the numerical stability and interpretability of the vector; evaluate the embedding quality and use downstream tasks such as link prediction or node classification to verify the degree to which the embedding vector retains the network structure and node attributes; if the embedding quality does not meet expectations, adjust the hyperparameters of the graph embedding algorithm, such as vector dimension, walk length or learning rate, and retrain the embedding model; use the optimized node embedding vector as the input feature for the next step of community detection and fraud judgment, and integrate it into the subsequent analysis algorithm to enhance the accuracy of fraud gang identification.

[0034] After obtaining the embedded relational dataset, some optional implementations further include: performing a relational network analysis on the embedded relational dataset to obtain a relational network of the embedded relational dataset; using data enhancement technology to add virtual nodes or edges to the relational network to enhance the connectivity of the graph and obtain an updated embedded relational dataset.

[0035] After obtaining the embedded relationship data set, the node attribute features in the embedded relationship data set are integrated, and the community discovery algorithm is used to identify multiple potential fraud gangs.

[0036] In this embodiment, an attribute-aware community discovery algorithm can be used to identify multiple potential fraud gangs based on the attribute similarity and connection relationship of the node attribute features in the embedded relationship data set; a community discovery algorithm based on a graph neural network can also be used to identify multiple potential fraud gangs based on the node attribute features in the embedded relationship data set combined with the node neighborhood information results obtained by graph convolution operation aggregation.

[0037] In some specific implementations, the node attribute features in the embedded relationship data set are integrated, and according to the data scale and computing resources, the attribute-aware Louvain (community discovery) algorithm is used to identify the community structure in the network while retaining the node attribute features by optimizing the modularity objective function. If the data scale is large and the computing resources are sufficient, a graph neural network algorithm based on deep learning can also be used to learn node representations through the node attribute features and network structure, and use a clustering algorithm to identify communities in the embedded relationship data set.

[0038] After identifying multiple potential fraud gangs, the similarity between each potential fraud gang and the pre-built fraud gang model is further calculated, and the potential fraud gang whose similarity exceeds the preset similarity threshold is determined as a suspected fraud gang.

[0039] Specifically, based on the behavioral characteristics and network structure characteristics of each potential fraud gang, a feature vector of each potential fraud gang is obtained; typical fraud behavior characteristics and typical network structure characteristics are extracted from a pre-built fraud gang model to obtain a feature vector of the fraud gang; a similarity calculation method is used to calculate the similarity between the feature vector of the potential fraud gang and the feature vector of the fraud gang; a potential fraud gang whose similarity between feature vectors exceeds a preset similarity threshold is determined to be a suspected fraud gang.

[0040] According to the pre-constructed fraud gang model, typical fraud behavior characteristics and network structure characteristics are extracted to construct the feature vector of the fraud gang; the similarity between the feature vector of the potential fraud gang and the feature vector of the fraud gang is calculated using a similarity calculation method, such as pre-similarity or Euclidean distance; a similarity threshold is set, and if the calculated similarity exceeds the preset threshold, the potential fraud gang is determined to be a suspected fraud gang.

[0041] Identify suspected fraud gangs, further construct gang behavior portraits based on the behavioral characteristics of the suspected fraud gangs, and use anomaly detection algorithms to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portraits. If the abnormality of the suspected fraud gang's behavior exceeds the preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang.

[0042] Specifically, the key behavioral characteristics and influencing factors of the fraud gang are extracted, and a gang behavior portrait is constructed to characterize the typical characteristics and evolution laws of the fraud model. Then, an anomaly detection algorithm is used to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portrait. If the abnormality of the suspected fraud gang's behavior exceeds the preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang.

[0043] After obtaining the fraud gang, some optional implementations also include: for the identified fraud gang, using an integrated learning method to fuse the prediction results of multiple heterogeneous models based on graph structure, behavioral characteristics and time series data; determining the weight of each heterogeneous model based on the historical data of multiple heterogeneous models; and obtaining the final fraud gang determination result by adding up the weights.

[0044] Specifically, the prediction results of multiple heterogeneous models can be integrated, including models based on graph structures, models based on behavioral characteristics, and models based on time series data. The weights of different heterogeneous models are determined according to their performance on historical data, and the final fraud gang determination result is obtained by adding up the different weights.

[0045] After obtaining the final fraud gang determination result, some optional implementations also include: for the identified fraud gang, using an incremental learning strategy, combining the final fraud gang determination result, regularly adding newly discovered fraud samples to the training set dynamically, and updating the pre-built fraud gang model.

[0046] That is, for identified fraud gangs, an incremental learning strategy is adopted to dynamically add newly discovered fraud samples to the training set on a regular basis, update model parameters, continuously optimize the prediction model, and improve the ability to identify new types of fraudulent behaviors.

[0047] In some optional implementations, an incremental learning strategy is adopted to train on the basis of the original model and update the model parameters; in the incremental learning process, optimization algorithms such as gradient descent are used to minimize the prediction error of the model on new samples, and regularization technology is used to avoid overfitting; the incremental learning process is continuously iterated to continuously optimize the prediction model so that it can adapt to changing fraud patterns and improve the ability to identify new types of fraudulent behaviors; the optimized prediction model is applied to the actual business system to make real-time predictions on new transaction data. If it is determined to be a fraud gang, an early warning mechanism is triggered and handled in combination with business rules.

[0048] The following is a specific example to illustrate the community discovery and gang fraud prediction method based on relational data provided by the present invention.

[0049] S101: Obtain relationship network data, such as collecting transaction data from the past year, assuming that it contains 1 million transaction records involving 500,000 accounts. First, perform data cleaning to remove incomplete or erroneous records, such as records with negative transaction amounts or invalid transaction timestamps, which account for about 2% of the total data. Then perform feature selection. By calculating the information gain of the features, select features with information gain greater than 1 as key features, such as transaction amount, transaction frequency, transaction object, etc. Finally, retain 80% of the valid data and build a high-quality key relationship data set.

[0050] S102: Based on the cleaned key relationship data set, the graph embedding algorithm Node2Vec is used to map it to a low-dimensional vector space. The embedding dimension is set to 128 dimensions, and a 128-dimensional vector representation is generated for each account node. In the process of generating vectors, the walk_length (step length) of the Node2Vec algorithm can be set to 80, and the window_size (window size) can be set to 10, where walk_length and window_size represent the maximum number of steps for each random walk on the graph. The node sequence is sampled by random walk, and the vector representation of the node is obtained by training the Skip-Gram model. These vectors can capture the structural information of the network, such as the connection pattern and community structure between nodes.

[0051] S103: Fusion node attribute features, such as account registration time, authentication level, etc., use attribute-aware Louvain algorithm for community discovery, set the minimum community size to 5 people, iteratively optimize community division until modularity no longer increases, set the maximum number of iterations to 100, and preliminarily identify potential fraud gangs.

[0052] S104: Assuming that 1,000 potential fraud gangs are discovered, in order to further confirm whether these gangs are fraud gangs, some fraud gang patterns can be pre-defined, such as frequent small transactions, a high proportion of transactions between gang members, etc., and the similarity between each potential gang and these patterns is calculated. The similarity threshold is set to 8, and gangs with a similarity exceeding 8 are judged as suspected fraud gangs and included in the key monitoring scope.

[0053] S105: Assume that there are 200 suspected fraud gangs, then extract the behavioral characteristics of these gangs, such as the total transaction amount, transaction frequency, transaction time distribution, etc. within the gang, and build a behavioral portrait of the gang; for these 200 suspected fraud gangs, use the density-based anomaly detection algorithm LOF (Local Outlier Factor) to determine whether their behavior conforms to the fraud pattern, calculate the LOF value of each gang, and set the anomaly threshold to 5 based on historical data analysis. If the LOF value is greater than 5, the behavior of the suspected fraud gang is considered abnormal and it is determined to be a fraud gang, triggering the early warning mechanism. Assume that 50 gangs are finally determined to be fraud gangs.

[0054] S106: For the 50 identified fraud gangs, the transaction data of the past 6 months are collected, and the time series analysis algorithm ARIMA (Autoregressive Integrated Moving Average Model) model is used to model the transaction amount and transaction frequency of each gang. For example, the daily transaction amount series of a gang is analyzed and it is found that it conforms to the ARIMA (2,1,1) model, that is, the autoregressive order is 2, the difference order is 1, and the moving average order is 1. The ARIMA model is used to predict the transaction behavior of the gang in the future and compare it with the actual observation value. If the prediction error exceeds the preset threshold, such as 20%, it is considered that the time series behavior pattern of the gang is abnormal, thereby further confirming its fraudulent nature and obtaining the fraud gang judgment result based on time series data. In the actual prediction process, the weighted average method in the ensemble learning method is used to integrate the prediction results of the three models based on graph structure, behavior characteristics and time series data. According to the accuracy of the model on the historical data of the past month, the three models are given weights of 4, 3 and 3 respectively, and then the prediction results of the three models are weighted averaged to obtain the final fraud gang judgment result. The 50 gangs finally judged as fraud gangs are analyzed for interpretability. By calculating the contribution of each feature to the model prediction results, for example, using SHAP (Shapley Additive exPlanations, model interpretability) value to sort the feature importance, determine the key features such as transaction frequency and proportion of transactions within the gang, and trace the decision path of the model, it is found that some gangs are judged as fraud gangs due to frequent small transactions and a high proportion of transactions within the gang. Further analysis of the membership relationship of these gangs determines that the members with the most transactions and the largest transaction amount are key members, and analyze their transaction behaviors. It is found that they frequently transfer money to certain specific accounts. These specific accounts may be the collection accounts of the fraud gangs, thereby determining the key members and key behaviors.

[0055] S107, for the 50 identified fraud gangs, adopts an incremental learning strategy, adds newly discovered fraud samples to the training set every week, for example, 10 new fraud samples are added every week, and the parameters of the model are updated using the new training set. For example, the stochastic gradient descent algorithm is used for parameter optimization, the learning rate is set to 0.1, and the number of iterations is set to 50 times. The prediction model is continuously optimized to improve the accuracy and real-time performance of fraud gang identification.

[0056] Embodiment 2: Based on the same inventive concept, the present invention also provides a community discovery group fraud prediction system 200 based on relationship data, the system structure is as follows: Figure 2 As shown, the system 200 includes: The key relationship data set construction module 201 is used to pre-process the acquired original relationship data to construct the key relationship data set; An embedded relationship data set acquisition module 202 is used to map the key relationship data set to a low-dimensional vector space using a graph embedding algorithm to obtain an embedded relationship data set; Potential fraud group identification module 203, used to integrate node attribute features in the embedded relationship data set and adopt community discovery algorithm to identify multiple potential fraud groups; The suspected fraud group determination module 204 is used to calculate the similarity between each potential fraud group and a pre-built fraud group model, and determine the potential fraud group whose similarity exceeds a preset similarity threshold as a suspected fraud group; The fraud gang determination module 205 is used to construct a gang behavior portrait based on the behavior characteristics of the suspected fraud gang, and use an anomaly detection algorithm to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portrait. If the abnormality of the suspected fraud gang's behavior exceeds a preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang.

[0057] Optional, key relationship dataset building module, specifically used for: Clean and standardize the original relational data, remove missing values, outliers and duplicate data, and obtain standardized original relational data; Use feature selection algorithms to determine the key feature indicators of a specified business and filter out feature subsets related to fraudulent behavior from standardized raw relational data; The key relationship data set is constructed through correlation analysis and redundancy calculation of feature subsets.

[0058] Optionally, embed a relational dataset acquisition module, specifically used for: A graph embedding algorithm is used to map the key relationship data set into a low-dimensional vector space, and the global topological structure information of the key relationship data set is obtained through a random walk strategy. The embedded relation dataset is obtained based on the global topological structure information.

[0059] Optionally, the system further includes an embedded relationship data set updating module, which is specifically used to: Performing a relational network analysis on the embedded relational data set to obtain a relational network of the embedded relational data set; Using data augmentation techniques, virtual nodes or edges are added to the relational network to obtain an updated embedded relational dataset.

[0060] Optionally, the potential fraud group identification module is specifically used for: An attribute-aware community discovery algorithm is used to identify multiple potential fraud gangs based on the attribute similarity and connection relationships of node attribute features in embedded relational datasets.

[0061] Optionally, the potential fraud group identification module is specifically used for: A community discovery algorithm based on graph neural networks is used to identify multiple potential fraud gangs based on the node attribute characteristics in the embedded relational dataset and the node neighborhood information results obtained by graph convolution operations.

[0062] Optionally, the suspected fraud gang identification module is specifically used for: Based on the behavior characteristics and network structure characteristics of each potential fraud gang, a feature vector of each potential fraud gang is obtained; Extract typical fraud behavior features and typical network structure features from the pre-built fraud gang model to obtain the feature vector of the fraud gang; Using a similarity calculation method, the similarity between the feature vector of the potential fraud gang and the feature vector of the fraud gang is calculated; Potential fraud groups whose similarity between feature vectors exceeds a preset similarity threshold are determined as suspected fraud groups.

[0063] Optionally, the system further includes a determination result obtaining module, which is specifically used to: For identified fraud gangs, an ensemble learning method is used to fuse the prediction results of multiple heterogeneous models based on graph structure, behavioral characteristics, and time series data; Determine the weight of each heterogeneous model based on the historical data of multiple heterogeneous models; By adding up the weights, the final fraud gang determination result is obtained.

[0064] Optionally, the system further includes a fraud gang model update module, which is specifically used to: For identified fraud gangs, an incremental learning strategy is adopted. Combined with the final fraud gang determination results, newly discovered fraud samples are dynamically added to the training set regularly to update the pre-built fraud gang model.

[0065] Embodiment 3: Based on the same inventive concept, Figure 3 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0066] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a readable storage medium to implement the corresponding method flow or corresponding functions, so as to realize the steps of a community discovery gang fraud prediction method based on relational data in the above-mentioned embodiment.

[0067] Embodiment 4: Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the readable storage medium here can include both built-in storage media in electronic devices and, of course, extended storage media supported by electronic devices. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk memory. The processor can load and execute one or more instructions stored in the storage medium to implement the steps of a community discovery gang fraud prediction method based on relational data in the above embodiment.

[0068] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0069] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0070] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0071] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims to be approved.

Claims

1. A community discovery and gang fraud prediction method based on relational data, characterized in that: include: Preprocess the acquired raw relational data and construct a key relational data set; Mapping the key relationship data set to a low-dimensional vector space using a graph embedding algorithm to obtain an embedded relationship data set; Integrate the node attribute features in the embedded relationship data set, adopt a community discovery algorithm, and identify multiple potential fraud gangs; Calculate the similarity between each potential fraud group and a pre-built fraud group model, and determine the potential fraud group whose similarity exceeds a preset similarity threshold as a suspected fraud group; According to the behavioral characteristics of the suspected fraud gang, a gang behavior portrait is constructed, and an anomaly detection algorithm is used to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portrait. If the abnormality of the suspected fraud gang's behavior exceeds a preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang.

2. The method according to claim 1, characterized in that The step of preprocessing the acquired original relationship data to construct a key relationship data set includes: Cleaning and standardizing the original relational data to remove missing values, outliers and duplicate data from the original relational data to obtain standardized original relational data; Using a feature selection algorithm to determine key feature indicators of a specified business, and screening out a feature subset related to fraudulent behavior from the standardized original relationship data; The key relationship data set is constructed by performing correlation analysis and redundancy calculation on the feature subset.

3. The method according to claim 1, characterized in that The step of using a graph embedding algorithm to map the key relationship data set to a low-dimensional vector space to obtain an embedded relationship data set includes: A graph embedding algorithm is used to map the key relationship data set into a low-dimensional vector space, and a random walk strategy is used to obtain global topological structure information of the key relationship data set; An embedded relationship data set is obtained based on the global topological structure information.

4. The method according to claim 1, characterized in that After the graph embedding algorithm is used to map the key relationship data set to a low-dimensional vector space to obtain an embedded relationship data set, the method further includes: Performing a relational network analysis on the embedded relational data set to obtain a relational network of the embedded relational data set; Using data enhancement technology, virtual nodes or edges are added to the relationship network to obtain an updated embedded relationship data set.

5. The method according to claim 1, characterized in that The calculating the similarity between each potential fraud group and the pre-built fraud group model, and determining the potential fraud group whose similarity exceeds a preset similarity threshold as a suspected fraud group, includes: Based on the behavioral characteristics and network structure characteristics of each potential fraud gang, a feature vector of each potential fraud gang is obtained; Extract typical fraud behavior features and typical network structure features from the pre-built fraud gang model to obtain the feature vector of the fraud gang; Using a similarity calculation method, calculate the similarity between the feature vector of the potential fraud gang and the feature vector of the fraud gang; Potential fraud groups whose similarity between feature vectors exceeds a preset similarity threshold are determined as suspected fraud groups.

6. The method according to any one of claims 1 to 5, characterized in that: After determining that the suspected fraud gang is a fraud gang, the method further includes: For identified fraud gangs, an ensemble learning method is used to fuse the prediction results of multiple heterogeneous models based on graph structure, behavioral characteristics, and time series data; Determining a weight of each heterogeneous model based on the historical data of the plurality of heterogeneous models; By adding up the weights, the final fraud gang determination result is obtained.

7. The method according to claim 6, characterized in that After obtaining the final fraud gang determination result, the method further includes: For the identified fraud gangs, an incremental learning strategy is adopted. Combined with the final fraud gang determination results, newly discovered fraud samples are dynamically added to the training set regularly to update the pre-built fraud gang model.

8. A community discovery gang fraud prediction system based on relational data, characterized in that: include: A key relationship data set construction module is used to pre-process the acquired original relationship data and construct a key relationship data set; An embedded relationship data set acquisition module is used to map the key relationship data set into a low-dimensional vector space using a graph embedding algorithm to obtain an embedded relationship data set; A potential fraud group identification module is used to integrate the node attribute features in the embedded relationship data set and use a community discovery algorithm to identify multiple potential fraud groups; A suspected fraud gang determination module is used to calculate the similarity between each potential fraud gang and a pre-built fraud gang model, and determine the potential fraud gang whose similarity exceeds a preset similarity threshold as a suspected fraud gang; The fraud gang identification module is used to construct a gang behavior portrait according to the behavioral characteristics of the suspected fraud gang, and adopt an anomaly detection algorithm to obtain the abnormality of the suspected fraud gang's behavior based on the gang behavior portrait. If the abnormality of the suspected fraud gang's behavior exceeds a preset abnormality threshold, the suspected fraud gang is determined to be a fraud gang.

9. An electronic device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the community discovery and gang fraud prediction method based on relational data as described in any one of claims 1 to 7 is implemented.

10. A readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, the community discovery gang fraud prediction method based on relational data as described in any one of claims 1 to 7 is implemented.

Images