Abnormal account detection method based on graph continuous learning

Abstract

The invention belongs to the cross technical field of block chains and machine learning, and provides an abnormal account detection method based on graph continuous learning, and the method comprises the specific steps: 1, obtaining normal and abnormal account data with labels, and extracting account features; dividing the obtained accounts into a plurality of groups of tasks; 2, performing model training on the graph neural network model by using a group of tasks; 3, obtaining the importance score of the model parameters to the loss of the current task and the importance score of the topological structure, and calculating the final importance score of all the parameters to the current task; and 4, when the tasks are not trained completely, updating the loss function based on the final importance score, returning to the step 2 to continue training of the next group of tasks, and when the tasks are trained completely, using the obtained model for detection of abnormal accounts.

Description

Technical Field

[0001] The present invention discloses an abnormal account detection method based on graph continuous learning, which belongs to the cross-technical field of blockchain and machine learning. Background Art

[0002] With the booming development of blockchain technology, cryptocurrencies are facing an upward trend and people seem to be interested in it. The flexibility and sense of ownership that blockchain technology provides to users make cryptocurrencies particularly popular in this era. Due to the convenience of online payment services, the frequency of use of virtual currencies has skyrocketed. In addition to the most well-known Bitcoin, there is Ethereum with other functions, whose features include but are not limited to the development of decentralized applications and the development of smart contracts, as well as the development of non-fungible tokens. The ERC-20 standard defines the existence of fungible tokens as cryptocurrencies. The standard defines how tokens are created and managed for different purposes, including fundraising, reward programs, and fund management. However, the booming development of blockchain also puts millions of users at risk of various malicious attacks, such as phishing scams, Ponzi schemes, and money laundering.

[0003] Abnormal transaction behaviors on blockchains may cause huge economic losses to customers and companies. To address this problem, researchers have proposed many blockchain anomaly detection models, which face blockchain transaction flows and aim to distinguish fraudulent transactions from real transactions. Traditional anomaly detection models rely on slowly evolving expert rules, which require significant human resources and may miss complex illegal transaction patterns. Recent anomaly detection models have developed into hybrid configurations that combine expertise and machine learning algorithms. Many machine learning methods, such as neural networks, batch algorithms based on decision trees and support vector machines, have been adopted. In particular, neural networks have shown good performance in fraud detection tasks and have been widely used. Of course, blockchain transactions can be represented as a large-scale evolving graph. Many successful cases have shown that deep graph learning techniques can be applied to non-Euclidean data such as graphs. However, in the real-world blockchain illegal activity detection environment, there is a difficult problem to be solved in order to use deep graph learning to detect abnormal accounts and behaviors. As account transaction behaviors evolve and new attack strategies emerge, transaction patterns may change over time. Therefore, if the neural network cannot adapt to the new pattern in a timely manner, the performance of the fitted neural network will also decay over time. In order to ensure that blockchain platforms can effectively defend against the increasing number of attack strategies, it is necessary to continuously develop blockchain anomaly detection systems based on continuous learning. Summary of the invention

[0004] This paper aims to evaluate the challenges of continuous learning in solving the design of blockchain anomaly detection methods, and proposes a blockchain abnormal account detection method based on graph continuous learning. This method introduces a topological importance score, which aims to explicitly explore the local structure of the input graph and try to stabilize the parameters that play a key role in topological aggregation. In this way, the catastrophic forgetting problem that may occur in the blockchain abnormal account detection task can be effectively evaluated.

[0005] The technical solution for implementing the present invention is as follows:

[0006] A method for detecting abnormal accounts based on graph continuous learning. The specific process is as follows:

[0007] Step 1: Obtain labeled normal and abnormal account data and extract account features; divide the obtained accounts into multiple groups of tasks;

[0008] Step 2: Use a set of tasks to train the graph neural network model;

[0009] Step 3: Obtain the importance score of the model parameters to the current task loss and the topological structure importance score, and calculate the final importance score of all parameters to the current task;

[0010] Step 4: When the task has not been trained, update the loss function based on the final importance score, return to step 2 to continue training the next set of tasks, and when the task has been trained, use the obtained model to detect abnormal accounts.

[0011] Furthermore, step 1 of the present invention obtains normal and abnormal account data with labels and extracts account features, specifically:

[0012] Get the abnormal account with the label, and get the normal account that has transactions with the abnormal account;

[0013] Obtain transaction activity data of the above abnormal accounts and normal accounts;

[0014] The transaction activity data features are extracted as account feature data.

[0015] Furthermore, the graph neural network model described in the present invention includes an embedding layer, an intermediate layer and an output layer, wherein the intermediate layer is a graph convolution layer or a graph attention layer.

[0016] Furthermore, the importance score of the model parameters of the present invention to the current task loss is:

[0017] Step 3.2.1: Calculate the gradient of the task loss change relative to the model parameters after adding infinitesimal parameter perturbations to the model parameters, and use the gradient to represent the contribution of the parameters to the loss;

[0018] Step 3.2.2: Construct a matrix of importance scores of model parameters to task loss, whose elements are the gradients of loss with respect to the parameters.

[0019] Furthermore, the importance of the model parameters of the present invention to the current task loss is The number is:

[0020] Step 3.2.1: Calculate the given task T k Training set Loss on and add an infinitesimal parameter perturbation ΔW to the model parameters = {Δw m}Loss The loss is expressed as:

[0021]

[0022] Among them, L represents the loss function, Δw m is the parameter w m Infinitesimal change, W = {w m}, m = 1, 2...M, M is the number of model parameters;

[0023] Compute the loss with respect to the parameter w m Gradient

[0024] Step 3.2.2: Calculate the parameter W for task T k The importance of the loss can be expressed as

[0025] Furthermore, the intermediate layer of the present invention is a graph attention layer, and the importance score of the model parameters to the current task topology structure is:

[0026] Step 3.3.1: Represent the attention coefficients between the nodes of the graph attention layer and the neighboring nodes as a matrix;

[0027] Step 3.3.2: Calculate the gradient of the attention coefficient matrix change relative to the model parameters after adding infinitesimal parameter perturbations to the model parameters;

[0028] Step 3.3.3: Construct a matrix of the importance scores of the model parameters to the current task topology. The elements in this matrix are the gradients of the changes in the attention coefficients relative to the model parameters.

[0029] Furthermore, the model parameters of the present invention are important to the current task topology structure. for:

[0030] Step 3.3.1: Set the node v in layer l i With its neighbors v jThe attention coefficient between Rewritten in matrix form, it looks like this:

[0031]

[0032] Among them, a is a neural network, W (l) is the weight matrix of the lth layer. Contains node v i and v j The embedding features of are calculated by the (l-1)th layer;

[0033] Step 3.3.2: Calculate the model parameters based on the attention coefficient matrix obtained in 3.3.1 and add the infinitesimal parameter ΔW = {Δw m The change caused by the disturbance can be approximated as:

[0034]

[0035] The model The topological loss of all nodes in is defined as the squared l2 norm of the multidimensional vector of the lth layer, and the gradient is calculated as:

[0036]

[0037] Step 3.3.3: Based on the gradient calculated in 3.3.2, the task T can be calculated k The importance scores of all parameters in the topology can be expressed as

[0038] Furthermore, the final importance score of all parameters to the current task is calculated as follows:

[0039]

[0040] Among them, λ l and λ t are two preset hyperparameters, the importance scores of model parameters to the current task loss Importance score of model parameters to the current task topology

[0041] Furthermore, the updating of the loss function based on the final importance score described in the present invention is: changing non-important model parameters, and establishing a penalty guarantee model based on the final importance score calculated for the trained task, and establishing the loss function of the next task according to the penalty guarantee function and the changed non-importance parameters.

[0042] Furthermore, the present invention further calculates by adding the l1 norm as the next task T k+1 Regularization of the importance scores computed ||Ik ||1; Using the ||I k ||1Update the loss function of the next task.

[0043] Beneficial effects:

[0044] First, the present invention estimates the importance score of each parameter of the network according to its task-related performance and topological structure, maintains the focus and aggregation strategy of old tasks in deep learning tasks through the topological aggregation mechanism, and realizes a continuous learning process for effectively and reliably identifying abnormal accounts on a gradually expanding and more complex blockchain network.

[0045] Second, from the perspectives of anomaly detection and continuous learning, the present invention designed and ran comparative experiments based on different neural network backbones and different continuous learning strategies. The experiments have proven that the present invention has high accuracy in node classification, effectiveness and applicability in continuous learning, and outstanding performance in detection stability in overcoming catastrophic forgetting. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 The topological weights used in the present invention maintain the overall framework of the model.

[0048] Figure 2 Schematic diagram of the continuous learning process. DETAILED DESCRIPTION

[0049] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0050] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0051] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0052] The design idea of ​​the present invention is: first, based on the acquired on-chain transaction data information, the present invention constructs a graph model containing the link relationship and features of illegal transactions and legal transactions, and then introduces a topology-aware weight retention module to maintain the focus and aggregation strategy of old tasks in deep learning tasks through topological aggregation, thereby realizing a continuous learning process. Finally, the graph neural network is used as a feature extractor to calculate and obtain node predictions to achieve the classification task of abnormal accounts.

[0053] Example 1

[0054] This example describes in detail the specific process of the abnormal account detection method based on graph continuous learning on the blockchain of the present invention.

[0055] Step 1: Obtain normal and abnormal account data with labels and extract account features; divide the obtained account data into multiple groups of tasks;

[0056] Step 1.1: Get account tag data. Specifically, it includes the following steps:

[0057] Step 1.1.1: Get abnormal account data: Get the abnormal account information with labels from the CryptoScamDB database, and get the account addresses marked with abnormal transaction behavior.

[0058] Step 1.1.2: Get normal account data: Use the function tool developed by Sokolowska to select normal accounts that have made transactions within a certain block range and filter out non-unique accounts. All of these accounts are cross-referenced with abnormal account addresses to ensure that any obtained accounts have not performed any documented illegal activities, that is, the obtained accounts are normal accounts.

[0059] Step 1.2: Obtain transaction activity information. Pass all normal and abnormal account addresses obtained in step 1.1 to Etherscan's application programming interface (e.g., API) to obtain the corresponding transaction activity information that the account participated in during the above time period.

[0060] Step 1.3: Obtain account feature data. Analyze the characteristics of common abnormal accounts, select applicable features, collect and calculate the account feature information obtained in step 1.1, and finally scale the numerical features according to normalization and standardization operations, and then divide them into multiple task groups to build a graph model containing the link relationship and features of illegal transactions (normal accounts) and legal transactions (abnormal accounts).

[0061] Step 2: Use a set of tasks to train the graph neural network model;

[0062] Based on the graph data composed of the data obtained in step 1, select an account-transaction graph model, specify a set of node input features and an adjacency matrix representing the adjacency relationship between nodes. The specific process is:

[0063] Step 2.1: Select the graph neural network model and choose the appropriate graph neural network structure and layer according to the task requirements, including embedding layer, graph convolution layer or graph attention layer and output layer.

[0064] Step 2.2: Train the model using data from a set of tasks to compute a graph representation of the account transaction graph.

[0065] Step 2.2.1: In the embedding layer, assign initial feature vectors to nodes.

[0066] Step 2.2.2: In the graph convolution layer or graph attention layer, aggregate the information of neighbor nodes and update the representation of the current node.

[0067] Step 2.3: In the output layer, the node representations are mapped to the final class predictions, and the node labels in the graph are inferred.

[0068] Step 3: Obtain the importance score of the model parameters to the current task loss and the topological structure importance score, and calculate the final importance score of all parameters to the current task;

[0069] The topology weight-aware preserving module captures the network topology information constructed in step 2 and finds the key parameters that are important for both task-related and topology-related objectives.

[0070] Step 3.1: Calculate the model base loss and back propagate.

[0071] Step 3.2: Minimize loss and save. By training a set of tasks, we get a set of optimized parameters after the model has learned. Find the key parameters that maintain the minimum loss, thereby minimizing the loss of this task.

[0072] Specifically, the following steps are included:

[0073] Step 3.2.1: Calculate the loss on the given task training set and the loss of infinitesimal parameter perturbations, and then calculate the gradient of the loss with respect to the parameters to approximate the contribution of the parameters to the loss.

[0074] Step 3.2.2: Define the importance matrix of parameters for the current task loss. This matrix contains the importance scores of all parameters, reflecting the influence of each parameter on the current task loss.

[0075] Step 3.3: Topology preservation. The main task is to find parameters that are important for the learned topology information.

[0076] Step 3.3.1: Use the graph attention network as the basic model, and model the attention coefficient between the central node and its neighbor nodes as the topological information around the central node. The attention coefficient between the node and its neighbors is represented as a matrix.

[0077] Step 3.3.2: Calculate the changes caused by infinitesimal changes based on the attention coefficient matrix obtained in 3.3.1, and calculate the gradient of the attention coefficient with respect to the parameters.

[0078] Step 3.3.3: According to the gradient calculated in 3.3.2, the importance score of all parameters in the current task to the topological structure can be calculated, which contains a matrix of the importance scores of all parameters.

[0079] Step 3.4: Based on the importance score of the parameters to the current task loss obtained in step 3.2 and the topological structure importance score obtained in step 3.3, calculate the final importance score of all parameters to the current task.

[0080] Step 4: When the task has not been trained, update the loss function based on the final importance score, return to step 2 to continue training the next set of tasks, and when the task has been trained, use the obtained model to detect abnormal accounts.

[0081] Step 4.1: After learning each task, use the topological weight perception module to measure the importance of all parameters. When learning a new task, change the non-important parameters to improve the detection performance of the new task. At the same time, penalize the changes of important parameters of the old task to ensure that the model remembers the old task and maintains the stability of the old task detection.

[0082] Step 4.1.1: Calculate the loss function for the new task.

[0083] Step 4.1.2: Improve the minimum importance score. Add the norm as a regularization for the importance score of the current task, which promotes the minimization of the importance score of all parameters.

[0084] Step 4.1.3: Calculate the total loss of training the new task based on the new task loss obtained in step 4.1.1 and the total importance score of all parameters to the new task obtained in step 3.

[0085] Step 4.2: If the current task is the last task, obtain the optimal model parameters. Otherwise, return to step 2.2 and continue training the next task. Use the total loss obtained in step 4.1 to calculate the difference between the predicted result and the true label, and use the optimization algorithm to update the model parameters, including the weights and importance matrix of the graph neural network.

[0086]

[0087] Embodiment 2:

[0088] Step 1: Obtain normal and abnormal account data with labels and extract account features; divide the obtained account data into multiple groups of tasks;

[0089] Step 1.1: Get account tag data. Specifically, it includes the following steps:

[0090] Step 1.1.1: Obtain abnormal account data: Obtain tagged account information from the CryptoScamDB database, and obtain 19 account addresses that are marked with various abnormal transaction behaviors, including phishing and Ponzi schemes.

[0091] Step 1.1.2: Get normal account data: Using the function developed by Sokolowska, select normal accounts that made transactions in the range of blocks 3800000 and 3805000, and filter out non-unique accounts. These accounts were active during mid-July 2017, a period during which Ethereum network usage increased. All of these accounts were cross-referenced with abnormal account addresses to ensure that any of the obtained accounts did not perform any documented illegal activities.

[0092] Step 1.2: Get transaction activity information. Pass all normal and abnormal account addresses obtained in step 1.1 to Etherscan's API to obtain the corresponding transaction activity information that the account participated in during the above time period.

[0093] Step 1.3: Obtain account feature data. Analyze the common abnormal account characteristics, select applicable features, collect and calculate the account feature information obtained in step 1.1, and finally scale the numerical features according to normalization and standardization operations, and then divide them into multiple task groups.

[0094] Step 2: Select a graph neural network model and use a set of tasks to train the model;

[0095] Based on the graph data obtained in step 1, given an account-transaction graph model G = {V, E} with N nodes, specify a set of node input features h = {h1, h2, ..., h N} and an adjacency matrix A representing the adjacency relationship between nodes. is node v i The hidden representation at layer l is F represents the feature dimension of node i.

[0096] Step 2.1: Select the graph neural network model. According to the task requirements, select the graph attention network structure and layer, including the embedding layer, graph attention layer and output layer, and initialize the model parameters.

[0097] Step 2.2: Starting from k=0, use task T k Data training model Calculate the graphical representation of the account transaction graph. The specific process is:

[0098] Step 2.2.1: In the embedding layer, assign tasks T to nodes k The initial eigenvector of

[0099] Step 2.2.2: In the graph attention layer, aggregate the information of neighboring nodes and update the representation of the current node. Represents node v i Updated feature vector, N(i) represents node v i The neighbor nodes of A, σ(·) is the activation function, ij is node v i and node v j The connection relationship, W (l) is the transformation matrix of layer l, Represents node v i The input feature is:

[0100]

[0101] Step 2.3: Map the node representation to the final category prediction in the output layer, infer the node labels (i.e. account labels) in the graph, and obtain the model parameters after the task T0 training is completed. And let k=k+1.

[0102] Step 3: Obtain the importance score of the model parameters for the current task loss and the topology importance score, and calculate the final importance score of all parameters for the current task.

[0103] This step can be implemented using the topology-aware weight preservation module. The overall framework of the topology-aware weight preservation module is as follows: Figure 1The topology weight-aware preserving module captures the network topology information constructed in step 2 and finds the key parameters that are important for both task-related and topology-related objectives.

[0104] Step 3.1: Using Task T k Perform model training, calculate model basic loss, and back propagate.

[0105] Step 3.2: Minimize the loss and save to obtain a set of optimized model parameters after model learning make Find the key parameters that maintain minimum loss and thus minimize the loss for this task.

[0106] Specifically, the following steps are included:

[0107] Step 3.2.1: Calculate the given task T k Training set Loss on and add an infinitesimal parameter perturbation ΔW to the model parameters = {Δw m}Loss The loss variation can be approximated as:

[0108]

[0109] Among them, L represents the loss function, Δw m is the parameter w m Infinitesimal change, W = {w m}, m = 1, 2...M, M is the number of model parameters.

[0110] Then calculate the loss relative to the parameter w m Gradient It can be used to approximately estimate the parameter w m Contribution to loss, The L in

[0111] Step 3.2.2: Set the parameter w m The importance of is expressed as the gradient f m The size of all parameters W for task T k The importance of the loss can be expressed as in, It is a matrix containing the importance scores of all parameters, reflecting the influence of each parameter on the current task loss.

[0112] Step 3.3: Topology preservation. The main task is to find parameters that are important for the learned topology information. The specific process is:

[0113] Step 3.3.1: Use the graph attention network as the basic model and model the attention coefficient between the central node and its neighboring nodes as the topological information around the central node. i With its neighbors v j The attention coefficient between Rewritten in matrix form, it looks like this:

[0114]

[0115] Among them, a is a neural network, W (l) is the weight matrix of the lth layer. Contains node v i and v j The embedding features of are calculated by the (l-1)-th layer.

[0116] Step 3.3.2: Calculate the model parameters based on the attention coefficient matrix obtained in 3.3.1 and add the infinitesimal parameter ΔW = {Δw m The change caused by the disturbance can be approximated as:

[0117]

[0118] in, is the attention coefficient With respect to parameter w m The gradient of The a in

[0119] Calculate the gradient of the attention coefficient with respect to the model parameters. Unlike the task-related loss that has been defined and is a single value, the attention layer has no objective function and is based on the l-th layer node v i The attention coefficient centered on forms a multi-dimensional vector. The topological loss of all nodes in is defined as the squared l2 norm of the multidimensional vector of the lth layer, and the gradient is calculated as:

[0120]

[0121] in, is the output of the (l-1)th layer.

[0122] Step 3.3.3: Based on the gradient calculated in 3.3.2, the task T can be calculated k The importance scores of all parameters in the topology can be expressed as in, is a matrix containing the importance scores of all parameters.

[0123] Step 3.4: According to the importance score of the parameters obtained in step 3.2 to the current task loss and the topological importance score obtained in step 3.3 Calculate all parameters W for the current task T k The final importance score of .

[0124]

[0125] Among them, λ l and λ t are two hyperparameters that together determine the importance of a parameter. Changing a parameter with a small importance score will not have much impact on the performance of the task and can minimize the loss of subsequent tasks.

[0126] Step 4: Continuous learning on graph neural network and training model. The continuous learning process is as follows Figure 2 shown.

[0127] Step 4.1: After learning the current task, use the topological weight perception module to measure the importance of all parameters. k+1 When the model is trained, it changes the unimportant parameters to improve the detection performance of the new task. At the same time, it penalizes the changes of the important parameters of the old task to ensure that the model remembers the old task and maintains the stability of the old task detection. The specific process is:

[0128] Step 4.1.1: Calculate the loss function for the next task. Next task T k+1 The loss function formula is:

[0129]

[0130] in, represents element-wise multiplication. L′ k+1 (W) represents the comprehensive result of the combination of the loss function of the new task and the importance penalty of the old task, Indicates the loss function calculation of the next task obtained from the convolution of the neural network. n Indicates the importance score of the model parameters that have completed the training task, Represents task T n The optimal parameters of the model after training. All parameters of W are variables. This learning strategy ensures that parameters with low importance scores can be freely changed to adapt to new tasks, while changing parameters with high importance scores will be penalized.

[0131] Step 4.1.2: Based on the new task loss L′ obtained in step 4.1.1 k+1 (W) and the total importance score I of all parameters obtained in step 3 for the new task k Calculate the new training task T k+1 The total loss at this time is:

[0132] L k+1 (W) = L′ k+1 (W)+β||I k ||1

[0133] By adding the l1 norm as a new task T k+1 Regularization of the computed importance scores to promote minimization of the computed importance scores of all parameters.

[0134] Step 4.2: If the current task is not the last task, set k = k + 1 and return to step 3 to continue training the next task. Use the total loss L obtained in step 4.1 k+1 (W) Calculate the difference between the predicted result and the true label, and use the optimization algorithm to update the model parameters, including the weights and importance matrix of the graph neural network. If the current task is the last task, obtain the optimal model parameters and node prediction results.

[0135] The embodiment of the present application is an account-centric heterogeneous information network, and on this basis, a graph converter network is used to automatically mine meta-paths, calculate multi-hop connections, input the obtained relationship matrix into a convolutional neural network, obtain node embedding, and realize the task of detecting abnormal accounts.

[0136] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of the present invention.

Claims

1. A method for detecting abnormal accounts based on continuous graph learning, characterized in that: The specific process is: Step 1: Obtain normal and abnormal account data with labels and extract account features; divide the obtained accounts into multiple groups of tasks; Step 2: Use a set of tasks to train the graph neural network model; Step 3: Obtain the importance score of the model parameters to the current task loss and the topological structure importance score, and calculate the final importance score of all parameters to the current task; Step 4: When the task has not been trained, update the loss function based on the final importance score, return to step 2 to continue training the next set of tasks, and when the task has been trained, use the obtained model to detect abnormal accounts.

2. According to claim 1, the abnormal account detection method based on graph continuous learning is characterized in that: The step 1 obtains normal and abnormal account data with labels and extracts account features, specifically: Get the abnormal account with the label, and get the normal account that has transactions with the abnormal account; Obtain transaction activity data of the above abnormal accounts and normal accounts; The transaction activity data features are extracted as account feature data.

3. According to claim 1, the abnormal account detection method based on graph continuous learning is characterized in that: The graph neural network model includes an embedding layer, an intermediate layer and an output layer, wherein the intermediate layer is a graph convolution layer or a graph attention layer.

4. According to claim 1, the abnormal account detection method based on graph continuous learning is characterized in that: The importance score of the model parameters to the current task loss is: Step 3.2.1: Calculate the gradient of the task loss change relative to the model parameters after adding infinitesimal parameter perturbations to the model parameters, and use the gradient to represent the contribution of the parameters to the loss; Step 3.2.2: Construct a matrix of importance scores of model parameters to task loss, whose elements are the gradients of loss with respect to the parameters.

5. According to claim 4, the abnormal account detection method based on graph continuous learning is characterized in that: The importance of the model parameters to the current task loss The number is: Step 3.2.1: Calculate the given task T k Training set Loss on and add an infinitesimal parameter perturbation ΔW to the model parameters = {Δw m }Loss The loss is expressed as: Among them, L represents the loss function, Δw m is the parameter w m Infinitesimal change, W = {w m }, m = 1, 2...M, M is the number of model parameters; Compute the loss with respect to the parameter w m Gradient Step 3.2.2: Calculate the parameter W for task T k The importance of the loss can be expressed as 6. According to claim 1, the abnormal account detection method based on graph continuous learning is characterized in that: The middle layer is the graph attention layer, and the importance score of the model parameters to the current task topology structure is: Step 3.3.1: Represent the attention coefficients between the nodes of the graph attention layer and the neighboring nodes as a matrix; Step 3.3.2: Calculate the gradient of the attention coefficient matrix change relative to the model parameters after adding infinitesimal parameter perturbations to the model parameters; Step 3.3.3: Construct a matrix of the importance scores of the model parameters to the current task topology. The elements in this matrix are the gradients of the changes in the attention coefficients relative to the model parameters.

7. The abnormal account detection method based on graph continuous learning according to claim 6 is characterized in that: The importance score of the model parameters to the current task topology for: Step 3.3.1: Set the node v in layer l i With its neighbors v j The attention coefficient between Rewritten in matrix form, it looks like this: Among them, a is a neural network, W (l) is the weight matrix of the lth layer, Contains node v i and v j The embedding features of are calculated by the (l-1)th layer; Step 3.3.2: Calculate the model parameters based on the attention coefficient matrix obtained in 3.3.1 and add the infinitesimal parameter ΔW = {Δw m The change caused by the disturbance can be approximated as: The model The topological loss of all nodes in is defined as the squared l2 norm of the multidimensional vector of the lth layer, and the gradient is calculated as: Step 3.3.3: Based on the gradient calculated in 3.3.2, the task T can be calculated k The importance scores of all parameters in the topology can be expressed as 8. The abnormal account detection method based on graph continuous learning according to claim 1 is characterized in that: The final importance score of all parameters for the current task is calculated as: Among them, λ l and λ t are two preset hyperparameters, the importance scores of model parameters to the current task loss Importance score of model parameters to the current task topology 9. The abnormal account detection method based on graph continuous learning according to claim 1 is characterized in that: The updating of the loss function based on the final importance score is: changing non-important model parameters, and establishing a penalty guarantee model based on the final importance score calculated for the trained task, and establishing the loss function of the next task according to the penalty guarantee function and the changed non-importance parameters.

10. The abnormal account detection method based on graph continuous learning according to claim 1 is characterized in that: Further calculation is performed by adding the l1 norm as the next task T k+1 Regularization of the importance score computed k ‖1; Using the above ‖I k ‖1 updates the loss function of the next task.

Images