Fraudulent transaction risk monitoring method and device based on graph neural network, equipment and medium

Abstract

The invention discloses a fraudulent transaction risk monitoring method and device based on a graph neural network, equipment and a medium, and relates to the field of anti-fraudulent, and the method comprises the steps: determining each transaction node and each neighbor entity in a dynamic transaction graph, linking each transaction node with each neighbor entity, and constructing a target static graph; creating new transaction nodes and new neighbor entities respectively, and constructing a snapshot graph according to the new transaction nodes, the transaction time corresponding to the new transaction nodes, the new neighbor entities and the reference transaction nodes; determining a first target directed graph based on the target static graph and the snapshot graph, and training the target graph neural network by using the first target directed graph to obtain a trained neural network; and when a new transaction occurs, determining a second target directed graph of the new transaction through transaction information of the new transaction, determining a risk score of the new transaction by using the trained neural network and the second target directed graph, and determining a fraud risk of the new transaction based on the risk score. Therefore, accurate fraud monitoring is realized.

Description

Technical Field

[0001] The present invention relates to the field of anti-fraud, and in particular to a method, device, equipment and medium for monitoring fraudulent transaction risks based on a graph neural network. Background Art

[0002] In the e-commerce market, detecting fraudulent transactions is an important part of controlling risks. With the increase in online transactions, fraudulent behaviors have become more complex and hidden. Although traditional rule-based and machine learning filters have been applied in production, they often face limitations when dealing with complex fraud patterns. Graph Neural Networks (GNNs), as an emerging deep learning technology, can effectively capture multi-hop risk propagation in transaction graphs and provide more accurate fraud detection. Currently, when applying GNNs to production environments, there are two major challenges because the graph is dynamically changing: Information leakage in dynamic graphs: When messaging, future information should not be considered to ensure that the model's predictions of past events are accurate. Latency issues: The latency of graph queries and GNN model inferences is usually as high as hundreds of milliseconds, which is unacceptable for some critical online services. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for monitoring fraudulent transaction risks based on graph neural network, which can realize efficient end-to-end GNN learning and real-time reasoning, and realize efficient real-time fraud detection. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a fraudulent transaction risk monitoring method based on a graph neural network, comprising:

[0005] Determine each transaction node in the dynamic transaction graph according to the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph;

[0006] Based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, a new transaction node and a new neighbor entity are respectively created, and a snapshot graph is constructed according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is a transaction node within the target time period referenced when analyzing the target transaction node;

[0007] Determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and training a target graph neural network using the first target directed graph to obtain a trained neural network;

[0008] When a new transaction occurs, the transaction information of the new transaction is determined, and the second target directed graph corresponding to the new transaction is determined through the transaction information, the risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

[0009] Optionally, the neighbor entity includes any one or a combination of the shipping address of the transaction, the user's email, IP address, device ID, user's contact number, payment token, and user account.

[0010] Optionally, constructing a snapshot graph according to each of the new transaction nodes, the transaction time corresponding to each of the new transaction nodes, each of the new neighbor entities, and the referenced transaction node includes:

[0011] Determine a one-hop neighbor node corresponding to the new transaction node and a one-hop neighbor node corresponding to the referenced transaction node in the new neighbor entity;

[0012] An edge is created between the new transaction node and a one-hop neighbor node corresponding to the new transaction node, and an edge is created between the reference transaction node and a one-hop neighbor node corresponding to the reference transaction node, so as to construct a snapshot graph corresponding to the transaction time.

[0013] Optionally, determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph includes:

[0014] Put the new transaction node corresponding to the snapshot graph, the one-hop neighbor node corresponding to the new transaction node, and the reference transaction node into a target partition;

[0015] The reference transaction node in the target partition and the one-hop neighbor node corresponding to the reference transaction node are connected by a bidirectional edge, and the one-hop neighbor node corresponding to the new transaction node and the new transaction node are linked to determine a first target directed graph corresponding to the historical transaction data.

[0016] Optionally, the target graph neural network includes a batch network and a real-time network built based on a graph convolutional layer and a decoder.

[0017] Optionally, the determining the risk score of the new transaction by using the trained neural network and the second target directed graph includes:

[0018] Input the feature information of the historical relationship subgraph in the second target directed graph and the feature embedding of the one-hop neighbor node corresponding to the new transaction node into the batch processing network to obtain a plurality of entity embeddings;

[0019] A risk score for the new transaction is determined based on a number of the entity embeddings and the real-time network.

[0020] Optionally, the determining the risk score of the new transaction based on the plurality of entity embeddings and the real-time network includes:

[0021] Determine the embedding of a new transaction node obtained by inference of the real-time network based on the real-time network, the plurality of entity embeddings, and the feature embedding of a new transaction node in the snapshot graph corresponding to the new transaction;

[0022] The risk score of the new transaction is determined by embedding the new transaction node obtained by the real-time network reasoning and a preset weight matrix.

[0023] In a second aspect, the present application discloses a fraudulent transaction risk monitoring device based on a graph neural network, comprising:

[0024] A static graph construction module, used to determine each transaction node in the dynamic transaction graph according to the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph;

[0025] A snapshot graph construction module, used to create new transaction nodes and new neighbor entities respectively based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, and to construct a snapshot graph according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is a transaction node within a target time period referenced when analyzing the target transaction node;

[0026] A training module, configured to determine a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and train a target graph neural network using the first target directed graph to obtain a trained neural network;

[0027] A fraud risk determination module is used to determine the transaction information of a new transaction when a new transaction occurs, and determine a second target directed graph corresponding to the new transaction through the transaction information, determine a risk score of the new transaction using the trained neural network and the second target directed graph, and determine the fraud risk of the new transaction based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

[0028] In a third aspect, the present application discloses an electronic device, comprising:

[0029] Memory, used to store computer programs;

[0030] A processor is used to execute the computer program to implement the aforementioned method for monitoring fraudulent transaction risks based on graph neural network.

[0031] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for monitoring fraud transaction risks based on a graph neural network.

[0032] When monitoring fraudulent transaction risks, the present application first determines each transaction node in the dynamic transaction graph according to the payment transaction and transaction ID, determines each neighbor entity of each transaction node, and links each transaction node with the corresponding neighbor entity to construct a target static graph; then, based on each transaction node in the target static graph and the neighbor entity corresponding to each transaction node, a new transaction node and a new neighbor entity are created respectively, and a snapshot graph is constructed according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is the time when the target transaction node is analyzed. The transaction nodes within the referenced target time period are determined; based on the target static graph and the snapshot graph, the first target directed graph corresponding to the historical transaction data is determined, and the target graph neural network is trained using the first target directed graph to obtain a trained neural network; finally, when a new transaction occurs, the transaction information of the new transaction is determined, and the second target directed graph corresponding to the new transaction is determined through the transaction information, and the risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph. It can be seen that the present application ensures the directional control of the information flow by constructing a target directed graph, and only uses historical transaction information for prediction. Batch processing and online learning are supported by maintaining static graphs and snapshot graphs. Lambda neural networks are used to train the converted graphs and optimize model parameters. Finally, the trained model is used to perform real-time fraud detection on new transactions to quickly respond to potential fraudulent behaviors. This improves the efficiency and accuracy of fraud detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0034] Figure 1 A flowchart of a fraudulent transaction risk monitoring method based on graph neural network disclosed in this application;

[0035] Figure 2 A transaction diagram disclosed in this application;

[0036] Figure 3 A schematic diagram of a static image disclosed in this application;

[0037] Figure 4 A schematic diagram of a snapshot diagram disclosed in this application;

[0038] Figure 5 A schematic diagram of a target directed graph disclosed in this application;

[0039] Figure 6 A schematic diagram of a Lambda neural network structure disclosed in this application;

[0040] Figure 7 This is a schematic diagram of the structure of a fraudulent transaction risk monitoring device based on a graph neural network disclosed in this application;

[0041] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Currently, when applying GNNs in production environments, there are two main challenges because the graph is dynamically changing: 1. Information leakage in dynamic graphs: When messaging, future information should not be considered to ensure that the model's predictions of past events are accurate. 2. Latency issues: The latency of graph queries and GNN model reasoning is typically as high as hundreds of milliseconds, which is unacceptable for some critical online services. In order to solve the above technical problems, the present application discloses a method, device, equipment and medium for fraudulent transaction risk monitoring based on graph neural networks, which can achieve efficient end-to-end GNN learning and real-time reasoning, and achieve efficient real-time fraud detection.

[0044] See also Figure 1 As shown, the embodiment of the present invention discloses a fraudulent transaction risk monitoring method based on a graph neural network, comprising:

[0045] Step S11, determining each transaction node in the dynamic transaction graph according to the payment transaction and the transaction ID, determining each neighbor entity of each transaction node, and linking each transaction node with the corresponding neighbor entity to construct a target static graph.

[0046] In this embodiment, in order to collect neighbor features to assess the risk of transaction fraud, multiple entities are considered as neighbors of transaction nodes. These entities, including shipping addresses, emails, IP (Internet Protocol) addresses, device IDs (Identity documents), contact numbers, payment tokens, and user accounts, are represented as entity vertices in the static graph. Each transaction node represents a payment transaction and a unique transaction ID, linked to multiple entity vertices, such as shipping addresses, emails, and contact numbers that buyers need to confirm on the payment page. Most entity vertices are also linked to multiple transaction vertices. Given a set of target transactions, a static graph G can be constructed from their records. A transaction record can be decomposed into a transaction vertex and several entity vertices. Edges are placed between entities and transactions that use these entities. If reference transactions within a given observation window share the same entities, these reference transactions will be extracted. Edges will also be added between reference transactions and common entities. In a specific embodiment, such as Figure 2 As shown in the figure, there are several transaction records. The static graph structure is shown in the attached figure. Figure 3 shown.

[0047] Step S12: creating new transaction nodes and new neighbor entities based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, and constructing a snapshot graph according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and the referenced transaction node; the referenced transaction node is a transaction node within the target time period referenced when analyzing the target transaction node.

[0048] In this embodiment, when constructing a snapshot graph, firstly, based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, a new transaction node and a new neighbor entity are created respectively, then the one-hop neighbor node corresponding to the new transaction node and the one-hop neighbor node corresponding to the reference transaction node in the new neighbor entity are determined; an edge is created between the new transaction node and the one-hop neighbor node corresponding to the new transaction node, and an edge is created between the reference transaction node and the one-hop neighbor node corresponding to the reference transaction node, so as to construct a snapshot graph corresponding to the transaction time. Specifically, T is a time window in a snapshot graph. The snapshot vertex vt∈VT represents a static vertex. The snapshot vertex vt is the transformation of the vertex v at snapshot t. The workflow of constructing the snapshot graph is as follows. (1) For each transaction node txn on the static graph G, construct txnt on snapshot t (the corresponding transaction node constructed on snapshot t for transaction txn at time t), where t is the time period for creating the transaction. (2) For each entity node directly linked to the transaction node, create a node entity t on snapshot t, sharing the same transaction creation time. If an entity is linked to transactions created in various snapshots, there may be multiple instances of the same entity. (3) Create an edge between the target transaction node txnt and its 1-hop entity neighbor. (4) Create an edge between the reference transaction node txni and its 1-hop entity neighbor, where 0≤i≤t. When analyzing transaction txn at time t, txnt is the target transaction node, and in order to analyze txnt, it is necessary to reference transaction information between time 0-t. The referenced transaction node is called the reference transaction node. Figure 4 In the snapshot diagram shown, when transaction 1 is the target transaction, transactions 2, 3, and 4 are reference transactions.

[0049] Step S13: determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and using the first target directed graph to train a target graph neural network to obtain a trained neural network.

[0050] In this embodiment, after constructing the target static graph and the snapshot graph, the first target directed graph (also called a two-stage directed graph) corresponding to the historical transaction data is determined according to the target static graph and the snapshot graph. The new transaction node corresponding to the snapshot graph, the one-hop neighbor node corresponding to the new transaction node, and the reference transaction node are placed in the target partition; the reference transaction node in the target partition and the one-hop neighbor node corresponding to the reference transaction node are connected by bidirectional edges, and the one-hop neighbor node corresponding to the new transaction node and the new transaction node are linked to determine the first target directed graph corresponding to the historical transaction data. Specifically, the two-stage directed graph simplifies the topological view starting from the target transaction end, making it easy to split the graph into a real-time graph (real-time link subgraph) and a batch graph (historical relationship subgraph), which are later acquired by the LNN as inputs to various parts of the network. The historical relationship subgraph is used to store past transaction information, while the real-time link subgraph is used to capture current transaction activities. The partition of the target transaction is introduced to isolate transaction roles, because transactions can be simultaneously target / reference transactions. All reference transaction nodes that share a common entity are stored in the same partition with the target transaction. In the two-phase directed graph, a transaction has only one role, namely the target transaction or the reference transaction. In a target partition partitiont, there are multiple snapshots i, where 0≤i≤t. The construction workflow shown is as follows:

[0051] (1) Put the target transaction txnt, their corresponding 1-hop entities entityt and reference transactions txni, where 0≤i≤t, into partitiont. These transactions are represented as txntgtt and txnreft. These entities are represented as entitytgtt. In the two-stage directed graph, txntgtt is the target transaction node, txnreft is the reference transaction node, and entitytgtt is the 1-hop entity node corresponding to the target transaction node. If the related target transactions of the reference transaction are in different time snapshots, they can be placed in multiple partitions. (2) Connect txnreft and entitytgtt with bidirectional edges to form a batch graph. It is used for batch reasoning of entity representation. (3) Link entitytgtt and txntgtt, and use directed edges from entities to target transactions to form a real-time link subgraph. It is used for real-time inference of transaction risks. In a specific embodiment, in the two-stage directed graph of partition t, as shown Figure 5 As shown, the target transaction is transaction t, and the referenced transactions are transactions t-1, t-2, and t-3, which are then acquired by the LNN (Linear Neural Network) as input to various parts of the network for model training.

[0052] Afterwards, the Lambda neural network is used to train the converted graph and optimize the model parameters. The present invention introduces a Lambda neural network (LNN) structure, as shown in the attached figure. Figure 6 As shown in , the Lambda architecture is a hybrid data processing approach that processes large amounts of data in both batch and stream processing ways. The Lambda neural network consists of a batch net and a real-time net built on graph convolutional layers and decoders. One of the benefits of the Lambda architecture is the balance between data processing scalability and data access latency. The LNN architecture processes message passing from batch graphs and real-time graphs in separate GNN blocks. Message passing on the batch graph is performed in batch jobs through the batch net. Message passing on the real-time graph is performed in a real-time inference manner through the real-time (RT) network deployed in an online service. As Figure 6 As shown, LNN consists of a batch net (right) and a real-time (RT Net) net (left). Batch Net is a stack of GNN layers. RT Net consists of a graph convolution layer and a decoder, which is a fully connected linear layer. The first stage is batch net inference, after which the entity embeddings learned from historical transactions are obtained and refreshed to a key-value store. In the second stage, RT Net obtains the entity embeddings from the key-value store and also obtains the original features from the target transaction, and then calculates the transaction risk score. Finally, the trained neural network is obtained.

[0053] Step S14: When a new transaction occurs, determine the transaction information of the new transaction, and determine the second target directed graph corresponding to the new transaction through the transaction information, determine the risk score of the new transaction using the trained neural network and the second target directed graph, and determine the fraud risk of the new transaction based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

[0054] In this embodiment, when a new transaction appears, the transaction data is first collected and cleaned to construct the target transaction information (i.e., a dynamic transaction graph, target transactions and their one-hop entities and edges, similar to the real-time link subgraph in the training process). Then the second target directed graph of the new transaction is determined, and the feature information of the historical relationship subgraph in the second target directed graph and the feature embedding of the one-hop neighbor node corresponding to the new transaction node are input into the batch network to obtain several entity embeddings; the embedding of the new transaction node obtained by real-time network reasoning is determined based on the real-time network, several entity embeddings, and the feature embedding of the new transaction node in the snapshot graph corresponding to the new transaction; the risk score of the new transaction is determined by the embedding of the new transaction node obtained by real-time network reasoning and the preset weight matrix. Specifically, the trained model is used to perform real-time fraud detection on new transactions to quickly respond to potential fraudulent behavior. The end-to-end training uses a complete LNN architecture. When deployed in a production environment, LNN reasoning is decoupled into batch reasoning and real-time reasoning. For the batch reasoning stage, the embedding hbatcht of the entity entitytgtt is generated regularly according to the equation. Finally, the entity embeddings are generated and stored in a distributed key-value database, and these embeddings are used to detect fraudulent transactions. The embedding is refreshed every unit time (e.g., every day) to provide real-time transaction risk assessment. For real-time risk assessment, the second stage of LNN (i.e., RT Net) calculates the score through the equation. The result is equivalent to the end-to-end reasoning of the full LNN adopted in the training phase. Since the RT Net has only 1 layer, the reasoning latency is further significantly reduced.

[0055] When monitoring fraudulent transaction risks, the present application first determines each transaction node in the dynamic transaction graph according to the payment transaction and transaction ID, determines each neighbor entity of each transaction node, and links each transaction node with the corresponding neighbor entity to construct a target static graph; then, based on each transaction node in the target static graph and the neighbor entity corresponding to each transaction node, a new transaction node and a new neighbor entity are created respectively, and a snapshot graph is constructed according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is the time when the target transaction node is analyzed. The transaction nodes within the referenced target time period are determined; based on the target static graph and the snapshot graph, the first target directed graph corresponding to the historical transaction data is determined, and the target graph neural network is trained using the first target directed graph to obtain a trained neural network; finally, when a new transaction occurs, the transaction information of the new transaction is determined, and the second target directed graph corresponding to the new transaction is determined through the transaction information, and the risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph. It can be seen that the present application ensures the directional control of the information flow by constructing a target directed graph, and only uses historical transaction information for prediction. Batch processing and online learning are supported by maintaining static graphs and snapshot graphs. Lambda neural networks are used to train the converted graphs and optimize model parameters. Finally, the trained model is used to perform real-time fraud detection on new transactions to quickly respond to potential fraudulent behaviors. This improves the efficiency and accuracy of fraud detection.

[0056] Based on the above embodiment, it can be seen that when the application performs fraudulent transaction risk monitoring, the model will be trained first, and the trained model will be used to perform real-time fraud detection on new transactions. Next, the model training process will be described in detail.

[0057] like Figure 6 As shown, the LNN consists of a batch net (right side) and a real-time (RT Net) net (left side). Batch Net is a stack of GNN layers. RT Net consists of a graph convolutional layer and a decoder, which is a fully connected linear layer. The first stage is batch net inference, after which we will obtain the entity embeddings learned from historical transactions and flush them to a key-value store. In the second stage, RT Net obtains the entity embeddings from the key-value store and also obtains the original features from the target transaction, and then calculates the transaction risk score. The following details the training process:

[0058] During the training phase, both the batch graph and the real-time graph are used for end-to-end LNN training. In each batch, a partition is sampled for a time window T, where T := {0, 1, ..., t}. The timestamp of each target transaction is within the partition time window. All timestamps of reference transactions precede the timestamp of the target transaction.

[0059] Similar to traditional GNN, the input of the batch network includes the features of the reference transaction Xt and the batch graph Batch Grapht, as shown in the following equation:

[0060] ;

[0061] in, are several entity embeddings obtained by the final training of the batch network on partitiont (target partition); X t Feature embedding for reference transactions on partitiont (similar to traditional GNN) It is the feature information of the batch graph on partitiont (similar to traditional GNN); Batch Net is a stack of GNN layers;

[0062] Each graph convolution layer of the batch net is generic, and as input, the RT net takes features from the target transaction and the entity embedding learned from the batch net inference. The graph convolution layer of the RT net is in the same form as the batch net, as shown in the equation below, with one difference being that there is only one convolution layer in the RT net for improved inference efficiency. In addition, the RT Net isolates the message aggregation between different target transaction nodes in the same target snapshot partition.

[0063] ;

[0064] in, is the embedding of the target transaction txnt obtained through real-time network reasoning; ⊙ is a generalized node aggregation function. ∪ represents concatenation in deep learning; W is the weight matrix; is a linear mapping of transaction features to ensure that transaction features and embeddings have the same dimension. Feature embedding for target transaction txnt; Vertex All neighbors of ; For entity nodes Embeddings obtained through batch network reasoning; For entity nodes.

[0065] The risk score of the target transaction txnt is decoded by the hRTtxnt embedded in the real-time transaction, as shown in the following equation:

[0066] ;

[0067] Where W is the weight matrix; The embedding obtained by real-time network reasoning for the target transaction txnt; Score the risk of the target transaction txnt. Finally, a trained neural network is obtained.

[0068] In this way, by monitoring the risk of fraudulent transactions through a pre-trained model, batch network inference is omitted in the process of fraudulent transaction risk monitoring, further reducing the latency of end-to-end inference, thereby improving the efficiency and accuracy of fraud detection and achieving significant performance improvement and latency reduction.

[0069] See also Figure 7 As shown, the embodiment of the present invention discloses a fraudulent transaction risk monitoring device based on a graph neural network, comprising:

[0070] The static graph construction module 11 is used to determine each transaction node in the dynamic transaction graph according to the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph;

[0071] The snapshot graph construction module 12 is used to create new transaction nodes and new neighbor entities respectively based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, and to construct a snapshot graph according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is a transaction node within the target time period referenced when analyzing the target transaction node;

[0072] A training module 13 is used to determine a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and train a target graph neural network using the first target directed graph to obtain a trained neural network;

[0073] The fraud risk determination module 14 is used to determine the transaction information of a new transaction when a new transaction occurs, and determine the second target directed graph corresponding to the new transaction through the transaction information, determine the risk score of the new transaction using the trained neural network and the second target directed graph, and determine the fraud risk of the new transaction based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

[0074] When monitoring fraudulent transaction risks, the present application first determines each transaction node in the dynamic transaction graph according to the payment transaction and transaction ID, determines each neighbor entity of each transaction node, and links each transaction node with the corresponding neighbor entity to construct a target static graph; then, based on each transaction node in the target static graph and the neighbor entity corresponding to each transaction node, a new transaction node and a new neighbor entity are created respectively, and a snapshot graph is constructed according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is the time when the target transaction node is analyzed. The transaction nodes within the referenced target time period are determined; based on the target static graph and the snapshot graph, the first target directed graph corresponding to the historical transaction data is determined, and the target graph neural network is trained using the first target directed graph to obtain a trained neural network; finally, when a new transaction occurs, the transaction information of the new transaction is determined, and the second target directed graph corresponding to the new transaction is determined through the transaction information, and the risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph. It can be seen that the present application ensures the directional control of the information flow by constructing a target directed graph, and only uses historical transaction information for prediction. Batch processing and online learning are supported by maintaining static graphs and snapshot graphs. Lambda neural networks are used to train the converted graphs and optimize model parameters. Finally, the trained model is used to perform real-time fraud detection on new transactions to quickly respond to potential fraudulent behaviors. This improves the efficiency and accuracy of fraud detection.

[0075] In some specific embodiments, the snapshot image building module 12 may specifically include:

[0076] A node determination unit, used to determine a one-hop neighbor node corresponding to the new transaction node and a one-hop neighbor node corresponding to the referenced transaction node in the new neighbor entity;

[0077] A snapshot graph construction unit is used to create an edge between the new transaction node and a one-hop neighbor node corresponding to the new transaction node, and to create an edge between the reference transaction node and a one-hop neighbor node corresponding to the reference transaction node, so as to construct a snapshot graph corresponding to the transaction time.

[0078] In some specific embodiments, the training module 13 may specifically include:

[0079] A node placing unit, used to place the new transaction node corresponding to the snapshot graph, the one-hop neighbor node corresponding to the new transaction node, and the reference transaction node into a target partition;

[0080] The first target directed graph determination unit is used to connect the reference transaction node in the target partition and the one-hop neighbor node corresponding to the reference transaction node using bidirectional edges, and to link the one-hop neighbor node corresponding to the new transaction node and the new transaction node, so as to determine the first target directed graph corresponding to the historical transaction data.

[0081] In some specific embodiments, the fraud risk determination module 14 may specifically include:

[0082] An entity embedding acquisition unit, used for inputting feature information of the historical relationship subgraph in the second target directed graph and feature embedding of a one-hop neighbor node corresponding to the new transaction node into the batch processing network to obtain a plurality of entity embeddings;

[0083] A risk score determination unit is used to determine the risk score of the new transaction based on a plurality of entity embeddings and the real-time network.

[0084] In some specific embodiments, the risk score determination unit may specifically include:

[0085] An embedding acquisition subunit, configured to determine an embedding of a new transaction node acquired by inference on the real-time network based on the real-time network, a plurality of the entity embeddings, and a feature embedding of a new transaction node in the snapshot graph corresponding to the new transaction;

[0086] The risk score determination subunit is used to determine the risk score of the new transaction through the embedding of the new transaction node obtained by the real-time network reasoning and the preset weight matrix.

[0087] Furthermore, the present application also discloses an electronic device. Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0088] Figure 8 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the fraud transaction risk monitoring method based on graph neural network disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0089] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0090] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0091] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program that can be used to complete the fraud transaction risk monitoring method based on graph neural network performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks.

[0092] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed method for monitoring fraudulent transaction risk based on a graph neural network is implemented. The specific steps of the method can be referred to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0093] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0094] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0095] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0096] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0097] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A fraudulent transaction risk monitoring method based on graph neural network, characterized in that: include: Determine each transaction node in the dynamic transaction graph according to the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph; Based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, a new transaction node and a new neighbor entity are respectively created, and a snapshot graph is constructed according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is a transaction node within the target time period referenced when analyzing the target transaction node; Determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and training a target graph neural network using the first target directed graph to obtain a trained neural network; When a new transaction occurs, the transaction information of the new transaction is determined, and the second target directed graph corresponding to the new transaction is determined through the transaction information, the risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

2. The fraudulent transaction risk monitoring method based on graph neural network according to claim 1 is characterized in that: The neighbor entities include any one or a combination of the shipping address of the transaction, the user's email, IP address, device ID, user's contact number, payment token, and user account.

3. The fraudulent transaction risk monitoring method based on graph neural network according to claim 1 or 2, characterized in that: The step of constructing a snapshot graph according to each of the new transaction nodes, the transaction time corresponding to each of the new transaction nodes, each of the new neighbor entities, and the referenced transaction node includes: Determine a one-hop neighbor node corresponding to the new transaction node and a one-hop neighbor node corresponding to the referenced transaction node in the new neighbor entity; An edge is created between the new transaction node and a one-hop neighbor node corresponding to the new transaction node, and an edge is created between the reference transaction node and a one-hop neighbor node corresponding to the reference transaction node, so as to construct a snapshot graph corresponding to the transaction time.

4. The fraudulent transaction risk monitoring method based on graph neural network according to claim 3 is characterized in that: The determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph includes: Put the new transaction node corresponding to the snapshot graph, the one-hop neighbor node corresponding to the new transaction node, and the reference transaction node into a target partition; The reference transaction node in the target partition and the one-hop neighbor node corresponding to the reference transaction node are connected by a bidirectional edge, and the one-hop neighbor node corresponding to the new transaction node and the new transaction node are linked to determine a first target directed graph corresponding to the historical transaction data.

5. The fraudulent transaction risk monitoring method based on graph neural network according to claim 1 is characterized in that: The target graph neural network includes a batch network and a real-time network built based on a graph convolutional layer and a decoder.

6. The fraudulent transaction risk monitoring method based on graph neural network according to claim 5 is characterized in that: The step of determining the risk score of the new transaction by using the trained neural network and the second target directed graph includes: Input the feature information of the historical relationship subgraph in the second target directed graph and the feature embedding of the one-hop neighbor node corresponding to the new transaction node into the batch processing network to obtain a plurality of entity embeddings; A risk score for the new transaction is determined based on a number of the entity embeddings and the real-time network.

7. The fraudulent transaction risk monitoring method based on graph neural network according to claim 6 is characterized in that: The step of determining the risk score of the new transaction based on the embedding of the plurality of entities and the real-time network comprises: Determine the embedding of a new transaction node obtained by inference of the real-time network based on the real-time network, the plurality of entity embeddings, and the feature embedding of a new transaction node in the snapshot graph corresponding to the new transaction; The risk score of the new transaction is determined by embedding the new transaction node obtained by the real-time network reasoning and a preset weight matrix.

8. A fraudulent transaction risk monitoring device based on graph neural network, characterized in that: include: A static graph construction module, used to determine each transaction node in the dynamic transaction graph according to the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph; A snapshot graph construction module, used to create new transaction nodes and new neighbor entities respectively based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, and to construct a snapshot graph according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is a transaction node within a target time period referenced when analyzing the target transaction node; A training module, configured to determine a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and train a target graph neural network using the first target directed graph to obtain a trained neural network; A fraud risk determination module is used to determine the transaction information of a new transaction when a new transaction occurs, and determine a second target directed graph corresponding to the new transaction through the transaction information, determine a risk score of the new transaction using the trained neural network and the second target directed graph, and determine the fraud risk of the new transaction based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the fraud transaction risk monitoring method based on graph neural network as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, it implements the fraud transaction risk monitoring method based on graph neural network as described in any one of claims 1 to 7.

Images