Fraud transaction risk monitoring method and device based on graph neural network, equipment and medium

Abstract

The application discloses a fraud transaction risk monitoring method and device based on a graph neural network, equipment and a medium, relates to the field of anti-fraud, and comprises the following steps: determining each transaction node and each neighbor entity in a dynamic transaction graph, linking each transaction node with each neighbor entity, and constructing a target static graph; creating new transaction nodes and new neighbor entities respectively, constructing a snapshot graph according to each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; determining a first target directed graph based on the target static graph and the snapshot graph, training a target graph neural network by using the first target directed graph, and obtaining a trained neural network; when a new transaction occurs, determining a second target directed graph of the new transaction through transaction information of the new transaction, determining a risk score of the new transaction by using the trained neural network and the second target directed graph, and determining a fraud risk of the new transaction based on the risk score. Therefore, accurate fraud monitoring is realized.

Description

Technical Field

[0001] The present invention relates to the field of anti-fraud, and in particular to a method, device, equipment and medium for monitoring fraudulent transaction risks based on graph neural networks. Background Art

[0002] In the e-commerce market, detecting fraudulent transactions is an important part of risk control. With the increase in online transactions, fraudulent behaviors have become more complex and hidden. Although traditional rule-based and machine learning filters have been applied in production, they often face limitations when dealing with complex fraud patterns. Graph Neural Networks (GNNs), as an emerging deep learning technology, can effectively capture multi-hop risk propagation in transaction graphs and provide more accurate fraud detection. Currently, when applying GNNs in production environments, there are two major challenges due to the dynamic nature of the graph: Information leakage in dynamic graphs: When messaging, future information should not be considered to ensure that the model's predictions of past events are accurate. Latency issues: The latency of graph queries and GNN model inferences is often as high as hundreds of milliseconds, which is unacceptable for some critical online services. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a method, apparatus, device, and medium for monitoring fraudulent transaction risks based on graph neural networks, which can achieve efficient end-to-end GNN learning and real-time reasoning, and realize efficient real-time fraud detection. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a fraudulent transaction risk monitoring method based on a graph neural network, comprising:

[0005] Determine each transaction node in the dynamic transaction graph based on the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph;

[0006] creating new transaction nodes and new neighbor entities based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, respectively, and constructing a snapshot graph based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity, and a reference transaction node; the reference transaction node being a transaction node within the target time period referenced when analyzing the target transaction node;

[0007] Determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and training a target graph neural network using the first target directed graph to obtain a trained neural network;

[0008] When a new transaction occurs, transaction information of the new transaction is determined, and a second target directed graph corresponding to the new transaction is determined based on the transaction information. A risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score. The target directed graph includes a historical relationship subgraph and a real-time link subgraph.

[0009] Optionally, the neighbor entity includes any one or a combination of the transaction shipping address, user's email, IP address, device ID, user's contact number, payment token, and user account.

[0010] Optionally, constructing a snapshot graph according to each of the new transaction nodes, the transaction time corresponding to each of the new transaction nodes, each of the new neighbor entities, and the referenced transaction node includes:

[0011] Determine a one-hop neighbor node corresponding to the new transaction node and a one-hop neighbor node corresponding to the referenced transaction node in the new neighbor entity;

[0012] An edge is created between the new transaction node and a one-hop neighbor node corresponding to the new transaction node, and an edge is created between the reference transaction node and a one-hop neighbor node corresponding to the reference transaction node, so as to construct a snapshot graph corresponding to the transaction time.

[0013] Optionally, determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph includes:

[0014] Putting the new transaction node corresponding to the snapshot graph, the one-hop neighbor node corresponding to the new transaction node, and the reference transaction node into a target partition;

[0015] The reference transaction node in the target partition is connected with a one-hop neighbor node corresponding to the reference transaction node by using a bidirectional edge, and the one-hop neighbor node corresponding to the new transaction node and the new transaction node are linked to determine a first target directed graph corresponding to the historical transaction data.

[0016] Optionally, the target graph neural network includes a batch network and a real-time network constructed based on a graph convolutional layer and a decoder.

[0017] Optionally, determining the risk score of the new transaction by using the trained neural network and the second target directed graph includes:

[0018] Inputting the feature information of the historical relationship subgraph in the second target directed graph and the feature embedding of the one-hop neighbor node corresponding to the new transaction node into the batch processing network to obtain a plurality of entity embeddings;

[0019] A risk score for the new transaction is determined based on a number of the entity embeddings and the real-time network.

[0020] Optionally, the determining the risk score of the new transaction based on the plurality of entity embeddings and the real-time network includes:

[0021] Determining an embedding of a new transaction node obtained by inference on the real-time network based on the real-time network, the plurality of entity embeddings, and a feature embedding of a new transaction node in the snapshot graph corresponding to the new transaction;

[0022] The risk score of the new transaction is determined by embedding the new transaction node obtained by the real-time network reasoning and a preset weight matrix.

[0023] In a second aspect, the present application discloses a fraudulent transaction risk monitoring device based on a graph neural network, comprising:

[0024] a static graph construction module, configured to determine each transaction node in the dynamic transaction graph based on the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph;

[0025] a snapshot graph construction module, configured to create new transaction nodes and new neighbor entities based on each transaction node and the neighbor entities corresponding to each transaction node in the target static graph, and to construct a snapshot graph based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity, and a reference transaction node; the reference transaction node being a transaction node within a target time period referenced when analyzing the target transaction node;

[0026] a training module, configured to determine a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and train a target graph neural network using the first target directed graph to obtain a trained neural network;

[0027] The fraud risk determination module is configured to determine, when a new transaction occurs, transaction information of the new transaction, determine a second target directed graph corresponding to the new transaction based on the transaction information, determine a risk score for the new transaction using the trained neural network and the second target directed graph, and determine the fraud risk of the new transaction based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

[0028] In a third aspect, the present application discloses an electronic device, comprising:

[0029] Memory, used to store computer programs;

[0030] A processor is used to execute the computer program to implement the aforementioned method for monitoring fraudulent transaction risks based on graph neural networks.

[0031] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for monitoring fraudulent transaction risks based on graph neural networks.

[0032] When monitoring fraudulent transaction risks, the present application first determines each transaction node in the dynamic transaction graph based on the payment transaction and transaction ID, determines each neighbor entity of each transaction node, and links each transaction node with the corresponding neighbor entity to construct a target static graph; then, based on each transaction node in the target static graph and the neighbor entity corresponding to each transaction node, a new transaction node and a new neighbor entity are created respectively, and a snapshot graph is constructed based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is the reference node when analyzing the target transaction node. The target directed graph is constructed to identify transaction nodes within the referenced target time period; a first target directed graph corresponding to the historical transaction data is then determined based on the target static graph and the snapshot graph, and the target graph neural network is trained using the first target directed graph to obtain a trained neural network. Finally, when a new transaction occurs, the transaction information of the new transaction is determined, and a second target directed graph corresponding to the new transaction is determined based on the transaction information. The risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score. The target directed graph includes a historical relationship subgraph and a real-time link subgraph. As can be seen, this application ensures directional control of information flow by constructing a target directed graph, using only historical transaction information for prediction. By maintaining both static and snapshot graphs, batch processing and online learning are supported. A Lambda neural network is used to train the converted graph and optimize model parameters. Finally, the trained model is used to perform real-time fraud detection on new transactions, rapidly responding to potential fraudulent activity. This improves the efficiency and accuracy of fraud detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0034] Figure 1 This is a flow chart of a fraudulent transaction risk monitoring method based on graph neural network disclosed in this application;

[0035] Figure 2 A transaction diagram disclosed in this application;

[0036] Figure 3 A schematic diagram of a static image disclosed in this application;

[0037] Figure 4 A schematic diagram of a snapshot diagram disclosed in this application;

[0038] Figure 5 A schematic diagram of a target directed graph disclosed in this application;

[0039] Figure 6 A schematic diagram of a Lambda neural network structure disclosed in this application;

[0040] Figure 7 This is a schematic diagram of the structure of a fraudulent transaction risk monitoring device based on a graph neural network disclosed in this application;

[0041] Figure 8 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0042] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0043] Currently, when applying GNNs to production environments, there are two major challenges because the graph is dynamically changing: 1. Information leakage in dynamic graphs: when messaging, future information should not be taken into account to ensure that the model's predictions of past events are accurate. 2. Latency issues: The latency of graph queries and GNN model inferences is typically as high as hundreds of milliseconds, which is unacceptable for some critical online services. In order to solve the above technical problems, the present application discloses a fraudulent transaction risk monitoring method, apparatus, device and medium based on graph neural networks, which can achieve efficient end-to-end GNN learning and real-time inference, and achieve efficient real-time fraud detection.

[0044] See also Figure 1 As shown, an embodiment of the present invention discloses a fraudulent transaction risk monitoring method based on a graph neural network, comprising:

[0045] Step S11: Determine each transaction node in the dynamic transaction graph according to the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph.

[0046] In this embodiment, in order to collect neighbor features to assess the risk of transaction fraud, multiple entities are considered as neighbors of the transaction node. These entities, including shipping addresses, emails, IP (Internet Protocol) addresses, device IDs (Identity documents), contact numbers, payment tokens, and user accounts, are represented as entity vertices in the static graph. Each transaction node represents a payment transaction and a unique transaction ID, linked to multiple entity vertices, such as shipping addresses, emails, and contact numbers that buyers need to confirm on the payment page. Most entity vertices are also linked to multiple transaction vertices. Given a set of target transactions, a static graph G can be constructed from their records. A transaction record can be decomposed into a transaction vertex and several entity vertices. Edges are placed between entities and transactions that use these entities. If reference transactions within a given observation window share the same entities, these reference transactions will be extracted. Edges will also be added between reference transactions and common entities. In a specific embodiment, such as Figure 2 As shown in the figure, there are several transaction records. The static graph structure is shown in the attached figure. Figure 3 shown.

[0047] Step S12: creating new transaction nodes and new neighbor entities based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, and constructing a snapshot graph based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity, and a reference transaction node; the reference transaction node is a transaction node within the target time period referenced when analyzing the target transaction node.

[0048] In this embodiment, when constructing a snapshot graph, a new transaction node and a new neighbor entity are first created based on each transaction node in the target static graph and the neighbor entity corresponding to each transaction node. Then, the one-hop neighbor node corresponding to the new transaction node and the one-hop neighbor node corresponding to the reference transaction node in the new neighbor entity are determined. An edge is created between the new transaction node and the one-hop neighbor node corresponding to the new transaction node, and an edge is created between the reference transaction node and the one-hop neighbor node corresponding to the reference transaction node to construct a snapshot graph corresponding to the transaction time. Specifically, T is a time window in the snapshot graph. The snapshot vertex vt∈VT represents a static vertex. The snapshot vertex vt is the transformation of the vertex v at snapshot t. The workflow for constructing the snapshot graph is as follows. (1) For each transaction node txn on the static graph G, construct txnt on snapshot t (the corresponding transaction node constructed on snapshot t for transaction txn at time t), where t is the time period for creating the transaction. (2) For each entity node directly linked to the transaction node, create a node entity t on snapshot t, sharing the same transaction creation time. If an entity is linked to transactions created in various snapshots, there may be multiple instances of the same entity. (3) Create an edge between the target transaction node txnt and its 1-hop entity neighbor. (4) Create an edge between the reference transaction node txni and its 1-hop entity neighbor, where 0≤i≤t. When analyzing the transaction txn at time t, txnt is the target transaction node, and in order to analyze txnt, it is necessary to reference the transaction information between time 0-t. The referenced transaction node is called the reference transaction node. Figure 4 In the snapshot diagram shown, when transaction 1 is the target transaction, transactions 2, 3, and 4 are reference transactions.

[0049] Step S13: determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and using the first target directed graph to train a target graph neural network to obtain a trained neural network.

[0050] In this embodiment, after constructing the target static graph and snapshot graph, a first target directed graph (also known as a two-phase directed graph) corresponding to the historical transaction data is determined based on the target static graph and the snapshot graph. The new transaction node, its corresponding one-hop neighbor node, and the reference transaction node corresponding to the snapshot graph are placed in the target partition. Bidirectional edges are used to connect the reference transaction node and its corresponding one-hop neighbor node in the target partition, and the new transaction node's corresponding one-hop neighbor node is linked to the new transaction node to determine the first target directed graph corresponding to the historical transaction data. Specifically, the two-phase directed graph simplifies the topological view from the target transaction end, making it easy to partition the graph into a real-time graph (real-time link subgraph) and a batch graph (historical relationship subgraph). These graphs are later consumed by the LNN as input to various components of the network. The historical relationship subgraph stores past transaction information, while the real-time link subgraph captures current transaction activity. Partitioning of target transactions is introduced to isolate transaction roles, as transactions can serve as both target and reference transactions. All reference transaction nodes that share common entities are stored in the same partition as the target transaction. In a two-phase directed graph, a transaction has only one role: either a target transaction or a reference transaction. Within a target partition, partition t, there are multiple snapshots i, where 0 ≤ i ≤ t. The construction workflow is as follows:

[0051] (1) Put the target transaction txnt, their corresponding 1-hop entities entityt and reference transactions txni, where 0≤i≤t, into partitiont. These transactions are represented as txntgtt and txnreft. These entities are represented as entitytgtt. In the two-stage directed graph, txntgtt is the target transaction node, txnreft is the reference transaction node, and entitytgtt is the 1-hop entity node corresponding to the target transaction node. If the related target transactions of the reference transaction are in different time snapshots, they can be placed in multiple partitions. (2) Connect txnreft and entitytgtt with bidirectional edges to form a batch graph. It is used for batch reasoning of entity representation. (3) Link entitytgtt and txntgtt, and use directed edges to link from the entity to the target transaction to form a real-time link subgraph. It is used for real-time inference of transaction risk. In a specific embodiment, in the two-stage directed graph of partition t, as shown in Figure 5 As shown, the target transaction is transaction t, and the reference transactions are transactions t-1, t-2, and t-3, which are then captured by the LNN (Linear Neural Network) as input to various parts of the network for model training.

[0052] Afterwards, the Lambda neural network is used to train the converted graph and optimize the model parameters. The present invention introduces a Lambda neural network (LNN) structure, as shown in the attached figure. Figure 6 As shown in , the Lambda architecture is a hybrid data processing approach that processes large amounts of data in a batch and stream processing manner. The Lambda neural network consists of a batch network and a real-time network built on graph convolutional layers and decoders. One of the benefits of the Lambda architecture is the balance between the scalability of data processing and the latency of data access. The LNN architecture processes message passing from batch graphs and real-time graphs in separate GNN blocks. Message passing on the batch graph is performed in batch jobs through the batch network. Message passing on the real-time graph is performed in a real-time inference manner through the real-time (RT) network deployed in the online service. As Figure 6 As shown, the LNN consists of a batch network (right) and a real-time (RT Net) network (left). The batch network is a stack of GNN layers. The RT Net consists of a graph convolutional layer and a decoder, which is a fully connected linear layer. The first stage is batch network inference, after which entity embeddings learned from historical transactions are obtained and flushed to a key-value store. In the second stage, the RT Net retrieves the entity embeddings from the key-value store and the raw features from the target transaction, and then calculates the transaction risk score. The final result is a trained neural network.

[0053] Step S14: When a new transaction occurs, determine the transaction information of the new transaction, and determine a second target directed graph corresponding to the new transaction based on the transaction information, determine a risk score for the new transaction using the trained neural network and the second target directed graph, and determine the fraud risk of the new transaction based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

[0054] In this embodiment, when a new transaction occurs, transaction data is first collected and cleaned to construct target transaction information (i.e., a dynamic transaction graph consisting of target transactions, their one-hop entities, and their connecting edges, similar to the real-time link subgraph used in training). A second target directed graph for the new transaction is then determined. Feature information from the historical relationship subgraph within the second target directed graph, as well as the feature embeddings of the one-hop neighbor nodes corresponding to the new transaction node, are then fed into a batch network to obtain several entity embeddings. The embeddings of the new transaction node, obtained through real-time network inference, are then determined based on the real-time network, the several entity embeddings, and the feature embeddings of the new transaction node in the snapshot graph corresponding to the new transaction. The risk score of the new transaction is then determined using the embeddings of the new transaction node obtained through real-time network inference and a preset weight matrix. Specifically, the trained model is used to perform real-time fraud detection on new transactions, enabling rapid response to potential fraudulent activity. End-to-end training utilizes a complete LNN architecture. When deployed in production, LNN inference is decoupled into batch and real-time inference. During the batch inference phase, embeddings for the entity entitytgtt are periodically generated according to the equation hbatcht. Finally, entity embeddings are generated and stored in a distributed key-value database, where they are used to detect fraudulent transactions. The embedding is refreshed every unit of time (e.g., daily) to provide real-time transaction risk assessment. For real-time risk assessment, the second stage of the LNN (i.e., RT Net) calculates the score using the equation. The result is equivalent to the end-to-end inference of the full LNN used during the training phase. Because the RT Net consists of only one layer, inference latency is further significantly reduced.

[0055] When monitoring fraudulent transaction risks, the present application first determines each transaction node in the dynamic transaction graph based on the payment transaction and transaction ID, determines each neighbor entity of each transaction node, and links each transaction node with the corresponding neighbor entity to construct a target static graph; then, based on each transaction node in the target static graph and the neighbor entity corresponding to each transaction node, a new transaction node and a new neighbor entity are created respectively, and a snapshot graph is constructed based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is the reference node when analyzing the target transaction node. The target directed graph is constructed to identify transaction nodes within the referenced target time period; a first target directed graph corresponding to the historical transaction data is then determined based on the target static graph and the snapshot graph, and the target graph neural network is trained using the first target directed graph to obtain a trained neural network. Finally, when a new transaction occurs, the transaction information of the new transaction is determined, and a second target directed graph corresponding to the new transaction is determined based on the transaction information. The risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score. The target directed graph includes a historical relationship subgraph and a real-time link subgraph. As can be seen, this application ensures directional control of information flow by constructing a target directed graph, using only historical transaction information for prediction. By maintaining both static and snapshot graphs, batch processing and online learning are supported. A Lambda neural network is used to train the converted graph and optimize model parameters. Finally, the trained model is used to perform real-time fraud detection on new transactions, rapidly responding to potential fraudulent activity. This improves the efficiency and accuracy of fraud detection.

[0056] Based on the previous embodiment, it can be seen that when performing fraudulent transaction risk monitoring, the present application will first train the model and use the trained model to perform real-time fraud detection on new transactions. The following will describe the model training process in detail.

[0057] like Figure 6 As shown, the LNN consists of a batch network (right) and a real-time (RT Net) network (left). Batch Net is a stack of GNN layers. RT Net consists of a graph convolutional layer and a decoder, which is a fully connected linear layer. The first stage is batch network inference, after which we obtain entity embeddings learned from historical transactions and flush them to a key-value store. In the second stage, RT Net retrieves entity embeddings from the key-value store and raw features from the target transaction, and then calculates the transaction risk score. The following details the training process:

[0058] During training, both the batch graph and the real-time graph are used for end-to-end LNN training. Within each batch, a partition is sampled for a time window T, where T = {0, 1, ..., t}. The timestamp of each target transaction falls within the partition's time window. All timestamps of reference transactions precede the timestamp of the target transaction.

[0059] Similar to traditional GNNs, the input of the batch network includes the features of the reference transaction Xt and the batch graph Batch Grapht, as shown in the following equation:

[0060] ;

[0061] in, are the entity embeddings obtained by the final training of the batch network on partitiont (target partition); X t Feature embedding for reference transactions on partitiont (similar to traditional GNN) It is the feature information of the batch graph on partitiont (similar to traditional GNN); Batch Net is a stack of GNN layers;

[0062] Each graph convolutional layer in the BatchNet is generic. As input, the RTNet takes features from the target transactions and the entity embeddings learned from the BatchNet inference. The graph convolutional layers in the RTNet have the same form as the BatchNet, as shown in the equation below. The only difference is that, to improve inference efficiency, the RTNet has only one convolutional layer. Furthermore, the RTNet isolates message aggregation between different target transaction nodes within the same target snapshot partition.

[0063] ;

[0064] in, is the embedding of the target transaction txnt obtained through real-time network inference; ⊙ is a generalized node aggregation function. ∪ represents concatenation in deep learning; W is the weight matrix; is a linear mapping of transaction features to ensure that transaction features and embeddings have the same dimension. Feature embedding for the target transaction txnt; Vertex All neighbors of ; For entity nodes Embeddings obtained through batch network inference; For entity nodes.

[0065] The risk score of the target transaction txnt is decoded by the hRTtxnt embedded in the real-time transaction, as shown in the following equation:

[0066] ;

[0067] Where W is the weight matrix; The embedding of the target transaction txnt obtained through real-time network reasoning; Score the risk of the target transaction txnt and finally obtain a trained neural network.

[0068] In this way, fraudulent transaction risks are monitored through pre-trained models. During the fraudulent transaction risk monitoring process, batch network inference is omitted, further reducing the latency of end-to-end inference, thereby improving the efficiency and accuracy of fraud detection and achieving significant performance improvement and latency reduction.

[0069] See also Figure 7 As shown, an embodiment of the present invention discloses a fraudulent transaction risk monitoring device based on a graph neural network, comprising:

[0070] A static graph construction module 11 is configured to determine each transaction node in the dynamic transaction graph based on the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph;

[0071] A snapshot graph construction module 12 is configured to create new transaction nodes and new neighbor entities based on each transaction node and the neighbor entities corresponding to each transaction node in the target static graph, and to construct a snapshot graph based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity, and a reference transaction node; the reference transaction node is a transaction node within a target time period referenced when analyzing the target transaction node;

[0072] A training module 13 is configured to determine a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and train a target graph neural network using the first target directed graph to obtain a trained neural network;

[0073] The fraud risk determination module 14 is configured to determine, when a new transaction occurs, transaction information of the new transaction, determine a second target directed graph corresponding to the new transaction based on the transaction information, determine a risk score for the new transaction using the trained neural network and the second target directed graph, and determine the fraud risk of the new transaction based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

[0074] When monitoring fraudulent transaction risks, the present application first determines each transaction node in the dynamic transaction graph based on the payment transaction and transaction ID, determines each neighbor entity of each transaction node, and links each transaction node with the corresponding neighbor entity to construct a target static graph; then, based on each transaction node in the target static graph and the neighbor entity corresponding to each transaction node, a new transaction node and a new neighbor entity are created respectively, and a snapshot graph is constructed based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity and a reference transaction node; the reference transaction node is the reference node when analyzing the target transaction node. The target directed graph is constructed to identify transaction nodes within the referenced target time period; a first target directed graph corresponding to the historical transaction data is then determined based on the target static graph and the snapshot graph, and the target graph neural network is trained using the first target directed graph to obtain a trained neural network. Finally, when a new transaction occurs, the transaction information of the new transaction is determined, and a second target directed graph corresponding to the new transaction is determined based on the transaction information. The risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score. The target directed graph includes a historical relationship subgraph and a real-time link subgraph. As can be seen, this application ensures directional control of information flow by constructing a target directed graph, using only historical transaction information for prediction. By maintaining both static and snapshot graphs, batch processing and online learning are supported. A Lambda neural network is used to train the converted graph and optimize model parameters. Finally, the trained model is used to perform real-time fraud detection on new transactions, rapidly responding to potential fraudulent activity. This improves the efficiency and accuracy of fraud detection.

[0075] In some specific embodiments, the snapshot image construction module 12 may specifically include:

[0076] a node determining unit, configured to determine, in the new neighbor entity, a one-hop neighbor node corresponding to the new transaction node and a one-hop neighbor node corresponding to the referenced transaction node;

[0077] A snapshot graph construction unit is used to create an edge between the new transaction node and a one-hop neighbor node corresponding to the new transaction node, and to create an edge between the reference transaction node and a one-hop neighbor node corresponding to the reference transaction node, so as to construct a snapshot graph corresponding to the transaction time.

[0078] In some specific embodiments, the training module 13 may specifically include:

[0079] A node placement unit, configured to place the new transaction node corresponding to the snapshot graph, the one-hop neighbor node corresponding to the new transaction node, and the reference transaction node into a target partition;

[0080] A first target directed graph determination unit is used to connect the reference transaction node in the target partition and the one-hop neighbor node corresponding to the reference transaction node using bidirectional edges, and to link the one-hop neighbor node corresponding to the new transaction node and the new transaction node to determine the first target directed graph corresponding to the historical transaction data.

[0081] In some specific embodiments, the fraud risk determination module 14 may specifically include:

[0082] an entity embedding acquisition unit, configured to input feature information of a historical relationship subgraph in the second target directed graph and feature embeddings of one-hop neighbor nodes corresponding to the new transaction node into the batch processing network to obtain a plurality of entity embeddings;

[0083] A risk score determination unit is configured to determine a risk score for the new transaction based on the plurality of entity embeddings and the real-time network.

[0084] In some specific embodiments, the risk score determination unit may specifically include:

[0085] an embedding acquisition subunit, configured to determine an embedding of a new transaction node acquired by inference on the real-time network based on the real-time network, the plurality of entity embeddings, and a feature embedding of a new transaction node in the snapshot graph corresponding to the new transaction;

[0086] The risk score determination subunit is configured to determine the risk score of the new transaction by using the embedding of the new transaction node obtained by the real-time network reasoning and a preset weight matrix.

[0087] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0088] Figure 8 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the graph neural network-based fraudulent transaction risk monitoring method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0089] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0090] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0091] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of implementing the graph neural network-based fraudulent transaction risk monitoring method performed by the electronic device 20 as disclosed in any of the aforementioned embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0092] Furthermore, this application discloses a computer-readable storage medium for storing a computer program. When executed by a processor, the computer program implements the aforementioned method for monitoring fraudulent transaction risk based on a graph neural network. The specific steps of this method can be found in the corresponding content disclosed in the aforementioned embodiments and will not be further elaborated here.

[0093] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0094] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0095] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0096] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0097] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A fraudulent transaction risk monitoring method based on graph neural network, characterized in that: include: Determine each transaction node in the dynamic transaction graph based on the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph; creating new transaction nodes and new neighbor entities based on each transaction node in the target static graph and the neighbor entities corresponding to each transaction node, respectively, and constructing a snapshot graph based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity, and a reference transaction node; the reference transaction node being a transaction node within the target time period referenced when analyzing the target transaction node; Determining a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and training a target graph neural network using the first target directed graph to obtain a trained neural network; When a new transaction occurs, transaction information of the new transaction is determined, and a second target directed graph corresponding to the new transaction is determined based on the transaction information. A risk score of the new transaction is determined using the trained neural network and the second target directed graph, and the fraud risk of the new transaction is determined based on the risk score. The target directed graph includes a historical relationship subgraph and a real-time link subgraph.

2. The fraudulent transaction risk monitoring method based on graph neural network according to claim 1 is characterized in that: The neighbor entities include any one or a combination of the shipping address of the transaction, the user's email, IP address, device ID, user's contact number, payment token, and user account.

3. The fraudulent transaction risk monitoring method based on graph neural network according to claim 1 or 2, characterized in that: The constructing a snapshot graph according to each of the new transaction nodes, the transaction time corresponding to each of the new transaction nodes, each of the new neighbor entities, and the referenced transaction node includes: Determine a one-hop neighbor node corresponding to the new transaction node and a one-hop neighbor node corresponding to the referenced transaction node in the new neighbor entity; An edge is created between the new transaction node and a one-hop neighbor node corresponding to the new transaction node, and an edge is created between the reference transaction node and a one-hop neighbor node corresponding to the reference transaction node, so as to construct a snapshot graph corresponding to the transaction time.

4. The fraudulent transaction risk monitoring method based on graph neural network according to claim 3 is characterized in that: The determining, based on the target static graph and the snapshot graph, a first target directed graph corresponding to the historical transaction data includes: Putting the new transaction node corresponding to the snapshot graph, the one-hop neighbor node corresponding to the new transaction node, and the reference transaction node into a target partition; The reference transaction node in the target partition is connected with a one-hop neighbor node corresponding to the reference transaction node by using a bidirectional edge, and the one-hop neighbor node corresponding to the new transaction node and the new transaction node are linked to determine a first target directed graph corresponding to the historical transaction data.

5. The fraudulent transaction risk monitoring method based on graph neural network according to claim 1 is characterized in that: The target graph neural network includes a batch network and a real-time network built based on a graph convolutional layer and a decoder.

6. The fraudulent transaction risk monitoring method based on graph neural network according to claim 5 is characterized in that: Determining the risk score of the new transaction by using the trained neural network and the second target directed graph includes: Inputting the feature information of the historical relationship subgraph in the second target directed graph and the feature embedding of the one-hop neighbor node corresponding to the new transaction node into the batch processing network to obtain a plurality of entity embeddings; A risk score for the new transaction is determined based on a number of the entity embeddings and the real-time network.

7. The fraudulent transaction risk monitoring method based on graph neural network according to claim 6 is characterized in that: The determining the risk score of the new transaction based on the plurality of entity embeddings and the real-time network includes: Determining an embedding of a new transaction node obtained by inference on the real-time network based on the real-time network, the plurality of entity embeddings, and a feature embedding of a new transaction node in the snapshot graph corresponding to the new transaction; The risk score of the new transaction is determined by embedding the new transaction node obtained by the real-time network reasoning and a preset weight matrix.

8. A fraudulent transaction risk monitoring device based on graph neural network, characterized in that: include: a static graph construction module, configured to determine each transaction node in the dynamic transaction graph based on the payment transaction and the transaction ID, determine each neighbor entity of each transaction node, and link each transaction node with the corresponding neighbor entity to construct a target static graph; a snapshot graph construction module, configured to create new transaction nodes and new neighbor entities based on each transaction node and the neighbor entities corresponding to each transaction node in the target static graph, and to construct a snapshot graph based on each new transaction node, the transaction time corresponding to each new transaction node, each new neighbor entity, and a reference transaction node; the reference transaction node being a transaction node within a target time period referenced when analyzing the target transaction node; a training module, configured to determine a first target directed graph corresponding to the historical transaction data based on the target static graph and the snapshot graph, and train a target graph neural network using the first target directed graph to obtain a trained neural network; The fraud risk determination module is configured to determine, when a new transaction occurs, transaction information of the new transaction, determine a second target directed graph corresponding to the new transaction based on the transaction information, determine a risk score for the new transaction using the trained neural network and the second target directed graph, and determine the fraud risk of the new transaction based on the risk score; the target directed graph includes a historical relationship subgraph and a real-time link subgraph.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the fraudulent transaction risk monitoring method based on graph neural network as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the fraudulent transaction risk monitoring method based on graph neural network as described in any one of claims 1 to 7.

Images