Device and method for detecting abnormity in interaction data of two parties

Abstract

Aspects relate to a method for detecting anomalies in interaction data of both parties, the method comprising: representing interactions between parties in a first group and parties in a second group as a graph, each interaction between a first party in the first group and a second party in the second group is represented by an edge between a respective first node representing the first party and a respective second node representing the second party, and wherein information about the first party is assigned to the first node as node attribute information, distributing information about a second party to a second node as node attribute information, distributing information about interaction to an edge as edge attribute information, and processing the graph through a graph convolutional neural network with an automatic encoder structure; in response to the graph including at least a loss between the edge attribute information and edge attribute information reconstructed by a decoder of the graph convolutional neural network, deriving an exception score for interaction of each party in the first group and each party in the second group from a reconstruction loss between the graph and an output of the graph convolutional neural network; and detecting an anomaly based on the anomaly score.

Description

Technical Field

[0001] Aspects of the present disclosure relate to apparatus and methods for detecting anomalies in two-party interaction data. Background Art

[0002] Identifying behaviors that differ significantly from the majority has become an important area in various applications across multiple industries. The occurrence of these (usually rare) abnormal behaviors can have serious implications in many fields. For example, in a manufacturing environment, the occurrence of abnormal events can indicate errors in the workflow (e.g., in the interaction of robotic devices). In cybersecurity systems, abnormal events may mean security vulnerabilities or network intrusions, and in e-commerce businesses, their occurrence may suggest e-commerce fraud, such as price / promotion abuse, review / rating games, or fraud collusion.

[0003] For this reason, effective methods for anomaly detection for many fields as mentioned above and others, such as manufacturing, healthcare, insurance, medical, and many others, are desirable. Summary of the invention

[0004] Embodiments relate to a method for detecting anomalies in bilateral interaction data, the method comprising: representing the interactions between parties in a first group and parties in a second group as a graph, wherein each interaction between a first party in the first group and a second party in the second group is represented by an edge between a corresponding first node representing the first party and a corresponding second node representing the second party, and wherein information about the first party is assigned to the first node as node attribute information, information about the second party is assigned to the second node as node attribute information, and information about the interaction is assigned to the edge as edge attribute information. The method further comprises: processing the graph by a graph convolutional neural network having an autoencoder structure, deriving an anomaly score for the interaction,

[0005] In response to the graph comprising at least a loss between edge attribute information and edge attribute information reconstructed by a decoder of the graph convolutional neural network, parties in the first group and parties in the second group are derived from a reconstruction loss between the graph and an output of the graph convolutional neural network. Anomalies are detected based on anomaly scores.

[0006] According to one embodiment, the reconstruction loss includes a loss between the node attribute information and the node attribute information reconstructed by the decoder.

[0007] According to one embodiment, the reconstruction loss comprises a loss between node adjacency information of the graph and the node adjacency information reconstructed by the decoder.

[0008] According to one embodiment, the method includes comparing the anomaly score to one or more thresholds, and detecting an anomaly in the interaction of a party in the first group or the interaction of a party in the second group if the anomaly score thereof is above the corresponding threshold.

[0009] According to one embodiment, the method includes: for each training data element in a plurality of training data elements, wherein each training data element includes a training graph, in response to the graph at least including a loss between edge attribute information and edge attribute information reconstructed by a decoder of the graph convolutional neural network, determining a reconstruction loss between the training graph and an output of the graph convolutional neural network based on the training graph and the output of the graph convolutional neural network, thereby training the graph convolutional neural network, and adjusting the neural network to reduce an overall loss, the overall loss including the reconstruction loss determined for the training data element.

[0010] According to one embodiment, the method includes: for each training data element, sampling a subgraph of the training graph; for each sampled subgraph, setting a reconstruction target to the sampled subgraph; and expanding the subgraph by including nodes and edges connected to the sampled subgraph and calculating a reconstruction loss between the reconstruction target and an output of the graph convolutional neural network in response to the expanded subgraph, wherein the overall loss includes the reconstruction loss determined for the subgraph.

[0011] According to one embodiment, the parties in the first group are customers and the parties in the second group are service providers.

[0012] According to one embodiment, the interaction is a transaction between parties in the first group and parties in the second group.

[0013] According to one embodiment, the method includes detecting fraud based on the detected anomalies.

[0014] According to one embodiment, the method comprises, for each detected anomaly, checking whether fraud has occurred.

[0015] According to one embodiment, the method further comprises: using the anomaly score as an input to the human-machine loop system and / or the automatic system. If an anomaly exists, corresponding actions may be taken, such as blocking customers involving anomalies from certain characteristics (i.e., interactions whose anomaly scores indicate anomalies).

[0016] According to one embodiment, a server computer is provided. The server computer includes a radio interface, a memory interface, and a processing unit. The processing unit is configured to execute the above-mentioned method for detecting anomalies in bilateral interaction data.

[0017] According to one embodiment, a computer program element is provided. The computer program element includes program instructions. When the program instructions are executed by one or more processors, the one or more processors execute the above-mentioned method for detecting anomalies in bilateral interaction data.

[0018] According to one embodiment, a computer-readable medium is provided, the computer-readable medium comprising program instructions, which, when executed by one or more processors, cause the one or more processors to execute the above-mentioned method for detecting anomalies in bilateral interaction data. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The invention will be better understood with reference to the detailed description when considered in conjunction with the non-limiting examples and accompanying drawings, in which:

[0020] - Figure 1 A communication arrangement comprising a smartphone and a server is shown.

[0021] - Figure 2 A data processing pipeline according to an embodiment is shown, ie, implemented by the server.

[0022] - Figure 3 A graph anomaly detection neural network according to an embodiment is shown.

[0023] - Figure 4A The message passing flow of the customer node is shown.

[0024] - Figure 4B The message passing flow of the service provider node is shown.

[0025] - Figure 4C The message passing flow at the edge is shown.

[0026] - Figure 5 A flow chart illustrating a method for detecting anomalies in two-party interaction data is shown.

[0027] - Figure 6 A server computer according to an embodiment is shown. DETAILED DESCRIPTION

[0028] The following detailed description refers to the accompanying drawings, which illustrate the specific details and embodiments in which the present disclosure can be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present disclosure. Other embodiments may be utilized and structural and logical changes may be made without departing from the scope of the present disclosure. The various embodiments are not necessarily mutually exclusive, as some embodiments may be combined with one or more other embodiments to form new embodiments.

[0029] Embodiments described in the context of one of these devices or methods are analogously valid for the other device or method. Similarly, embodiments described in the context of a device are analogously valid for a vehicle or method, and vice versa.

[0030] Features described in the context of an embodiment may be correspondingly applicable to the same or similar features in other embodiments. Features described in the context of an embodiment may be correspondingly applicable to other embodiments, even if not explicitly described in these other embodiments. Furthermore, additions and / or combinations and / or substitutions as described for features in the context of an embodiment may be correspondingly applicable to the same or similar features in other embodiments.

[0031] In the context of various embodiments, the articles “a,” “an,” and “the” as used with respect to features or elements include reference to one or more of these features or elements.

[0032] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0033] Hereinafter, embodiments will be described in detail.

[0034] Figure 1 A communication arrangement including a smartphone 100 and a server (computer) 106 is shown.

[0035] The smartphone 100 has a screen showing a graphical user interface (GUI) of applications for one or more of different services that a user using the smartphone has previously installed on his smartphone and has opened (i.e., turned on), for example, ordering food or calling a ride online.

[0036] GUI 101 includes graphical user interface elements 102, 103 that assist the user in using the service, e.g., a map near the user's location, food available near the user (e.g., which the application may determine based on location services such as GPS-based location services), buttons for placing an order, etc.

[0037] When the user has made a selection for a service (e.g., a restaurant or online supermarket and / or food or groceries to be ordered), the application communicates with the server 106 of the corresponding service via a radio connection. The server 106 (through the processor 107 executing the corresponding server program) may consult a memory 109 or a data storage device 108 with information about the service (e.g., price, availability, estimated delivery time, etc.). The server transmits any data related to the user or requested by the user (such as the estimated delivery time) back to the smartphone 100, and the smartphone 100 displays the information on the GUI 101. Ultimately, the user may accept the service, e.g., order food. In this case, the server 106 notifies the service provider 104 accordingly, e.g., a restaurant or online supermarket. The server 106 may also communicate with the service provider 104 earlier, e.g., for determining the estimated delivery time.

[0038] It should be noted that although server 106 is described as a single server, its functions (e.g., providing certain services and advertising data) are usually provided by an arrangement of multiple server computers (e.g., implementing cloud services) in actual applications. Therefore, the functions provided by a server (e.g., server 106) described below can be understood as being provided by an arrangement of multiple servers or multiple server computers.

[0039] Server 106 may store information about interactions between parties (in this example, transactions between a user, such as the user of smartphone 100 , and a service provider, such as service provider 104 ) in data storage device 108 for analysis.

[0040] These data can therefore be modeled as data about two-party interactions. For example, food ordering and grocery store transactions and online ride-hailing trips (which can also be considered to correspond to transactions because the passenger pays for the trip) form interactions between customers and merchants (usually including service providers such as drivers). These interactions are rich with information such as about orders, types of food purchased, prices, delivery addresses, etc. Using these data, it may be desirable to detect anomalies in these two-party interactions, because anomalies in transactions generally indicate the occurrence of fraudulent activities submitted by the parties involved. For example, abuse or manipulation of promotions by customers (where very frequent orders are made) and collusion between customers and merchants (where transactions to merchants are primarily from colluding customers). Fraudsters tend to repeat fraudulent behaviors to maximize revenue, making these behaviors more prominent compared to other behaviors.

[0041] It is desirable that anomaly detection models do not require labeled data, so that they can be applied directly to collected data without the need to collect labels, which is often limited and time-consuming. In addition, fraudsters continue to innovate their fraudulent modes of operation (MO), making any model that relies on historical labeled data ineffective in detecting new MOs. However, many classical machine learning algorithms for anomaly detection cannot model the rich information in the interaction between two parties.

[0042] In particular, exception models that work on tabular data cannot effectively model interactions because they place the data in a tabular format, which destroys the relationship between two different parties.

[0043] Further, conventional anomaly models that model relational data and work on interaction data cannot model the rich information attached to customer-service provider interactions. Typically, they focus on the individual attributes of each entity (e.g., attributes of the customer or attributes of the service provider).

[0044] In view of the above, according to various embodiments, a method for anomaly detection in a two-party interaction is provided, which allows modeling of rich information attached to the interaction.

[0045] Figure 2 A data processing pipeline (ie, implemented by server 106) according to an embodiment is shown.

[0046] First, the data acquisition system 201 collects raw interaction data between customers (PAX) and service providers (MEX), for example, in the data storage device 108 for food transactions, grocery transactions, online ride-hailing, etc. as described above.

[0047] The collected data is then formulated (ie, represented as a bipartite graph 202 with attributes), that is, as a mathematical formula for representing the interaction between the two parties.

[0048] Specifically, a bipartite graph is a node-edge-attribute graph It includes:

[0049] The first node set representing the customer node

[0050] A set of second nodes representing service providers

[0051] The set of edges E indexed by ei,j, where i = {1, ..., n v} and j∈{1,…,n v},n e Indicates its cardinality, representing the customer-service provider interaction;

[0052] · The attributes / features of each node in u;

[0053] · The attributes / features of each node in;

[0054] · The attributes / features of each edge in ε.

[0055] Here, n represents the number of nodes / edges in the graph, and m represents the number of node / edge features. The subscripts in n and m indicate which set the number represents (e.g., n for set u u and n for the edge set ε e ).

[0056] For example, the data acquisition system 201 collects data about transactions between customers and service providers (e.g., restaurants and online supermarkets) over the past 7 days. The data may include many (about 30-50) features of each transaction and / or party (i.e., customer or service provider), such as information about the order, the type of food purchased, the price, the delivery address, the number of orders, the price, promotions, delivery address statistics, etc. From these transactions, a bipartite graph is constructed, wherein each node in the bipartite graph represents a customer or a service provider (i.e., for example, a merchant or a driver), i.e., each node is a customer node or a service provider node. If a customer has conducted at least one transaction with a service provider, there is an edge between the customer and the service provider in the bipartite graph.

[0057] Each edge is provided with rich information (i.e., attributes also called features) about the transaction between the corresponding customer and the service provider (corresponding to the node connected by the edge). Similarly, each node is also provided with information about the image of the customer or service provider, respectively.

[0058] Thus, for example, to monitor transactions between customers and service providers across multiple services, such as food and online supermarket orders (e.g., daily), the data acquisition system 201 extracts the food and online supermarket transactions for the past seven days in the dataset, as well as additional information including order quantity, price, promotion, order information, shipping address statistics, etc. From these transactions, the server 106 constructs a bipartite graph representation of the dataset.

[0059] The bipartite graph 202 constructed by the data acquisition system 201 is then passed to a graph anomaly detection machine learning (ML) model 203, such as a neural network (e.g., implemented by the server 106). The anomaly ML model 203 is a graph neural network model specifically designed for anomaly detection in bipartite graphs. The input to the ML model 203 is the attributed bipartite graph 202, which includes features (or attributes) to encode the collected data as described above. From the output of the graph anomaly detection neural network 203 in response to the bipartite graph 202, the anomaly scoring system 204 determines an anomaly score 204 for each customer-service provider pair, as well as an anomaly score for each customer and each provider pair.

[0060] The anomaly scores can then be evaluated by the action system 205 (e.g., by comparing them to one or more thresholds), which can take action in response to detecting an anomaly. For example, the anomaly score for a customer-service provider pair is used to determine whether the pair is an anomaly, such that the customer colluded with the service provider to abuse a promotion.

[0061] The graph anomaly detection neural network 203 is trained before being used for anomaly detection. After the graph anomaly detection neural network 203 is trained, it can be used to generate anomaly scores. The anomaly score is based on the reconstruction error of each individual node / edge output from the graph anomaly detection neural network 203. This can be based on the following assumptions: normal behavior is common and can therefore be easily reconstructed, while abnormal behavior is rare and the model will have problems reconstructing them. Therefore, abnormal edges / nodes will have higher reconstruction errors and therefore higher anomaly scores. The anomaly score can be in any range of non-negative numbers. In practical applications, most anomaly scores are typically close to 0, but some may be in the tens or hundreds.

[0062] The anomaly scoring system 204 first calculates an anomaly score for each edge (i.e., each customer-service provider relationship) using the corresponding edge reconstruction error. Then, it calculates an anomaly score for the node (i.e., the customer and the service provider). The anomaly score of a node depends not only on the reconstruction error of the customer or service provider, but also takes into account all edges connected to the node. The anomaly score for each customer, each service provider, and each customer-service provider interaction for each run day can be stored in the database 108.

[0063] The anomaly score generated by the anomaly scoring system 204 is then passed to the action system 205. For example, the action system 205 may include, for example, a human-machine loop system and an automatic action system. For the human-machine loop system, multiple sets of the most abnormal customers, merchants, and customer-merchant interactions are provided to a group of human experts. The human assessor then manually investigates the anomaly, evaluates whether a specific mode of operation occurs (old or new), and decides what actions the suspicious customer or service provider has performed. For the automatic action system, the anomaly score is combined with other signals or data to create an automatic action task, such as automatically banning certain promotional ads for users with high anomaly scores in the past few days.

[0064] Reference now Figure 3 Describe the graph anomaly detection neural network 203 in more detail.

[0065] Figure 3 A graph anomaly detection neural network 300 is shown according to an embodiment.

[0066] The graph anomaly detection neural network 300 includes an encoder 301 and a decoder, the decoder including a feature decoder 302 and a structure decoder 303. The graph anomaly detection neural network 300 is trained according to a loss function 304 (ie, during training, it is adjusted to reduce the value of the loss function for the training data).

[0067] The encoder 301 takes an input graph 305 (including feature / attribute information) and processes it in a series of graph convolutional layers. According to various embodiments, a custom convolution operation is used that operates on a bipartite graph with node and edge features. Each convolutional layer is followed by batch normalization and a ReLU rectified linear unit activation function to produce a layer representation of nodes and edges, denoted as H u , H v and H e The last layer of encoder 301 generates Z u and Z v A potential representation 306 of each node.

[0068] The feature decoder 300 is trained to u and Z v It is passed to a series of graph convolutional layers to reconstruct the original input features from the latent representation 306. The final output is the reconstructed node and edge features, represented as and

[0069] The structure decoder 303 is trained to reconstruct the original graph structure from the latent representation 306. It works in the following way: u and Z v The matrix representation of Z u and Zv A multi-layer perceptron (MLP) is applied on , and then a sigmoid function is used to generate the probability that node u is connected to node v via an edge.

[0070] To train the graph anomaly detection neural network 300, the loss function 304 includes a reconstruction error (for each training data element of the training data (i.e., training input graph)) which is a combination of the mean squared error of feature reconstruction (feature decoder output) and the binary cross entropy of edge prediction (structure decoder output).

[0071] In the following, the operation of the graph anomaly detection neural network 300 is described in further detail, starting with some notations used in the following.

[0072] The structure of the attribute graph G is composed of the class adjacency matrix Indicates that, if in u j and v j If there is an edge between them, then the (i,j)th item A i,j =1, and otherwise the (i,j)th item A i,j = 0. Note that unlike the adjacency matrix in a regular (isomorphic) graph, the matrix A does not need to be a square matrix, since u and The number of nodes in can be different. Further, N is defined as a neighbor operator that returns a list of all neighboring nodes. Specifically, for a node u in the first node set (customer nodes),

[0073]

[0074] Similarly, for node v (service provider node) in the second node set,

[0075]

[0076] Furthermore, another function M is defined that behaves similarly to N. However, instead of returning neighboring nodes, it returns the edges connecting the target node to the neighboring nodes. Specifically,

[0077]

[0078] as well as

[0079]

[0080] Now, we can formalize the anomaly detection task as follows: Given a bipartite node-and-edge-attribute graph G, the task is to generate anomaly detection algorithms that apply to every edge e∈ε and every node u∈u and A scoring function is proposed such that edges / nodes that are different from the majority in terms of both structure and attribute information should be given higher anomaly scores.

[0081] Specifically, the task involves providing three scoring functions: scoree(.), scoreu(.), and scorev(·), which are used to score edges, nodes in u, and The nodes in are scored separately.

[0082] The key components of the graph anomaly detection neural network 300 as described below can be seen from the graph convolution operation and message passing scheme that computes the next (i.e., next layer) node and edge representation from the current node (i.e., current layer).

[0083] In the following, the lower case x is used to represent node / edge features, where the subscript is used to enumerate nodes / edges. represents the node u in u i The characteristics of u},by express Node v in j The characteristics of v}, and represents the edge e in ε i,j characteristics.

[0084] The graph anomaly detection neural network 300 includes several convolutional layers. Let K denote the number of convolutional layers (an even number), where half are part of the encoder 301 and the other half are part of the feature decoder 302. The lower case k is used to enumerate the convolutional layers. To represent the intermediate node / edge representation of layer k, we use the lower case h below and replace the super script {·} (k) Add to annotation to specify the layer. Specifically, and Respectively represent the node u i , node v j , and edge e j The k-th layer representation of .

[0085] The convolution operation of layer k takes the node representation of each node of layer k-1, that is, and and the edge representation of layer k-1, i.e., Perform message passing and output new node and edge representations as well as

[0086] Instead of training a different representation for each node, a set of aggregator functions are trained that learn to aggregate feature information from the local neighborhood of a node.

[0087] To compute a new representation for a node or edge, The kth convolutional layer first collects the messages passed to a specific node / edge. i or v i The message comes from the aggregator function on the neighbor node representation, connected to u i Aggregator function on the edge representation of and its own previous representation. Passed to edge e i,j The messages come from nodes connected to the edge (i.e., u i and v j ), and the edge has a previous representation.

[0088] Figure 4A The message passing flow of the customer node is shown.

[0089] Figure 4B The message passing flow of the service provider node is shown.

[0090] Figure 4C The message passing flow at the edge is shown.

[0091] The following equation formally describes how to calculate the value passed to u i 、v j and e i,j The message:

[0092]

[0093] Here, U represents the concatenation operator, where messages from different sources are concatenated. The aggregation function Agg can be a simple aggregation function such as Mean and Max, a combination of the two, or more complex mentioned aggregation functions such as LSTM (Long Short Term Memory) and Pooling.

[0094] After collecting the messages for each node and edge, the convolutional layer computes the next representation (i.e., its output representation). To do this, the messages are processed by a linear operation parameterized by parameters W and b. The output of the linear operation is normalized to the activation function as follows:

[0095]

[0096] Where BN stands for batch normalization. The weights and bias parameters in the linear operations of each node set are shared across all nodes in the set. Similarly, the parameters of the edge set are shared across all edges. Therefore, in a convolutional layer, there are six parameter vectors: W u ,W,W e , b u , b v and b e These parameters are trained when training the neural network 300 .

[0097] As described above, the encoder 301 includes K / 2 graph convolutional layers. The input to the first layer is the raw features of each node and edge of the input graph 305, i.e.,

[0098]

[0099] Subsequent layers take the output of the previous layer as input. and The last encoder layer (i.e., the K / 2th layer) of and

[0100] For each node in U and V, these node representations become latent representations 306 (denoted as z), namely,

[0101]

[0102] This construction forces the latent representation of each node to also encode all neighboring edge features in addition to the local graph structure and neighboring node features.

[0103] The feature decoder 302 also consists of K / 2 convolutional layers. The first layer combines u and The latent representation 306 of the nodes in is taken as input, and no edge representation is accepted. Therefore, the message collection in the message passing scheme is simplified to:

[0104]

[0105] The remaining convolutional layers for feature decoder 302 follow the scheme as described for encoder 301. The output of the last layer of decoder 302 becomes the reconstructed node and edge features, namely:

[0106]

[0107] This is compared to the original input features in order to compute the loss 304 (in training) and the anomaly score (in inference).

[0108] In the feature decoder 302, the graph structure is given to the model as a basis for conveying messages. Therefore, in order to enhance the encoding of the latent variables of the graph structure, the structure decoder 303 is included in the neural network 300. From the latent representation 306 and The structure decoder 303 attempts to predict the node u in u i Whether Node v in j connection. It passes To the first multi-layer perception 307 (MLP u ) and pass it through K / 2 layers to the similar (second) MLP308 (MLP v ) to act. It then takes the dot product of the output of the MLP and passes it to the sigmoid function 309 to produce u i Connect to v j The probability of is:

[0109]

[0110] These probabilities are then compared to the adjacency matrix A in order to compute the loss 304 (in training) and the anomaly score (in inference).

[0111] In the following, the training of the neural network 300 is explained.

[0112] The edge prediction formula in the structure decoder (Eq.13) defines u and The probability of each pair of nodes in . In practice, most pairs of nodes are not connected. Therefore, for higher efficiency, the probability is calculated for a subset of pairs without causing any performance degradation. Let ε + Indicates that u is connected in the graph i and v j The set of pairs of , and ε - represents the set of unconnected pairs, namely:

[0113] ε + ={(i,j)|A i,j =1},ε - ={(i,j)||A i,j =0} (14).

[0114] Set ε ± is defined as all indices ε ± =ε + ∪ε - According to one embodiment, during the training process, instead of using ε - In contrast, only ε - A small part of is used and is related to ε + Combine to obtain the set ε of pairs used in training ± ,Right now,

[0115]

[0116] A negative pair ε with a pre-specified number of samples can be used - Standard uniform random sampling of , for example, can be done using the positive sample pair ε + Small multiples of quantity.

[0117] The loss function 304 is a reconstruction loss. as well as are all nodes in u, The training objective function (i.e., loss function) 304 is a combination of the mean square error (MSE) of node feature reconstruction of nodes in u, the MSE of node feature reconstruction of nodes in , the MSE of edge feature reconstruction, and the binary cross entropy (BCE) of edge prediction of the structure decoder:

[0118]

[0119] in: and

[0120]

[0121] Wherein, η represents a constant used to balance the MSE loss from the feature decoder 302 and the BCE loss from the structure decoder 303.

[0122] During training, forward propagation is first performed by feeding input data (i.e., training data elements (i.e., training input graph) to encoder 301 to produce latent representation 306, which is then passed to feature decoder 302 and structure decoder 303 to produce reconstructed data. The value of the loss function is then calculated as the target for neural network optimization.

[0123] The training data elements may be input graphs based on historical or simulated transactions (e.g., two-party interactions between customers and merchants from food delivery services (e.g., GrabFood) and / or marketplace transactions (e.g., GrabMart)). Depending on the use case, other two-party interactions related to the respective use case may also be used, such as data on passenger-driver interactions (e.g., from GrabCar and / or GrabBike).

[0124] Algorithm 1 provides a detailed step-by-step procedure for performing the forward propagation, covering all network components as discussed above.

[0125]

[0126]

[0127] Algorithm 1

[0128] To compute the back propagation to calculate the gradients and update the neural network 300, a deep learning framework may be used.

[0129] After training the network, anomaly scoring system 204 may use neural network 300 to determine anomaly scores, as described above and explained in more detail below.

[0130] According to one embodiment, the anomaly scoring system 204 generates an anomaly scoring system for edge and u and The values ​​of the three anomaly scoring functions used to score the nodes in . Given an input graph 305, the scoring function is calculated by first performing a forward pass using the encoder 301 and decoders 303, 304, and then calculating the individual node / edge reconstruction errors. The edge scoring function is defined as a weighted combination of the reconstruction error of the edge feature and the BCE error that predicts whether the edge should exist in the graph, i.e.:

[0131]

[0132] where the constant η is the same as that used in the training objective. We then define u and The node in defines the scoring function. The anomaly score of a node is a combination of the reconstruction error of its node features and the aggregation of the anomaly scores of all edges connected to the node, that is:

[0133]

[0134] The aggregation function Agg can be a mean or a maximum value, depending on the needs of the application. The principle of aggregation is that since entities (customers, service providers, or projects depending on the application) are participants in the interaction in the edge, anomalies in the interaction should affect the anomaly score of the entity involved. In addition, an entity is usually involved in many interactions. Some of these interactions may be abnormal, while other interactions may be normal. Maximum aggregation is more sensitive to single anomalies in the interaction, while mean aggregation provides a complete overview of all interactions involving the entity.

[0135] The training process as described above requires access to the full graph structure and all node and edge features. However, this full graph training is not scalable to large-sized graphs. In order to be able to scale the learning algorithm to large graph data, random training via mini-batches and neighborhood sampling can be performed.

[0136] Mini-batching splits a large graph into multiple mini-batches, each of which consists of a small sub-graph. For each mini-batch, we compute the final output representation of the nodes and edges in the sub-graph (target sub-graph). Computing the output of a specific node / edge in the target sub-graph using graph convolution requires knowing the neighbors of the node / edge. Therefore, assuming we have K convolutional layers, the sub-graph is repeatedly expanded K times by sampling the neighboring nodes connected to the current sub-graph.

[0137] Furthermore, the message streams in the convolutions are stored layer by layer.

[0138] Let U, V and E (different from u, ε) represents the subgraph belonging to the node set u and the node set and the components of the edge set ε. In the following, F s1→s2 represents the message flow from a node / edge set s1 in one layer to a node / edge set s2 in the next layer, where s represents v or e. Message flow F s1→s2 A tuple containing the source and destination of the message, for example, F u→v =({u2,u3,u5},{u4,u6}). In addition, F →s Represents the set of all message flows pointing to s.

[0139] To create a mini-batch of a subgraph, enumerate the nodes in a node set (e.g., u) and group them into mini-batches of u nodes according to the batch size. Let U be the set containing mini-batch u nodes. The target subgraph is generated by sampling the v nodes in U (which are connected to any node in U). The resulting sample consists of a set of v nodes V and a set of edges E connecting V to U. The sets U, V, and E form the target subgraph for this particular mini-batch. This subgraph is extended K times by sampling the neighborhoods of U and V while creating a sequence of message flows F between layers. It should be noted that these layers are traversed in a backward manner, since the beginning is the target subgraph that defines the output of the network. Algorithm 2 provides a detailed step-by-step procedure for creating the message flow sequence.

[0140]

[0141] Algorithm 2

[0142] To perform stochastic training, the forward propagation process (Algorithm 1) is adjusted to follow the generated message stream sequence. The gradient of the loss function is then used to perform stochastic updates of the neural network 300.

[0143] So far, we have discussed the anomaly detection problem in a transductive setting, where the model only provides inferences about the observed data. A more general setting is the inductive setting, where the neural network 300 also needs to come up with general principles.

[0144] Models that can perform inductive learning can be applied to newly observed nodes / edges / subgraphs, whereas models that are only transductive cannot. The inductive anomaly detection task can be defined as follows: Given a bipartite node-and-edge attribute graph For training, given a new observed (sub)graph For scoring, the task is to generate a scoring function that applies to each edge e∈ε′ and each node and Such edges / nodes that are different from the majority in both structural and attribute information should be given higher anomaly scores.

[0145] In the embodiment described above, in the model, the inductive power comes from convolution operations, message passing and aggregation, and neighborhood sampling. The forward propagation of encoder 301, feature decoder 302 and structure decoder 303 can be directly applied to the newly observed sub-graph G'. The anomaly scoring function discussed is still applicable to G'.

[0146] In summary, according to different embodiments, a method is provided, such as Figure 5 As shown in .

[0147] Figure 5 A flow chart 500 illustrating a method for detecting anomalies in two-party interaction data is shown.

[0148] In 501, interactions between parties in the first group and parties in the second group are represented as a graph, wherein each interaction between a first party in the first group and a second party in the second group is represented by an edge between a corresponding first node representing the first party and a corresponding second node representing the second party, and wherein information about the first party is assigned to the first node as node attribute information, information about the second party is assigned to the second node as node attribute information, and information about the interaction is assigned to the edge as edge attribute information.

[0149] At 502, the graph is processed by a graph convolutional neural network having an autoencoder structure.

[0150] In 503, in response to the graph comprising at least a loss between edge attribute information and edge attribute information reconstructed by a decoder of the graph convolutional neural network, an anomaly score for the interaction between the parties in the first group and the parties in the second group is derived from the reconstruction loss between the graph and the output of the graph convolutional neural network.

[0151] At 504, an anomaly is based on an anomaly score.

[0152] According to various embodiments, in other words, based on (at least) edge detection anomalies (i.e., two-party interactions, i.e., interactions between two parties), the properties of this edge can only be poorly reconstructed. If the decoder is only able to poorly reconstruct property information about an edge, this can generally be an indication that the corresponding information is unusual, i.e., different from the interactions that the neural network has seen in its training, and therefore the interaction represents abnormal behavior.

[0153] It should be noted that the two-party interaction data may specifically include sensor data, and the parties may correspond to components of a technical system. In this case, the method may include: executing a control action of the technical system in response to a detected anomaly, which may indicate an interaction failure of the components of the technical system, for example, in a manufacturing system including a plurality of robotic devices or in an autonomous driving scenario including a plurality of vehicles.

[0154] Figure 5 For example, by Figure 6 The server computer shown is used to execute.

[0155] Figure 6 A server computer 600 is shown according to an embodiment.

[0156] The server computer 600 includes a communication interface 601 (e.g., configured to receive interaction data, i.e., information about interactions). The server computer 600 also includes a processing unit 602 and a memory 603. The memory 603 can be used by the processing unit 602 to store, for example, data to be processed, such as information about interactions and nodes and their graph representations. The server computer is configured to perform the method of FIG. 15 .

[0157] The methods described herein may be performed and the different processing or computing units and devices and computing entities described herein may be implemented by one or more circuits. In an embodiment, a "circuit" may be understood as any kind of logic implementation entity, which may be hardware, software, firmware, or any combination thereof. Therefore, in an embodiment, a "circuit" may be a hardwired logic circuit or a programmable logic circuit such as a programmable processor, for example, a microprocessor. A "circuit" may also be software implemented or executed by, for example, a processor, such as any kind of computer program, for example, a computer program using a virtual machine code. According to an alternative embodiment, any other kind of implementation of the various functions described herein may also be understood as a "circuit".

[0158] Although the present disclosure has been specifically shown and described with reference to specific embodiments, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined in the appended claims. Therefore, the scope of the present invention is indicated by the appended claims, and it is therefore intended to cover all changes within the meaning and range of equivalents of the claims.

Claims

1. A method for detecting anomalies in interaction data between two parties, comprising: representing interactions between parties in a first group and parties in a second group as a graph, wherein each interaction between a first party in the first group and a second party in the second group is represented by an edge between a respective first node representing the first party and a respective second node representing the second party, and wherein information about the first party is assigned to the first node as node attribute information, information about the second party is assigned to the second node as node attribute information, and information about the interaction is assigned to the edge as edge attribute information; Processing the graph by a graph convolutional neural network with an autoencoder structure; In response to the graph comprising at least a loss between the edge attribute information and edge attribute information reconstructed by a decoder of the graph convolutional neural network, deriving an anomaly score for interactions between parties in the first group and parties in the second group from a reconstruction loss between the graph and an output of the graph convolutional neural network; and Anomalies are detected based on the anomaly scores.

2. The method according to claim 1, wherein: The reconstruction loss includes a loss between node attribute information and node attribute information reconstructed by the decoder.

3. The method according to claim 1 or 2, wherein: The reconstruction loss includes a loss between node adjacency information of the graph and node adjacency information reconstructed by the decoder.

4. The method according to any one of claims 1 to 3, comprising: The anomaly score is compared to one or more thresholds, and an anomaly of the interaction of one of the first group or the interaction of one of the second group is detected if the anomaly score of the interaction is above the corresponding threshold.

5. The method according to any one of claims 1 to 4, comprising: The graph convolutional neural network is trained by determining, for each training data element of a plurality of training data elements, wherein each training data element comprises a training graph, in response to the graph comprising at least a loss between the edge attribute information and edge attribute information reconstructed by a decoder of the graph convolutional neural network, a reconstruction loss between the training graph and an output of the graph convolutional neural network according to the training graph and an output of the graph convolutional neural network, and The neural network is adjusted to reduce an overall loss, the overall loss comprising the reconstruction loss determined for the training data elements.

6. The method according to claim 5, comprising: For each training data element, sampling a subgraph of the training graph; For each sampled subgraph, the reconstruction target is set to the sampled subgraph; And expanding the subgraph by including nodes and edges connected to the sampled subgraph and calculating a reconstruction loss between the reconstruction target and the output of the graph convolutional neural network in response to the expanded subgraph, wherein the overall loss includes the reconstruction loss determined for the subgraph.

7. The method according to any one of claims 1 to 6, wherein: The parties in the first group are customers and the parties in the second group are service providers.

8. The method according to any one of claims 1 to 7, wherein: The interaction is a transaction between parties in the first group and parties in the second group.

9. The method according to any one of claims 1 to 8, comprising: Detect fraud based on detected anomalies.

10. The method according to claim 9, comprising: For each detected anomaly, check whether fraud has occurred.

11. The method according to any one of claims 1 to 10, further comprising: The anomaly score is utilized as input to a human-in-the-loop system and / or an automated system.

12. A server computer comprising a radio interface, a memory interface and a processing unit, the processing unit being configured to perform the method according to any one of claims 1 to 11.

13. A computer program element comprising program instructions which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 11.

14. A computer readable medium comprising program instructions which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 11.

Images