Abnormal user detection method and device, equipment and storage medium

Abstract

The invention provides an abnormal user detection method, device and equipment and a storage medium, and the method comprises the steps: constructing a graph convolutional neural network for processing a heterogeneous graph, the graph convolutional neural network comprises two graph convolutional layers and a full connection layer, adding a heterogeneous graph aggregation module of a multi-channel self-attention mechanism after the first graph convolutional layer, the loss function of the graph convolutional neural network is a compact classification loss function; obtaining a data set comprising user interaction data, and generating a heterogeneous graph comprising a plurality of interaction relationships according to the data set; taking nodes of normal users in the heterogeneous graph as a training set to train the graph convolutional neural network, and optimizing a loss function to obtain a target detection model; and inputting the to-be-identified user relation graph into the target detection model for abnormal user detection to obtain an abnormal classification result of the user. The method can improve the precision of abnormal user detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of user identification, and in particular relates to an abnormal user detection method, device, equipment and storage medium. Background Art

[0002] Abnormal user identification technology has been widely used in many fields such as financial risk control, social network security, and e-commerce fraud prevention, and has become an important tool for user behavior analysis, risk assessment, and fraud prevention.

[0003] In the prior art, anomaly detection models based on traditional machine learning or statistics are usually used to identify users. These methods often require relatively balanced positive (normal users) and negative (abnormal users) data sets. However, as users' abnormal behavior patterns become increasingly complex and diverse, the data scale is also huge, and the imbalance between positive data and negative data is becoming more and more serious. Abnormal user data is usually extremely scarce. Due to the influence of unbalanced data sets, the model may become overly conservative, that is, it is more inclined to judge users as normal, even if these users are actually abnormal, reducing the model's detection accuracy for abnormal users. Summary of the invention

[0004] In order to solve the problem of low accuracy in abnormal user detection in the prior art, the present invention provides an abnormal user detection method, apparatus, device and storage medium.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] An abnormal user detection method, comprising:

[0007] Construct a graph convolutional neural network for processing heterogeneous graphs. The graph convolutional neural network includes two graph convolutional layers and a fully connected layer. A heterogeneous graph aggregation module with a multi-channel self-attention mechanism is added after the first graph convolutional layer. The loss function of the graph convolutional neural network is a compact classification loss function.

[0008] Obtain a data set including user interaction data, and generate a heterogeneous graph containing multiple interaction relationships based on the data set; determine a training set for model training from the heterogeneous graph, delete nodes marked as abnormal users in the training set, and retain nodes marked as normal users; input the node data retained in the training set into the graph convolutional neural network for training, and update the model parameters of the graph convolutional neural network by optimizing the loss function to obtain a target detection model;

[0009] A user relationship graph to be identified is obtained, and the user relationship graph includes subgraphs corresponding to multiple relationships, and the nodes of the subgraphs represent users; the user relationship graph to be identified is input into the target detection model, and a convolution operation is performed on each subgraph in the user relationship graph through the first graph convolution layer, and the initial feature representation of each node is calculated. The initial feature representation is linearly transformed by the heterogeneous graph aggregation module to calculate the attention score, and the initial feature representation of each node is weighted summed based on the attention score to obtain the aggregated feature; a secondary convolution operation is performed on the aggregated feature through the second graph convolution layer, and the final output feature is generated based on the feature after the secondary convolution operation through the fully connected layer, and the output feature is mapped to the classification space, and the abnormal classification result of the user is output.

[0010] Optionally, a heterogeneous graph containing multiple interaction relationships is generated based on the data set, including:

[0011] Based on each interaction relationship in the data set, the user is used as a node and the interaction relationship as an edge to generate a corresponding subgraph;

[0012] An adjacency matrix is ​​constructed based on the connection relationship in the subgraph; wherein the adjacency matrix is ​​used to characterize whether there is an interactive relationship between users; a node feature matrix is ​​constructed, and the node feature matrix includes the attribute information of the user;

[0013] The feature representation of the heterogeneous graph is generated through the adjacency matrix and node feature matrix of each subgraph.

[0014] Optionally, the node data retained in the training set is input into the graph convolutional neural network for training, and the model parameters of the graph convolutional neural network are updated by optimizing the loss function, including:

[0015] The input node data is forward propagated through the graph convolutional neural network to obtain the feature vector of each node;

[0016] The loss value is calculated using the compact classification loss function based on the feature vector of each node; according to the loss value, the parameters of the graph convolutional neural network are updated through back propagation; the expression of the compact classification loss function is:

[0017]

[0018] Among them, f(x i ) represents the feature vector of the i-th node, c represents the center of all positive node feature vectors, and N is the number of positive nodes;

[0019] The process of iterative forward propagation, loss value calculation and back propagation is repeated until the preset end condition is reached to obtain the target detection model.

[0020] Optionally, the loss function of the graph convolutional neural network also includes a distillation loss function, and the model parameters of the graph convolutional neural network are updated by optimizing the loss function, including:

[0021] The hybrid loss function that optimizes the compact classification loss function and the distillation loss function updates the model parameters of the graph convolutional neural network. The expression of the hybrid loss function is:

[0022] L total =λ1L compact +λ2L distill ;

[0023] Among them, L compact is the compact classification loss function, L distill is the distillation loss function, λ1 and λ2 are the balance parameters of compact classification loss and distillation loss, respectively.

[0024] Optionally, a graph convolutional neural network for processing heterogeneous graphs is constructed, including:

[0025] Design the input feature dimension of the graph convolutional neural network according to the feature dimension of the node;

[0026] The Xavier initialization method is used to initialize the parameters of the graph convolutional neural network.

[0027] The present invention also provides an abnormal user detection device, comprising:

[0028] A construction module is used to construct a graph convolutional neural network for processing heterogeneous graphs. The graph convolutional neural network includes two graph convolutional layers and a fully connected layer. A heterogeneous graph aggregation module with a multi-channel self-attention mechanism is added after the first graph convolutional layer. The loss function of the graph convolutional neural network is a compact classification loss function.

[0029] A training module is used to obtain a data set including user interaction data, generate a heterogeneous graph containing multiple interaction relationships according to the data set; determine a training set for model training from the heterogeneous graph, delete nodes marked as abnormal users in the training set, and retain nodes marked as normal users; input the node data retained in the training set into the graph convolutional neural network for training, and update the model parameters of the graph convolutional neural network by optimizing the compact classification loss function to obtain a target detection model;

[0030] The recognition module is used to obtain the user relationship graph to be identified, which includes subgraphs corresponding to multiple relationships, and the nodes of the subgraphs represent users; the user relationship graph to be identified is input into the target detection model, and a convolution operation is performed on each subgraph in the user relationship graph through the first graph convolution layer to calculate the initial feature representation of each node, and the initial feature representation is linearly transformed by the heterogeneous graph aggregation module to calculate the attention score, and the initial feature representation of each node is weighted summed based on the attention score to obtain the aggregated feature; the aggregated feature is secondary convolutionally performed on the aggregated feature through the second graph convolution layer, and the final output feature is generated based on the feature after the secondary convolution operation through the fully connected layer, and the output feature is mapped to the classification space to output the abnormal classification result of the user.

[0031] The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned abnormal user detection method when executing the program.

[0032] The present invention also provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned abnormal user detection method is implemented.

[0033] The abnormal user detection method provided by the present invention has the following beneficial effects:

[0034] The present invention adds a heterogeneous graph aggregation module of a multi-channel self-attention mechanism to the graph convolutional neural network, performs weighted summation on the initial feature representation obtained by the convolution operation of the first graph convolution layer for each subgraph, aggregates the node features learned by the model in different relationships, and can accurately capture the feature association of user behaviors under different relationship types in the heterogeneous graph, thereby realizing effective information fusion between multiple subgraphs and improving the accuracy of feature extraction; introduces a compact classification loss function, deletes nodes marked as abnormal users in the training set, retains nodes marked as normal users, and uses positive data for model training; since the compact classification loss function is intended to make data points of the same category more closely clustered in the feature space, for normal user data, this means that the model will learn a mapping that makes the normal user feature representation more compact, thereby forming a dense cluster in the feature space, when the normal user features are closely clustered, data points (potential abnormal users) with large differences from the normal user features will appear more prominent in the feature space, thereby being more easily recognized by the model; and, since abnormal data are usually rare and difficult to obtain, using them for training may cause the model to be affected by data bias. Using only positive data for training can avoid this bias and make the model more fair and objective. Therefore, the present invention introduces a compact classification loss function by adding a heterogeneous graph aggregation module with a multi-channel self-attention mechanism and training the model only through positive user data. This can solve the problem of unbalanced data and improve the model's recognition accuracy for abnormal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiment of the present invention and its design scheme, the following briefly introduces the drawings required for this embodiment. The drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 A schematic flow chart of an abnormal user detection method provided by an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of the structure of a graph neural network provided by an embodiment of the present invention;

[0038] Figure 3 A schematic diagram of ACU curve comparison provided by an embodiment of the present invention;

[0039] Figure 4 A schematic diagram of the structure of an abnormal user detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the technical solution of the present invention and implement it, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention.

[0041] In the description of the present invention, it is to be understood that the terms “center”, “longitudinal”, “lateral”, “length”, “width”, “thickness”, “up”, “down”, “front”, “back”, “left”, “right”, “vertical”, “horizontal”, “top”, “bottom”, “inside”, “outside”, “axial”, “radial”, “circumferential”, etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing the technical solutions of the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0042] In addition, the terms "first", "second", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance. In the description of the present invention, it should be noted that, unless otherwise clearly specified or limited, the terms "connected" and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to the specific circumstances. In the description of the present invention, unless otherwise specified, "plurality" means two or more, which will not be described in detail here.

[0043] In view of the problems existing in the prior art, the embodiment of the present invention provides a method for detecting abnormal users. Figure 1 As shown, the following steps are included:

[0044] S1, construct a graph convolutional neural network for processing heterogeneous graphs. The graph convolutional neural network includes two layers of graph convolutional layers and a fully connected layer. A heterogeneous graph aggregation module with a multi-channel self-attention mechanism is added after the first layer of graph convolutional layer. The loss function of the graph convolutional neural network is a compact classification loss function.

[0045] It should be understood that there are multiple types of nodes and multiple types of relationships in a heterogeneous graph.

[0046] First, a graph convolutional neural network (GCN) basic model suitable for processing heterogeneous graphs is determined, such as GraphSAGE, graph attention network, etc., and then the convolution layer is designed. In an embodiment of the present invention, the graph convolutional neural network includes two layers of graph convolution layers and a fully connected layer, and after the first layer of graph convolution layer, a heterogeneous graph aggregation module with a multi-channel self-attention mechanism is added to dynamically aggregate the features learned by the model in different relationships; the fully connected layer is used to map the output features to the final classification space.

[0047] The input feature dimension of the GCN model is equal to the feature dimension of the node, for example, 25, and the output feature dimension is set according to the feature dimension of the input parameter; the GCN model contains two layers of graph convolution operations, and the feature dimension of the hidden layer can be set to 64. Each layer updates the node representation according to the node's neighbor information and determines the edge operation method according to the edge type of the graph to capture various relationships in the graph structure.

[0048] Before training the GCN model, the present invention uses the Xavier initialization method to initialize the GCN model parameters to ensure that the network weights have a suitable distribution at the initial stage, thereby accelerating the training process and improving convergence.

[0049] Exemplarily, in the embodiment of the present invention, the basic operations of the constructed GCN model are:

[0050]

[0051] Among them, H (l) is the node representation matrix of the lth layer, initially H (0) =X, is the normalized adjacency matrix, representing the subgraph G k The connection relationship between the nodes, W k is the convolution weight matrix of the kth relationship, σ(·) is the activation function, and the ReLU function is usually used to activate it to learn nonlinear features.

[0052] It should be understood that for each subgraph G in the heterogeneous graph k ,After the above GCN layer operation, the feature representation of each node under each ,relationship can be calculated.,After multiple layers of GCN, the feature of the node will aggregate ,the information of its neighbor nodes and be updated.

[0053] Finally, the features of each subgraph are aggregated to generate a node embedding representation that integrates multiple relationships:

[0054]

[0055] in, It represents the final node feature representation under the kth relationship, L is the number of GCN layers; concat(·) is the concatenation method, and the node features of all relationships are concatenated to form a complete node representation H.

[0056] At the same time, before training the GCN model, a loss function is defined. The loss function of the graph convolutional neural network in the present invention is a compact classification loss function, which is expressed as:

[0057]

[0058] Among them, f(x i ) represents the feature vector of the i-th node, c represents the center of all positive node feature vectors, and N is the number of positive nodes.

[0059] It should be understood that the compact classification loss is used to force the features of the positive nodes to be more compact, reduce the distance between similar nodes, and form a more concentrated feature distribution.

[0060] In the present invention, the learning rate can be set to 0.005, and the Epoch can be set to 1000.

[0061] S2, obtain a data set including user interaction data, generate a heterogeneous graph containing multiple interaction relationships based on the data set; determine the training set for model training from the heterogeneous graph, delete the nodes marked as abnormal users in the training set, and retain the nodes marked as normal users; input the node data retained in the training set into the graph convolutional neural network for training, update the model parameters of the graph convolutional neural network by optimizing the loss function, and obtain the target detection model.

[0062] It should be understood that S2 is the training process of the graph convolutional neural network. First, the user's interaction data, including the user's transaction records, social behaviors, and comment content, is collected as a data set. Optionally, the public data set FraudAmazonDataset can be used as an experimental data set. The data set contains product reviews under the musical instrument category. It marks users with more than 80% useful votes as normal users, and users with less than 20% useful votes as abnormal users.

[0063] It should be understood that in the dataset FraudAmazonDataset, users are nodes in the graph and have three relationships:

[0064] (1) UPU: connects users who have reviewed at least one of the same products.

[0065] (2) USU: connected to a user with at least one rating of the same level within one week.

[0066] (3) UVU: connects the top 5% of users with the highest mutual comment text similarity (measured by TF-IDF) among all users; so this dataset contains 3 subgraphs, describing 3 types of interaction relationships respectively.

[0067] Furthermore, a heterogeneous graph containing multiple interactive relationships is generated according to the data set. The process of generating the heterogeneous graph is as follows:

[0068] S21, based on each interaction relationship in the data set, the user is used as a node and the interaction relationship as an edge to generate the corresponding subgraph G k =(V,E k ).

[0069] Among them, V is the user node set, E k is the edge set under the kth relationship.

[0070] S22, construct the adjacency matrix A based on the connection relationship in the subgraph k ; Construct node feature matrix X.

[0071] Among them, A k Indicates whether there is a k-th interactive relationship between users. If yes, it can be represented by 1, and if not, it can be represented by 0.

[0072] X represents the user's attribute information, and its shape is X∈R N×d , where N is the number of nodes and d is the node feature dimension.

[0073] S23, generates feature representation of the heterogeneous graph through the adjacency matrix and node feature matrix of each subgraph.

[0074] For example, the adjacency matrix A of each subgraph is k Combined with the node feature matrix, a larger matrix or data structure is formed, which can simultaneously represent the characteristics of the nodes in the graph and the connection relationship between the nodes.

[0075] It should be understood that the heterogeneous graph G = (V, {E k}), contains multiple types of edges, each edge represents an interaction relationship, where {E k} represents the edge set consisting of all different interaction relationships. The feature representation of the heterogeneous graph can be directly input into the graph convolutional neural network for processing and analysis.

[0076] Then, the nodes in the heterogeneous graph are divided according to a preset ratio (for example, 4:3:3) to generate a training set, a validation set, a test set, and a validation set; in the training set, all nodes marked as abnormal users are removed, and only normal user nodes are retained to ensure that the model is trained only with positive data.

[0077] Furthermore, the node data retained in the training set is input into the GCN model, and forward propagation is performed through the graph convolutional neural network to obtain the feature vector of each node, and the feature vector of each node is substituted into the above compact classification loss function to calculate the loss value. According to the loss value, the parameters of the graph convolutional neural network are updated through back propagation, and then the process of forward propagation, loss value calculation and back propagation is iterated until the preset end condition is reached, such as when the performance index on the validation set is no longer improved, and the target detection model is finally obtained. Optionally, during the back propagation process, the parameters of the model are updated using the gradient descent method to ensure that the features of the forward nodes are more compact and the features of abnormal users can be effectively distinguished.

[0078] For each training round, a graph convolutional neural network is used to calculate the final feature representation of all nodes. To ensure that the model can effectively distinguish abnormal users from normal users, only positive nodes in the training set are used to optimize the model, and the importance evaluation of specific nodes is enhanced through the self-attention mechanism.

[0079] After the model training is completed, the optimal model parameters in the training process are saved, the model convergence status is judged by monitoring the performance indicators (Area Under Curve (AUC), Recall) on the validation set, and the model parameters with the best performance are saved; this step uses an early stopping strategy to prevent the model from overfitting; when the performance indicators on the validation set no longer improve, the training process will stop, the current model weights with the best performance will be saved, and the target detection model will be generated.

[0080] S3, obtain the user relationship graph to be identified, input the user relationship graph to be identified into the target detection model, perform convolution operation on each subgraph in the user relationship graph through the first graph convolution layer, calculate the initial feature representation of each node, perform linear transformation on the initial feature representation through the heterogeneous graph aggregation module to calculate the attention score, perform weighted summation on the initial feature representation of each node based on the attention score, and obtain the aggregated feature; perform secondary convolution operation on the aggregated feature through the second graph convolution layer, generate the final output feature based on the feature after the secondary convolution operation through the fully connected layer, and map the output feature to the classification space, and output the abnormal classification result of the user.

[0081] Among them, the user relationship graph is a heterogeneous graph, which contains subgraphs corresponding to multiple relationships. The nodes of the subgraphs represent users. In each subgraph, in order to prevent isolated nodes, an edge (self-loop) is added to each node to ensure that each node has at least one neighbor in the graph convolution, ensuring that the features can be effectively updated.

[0082] For example, the user relationship graph to be identified is input into the target detection model, and the subgraph G of each interaction relationship is k, the initial feature representation h of each node is calculated through the first graph convolution layer k ; The initial feature representation is linearly transformed through the self-attention mechanism to calculate the attention score α k , the process can be expressed by the following formula:

[0083] h k =ReLU(conv1 k (G k ,X));

[0084] α k =softmax(W q h k );

[0085] Among them, X is the input feature of the node, conv1 k (·) represents the convolution operation of the first graph convolutional layer, ReLU(·) represents the activation function, and W q represents the linear transformation parameter, and softmax(·) represents the normalization function.

[0086] It should be understood that the first convolutional layer (the first convolutional layer) conv1 is a module containing multiple sub-graph convolutions (GraphConv), which performs feature extraction for each edge type; in various real networks, various relationships represent different meanings and have different impacts on the results. In order to capture the importance of nodes under different relationships, the self-attention mechanism is introduced to give different weights to different relationships. Specifically, each sub-graph feature generates a scalar weight through a linear transformation.

[0087] Then, the initial feature representation of each node is weighted summed based on the attention score to generate a global node feature representation h that integrates all relationships:

[0088]

[0089] Among them, h is the feature representation after aggregation.

[0090] Furthermore, the aggregated feature representation is input into the second graph convolution layer for convolution operation. This step performs a convolution operation on each interaction relationship and sums the features obtained by the convolution operation. The formula is:

[0091]

[0092] Among them, h out is the node feature aggregated after the second convolution operation, and conv2(·) represents the convolution operation of the second graph convolution layer.

[0093] Optionally, in the present invention, the input feature dimension of conv1 is kept consistent with the node feature dimension, and the dimension of the output layer can be set to 64. By performing convolution on each relationship separately, a secondary convolution operation is implemented on each subgraph.

[0094] Then, h out The data is passed to the fully connected layer fc for integration to form a global node embedding representation. The fully connected layer performs a linear transformation on the node features through the weight matrix and the bias term, further adjusts the node feature representation, generates the final output features and maps the output features to the classification space, and outputs the abnormal classification results of the users, that is, identifies which users are abnormal users, as shown below:

[0095]

[0096] Among them, X represents the node feature matrix, A represents the adjacency matrix of the graph, and θ is the parameter of the model. is the abnormal identification result of user node i.

[0097] It should be understood that the target detection model outputs an abnormal or normal classification label for each user node, which is used to determine whether the user is an abnormal user.

[0098] Optionally, before training the GCN model, the present invention may also introduce a distillation loss function, and use the compact classification loss function and the distillation loss function as a mixed loss function to train the graph convolutional neural network.

[0099] The expression of the distillation loss function is:

[0100]

[0101] Among them, f current (x i ) is the feature generated by the current model, f original (x i ) is the feature generated by the historical model (i.e., the model in the previous round of training), and M is the number of all training nodes.

[0102] It should be understood that the purpose of introducing distillation loss is to reduce the difference between the current model and the historical model in the feature space to maintain the stability of performance during the model update process.

[0103] Furthermore, the compact classification loss function and the distillation loss function are used as the hybrid loss function in the model training process, which is expressed as follows:

[0104] L total =λ1L compact +λ2L distill ;

[0105] Among them, Lcompact is the compact classification loss function, L distill is the distillation loss function, λ1 and λ2 are the balance parameters of compact classification loss and distillation loss, respectively.

[0106] Next, combine Figure 2 The model training process in the present invention is further introduced. Figure 2 A schematic diagram of the structure of a graph convolutional neural network provided in an embodiment of the present invention.

[0107] For example, Figure 2 As shown in Figure 1, the heterogeneous graph is input into the graph convolutional neural network. For each subgraph (relationship) in the heterogeneous graph, after the above GCN layer operation, the node feature representation of each node under each relationship is calculated. Then, the weighted sum of each node feature representation is calculated through self-attention to achieve dynamic aggregation of features learned by the model in different relationships. During the training process, the "compact classification-distillation" hybrid loss function is optimized to ensure the accuracy of model anomaly recognition and the stability of model performance.

[0108] Next, the anomaly detection performance of the present invention is verified.

[0109] Figure 3 A schematic diagram of ACU curve comparison provided by an embodiment of the present invention.

[0110] Specifically, Figure 3 As shown, the existing anomaly recognition method Support Vector Data Description (SVDD) method is used as a comparison method to compare the recognition accuracy of abnormal users. The node features in the FruadAmazonDataset data set are used as input. The AUC curve corresponding to the anomaly recognition method of the present application is curve 201, and the AUC curve corresponding to the comparison method SVDD method is curve 202. Through the comparison, it can be seen that the method of the present application has a significant lead in the unbalanced data set.

[0111] By changing the proportion of the training set in the data set, the anomaly recognition method in this application and the existing general recognition method are used to perform recognition on the FraudAmazonDataset data set using SVDD. The AUC comparison results obtained at each stage are shown in Table 1 below:

[0112] Table 1 AUC comparison results

[0113]

[0114] It can be seen from Table 1 above that the present invention has a significant improvement in effect compared with the existing anomaly recognition comparison algorithm SVDD.

[0115] In summary, the present invention can effectively deal with the problems of scarcity of abnormal user data and label imbalance in actual scenarios; compared with traditional anomaly detection methods, the single-classification model designed by the present invention only needs to be trained on positive user data, and can identify potential abnormal behaviors in unlabeled complex user networks, which significantly improves the adaptability and generalization ability of the model.

[0116] By introducing the self-attention mechanism, the present invention can accurately capture the feature correlation of user behaviors under different relationship types in heterogeneous graphs, thereby realizing effective information fusion between multiple subgraphs and avoiding the recognition errors caused by isolated nodes or missing features in traditional methods.

[0117] In addition, the present invention introduces a "compact classification-distillation" loss function, which realizes the use of a single category data set for training and optimizes the model's recognition performance for abnormal users. This loss function can enhance the detection ability of abnormal behavior through knowledge distillation while retaining the characteristics of normal users. This design not only improves the robustness of the model, but also makes the method more efficient in actual application scenarios such as large-scale social networks, e-commerce platforms, and financial risk control, reducing the model's memory consumption and time complexity.

[0118] Based on the same inventive concept, the embodiment of the present invention also provides an abnormal user detection device, such as Figure 4 As shown, the device comprises:

[0119] Building module 41 is used to build a graph convolutional neural network for processing heterogeneous graphs. The graph convolutional neural network includes two graph convolutional layers and a fully connected layer. A heterogeneous graph aggregation module with a multi-channel self-attention mechanism is added after the first graph convolutional layer. The loss function of the graph convolutional neural network is a compact classification loss function.

[0120] The training module 42 is used to obtain a data set including user interaction data, generate a heterogeneous graph including multiple interaction relationships based on the data set; determine a training set for model training from the heterogeneous graph, delete the nodes marked as abnormal users in the training set, and retain the nodes marked as normal users; input the node data retained in the training set into the graph convolutional neural network for training, update the model parameters of the graph convolutional neural network by optimizing the loss function, and obtain the target detection model.

[0121] The identification module 43 is used to obtain a user relationship graph to be identified, where the user relationship graph includes subgraphs corresponding to multiple relationships, and the nodes of the subgraphs represent users; the user relationship graph to be identified is input into the target detection model, and a convolution operation is performed on each subgraph in the user relationship graph through the first graph convolution layer, and the initial feature representation of each node is calculated, and the initial feature representation is linearly transformed by the heterogeneous graph aggregation module to calculate the attention score, and the initial feature representation of each node is weighted summed based on the attention score to obtain the aggregated feature; a secondary convolution operation is performed on the aggregated feature through the second graph convolution layer, and the final output feature is generated based on the feature after the secondary convolution operation through the fully connected layer, and the output feature is mapped to the classification space, and the abnormal classification result of the user is output.

[0122] Each module in the abnormal user detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0123] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps in the abnormal user detection method embodiment. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0124] Furthermore, the present invention also provides a non-temporary computer-readable storage medium containing instructions, and a computer program is stored on the storage medium. For example, a memory containing instructions, the above instructions can be executed by a processor of a computer device to complete the above method. For example, a non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device. When the computer program is executed by the processor, the steps in the abnormal user detection method embodiment can be implemented. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0125] It will be appreciated by those skilled in the art that embodiments of the present invention may provide methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0126] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0127] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0128] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0129] It should be pointed out that the specific implementation methods described above can enable those skilled in the art to understand the invention more comprehensively, but do not limit the invention in any way. Therefore, although the invention has been described in detail in this specification and embodiments, those skilled in the art should understand that the invention can still be modified or replaced by equivalents; and all technical solutions and improvements that do not deviate from the spirit and scope of the invention are included in the protection scope of the invention. Any figure mark in the claims should not be regarded as limiting the claims involved. Any simple change or equivalent replacement of the technical solution that can be obviously obtained by any technician familiar with the field within the technical scope disclosed in the present invention belongs to the protection scope of the present invention.

Claims

1. A method for detecting abnormal users, characterized in that: include: Construct a graph convolutional neural network for processing heterogeneous graphs. The graph convolutional neural network includes two graph convolutional layers and a fully connected layer. A heterogeneous graph aggregation module with a multi-channel self-attention mechanism is added after the first graph convolutional layer. The loss function of the graph convolutional neural network is a compact classification loss function. Obtain a data set including user interaction data, and generate a heterogeneous graph containing multiple interaction relationships based on the data set; determine a training set for model training from the heterogeneous graph, delete nodes marked as abnormal users in the training set, and retain nodes marked as normal users; input the node data retained in the training set into the graph convolutional neural network for training, and update the model parameters of the graph convolutional neural network by optimizing the loss function to obtain a target detection model; A user relationship graph to be identified is obtained, and the user relationship graph includes subgraphs corresponding to multiple relationships, and the nodes of the subgraphs represent users; the user relationship graph to be identified is input into the target detection model, and a convolution operation is performed on each subgraph in the user relationship graph through the first graph convolution layer, and the initial feature representation of each node is calculated. The initial feature representation is linearly transformed by the heterogeneous graph aggregation module to calculate the attention score, and the initial feature representation of each node is weighted summed based on the attention score to obtain the aggregated feature; a secondary convolution operation is performed on the aggregated feature through the second graph convolution layer, and the final output feature is generated based on the feature after the secondary convolution operation through the fully connected layer, and the output feature is mapped to the classification space, and the abnormal classification result of the user is output.

2. The abnormal user detection method according to claim 1, characterized in that: Generate a heterogeneous graph containing various interactive relationships based on the dataset, including: Based on each interaction relationship in the data set, the user is used as a node and the interaction relationship as an edge to generate a corresponding subgraph; An adjacency matrix is ​​constructed based on the connection relationship in the subgraph; wherein the adjacency matrix is ​​used to characterize whether there is an interactive relationship between users; a node feature matrix is ​​constructed, and the node feature matrix includes the attribute information of the user; The feature representation of the heterogeneous graph is generated through the adjacency matrix and node feature matrix of each subgraph.

3. The abnormal user detection method according to claim 1 or 2, characterized in that: The node data retained in the training set is input into the graph convolutional neural network for training, and the model parameters of the graph convolutional neural network are updated by optimizing the loss function, including: The input node data is forward propagated through the graph convolutional neural network to obtain the feature vector of each node; The loss value is calculated based on the feature vector of each node using the compact classification loss function; according to the loss value, the parameters of the graph convolutional neural network are updated through back propagation; the expression of the compact classification loss function is: Among them, f(x i ) represents the feature vector of the i-th node, c represents the center of all positive node feature vectors, and N is the number of positive nodes; The process of iterative forward propagation, loss value calculation and back propagation is repeated until the preset end condition is reached to obtain the target detection model.

4. The abnormal user detection method according to claim 1 or 2, characterized in that: The loss function of the graph convolutional neural network also includes a distillation loss function. The model parameters of the graph convolutional neural network are updated by optimizing the loss function, including: The hybrid loss function that optimizes the compact classification loss function and the distillation loss function updates the model parameters of the graph convolutional neural network. The expression of the hybrid loss function is: L total =λ1L compact +λ2L distill ; Among them, L compact is the compact classification loss function, L distill is the distillation loss function, λ1 and λ2 are the balance parameters of compact classification loss and distillation loss, respectively.

5. The abnormal user detection method according to claim 1 or 2, characterized in that: Build a graph convolutional neural network for processing heterogeneous graphs, including: Design the input feature dimension of the graph convolutional neural network according to the feature dimension of the node; The Xavier initialization method is used to initialize the parameters of the graph convolutional neural network.

6. An abnormal user detection device, characterized in that: include: A construction module is used to construct a graph convolutional neural network for processing heterogeneous graphs. The graph convolutional neural network includes two graph convolutional layers and a fully connected layer. A heterogeneous graph aggregation module with a multi-channel self-attention mechanism is added after the first graph convolutional layer. The loss function of the graph convolutional neural network is a compact classification loss function. The training module is used to obtain a data set including user interaction data, generate a heterogeneous graph including multiple interaction relationships according to the data set; determine a training set for model training from the heterogeneous graph, delete nodes marked as abnormal users in the training set, and retain nodes marked as normal users; input the node data retained in the training set into the graph convolutional neural network for training, and update the model parameters of the graph convolutional neural network by optimizing the loss function to obtain a target detection model; The recognition module is used to obtain the user relationship graph to be identified, which includes subgraphs corresponding to multiple relationships, and the nodes of the subgraphs represent users; the user relationship graph to be identified is input into the target detection model, and a convolution operation is performed on each subgraph in the user relationship graph through the first graph convolution layer to calculate the initial feature representation of each node, and the initial feature representation is linearly transformed by the heterogeneous graph aggregation module to calculate the attention score, and the initial feature representation of each node is weighted summed based on the attention score to obtain the aggregated feature; the aggregated feature is secondary convolutionally performed on the aggregated feature through the second graph convolution layer, and the final output feature is generated based on the feature after the secondary convolution operation through the fully connected layer, and the output feature is mapped to the classification space to output the abnormal classification result of the user.

7. A computer device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the abnormal user detection method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the abnormal user detection method according to any one of claims 1 to 5 is implemented.

Images