Fraud detection method, device and system based on graph neural network

Abstract

The invention is suitable for the technical field of intelligent risk control anti-fraud, and provides a fraud detection method, device and system based on a graph neural network, and the method comprises the steps: obtaining data of a user and a corresponding intermediate medium, and constructing a relation graph between the user and the intermediate medium; constructing a heterogeneous relation graph containing user nodes and intermediate medium nodes; converting the heterogeneous relation graph into an isomorphic relation graph only containing user nodes and edge weights among the user nodes; performing feature coding processing on the converted isomorphic relation graph to generate a high-dimensional feature vector of each user node; inputting the coded high-dimensional feature vector of the user node into an anti-fraud model based on a graph neural network for training; reasoning the input high-dimensional feature vector of the target user node based on the trained anti-fraud model, calculating and outputting the fraud probability of the target user node, and generating a corresponding fraud detection result. According to the invention, the problem of low fraud detection efficiency and accuracy in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of intelligent risk control and anti-fraud technology, and in particular to a fraud detection method, device and system based on graph neural network. Background Art

[0002] With the rapid development of Internet finance and e-commerce, fraud has become increasingly complex and diverse. In high-risk fields such as finance, insurance, and the Internet, fraud has emerged in an endless stream, causing huge economic losses to enterprises and society. Existing anti-fraud systems have played an important role in identifying and preventing fraud. However, in the current anti-fraud field, with the continuous escalation of fraud methods and the tightening of privacy protection requirements, existing anti-fraud modeling methods still face many challenges and limitations.

[0003] First, the difficulty in obtaining labels is a major pain point in anti-fraud modeling. Most of the positive samples that anti-fraud models rely on require experts to mine through long-term experience and analyze single-point features. However, due to the concealment and complexity of fraudulent behavior, many potential fraud risks are not discovered in time, resulting in missing or inaccurate labels. What's more serious is that many labeled positive samples have often caused economic losses, increased the risk burden of enterprises, and led to lags and high costs, making the cost of obtaining labels high.

[0004] Secondly, the existing anti-fraud model mainly analyzes isolated point samples, that is, it only conducts risk assessment on a single sample and mines similar fraud patterns, but ignores the possible correlation between samples in fraudulent behavior, especially the risk of gang fraud. Single-point analysis cannot effectively capture these complex correlation information, which in turn affects the model's ability to capture complex fraud patterns. Among them, gang fraud uses hidden correlation relationships to commit fraud through the collaboration of multiple subjects. The lack of such correlation information greatly weakens the effectiveness of traditional anti-fraud models.

[0005] Furthermore, in actual fraud detection, the ratio of positive to negative samples in anti-fraud scenarios is often extremely low, and positive samples (i.e. fraudulent behavior) often account for a very low proportion. In some scenarios, the ratio of positive to negative samples may be as low as one thousandth or even lower. This sample imbalance not only increases the difficulty of model training and increases the complexity of the model, but also places higher requirements on the performance of the model, and easily causes the model to be biased towards negative samples, thereby reducing the accuracy of fraud detection and making it impossible to accurately predict fraud risks.

[0006] Finally, with the strengthening of data privacy protection, the collection and use of user data are subject to stricter restrictions. Traditional models based on explicit associations face the risk of weakening their effectiveness, and the mining of implicit associations becomes particularly critical. At the same time, anti-fraud models need to have a high degree of interpretability, especially in the face of regulatory review or internal audits or decision-making processes. The transparency and traceability of the model directly affect its credibility and acceptability in practical applications. Summary of the invention

[0007] Based on this, the purpose of the present invention is to provide a fraud detection method, device and system based on graph neural network, so as to fundamentally solve the problems of low efficiency and accuracy of existing fraud detection.

[0008] A fraud detection method based on a graph neural network according to an embodiment of the present invention includes:

[0009] Acquire data of a user and a corresponding intermediate medium, and construct a relationship graph between the user and the intermediate medium, wherein the relationship graph includes a user node, an intermediate medium node, and an association relationship between the user node and the intermediate medium node;

[0010] Based on the association relationship between the user node and the intermediate medium node in the relationship graph, a heterogeneous relationship graph including the user node and the intermediate medium node is constructed, wherein the heterogeneous relationship graph includes different types of nodes and different types of edges;

[0011] Based on the intermediate medium nodes in the heterogeneous relationship graph to represent the association relationship between user nodes, the heterogeneous relationship graph is converted into a homogeneous relationship graph containing only user nodes and the edge weights between them;

[0012] Perform feature encoding processing on the converted isomorphic relationship graph, aggregate the features of each user node and its adjacent nodes, and generate a high-dimensional feature vector for each user node;

[0013] The encoded high-dimensional feature vector of the user node is input into the anti-fraud model based on the graph neural network for training to learn the feature representation of each user node;

[0014] Based on the trained anti-fraud model, the high-dimensional feature vector of the input target user node is inferred, the fraud probability of the target user node is calculated and output, and the corresponding fraud detection result is generated.

[0015] In addition, the fraud detection method based on graph neural network according to the above embodiment of the present invention may also have the following additional technical features:

[0016] Furthermore, the step of obtaining data of the user and the corresponding intermediate medium and constructing a relationship diagram between the user and the intermediate medium includes:

[0017] Collect user data and intermediate media data of user interaction from multiple data sources;

[0018] Based on the collected user data and intermediary data, define user nodes and intermediary nodes, wherein the user node represents each user entity, and the intermediary node represents an intermediary entity interacting with the user;

[0019] According to the association interaction between the user node and the intermediate medium node, an edge between the user node and the intermediate medium node is generated, wherein the edge represents the association relationship between the user node and the intermediate medium node;

[0020] All user nodes, intermediate media nodes and the edges between them are combined to construct a relationship graph between users and intermediate media.

[0021] Furthermore, the step of constructing a heterogeneous relationship graph including user nodes and intermediate medium nodes based on the association relationship between the user nodes and the intermediate medium nodes in the relationship graph includes:

[0022] Extract all user nodes and intermediate medium nodes from the constructed relationship graph, and label each user node and intermediate medium node with its node type;

[0023] Define the edge types in the heterogeneous relationship graph according to the interaction type between the user node and the intermediate medium node;

[0024] Based on the interaction relationship between the user node and the intermediate medium node, create the edges in the heterogeneous relationship graph and assign corresponding weights to each edge;

[0025] The labeled user nodes, intermediate media nodes and different types of edges are combined to construct a heterogeneous relationship graph including user nodes and intermediate media nodes.

[0026] Furthermore, the step of converting the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and edge weights therebetween based on the intermediate medium nodes in the heterogeneous relationship graph representing the association relationship between user nodes comprises:

[0027] Identify the interaction relationship between each user node and the intermediate medium node in the heterogeneous relationship graph;

[0028] For each intermediate medium node, detect all user nodes directly connected to it, and determine the user node pairs that are associated with other user nodes through the intermediate medium;

[0029] Based on the association relationship between the user node pairs through the intermediate medium nodes, the association strength between the user node pairs is calculated, and the association strength is weighted according to the type, sharing quantity, interaction frequency, and time interval of the intermediate medium nodes;

[0030] Generate a new edge for each user-node pair, and assign the edge weight according to the strength of the association between the user-node pairs;

[0031] Delete the intermediate nodes in the heterogeneous relationship graph, retain the user nodes and the edges generated between them, and construct a homogeneous relationship graph containing only the user nodes and the edge weights between them.

[0032] Furthermore, the step of performing feature encoding processing on the converted isomorphic relationship graph, aggregating the features of each user node and its adjacent nodes, and generating a high-dimensional feature vector for each user node includes:

[0033] Initialize a feature vector for each user node in the isomorphic relationship graph, wherein the feature vector contains basic attribute information of the user node;

[0034] Based on the neighbor node set of each user node, the corresponding feature vector is extracted from each neighbor node, and the features of the neighbor nodes are weighted and aggregated according to the edge weights between the neighbor nodes and the user node to generate an aggregated feature vector;

[0035] The feature vector of each user node is combined with the aggregated feature vectors of its neighboring nodes to generate a high-dimensional feature vector for each user node.

[0036] Furthermore, the step of inputting the encoded high-dimensional feature vector of the user node into the anti-fraud model based on the graph neural network for training includes:

[0037] Inputting the high-dimensional feature vectors of all user nodes after feature encoding processing into an anti-fraud model based on a graph neural network, wherein the anti-fraud model comprises a plurality of graph convolutional layers, each of which performs feature aggregation and update operations to generate a new feature representation of each user node;

[0038] For each user node, the feature representation of the node is updated in turn through each graph convolution layer in the anti-fraud model, where each graph convolution layer performs weighted aggregation based on the feature vector of the current node and the feature vectors of its neighboring nodes to generate a new node feature representation;

[0039] During the training phase of the model, the pre-annotated fraud labels are used as supervisory signals to optimize the parameters of the anti-fraud model by minimizing a loss function calculated based on the difference between the fraud probability predicted by the model and the true label;

[0040] During the training process, the gradient descent optimization algorithm is used to adjust the weights of the graph neural network, and the model parameters are updated iteratively by calculating the gradient to gradually learn the feature representation of each user node;

[0041] The iterative training process is repeated until the model reaches convergence conditions and completes the learning of the feature representation of each user node.

[0042] Furthermore, the steps of inferring the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculating and outputting the fraud probability of the target user node, and generating the corresponding fraud detection result include:

[0043] Receiving a high-dimensional feature vector of a target user node generated after feature encoding processing;

[0044] Input the high-dimensional feature vector of the target user node into the trained anti-fraud model based on graph neural network for inference;

[0045] In the inference stage of the anti-fraud model, the feature representation of the target user node is calculated through the forward propagation of the graph neural network, and the contextual neighbor information and global graph structure of the target user node are combined to generate a new feature representation of the target user node;

[0046] Based on the feature representation of the target user node finally generated, the anti-fraud model outputs the fraud probability of the target user node, where the fraud probability indicates the possibility that the target user node is a fraud user;

[0047] The fraud detection result is generated by comparing the fraud probability of the target user node with a preset fraud threshold, and the fraud detection result includes the fraud probability and its corresponding prediction label.

[0048] Furthermore, after the step of generating the corresponding fraud detection result, the following steps are further included:

[0049] Based on the generated fraud detection results, take corresponding preventive or emergency response measures for the target user nodes whose fraud probability is higher than the fraud threshold. The response measures include freezing the target user account, restricting the target user's transaction rights, or marking the target user account for further review;

[0050] The fraud detection results of all target user nodes are stored in the database, recording the fraud probability, predicted label, and associated feature information of each user node;

[0051] Generate an explainable report for user nodes with fraudulent detection results, which includes the associations between user nodes detected by the anti-fraud model, key intermediate nodes and their interactive behaviors;

[0052] The generated fraud detection results are delivered to the risk control system to trigger corresponding business decisions.

[0053] Another embodiment of the present invention aims to provide a fraud detection device based on a graph neural network, the device comprising:

[0054] A relationship graph construction module, used to obtain data of users and corresponding intermediate media, and to construct a relationship graph between users and intermediate media, wherein the relationship graph includes user nodes, intermediate media nodes, and association relationships between user nodes and intermediate media nodes;

[0055] A heterogeneous relationship graph construction module, used to construct a heterogeneous relationship graph including user nodes and intermediate medium nodes based on the association relationship between the user nodes and the intermediate medium nodes in the relationship graph, wherein the heterogeneous relationship graph includes different types of nodes and different types of edges;

[0056] A homogeneous relationship graph construction module is used to represent the association relationship between user nodes based on the intermediate medium nodes in the heterogeneous relationship graph, and convert the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and the edge weights between them;

[0057] The encoding processing module is used to perform feature encoding processing on the converted isomorphic relationship graph, aggregate the features of each user node and its adjacent nodes, and generate a high-dimensional feature vector for each user node;

[0058] The model training module is used to input the encoded high-dimensional feature vector of the user node into the anti-fraud model based on the graph neural network for training and learn the feature representation of each user node;

[0059] The fraud detection module is used to infer the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculate and output the fraud probability of the target user node, and generate the corresponding fraud detection result.

[0060] Another embodiment of the present invention aims to provide a fraud detection system based on a graph neural network, comprising a memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, the fraud detection method based on the graph neural network as described above is implemented.

[0061] The fraud detection method based on graph neural network provided by the embodiment of the present invention can effectively capture the potential associations and interaction patterns between users and other nodes by constructing a relationship graph between users and intermediate media and converting it based on heterogeneous relationship graphs, so that it can not only accurately identify the fraudulent behavior of individual users, but also improve the ability to identify group fraud by capturing the complex relationship network between users, especially in the case of implicit associations; through the introduction of intermediate medium nodes, it can effectively characterize the implicit associations between users, which helps to reveal the complex interactive relationships between users that are not easy to directly observe, and especially can effectively capture group fraud behaviors, which are often difficult to identify through the analysis of a single node; by converting heterogeneous relationship graphs into homogeneous relationship graphs and using the association relationships between nodes, the problem of category imbalance in fraud detection is effectively solved; and through the aggregation mechanism of graph neural networks, it can focus on those high-risk aggregations. Clustered nodes, which are often closely related to fraudulent behavior, enable effective modeling even when labels are scarce, support unsupervised or semi-supervised learning, and thus enhance the model’s adaptability to scarce labeled data; by capturing the complex relationships and implicit features between nodes, the model’s interpretability is improved, and decision makers can understand through the features and results of the model output which relationships between user nodes and their interactive behaviors are the key factors leading to fraud detection results, making anti-fraud decisions more transparent and operational; through feature encoding processing of isomorphic relationship graphs, not only the feature information of user nodes is retained, but also the complex relationships between nodes and neighboring nodes can be captured, especially in anti-fraud scenarios, potential implicit associations and clues to group fraud can be effectively mined; and graph neural networks, through feature aggregation, help improve the overall model’s detection capabilities in different complex situations, ultimately solving the problems of low efficiency and accuracy in existing fraud detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 is a flowchart of a fraud detection method based on a graph neural network in a first embodiment of the present invention;

[0063] Figure 2 is a schematic diagram of the structure of a fraud detection device based on a graph neural network provided by a second embodiment of the present invention;

[0064] Figure 3 is a schematic diagram of the structure of a fraud detection system based on a graph neural network provided in a third embodiment of the present invention;

[0065] The following specific implementations will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0066] In order to facilitate the understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Several embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0067] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be a central element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be a central element at the same time. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0068] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0069] Embodiment 1

[0070] See also Figure 1 , which shows a fraud detection method based on a graph neural network in a first embodiment of the present invention. For ease of explanation, only the parts related to the embodiment of the present invention are shown. The fraud detection method based on a graph neural network provided by the embodiment of the present invention includes:

[0071] Step S10, obtaining data of the user and the corresponding intermediate medium, and constructing a relationship graph between the user and the intermediate medium, wherein the relationship graph includes user nodes, intermediate medium nodes, and association relationships between user nodes and intermediate medium nodes;

[0072] In one embodiment of the present invention, constructing a relationship graph between users and intermediaries is the first step in implementing an anti-fraud model based on a graph neural network, and the purpose is to represent the association between users and various intermediaries through a graph structure. By establishing connections between users and their associated intermediary nodes, a hidden relationship network is revealed. The above steps of obtaining data on users and corresponding intermediaries and constructing a relationship graph between users and intermediaries include:

[0073] Collect user data and intermediate media data of user interaction from multiple data sources;

[0074] Based on the collected user data and intermediary data, define user nodes and intermediary nodes, wherein the user node represents each user entity, and the intermediary node represents an intermediary entity interacting with the user;

[0075] According to the association interaction between the user node and the intermediate medium node, an edge between the user node and the intermediate medium node is generated, wherein the edge represents the association relationship between the user node and the intermediate medium node;

[0076] All user nodes, intermediate media nodes and the edges between them are combined to construct a relationship graph between users and intermediate media.

[0077] Specifically, user data and various intermediate media data associated with users are collected from various data sources, where user data is basic information related to users, including but not limited to user ID, registration information, registration time, geographic location, etc. Intermediate media data is characteristic information associated with users for identifying or contacting users, including but not limited to IP address, mobile phone number, email address, device information, other media, etc., where IP address is the network address of the user in the Internet environment, used to identify the user's online behavior; mobile phone number is the mobile phone number used when the user registers or binds an account, used for identity authentication and communication; email address is the email address when the user registers or uses services on the platform; device information is device ID, MAC address, etc., used to identify user devices; other media are bank card numbers, social accounts, etc., which can also be regarded as intermediate media data. Further, the collected user and intermediate media data are cleaned to remove missing values, duplicates and outliers. Then different types of data are standardized to conform to a unified format. For example, IP addresses and mobile phone numbers need to be converted into specific string formats. Further, based on the collected user data and intermediate media data, two types of nodes are defined in the relationship graph, namely user nodes and intermediate media nodes, wherein a user node corresponds to a node for each user, representing each user entity in the system. An intermediate media node corresponds to a node for each intermediate media (such as each IP address, mobile phone number, etc.), representing the intermediate media entity that interacts with the user, that is, the specific attributes of the user. Further, according to the association interaction between the user node and the intermediate media node, an edge between the user node and the intermediate media node is generated, wherein in the graph model, the association between the nodes is represented by an edge, and in order to describe the association relationship between the user and the intermediate media, an edge needs to be added between each user and the corresponding intermediate media. At this time, for each user, the intermediate media used by the user (such as the IP address or mobile phone number used by the user when logging in) is identified, and an edge is established in the relationship graph for each user node and the intermediate media node used by the user, forming an association relationship between the user and the intermediate media. For example, if the user has accessed the service through a certain IP address, an edge is established between the user node and the IP address node. If the user used a certain mobile phone number when registering, an edge is established between the user node and the mobile phone number node accordingly. Furthermore, in an optional embodiment of the present invention, each edge may be assigned a weight based on the interaction frequency, interaction type, interaction time, etc. between the user node and the intermediate medium node, wherein different types of intermediate mediums may have different importance in anti-fraud detection. For example, mobile phone number association can more accurately reflect the user identity than IP address association, so optionally, in the process of constructing the relationship graph between the user and the intermediate medium, different weights are assigned to different types of intermediate mediums according to the interaction type between the user node and the intermediate medium, so as to enhance the expression ability of the graph model.Of course, it is optional to assign weights to each edge according to the interaction frequency, interaction time, etc. Further, all user nodes and intermediate medium nodes are combined together according to the edges and weights defined above to form a relationship graph, and a relationship graph between users and intermediate media is constructed. At this time, the generated relationship graph structure includes nodes and edges, wherein the nodes include user nodes and intermediate medium nodes, and the edges are the associated edges between users and their corresponding intermediate media, and the edges can be assigned corresponding weights. Furthermore, the relationship graph can also be represented by using a graph data structure (such as an adjacency list or an adjacency matrix). The adjacency matrix is ​​represented by a two-dimensional matrix, and the rows and columns of the matrix represent user nodes and intermediate medium nodes respectively, and the elements in the matrix represent the strength of association between nodes (such as 1 for association and 0 for no association). The adjacency table maintains a list for each user node, containing all intermediate medium nodes associated with it.

[0078] Through the above steps, a relationship graph between users and intermediaries is finally constructed, in which each user node is connected to its corresponding intermediary node. This graph structure can well capture the potential association relationships between users established through intermediaries, especially in fraud gangs, where different users show certain association patterns by sharing intermediaries such as IP addresses or device information. At this time, possible anomalies or fraudulent behaviors are identified by analyzing these associations. In anti-fraud scenarios, there are often multiple implicit connections between users through intermediaries (such as IP addresses, mobile phone numbers, device IDs, etc.). Constructing a relationship graph can intuitively represent this complex relationship structure, which is the basis for the subsequent construction of an anti-fraud model.

[0079] Step S20, based on the association relationship between the user node and the intermediate medium node in the relationship graph, construct a heterogeneous relationship graph including the user node and the intermediate medium node, wherein the heterogeneous relationship graph includes different types of nodes and different types of edges;

[0080] Among them, in one embodiment of the present invention, constructing a heterogeneous relationship graph including user nodes and intermediate media nodes is a key step in modeling various relationships between users and intermediate media. A heterogeneous relationship graph (HeterogeneousGraph) contains multiple types of nodes and multiple types of edges, which are used to capture complex associations between different entities, where different types of nodes represent different entities, and different types of edges represent different relationships. Specifically, in anti-fraud scenarios, heterogeneous relationship graphs can reflect the multi-level relationships between users and various intermediate media (such as IP addresses, device IDs, mobile phone numbers, etc.), thereby enhancing the model's ability to mine potential fraudulent behaviors. The above-mentioned steps of constructing a heterogeneous relationship graph including user nodes and intermediate media nodes based on the association relationship between user nodes and intermediate media nodes in the relationship graph include:

[0081] Extract all user nodes and intermediate medium nodes from the constructed relationship graph, and label each user node and intermediate medium node with its node type;

[0082] Define the edge types in the heterogeneous relationship graph according to the interaction type between the user node and the intermediate medium node;

[0083] Based on the interaction relationship between the user node and the intermediate medium node, create the edges in the heterogeneous relationship graph and assign corresponding weights to each edge;

[0084] The labeled user nodes, intermediate media nodes and different types of edges are combined to construct a heterogeneous relationship graph including user nodes and intermediate media nodes.

[0085] Specifically, all user nodes and intermediate media nodes are extracted from the constructed relationship graph, where user nodes can be nodes representing different user identities; intermediate media nodes can be various media representing interactions between users. Then, the node type of each node is annotated, where all user nodes are marked as "user" type, and all intermediate media nodes are marked as "intermediate media" type. Of course, the annotation of the node type can be identified in the attributes of the node, for example, an attribute field is added to the metadata of the node to indicate the node type. Further, the edge type in the heterogeneous relationship graph is defined according to the interaction type between the user node and the intermediate media node. For example, the interaction between the user and the intermediate media may be of different types, such as transaction edge, access edge, device edge, etc., where, for example, the transaction edge is the transaction behavior between the user and the intermediate media node. The access edge is the access behavior of the user through the intermediate media (such as logging in through the IP address). The device edge is the interaction of the user through the intermediate media of a specific device (such as a mobile phone, computer, etc.). At this time, each interaction type can be defined as an edge type in the heterogeneous relationship graph, and the edge type is usually used as a metadata attribute of the graph structure. Further, the edge is created according to the interaction relationship between the user node and the intermediate media node. For example, if user A accesses the intermediary platform P through device D, an edge is created between user A and device D, and the interaction type is defined as "visit". If user A and user B conduct a transaction through device D, an edge is created between user A and user B, and the interaction type is "transaction". Further, a corresponding weight is assigned to each edge, where the edge weight can be set according to specific business needs, and the weight can usually be calculated according to type weight, frequency weight, distance weight, and timeliness weight. The type weight is based on the type of the intermediary (for example, the edge weight of a mobile phone number is higher). The frequency weight is based on the frequency of interaction between the user and the intermediary (for example, the edge weight of frequent transactions or visits is higher). The distance weight is based on the similarity or distance between the user and the intermediary (for example, the edge between users with the same IP address can be set with a higher weight). The timeliness weight is based on the time window of the interaction behavior, where the most recent interaction can have a higher weight. The weight calculation method can be defined by statistical methods, machine learning models, or domain knowledge. For example, the frequency weight can be obtained by calculating the number of interactions between the user and the intermediary. Further, the labeled user nodes, intermediary nodes, and different types of edges are combined into a complete heterogeneous relationship graph. At this time, the node types in the graph include "user" and "intermediary", and the edge types include a variety of different interactive relationships (such as "transaction edge", "access edge", "device edge", etc.). Then the heterogeneous relationship graph is represented by a graph data structure. A graph database (such as Neo4j) or a graph processing framework (such as DGL or PyTorch Geometric) can be used to store and process the heterogeneous relationship graph.The graph data structure usually includes a set of nodes, a set of edges, and the attributes of the nodes and edges (such as type, weight, timestamp, etc.).

[0086] In this step, the heterogeneous relationship graph can represent multiple types of nodes and edges, reflecting the different association dimensions between users and intermediaries. Therefore, the heterogeneous relationship graph between user nodes is constructed using intermediaries, with the aim of establishing associations between users through intermediaries (such as IP addresses, mobile phone numbers, device IDs, etc.) as bridges. The heterogeneous relationship graph constructed at this time includes the direct association between users and intermediaries, as well as the implicit association between users implied by the intermediaries. Therefore, the heterogeneous relationship graph can not only better capture the various behavioral characteristics of users, but also tap into potential complex associations, providing richer feature inputs for subsequent anti-fraud models. In anti-fraud modeling, the heterogeneous relationship graph can better simulate the behavior of multiple users in a fraud gang sharing the same intermediary.

[0087] Further, in practical applications, the interactive relationship data between the user and the intermediate medium is basic information. These data need to be first clearly structured into a simple association diagram between the user and the intermediate medium (i.e., the initial relationship diagram). At this time, the user converts the original data into a graph structure suitable for modeling, so that the source, type, and relationship of the data are clearer. By first constructing the relationship diagram, the accuracy of data organization and processing can be ensured, and the problem of inconsistent data types or redundancy that occurs when directly constructing a heterogeneous relationship diagram can be avoided. At the same time, the initial relationship diagram processes the original relationship of the data separately, providing a clear graph model structure. This processing can be used as a basic diagram, and any subsequent expansion or enhancement (such as heterogeneous relationship diagram construction) can be based on this basic structure. Therefore, by separating the relationship diagram from the heterogeneous relationship diagram, the different levels of data processing can be clearly divided, making each step more logical and controllable. Therefore, in the embodiment of the present invention, first constructing the initial relationship diagram through step S10 provides greater flexibility for the subsequent construction of the heterogeneous relationship diagram in step S20. If the source or structure of the data changes, only the initial relationship diagram can be adjusted, without having to adjust the construction method of the entire heterogeneous relationship diagram from scratch. At the same time, the initial relationship graph, as an independent module, provides flexibility for the adjustment of the graph structure, and the construction of heterogeneous relationship graphs can also be expanded and adjusted based on different needs. At the same time, building the relationship graph first helps to add more complexity to the subsequent heterogeneous relationship graph. For example, in addition to user nodes and some intermediate medium nodes, new node types or association relationships can be introduced to gradually expand the relationship graph into a heterogeneous relationship graph containing more entities and relationships. Directly building a heterogeneous relationship graph may complicate the expansion process, while building a simple relationship graph first and then transitioning to a heterogeneous relationship graph can maintain the clarity of the structure.

[0088] In addition, for anti-fraud models based on graph neural networks, specific encoding methods are required to process different types of nodes and relationship graphs. By building a relationship graph first, the graph structure can be defined more clearly, which is helpful for the effectiveness of subsequent feature encoding, aggregation, and model training. If a heterogeneous relationship graph is constructed directly, more complex node and edge information may need to be processed during model training, which may cause the graph to be too large, affecting training efficiency and model performance. Therefore, building a simple relationship graph first, and then building a heterogeneous relationship graph through information aggregation, can help discover potential problems in the data structure. At this time, the processing results of each step can be tested and optimized separately, and the debugging process is simpler. If a heterogeneous relationship graph is constructed directly, it may be more difficult to locate and fix the problem.

[0089] Step S30, based on the intermediate medium nodes in the heterogeneous relationship graph representing the association relationship between the user nodes, the heterogeneous relationship graph is converted into a homogeneous relationship graph containing only the user nodes and the edge weights between them;

[0090] Among them, in one embodiment of the present invention, the heterogeneous relationship graph contains multiple different types of nodes and edges. For fraud detection, user nodes and intermediate media nodes may be different types of nodes, and the association relationship between them may also be expressed as different types of edges. Therefore, when performing feature encoding, different feature encoding methods need to be designed for different types of nodes and edges. This increases the complexity of the graph neural network model, resulting in a more complex structure of the model and higher requirements for computing resources. The message passing mechanism in the graph neural network (GNN) is usually based on information transmission between nodes, while in a heterogeneous relationship graph, different types of nodes and edges make message transmission complicated. For example, the interaction between user nodes and intermediate media nodes is different from the relationship between users, which requires a specific message transmission method to be designed for each different node and edge, making model design more difficult. In actual fraud detection scenarios, the data sample size may be limited, especially the relationship between different types of nodes and edges. Direct encoding and training on heterogeneous relationship graphs may lead to excessive model complexity and increase the risk of overfitting. Direct processing of heterogeneous relationship graphs usually requires larger-scale data and more complex parameter adjustment processes.

[0091] Therefore, in order to solve the above problems, in an embodiment of the present invention, the core relationship between users is retained and the dimension is reduced by converting the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and the edge weights between them, which helps to simplify the calculation of the graph neural network model and facilitate the training of the anti-fraud model of the standard graph neural network. Among them, the above-mentioned steps of converting the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and the edge weights between them based on the intermediate medium nodes in the heterogeneous relationship graph to represent the association relationship between user nodes include:

[0092] Identify the interaction relationship between each user node and the intermediate medium node in the heterogeneous relationship graph;

[0093] For each intermediate medium node, detect all user nodes directly connected to it, and determine the user node pairs that are associated with other user nodes through the intermediate medium;

[0094] Based on the association relationship between the user node pairs through the intermediate medium nodes, the association strength between the user node pairs is calculated, and the association strength is weighted according to the type, sharing quantity, interaction frequency, and time interval of the intermediate medium nodes;

[0095] Generate a new edge for each user-node pair, and assign the edge weight according to the strength of the association between the user-node pairs;

[0096] Delete the intermediate nodes in the heterogeneous relationship graph, retain the user nodes and the edges generated between them, and construct a homogeneous relationship graph containing only the user nodes and the edge weights between them.

[0097] Specifically, firstly, all user nodes and intermediary nodes are extracted from the heterogeneous relationship graph, and the interaction relationship between them is identified. Each edge represents a specific interaction relationship (such as transaction, access, login, etc.). Then, the relevant interaction type and weight are recorded for each interaction relationship, and this information can be represented by the attributes of the node and the edge. Further, each intermediary node in the heterogeneous relationship graph is traversed. For each intermediary node, all directly connected user nodes (i.e., user nodes connected to the intermediary node through edges) are identified. For each intermediary node, all pairs of user nodes directly connected to it are considered. That is, if the intermediary node connects user node A and user node B, user A and user B are associated through the intermediary node. Further, the association strength between each pair of user nodes is calculated. The association strength can be weighted according to the type of the intermediary node, the number of shares, the frequency of interaction, or the time interval. For example, if user u1 and user u2 share multiple intermediaries, the weight of the edge can increase with the number of shared intermediaries. Or some intermediate media (such as IP addresses) may be shared among multiple users, but their weight is relatively low; while other intermediate media (such as mobile phone numbers) may be more unique and have relatively high weights. In one embodiment of the present invention, when constructing an isomorphic relationship graph, the edge weights w(u i ,u j ) can be calculated by the following formula:

[0098]

[0099] Among them, w(u i ,u j ) is the user node ui and user node u j The edge weight between Medium is the set of intermediate medium nodes, m is the intermediate medium node, A UM (u i ,m) is the user node u i The adjacency relationship between the user node u and the intermediate medium node m, where if the user node u i is associated with the intermediate medium node m, then A UM (u i ,m) is 1, otherwise it is 0; A UM (u j ,m) is the user node u j The adjacency relationship between the user node u and the intermediate medium node m, where if the user node u j is associated with the intermediate medium node m, then A UM (u j ,m) is 1, otherwise it is 0; f type (m) is the type weight of the intermediate node m, f frequency (u i ,u j ) is the user node u i and user node u j The interaction frequency weight between time (u i ,u j ) is the user node u i and user node u j The weight of the interaction time interval between them, where degree(m) represents the degree of the intermediate node m, that is, how many users are associated with the intermediate. The intermediate with a higher degree (shared by many users) has a lower weight, and vice versa. w1, w2, w3, and w4 are weight parameters adjusted according to actual business needs.

[0100] That is to say, when two user nodes u i and u j When sharing an intermediate node m, A UM (u i ,m)·A UM (u j,m)=1, indicating that the two are associated through the intermediate node. At this time, by calculating these features, the strength of association between each pair of user nodes is obtained. Furthermore, according to the calculated strength of association, a new edge is generated for each pair of user nodes. In the isomorphic relationship graph, the starting point and end point of the edge are user nodes, and the weight of the edge is a value obtained by the above-mentioned calculation of the strength of association. The weight of the edge represents the strength of association between user nodes, reflecting the strength of the indirect connection between two user nodes through the intermediary node. For example, user node pairs with frequent associations and strong timeliness will have higher edge weights. Furthermore, all intermediate nodes and their related edges in the heterogeneous relationship graph are deleted, so that only user nodes and edges generated by the association between user node pairs are retained. Then all user nodes and the edges between them are retained, and the weight of each edge is set to the strength of association calculated above. Finally, a isomorphic relationship graph is obtained, in which each node represents only one user, and the weight of the edge represents the strength of association between users.

[0101] In this step, after converting the heterogeneous relationship graph into a homogeneous relationship graph, usually only the user nodes and the direct edges between them (the relationship between users) remain, and the intermediate media nodes are abstracted as edge weights or other information. The advantage of converting the heterogeneous relationship graph into a homogeneous relationship graph is that the structure of the homogeneous relationship graph is simple, all nodes are of the same type (such as all user nodes), and there is only one type of edge, which greatly simplifies the design of the graph neural network. At this time, the graph neural network can transmit and aggregate information between nodes of the same type through a standard message passing mechanism, without distinguishing between node types or edge types. Feature encoding and training in homogeneous relationship graphs are relatively computationally inexpensive, the network parameter quantity and model complexity can be effectively controlled, and the training efficiency is higher. Especially in large-scale data scenarios, reducing the computational complexity of the model can improve the response speed of the system.

[0102] At the same time, by converting the intermediate media nodes (such as devices, IP addresses, etc.) in the heterogeneous relationship graph into edge weights or other features between user nodes, the implicit associations between users are actually aggregated. This process allows the user nodes in the homogeneous relationship graph to retain the information in the heterogeneous relationship graph, but makes the structure more concise, and at the same time, the potential fraudulent associations between users are easier to be captured by the model through feature aggregation. In homogeneous relationship graphs, graph neural networks can more efficiently aggregate the features of user nodes. Since all nodes are of the same type, the message passing mechanism no longer needs to distinguish between different types of nodes and edges, which enables each node to make full use of information from adjacent nodes for efficient feature aggregation, thereby improving the quality of feature representation.

[0103] At the same time, when converting heterogeneous relationship graphs to homogeneous relationship graphs, the relationships between different types of nodes are abstracted into unified edge weights or features. This unified representation helps improve the generalization ability of the model. Uniformly processing the relationships between user nodes can reduce the inconsistency problems caused by different node types and edge types, thereby improving the adaptability and prediction effect of the model in different fraud scenarios. After conversion to a homogeneous relationship graph, the model does not need to process different types of nodes and edges, which greatly reduces the number of parameters and complexity of the model and helps prevent overfitting. Especially in scenarios with limited data or less labeled data, training based on homogeneous relationship graphs can effectively improve the robustness of the model.

[0104] At the same time, in homogeneous relationship graphs, the complex associations between user nodes are more intuitive, and potential fraud associations between users can usually be displayed in the form of weights or direct edges. This makes the output of the model easier to interpret, especially in fraud detection applications, where interpretability helps analyze suspicious behavior patterns between users and the organizational structure of fraud gangs. After converting heterogeneous relationship graphs to homogeneous relationship graphs, the model's reasoning process on the edges between users is more transparent. Compared with the complex relationships of multiple node types and edges when dealing with heterogeneous relationship graphs, the edge weights of homogeneous relationship graphs can directly represent the similarities or potential risks between users, which helps explain and analyze model decisions.

[0105] Step S40, performing feature encoding processing on the converted isomorphic relationship graph, aggregating the features of each user node and its adjacent nodes, and generating a high-dimensional feature vector for each user node;

[0106] Among them, in one embodiment of the present invention, the step of performing feature encoding processing on the converted isomorphic relationship graph, aggregating the features of each user node and its adjacent nodes, and generating a high-dimensional feature vector for each user node includes:

[0107] Initialize a feature vector for each user node in the isomorphic relationship graph, wherein the feature vector contains basic attribute information of the user node;

[0108] Based on the neighbor node set of each user node, the corresponding feature vector is extracted from each neighbor node, and the features of the neighbor nodes are weighted and aggregated according to the edge weights between the neighbor nodes and the user node to generate an aggregated feature vector;

[0109] The feature vector of each user node is combined with the aggregated feature vectors of its neighboring nodes to generate a high-dimensional feature vector for each user node.

[0110] Specifically, for each user node in the isomorphic relationship graph, its feature vector is initialized. The initialized feature vector usually contains the basic attribute information of the user node, such as: the user's basic identity information, historical behavior data, transaction records, etc. These basic attribute information can be represented as a vector Where u represents the user node, and its initial feature vector is usually a numerical vector of fixed dimension. Then for each user node u, extract the feature vectors of its neighbor nodes. The neighbor nodes are other user nodes connected to the current user node through edges. Then, by weighted aggregation, the feature vectors of each neighbor node are combined to generate the aggregated features of the user node. Each edge has a weight, which represents the strength of association between the two nodes. By weighted aggregation of the feature vectors of the neighbor nodes and considering the weights of the edges, a new feature vector can be obtained. Combine the feature vector of the user node itself with the weighted aggregated feature vector of its neighbor nodes. A common method is to concatenate or weighted sum these two vectors to form a new feature vector. The specific combination method depends on the graph neural network architecture used.

[0111] Among them, the feature encoding processing method can efficiently combine the basic features of each user node with the features of its neighbor nodes to form a comprehensive representation. This not only takes into account the characteristics of a single user, but also combines the influence of neighbor nodes on the user, so that the model can capture the relationship between users. Through the weighted aggregation of neighbor node features, the model can more accurately understand and represent the potential associations between users. Especially in fraud detection tasks, this information fusion helps to identify users with similar behavior patterns or abnormal patterns. At the same time, by introducing edge weights (indicating the strength of association between user nodes), this method can dynamically adjust the influence of different neighbor nodes on user node features. At the same time, the high-dimensional feature vector after feature encoding provides a richer node representation for the graph neural network, which can help the graph neural network better learn and predict the behavioral characteristics of user nodes, thereby improving the accuracy of fraud detection. At this time, through the feature aggregation and learning of the graph neural network, even if there are fewer labels, the model can mine potential fraud patterns through the relationship between neighbor nodes, thereby reducing dependence on a large amount of labeled data.

[0112] Step S50, inputting the encoded high-dimensional feature vector of the user node into an anti-fraud model based on a graph neural network for training, and learning the feature representation of each user node;

[0113] Among them, in one embodiment of the present invention, the step of inputting the encoded high-dimensional feature vector of the user node into the anti-fraud model based on the graph neural network for training includes:

[0114] Inputting the high-dimensional feature vectors of all user nodes after feature encoding processing into an anti-fraud model based on a graph neural network, wherein the anti-fraud model comprises a plurality of graph convolutional layers, each of which performs feature aggregation and update operations to generate a new feature representation of each user node;

[0115] For each user node, the feature representation of the node is updated in turn through each graph convolution layer in the anti-fraud model, where each graph convolution layer performs weighted aggregation based on the feature vector of the current node and the feature vectors of its neighboring nodes to generate a new node feature representation;

[0116] During the training phase of the model, the pre-annotated fraud labels are used as supervisory signals to optimize the parameters of the anti-fraud model by minimizing a loss function calculated based on the difference between the fraud probability predicted by the model and the true label;

[0117] During the training process, the gradient descent optimization algorithm is used to adjust the weights of the graph neural network, and the model parameters are updated iteratively by calculating the gradient to gradually learn the feature representation of each user node;

[0118] The iterative training process is repeated until the model reaches convergence conditions and completes the learning of the feature representation of each user node.

[0119] Specifically, the high-dimensional feature vectors of all user nodes after feature encoding are input into the anti-fraud model based on the graph neural network. The model includes multiple graph convolution layers, each of which is responsible for performing feature aggregation and update operations to generate a new feature representation for each user node. Then, in each graph convolution layer, weighted aggregation is performed based on the feature vector of the current node and the feature vectors of its neighboring nodes. After aggregation, the features of the node are updated to generate a new feature representation. Furthermore, in the training phase, the pre-labeled fraud labels are used as supervisory signals. The goal of the anti-fraud model is to predict the fraud probability of each user node based on the feature representation of the node. The loss function is calculated based on the difference between the fraud probability predicted by the model and the true label, and the commonly used loss function is the cross entropy loss. Furthermore, the weights of the graph neural network are adjusted using the gradient descent optimization algorithm, and the gradient of the loss function with respect to the model parameters (including the weight matrix of each layer) is calculated by back propagation. According to the gradient update rule, the weights are iteratively updated. Repeat the above training steps (feature update, loss calculation, gradient optimization) until the model reaches the convergence condition. The parameters in the graph neural network are continuously adjusted during the training process, and finally a trained anti-fraud model is obtained.

[0120] Among them, through the multi-layer feature aggregation of the graph convolution layer, the model can gradually learn the complex relationship between the user node and its neighboring nodes, so as to obtain a more accurate node feature representation; it helps to capture the potential pattern of fraudulent behavior and improve the accuracy of fraud detection. By aggregating the features of neighboring nodes, the representation of each user node not only depends on its own features, but also fully considers the relationship with other nodes. It is very important for identifying user groups with similar or abnormal behaviors, especially in fraud detection, which often requires relying on multi-party related information. Through supervised learning, the model can be trained according to the real label, and the optimized model can provide accurate fraud prediction in practical applications. In addition, the structure of the graph neural network makes the model's processing of the relationship between nodes more interpretable, and can clarify which node associations affect fraud prediction. During the training process, through the feature propagation and aggregation of the graph convolution layer, the model can learn the intrinsic relationship between the graph structure and node features when there is less labeled data, so that it does not need to rely on a large amount of labeled data, thereby improving the prediction effect of unlabeled samples and alleviating the challenge of difficult label acquisition. Through the gradient descent algorithm, the model can gradually adjust parameters in multiple iterations to optimize the fraud detection effect. The parameter adjustment of each graph convolution layer enables the final node feature representation to better match the actual fraud label, improving the accuracy and generalization ability of the model.

[0121] Step S60, inferring the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculating and outputting the fraud probability of the target user node, and generating a corresponding fraud detection result;

[0122] Among them, in one embodiment of the present invention, the above-mentioned steps of inferring the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculating and outputting the fraud probability of the target user node, and generating the corresponding fraud detection result include:

[0123] Receiving a high-dimensional feature vector of a target user node generated after feature encoding processing;

[0124] Input the high-dimensional feature vector of the target user node into the trained anti-fraud model based on graph neural network for inference;

[0125] In the inference stage of the anti-fraud model, the feature representation of the target user node is calculated through the forward propagation of the graph neural network, and the contextual neighbor information and global graph structure of the target user node are combined to generate a new feature representation of the target user node;

[0126] Based on the feature representation of the target user node finally generated, the anti-fraud model outputs the fraud probability of the target user node, where the fraud probability indicates the possibility that the target user node is a fraud user;

[0127] The fraud detection result is generated by comparing the fraud probability of the target user node with a preset fraud threshold, and the fraud detection result includes the fraud probability and its corresponding prediction label.

[0128] Specifically, first, the system receives the high-dimensional feature vector of the target user node after feature encoding processing. This feature vector contains the basic attribute information of the target user node and the deep information obtained by aggregating the features of neighboring nodes. This information will be sent as input data to the trained anti-fraud model for inference. Then the high-dimensional feature vector of the target user node is input into the trained anti-fraud model for inference. The anti-fraud model consists of multiple graph convolution layers, which will calculate and update the features of the target user node during the inference process. In the inference stage of the graph neural network, the model calculates the final feature representation of the target user node through forward propagation. This process takes into account the neighbor information of the target node (i.e., the features of other user nodes connected to the target node) and the global graph structure. Through the inference process of the graph neural network, the final feature representation of the target user node is generated. The anti-fraud model uses this feature representation, and after the fully connected layer and activation function, it outputs the fraud probability of the target user node, which indicates the possibility of the target user node being a fraud user. Then, based on the fraud probability of the target user node and the preset fraud threshold, the fraud detection result is generated. If the fraud probability is greater than the fraud threshold, the model predicts that the user is a fraud user, otherwise it is a normal user.

[0129] In an embodiment of the present invention, through the reasoning process of the graph neural network, the model can effectively integrate the feature information of the target user node and the context information of its neighboring nodes to generate an accurate fraud probability. This can provide decision makers with data-based fraud predictions and help identify potential fraud risks in a timely manner. At this time, appropriate fraud thresholds can be set according to different scenarios during fraud detection to ensure that appropriate prediction results are generated under different risk preferences. A lower threshold can be set for high-risk scenarios to detect potential fraud with higher accuracy. Among them, the model not only relies on the characteristics of the target user node, but also captures the relationship between the target user node and other nodes through the graph structure, which helps to identify fraud caused by behavioral similarity or historical correlation. Therefore, this step can efficiently perform reasoning and fraud detection in large-scale graph data, is suitable for large-scale financial, social network and other scenarios, and can process a large amount of user information in real time and make accurate predictions. Due to the characteristics of the graph neural network, the model can provide clear prediction probabilities and their corresponding labels, which provides a guarantee for the interpretability of fraud detection results. Users can assess risks based on the probability of fraud and decide whether to take further action.

[0130] Furthermore, in one embodiment of the present invention, after the step of generating the corresponding fraud detection result, the following steps are further included:

[0131] Based on the generated fraud detection results, take corresponding preventive or emergency response measures for the target user nodes whose fraud probability is higher than the fraud threshold. The response measures include freezing the target user account, restricting the target user's transaction rights, or marking the target user account for further review;

[0132] The fraud detection results of all target user nodes are stored in the database, recording the fraud probability, predicted label, and associated feature information of each user node;

[0133] Generate an explainable report for user nodes with fraudulent detection results, which includes the associations between user nodes detected by the anti-fraud model, key intermediate nodes and their interactive behaviors;

[0134] The generated fraud detection results are delivered to the risk control system to trigger corresponding business decisions.

[0135] Specifically, by analyzing the fraud probability of the target user node and the preset fraud threshold, when the fraud probability is greater than the fraud threshold, the target user node is considered to be a possible fraud user. At this time, the corresponding preventive or emergency measures will be taken according to the set response strategy. It can freeze the user account, restrict transactions or review mark according to the preset strategy. The specific implementation includes: freezing the user account with a fraud probability higher than the threshold by calling the backend account management system interface to prevent it from performing further fund operations. Restricting the withdrawal, transfer and other fund flow operations of the target user account to ensure that no losses will be caused before further review. Marking the target user as a high-risk user and transferring it to manual review or further risk control model for processing. Further, for each user node, its fraud detection results (including fraud probability, prediction label, and feature information related to the user node) are recorded and stored in the database to facilitate subsequent query, analysis and report generation. Further, for the user node determined to be fraudulent, according to the associated information output by the anti-fraud model, extract the key intermediate medium nodes, interactive behaviors, etc., and automatically generate an explainable report in combination with the weights and features of the model. The report can be presented in the form of a chart, graph or text to help decision makers understand the reasons for the fraud prediction results. The report should include: the association between user nodes, such as the interaction information between the user and other user nodes or intermediate media nodes. And the key intermediate media nodes and their interactive behaviors, which are used to reveal which intermediate media nodes affect the user's behavior and help analyze whether the user has gang fraud or is associated with a specific pattern. Further, the generated fraud detection results are passed to the risk control system to trigger corresponding business decisions. The risk control system can automatically execute relevant decision-making processes based on the received fraud prediction results, such as freezing funds, investigating and handling.

[0136] Therefore, by applying fraud detection results to prevention and emergency response measures, the damage of fraudulent behavior can be effectively prevented, suspicious accounts can be frozen in time, malicious behavior can be restricted, and losses can be reduced. Storing fraud detection results and related feature information in the database can provide a comprehensive record of each decision-making process, ensure transparency, and provide data support for subsequent audits and analysis. By generating explainable reports, the risk management team can clearly understand the reasons behind the fraud prediction results and make more targeted decisions. The interpretability of the model improves the confidence and accuracy of decisions. Passing fraud detection results to the risk control system can realize the automated response of fraud detection. It reduces the need for manual intervention and improves the response speed and processing efficiency of the business. Storing and tracking detection results, combined with actual fraud detection and response measures, can provide valuable feedback data for subsequent model training, help further optimize the anti-fraud model, and improve future detection accuracy and response capabilities.

[0137] Therefore, by constructing the relationship graph between users and intermediaries, transforming and encoding the heterogeneous relationship graph, we can effectively capture the potential associations and interaction patterns between users and other nodes; by constructing the heterogeneous relationship graph between users, we can mine the complex relationship network between users and improve the ability to identify group fraud; by representing user nodes through intermediaries and constructing heterogeneous relationship graphs, we can effectively capture the implicit associations between users, where the heterogeneous relationship graph can reflect different types of intermediary associations, and by assigning different weights to different edge types, we can improve the accuracy of the model in anti-fraud scenarios and the ability to detect group fraud; and by encoding the features of the homogeneous relationship graph, we not only retain the nodes, but also It can not only capture the characteristic information of nodes, but also the complex relationship between nodes and neighboring nodes. Especially in the anti-fraud scenario, it can effectively mine clues of implicit associations and group fraud. By constructing a relationship graph between users and intermediate media and gradually transforming it into an isomorphic relationship graph, it can comprehensively utilize the characteristics of nodes and the association between nodes to solve the problem of category imbalance, and support unsupervised or semi-supervised learning, so that effective modeling can be performed even when labels are scarce. By constructing an implicit association network between users through intermediate media, it can capture group fraud behaviors that cannot be discovered by isolated analysis. The aggregation mechanism of graph neural networks and the clustering characteristics of graphs can help improve the problem of category imbalance, and clustered nodes are often at higher risks.

[0138] In summary, the fraud detection method based on graph neural network in the above-mentioned embodiment of the present invention can effectively capture the potential associations and interaction patterns between users and other nodes by constructing a relationship graph between users and intermediate media and converting it based on a heterogeneous relationship graph, so that it can not only accurately identify the fraudulent behavior of individual users, but also improve the ability to identify group fraud by capturing the complex relationship network between users, especially in the case of implicit associations; through the introduction of intermediate medium nodes, it can effectively characterize the implicit associations between users, which is helpful to reveal the complex interactive relationships between users that are not easy to directly observe, especially it can effectively capture group fraud behaviors, which are often difficult to identify through the analysis of a single node; by converting the heterogeneous relationship graph into a homogeneous relationship graph and utilizing the association relationship between nodes, it effectively solves the problem of category imbalance in fraud detection; and through the aggregation mechanism of the graph neural network, it can focus on those high-risk ones. Risky clustering nodes, which are often closely related to fraudulent behavior, enable effective modeling even when labels are scarce, support unsupervised or semi-supervised learning, and thus enhance the model’s adaptability to scarce labeled data; by capturing the complex relationships and implicit features between nodes, the model’s interpretability is improved, and decision makers can understand through the features and results of the model output which relationships between user nodes and their interactive behaviors are the key factors leading to fraud detection results, making anti-fraud decisions more transparent and actionable; through feature encoding processing of isomorphic relationship graphs, not only the feature information of user nodes is retained, but also the complex relationships between nodes and neighboring nodes can be captured, especially in anti-fraud scenarios, potential implicit associations and clues to group fraud can be effectively mined; and graph neural networks, through feature aggregation, help improve the detection capabilities of the overall model in different complex situations, ultimately solving the problems of low efficiency and accuracy of existing fraud detection.

[0139] Embodiment 2

[0140] See also Figure 2 , is a schematic diagram of the structure of a fraud detection device based on a graph neural network provided by a second embodiment of the present invention. For the sake of convenience, only the part related to the embodiment of the present invention is shown. The device includes:

[0141] A relationship graph construction module 11 is used to obtain data of a user and a corresponding intermediate medium, and to construct a relationship graph between the user and the intermediate medium, wherein the relationship graph includes user nodes, intermediate medium nodes, and association relationships between user nodes and intermediate medium nodes;

[0142] A heterogeneous relationship graph construction module 12, configured to construct a heterogeneous relationship graph including user nodes and intermediate medium nodes based on the association relationship between the user nodes and the intermediate medium nodes in the relationship graph, wherein the heterogeneous relationship graph includes different types of nodes and different types of edges;

[0143] A homogeneous relationship graph construction module 13 is used to represent the association relationship between user nodes based on the intermediate medium nodes in the heterogeneous relationship graph, and convert the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and the edge weights between them;

[0144] The encoding processing module 14 is used to perform feature encoding processing on the converted isomorphic relationship graph, aggregate the features of each user node and its adjacent nodes, and generate a high-dimensional feature vector for each user node;

[0145] A model training module 15 is used to input the encoded high-dimensional feature vector of the user node into an anti-fraud model based on a graph neural network for training, and learn the feature representation of each user node;

[0146] The fraud detection module 16 is used to infer the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculate and output the fraud probability of the target user node, and generate a corresponding fraud detection result.

[0147] Furthermore, in one embodiment of the present invention, the relationship graph construction module 11 includes:

[0148] A data acquisition unit, used to collect user data and intermediate medium data of interaction with users from multiple data sources;

[0149] A node definition unit, used to define user nodes and intermediate media nodes based on the collected user data and intermediate media data, wherein the user node represents each user entity and the intermediate media node represents an intermediate media entity interacting with the user;

[0150] An edge generation unit, used to generate an edge between the user node and the intermediate medium node according to the association interaction between the user node and the intermediate medium node, wherein the edge represents the association relationship between the user node and the intermediate medium node;

[0151] The relationship graph construction unit is used to combine all user nodes, intermediate medium nodes and the edges between them to construct a relationship graph between users and intermediate media.

[0152] Furthermore, in one embodiment of the present invention, the heterogeneous relationship graph construction module 12 includes:

[0153] A node extraction unit is used to extract all user nodes and intermediate medium nodes from the constructed relationship graph, and mark the node type of each user node and intermediate medium node respectively;

[0154] An edge definition unit, used to define edge types in a heterogeneous relationship graph according to the interaction type between the user node and the intermediate medium node;

[0155] An edge creation unit, used to create edges in the heterogeneous relationship graph based on the interaction relationship between the user node and the intermediate medium node, and assign a corresponding weight to each edge;

[0156] The heterogeneous relationship graph creation unit is used to combine the marked user nodes, intermediate medium nodes and different types of edges to construct a heterogeneous relationship graph including user nodes and intermediate medium nodes.

[0157] Furthermore, in one embodiment of the present invention, the isomorphic relationship graph construction module 13 includes:

[0158] An interaction identification unit, used to identify the interaction relationship between each user node and the intermediate medium node in the heterogeneous relationship graph;

[0159] A user node pair determination unit, configured to detect, for each intermediate medium node, all user nodes directly connected thereto, and determine user node pairs associated with other user nodes via the intermediate medium;

[0160] An association strength calculation unit, used to calculate the association strength between the user node pairs based on the association relationship between the user node pairs through the intermediate medium node, wherein the association strength is weightedly calculated according to the type, sharing quantity, interaction frequency, and time interval of the intermediate medium node;

[0161] An edge generation unit, used to generate a new edge for each pair of user nodes, and the weight of the edge is assigned according to the strength of association between the user node pairs;

[0162] The isomorphic relationship graph construction unit is used to delete the intermediate medium nodes in the heterogeneous relationship graph, retain the user nodes and the edges generated between them, and construct an isomorphic relationship graph containing only the user nodes and the edge weights between them.

[0163] Furthermore, in one embodiment of the present invention, the encoding processing module 14 includes:

[0164] A feature vector initialization unit, used to initialize a feature vector of each user node in the isomorphic relationship graph, wherein the feature vector includes basic attribute information of the user node;

[0165] A feature vector aggregation unit is used to extract a corresponding feature vector from each neighbor node based on the neighbor node set of each user node, and to perform weighted aggregation on the features of the neighbor nodes according to the edge weights between the neighbor nodes and the user node to generate an aggregated feature vector;

[0166] The high-dimensional feature vector generating unit is used to combine the feature vector of each user node itself with the aggregated feature vectors of its neighboring nodes to generate a high-dimensional feature vector for each user node.

[0167] Furthermore, in one embodiment of the present invention, the model training module 15 includes:

[0168] An input unit, used to input the high-dimensional feature vectors of all user nodes after feature encoding processing into an anti-fraud model based on a graph neural network, wherein the anti-fraud model includes a plurality of graph convolutional layers, each of which performs feature aggregation and update operations to generate a new feature representation of each user node;

[0169] A feature updating unit, for each user node, sequentially updates the feature representation of the node through each graph convolution layer in the anti-fraud model, wherein each graph convolution layer generates a new node feature representation by weighted aggregation based on the feature vector of the current node and the feature vectors of its neighboring nodes;

[0170] A model optimization unit, used to optimize the parameters of the anti-fraud model by minimizing a loss function during the training phase of the model, using the pre-labeled fraud labels as supervision signals, wherein the loss function is calculated based on the difference between the fraud probability predicted by the model and the true label;

[0171] The model parameter adjustment unit is used to adjust the weights of the graph neural network using the gradient descent optimization algorithm during the training process, update the model parameters by calculating the gradient iteration, and gradually learn the feature representation of each user node;

[0172] The model training unit is used to repeat the iterative training process until the model reaches the convergence condition and completes the learning of the feature representation of each user node.

[0173] Furthermore, in one embodiment of the present invention, the fraud detection module 16 includes:

[0174] A feature vector receiving unit, used to receive a high-dimensional feature vector of a target user node generated after feature encoding processing;

[0175] The model inference unit is used to input the high-dimensional feature vector of the target user node into the trained anti-fraud model based on the graph neural network for inference;

[0176] The feature representation calculation unit is used to calculate the feature representation of the target user node through the forward propagation of the graph neural network during the inference stage of the anti-fraud model, and to generate a new feature representation of the target user node by combining the contextual neighbor information and the global graph structure of the target user node;

[0177] A model output unit, configured to output the fraud probability of the target user node based on the feature representation of the target user node finally generated by the anti-fraud model, wherein the fraud probability indicates the possibility that the target user node is a fraud user;

[0178] The fraud detection result generating unit is used to generate a fraud detection result according to the comparison between the fraud probability of the target user node and a preset fraud threshold, wherein the fraud detection result includes the fraud probability and its corresponding prediction label.

[0179] Furthermore, in one embodiment of the present invention, the device further comprises:

[0180] A response measure implementation module is used to take corresponding preventive or emergency response measures for target user nodes whose fraud probability is higher than the fraud threshold based on the generated fraud detection results. The response measures include freezing the target user account, restricting the target user's transaction rights, or marking the target user account for further review;

[0181] A data storage module is used to store the fraud detection results of all target user nodes in the database, and record the fraud probability, predicted label, and associated feature information related to each user node;

[0182] A report generation unit, used to generate an explainable report for a user node with a detection result of fraud, wherein the report includes the association relationship between user nodes detected by the anti-fraud model, key intermediate media nodes and their interactive behaviors;

[0183] The detection result delivery module is used to deliver the generated fraud detection results to the risk control system to trigger corresponding business decisions.

[0184] An embodiment of the present invention provides a fraud detection device based on a graph neural network, and its implementation principle and technical effects are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0185] Embodiment 3

[0186] On the other hand, the present invention also proposes a fraud detection system based on graph neural network, please refer to Figure 3 , shown is a fraud detection system based on graph neural network in the third embodiment of the present invention, including a memory 20, a processor 10, and a program 30 stored in the memory 20 and executable on the processor. When the processor 10 executes the program 30, the fraud detection method based on graph neural network in the above embodiment is implemented.

[0187] In some embodiments, the processor 10 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor or other data processing chip, used to run program codes or process data stored in the memory 20, such as executing access restriction programs.

[0188] Among them, the memory 20 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (such as SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 20 can be an internal storage unit of the fraud detection system based on graph neural network, such as the hard disk of the fraud detection system based on graph neural network. In other embodiments, the memory 20 can also be an external storage device of the fraud detection system based on graph neural network, such as a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the fraud detection system based on graph neural network. Further, the memory 20 can also include both an internal storage unit and an external storage device of the fraud detection system based on graph neural network. The memory 20 can be used not only to store application software and various types of data installed in the fraud detection system based on graph neural network, but also to temporarily store data that has been output or is to be output.

[0189] It should be pointed out that Figure 3 The structure shown does not constitute a limitation of the fraud detection system based on graph neural network. In other embodiments, the fraud detection system based on graph neural network may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0190] In summary, the fraud detection system based on graph neural network in the above embodiment of the present invention can effectively capture the potential associations and interaction patterns between users and other nodes by constructing a relationship graph between users and intermediate media and converting it based on a heterogeneous relationship graph, so that it can not only accurately identify the fraudulent behavior of individual users, but also improve the ability to identify group fraud by capturing the complex relationship network between users, especially in the case of implicit associations; through the introduction of intermediate medium nodes, it can effectively characterize the implicit associations between users, which helps to reveal the complex interactive relationships between users that are not easy to directly observe, and especially can effectively capture group fraud behaviors, which are often difficult to identify through the analysis of a single node; by converting the heterogeneous relationship graph into a homogeneous relationship graph and utilizing the association relationship between nodes, the problem of category imbalance in fraud detection is effectively solved; and through the aggregation mechanism of the graph neural network, it can focus on those high-risk ones. Risky clustering nodes, which are often closely related to fraudulent behavior, enable effective modeling even when labels are scarce, support unsupervised or semi-supervised learning, and thus enhance the model’s adaptability to scarce labeled data; by capturing the complex relationships and implicit features between nodes, the model’s interpretability is improved, and decision makers can understand through the features and results of the model output which relationships between user nodes and their interactive behaviors are the key factors leading to fraud detection results, making anti-fraud decisions more transparent and actionable; through feature encoding processing of isomorphic relationship graphs, not only the feature information of user nodes is retained, but also the complex relationships between nodes and neighboring nodes can be captured, especially in anti-fraud scenarios, potential implicit associations and clues to group fraud can be effectively mined; and graph neural networks, through feature aggregation, help improve the detection capabilities of the overall model in different complex situations, ultimately solving the problems of low efficiency and accuracy of existing fraud detection.

[0191] An embodiment of the present invention also provides a readable storage medium on which a program is stored. When the program is executed by a processor, the fraud detection method based on graph neural network as described in the above embodiment is implemented.

[0192] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional units or modules as needed, that is, the internal structure of the storage device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the implementation method can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application.

[0193] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any storage medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, a "storage medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0194] More specific examples of readable storage media (a non-exhaustive list) include the following: an electrical connection with one or more wirings (electronic devices), a portable computer disk case (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the storage medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in another suitable manner as necessary, and then stored in a memory.

[0195] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0196] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0197] The above-described embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A fraud detection method based on graph neural network, characterized in that: The method comprises: Acquire data of a user and a corresponding intermediate medium, and construct a relationship graph between the user and the intermediate medium, wherein the relationship graph includes a user node, an intermediate medium node, and an association relationship between the user node and the intermediate medium node; Based on the association relationship between the user node and the intermediate medium node in the relationship graph, a heterogeneous relationship graph including the user node and the intermediate medium node is constructed, wherein the heterogeneous relationship graph includes different types of nodes and different types of edges; Based on the intermediate medium nodes in the heterogeneous relationship graph to represent the association relationship between user nodes, the heterogeneous relationship graph is converted into a homogeneous relationship graph containing only user nodes and the edge weights between them; Perform feature encoding processing on the converted isomorphic relationship graph, aggregate the features of each user node and its adjacent nodes, and generate a high-dimensional feature vector for each user node; The encoded high-dimensional feature vector of the user node is input into the anti-fraud model based on the graph neural network for training to learn the feature representation of each user node; Based on the trained anti-fraud model, the high-dimensional feature vector of the input target user node is inferred, the fraud probability of the target user node is calculated and output, and the corresponding fraud detection result is generated.

2. The fraud detection method based on graph neural network according to claim 1, characterized in that: The step of obtaining data of the user and the corresponding intermediate medium and constructing a relationship diagram between the user and the intermediate medium comprises: Collect user data and intermediate media data of user interaction from multiple data sources; Based on the collected user data and intermediary data, define user nodes and intermediary nodes, wherein the user node represents each user entity, and the intermediary node represents an intermediary entity interacting with the user; According to the association interaction between the user node and the intermediate medium node, an edge between the user node and the intermediate medium node is generated, wherein the edge represents the association relationship between the user node and the intermediate medium node; All user nodes, intermediate media nodes and the edges between them are combined to construct a relationship graph between users and intermediate media.

3. The fraud detection method based on graph neural network according to claim 1, characterized in that: The step of constructing a heterogeneous relationship graph including user nodes and intermediate medium nodes based on the association relationship between the user nodes and the intermediate medium nodes in the relationship graph comprises: Extract all user nodes and intermediate medium nodes from the constructed relationship graph, and label each user node and intermediate medium node with its node type; Define the edge types in the heterogeneous relationship graph according to the interaction type between the user node and the intermediate medium node; Based on the interaction relationship between the user node and the intermediate medium node, create the edges in the heterogeneous relationship graph and assign corresponding weights to each edge; The labeled user nodes, intermediate media nodes and different types of edges are combined to construct a heterogeneous relationship graph including user nodes and intermediate media nodes.

4. The fraud detection method based on graph neural network according to claim 1, characterized in that: The step of converting the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and edge weights therebetween based on the intermediate medium nodes in the heterogeneous relationship graph representing the association relationship between user nodes comprises: Identify the interaction relationship between each user node and the intermediate medium node in the heterogeneous relationship graph; For each intermediate medium node, detect all user nodes directly connected to it, and determine the user node pairs that are associated with other user nodes through the intermediate medium; Based on the association relationship between the user node pairs through the intermediate medium nodes, the association strength between the user node pairs is calculated, and the association strength is weighted according to the type, sharing quantity, interaction frequency, and time interval of the intermediate medium nodes; Generate a new edge for each user-node pair, and assign the edge weight according to the strength of the association between the user-node pairs; Delete the intermediate nodes in the heterogeneous relationship graph, retain the user nodes and the edges generated between them, and construct a homogeneous relationship graph containing only the user nodes and the edge weights between them.

5. The fraud detection method based on graph neural network according to claim 1, characterized in that: The step of performing feature encoding processing on the converted isomorphic relationship graph, aggregating the features of each user node and its adjacent nodes, and generating a high-dimensional feature vector for each user node comprises: Initialize a feature vector for each user node in the isomorphic relationship graph, wherein the feature vector contains basic attribute information of the user node; Based on the neighbor node set of each user node, the corresponding feature vector is extracted from each neighbor node, and the features of the neighbor nodes are weighted and aggregated according to the edge weights between the neighbor nodes and the user node to generate an aggregated feature vector; The feature vector of each user node is combined with the aggregated feature vectors of its neighboring nodes to generate a high-dimensional feature vector for each user node.

6. The fraud detection method based on graph neural network according to claim 1, characterized in that: The step of inputting the encoded high-dimensional feature vector of the user node into the anti-fraud model based on the graph neural network for training includes: Inputting the high-dimensional feature vectors of all user nodes after feature encoding processing into an anti-fraud model based on a graph neural network, wherein the anti-fraud model comprises a plurality of graph convolutional layers, each of which performs feature aggregation and update operations to generate a new feature representation of each user node; For each user node, the feature representation of the node is updated in turn through each graph convolution layer in the anti-fraud model, where each graph convolution layer performs weighted aggregation based on the feature vector of the current node and the feature vectors of its neighboring nodes to generate a new node feature representation; During the training phase of the model, the pre-annotated fraud labels are used as supervisory signals to optimize the parameters of the anti-fraud model by minimizing a loss function calculated based on the difference between the fraud probability predicted by the model and the true label; During the training process, the gradient descent optimization algorithm is used to adjust the weights of the graph neural network, and the model parameters are updated iteratively by calculating the gradient to gradually learn the feature representation of each user node; The iterative training process is repeated until the model reaches convergence conditions and completes the learning of the feature representation of each user node.

7. The fraud detection method based on graph neural network according to claim 1, characterized in that: The steps of inferring the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculating and outputting the fraud probability of the target user node, and generating the corresponding fraud detection result include: Receiving a high-dimensional feature vector of a target user node generated after feature encoding processing; Input the high-dimensional feature vector of the target user node into the trained anti-fraud model based on graph neural network for inference; In the inference stage of the anti-fraud model, the feature representation of the target user node is calculated through the forward propagation of the graph neural network, and the contextual neighbor information and global graph structure of the target user node are combined to generate a new feature representation of the target user node; Based on the feature representation of the target user node finally generated, the anti-fraud model outputs the fraud probability of the target user node, where the fraud probability indicates the possibility that the target user node is a fraud user; The fraud detection result is generated by comparing the fraud probability of the target user node with a preset fraud threshold, and the fraud detection result includes the fraud probability and its corresponding prediction label.

8. The fraud detection method based on graph neural network according to claim 1, characterized in that: The step of generating the corresponding fraud detection result also includes: Based on the generated fraud detection results, take corresponding preventive or emergency response measures for the target user nodes whose fraud probability is higher than the fraud threshold. The response measures include freezing the target user account, restricting the target user's transaction rights, or marking the target user account for further review; The fraud detection results of all target user nodes are stored in the database, recording the fraud probability, predicted label, and associated feature information of each user node; Generate an explainable report for user nodes with fraudulent detection results, which includes the associations between user nodes detected by the anti-fraud model, key intermediate nodes and their interactive behaviors; The generated fraud detection results are delivered to the risk control system to trigger corresponding business decisions.

9. A fraud detection device based on graph neural network, characterized in that: The device comprises: A relationship graph construction module, used to obtain data of users and corresponding intermediate media, and to construct a relationship graph between users and intermediate media, wherein the relationship graph includes user nodes, intermediate media nodes, and association relationships between user nodes and intermediate media nodes; A heterogeneous relationship graph construction module, used to construct a heterogeneous relationship graph including user nodes and intermediate medium nodes based on the association relationship between the user nodes and the intermediate medium nodes in the relationship graph, wherein the heterogeneous relationship graph includes different types of nodes and different types of edges; A homogeneous relationship graph construction module is used to represent the association relationship between user nodes based on the intermediate medium nodes in the heterogeneous relationship graph, and convert the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and the edge weights between them; The encoding processing module is used to perform feature encoding processing on the converted isomorphic relationship graph, aggregate the features of each user node and its adjacent nodes, and generate a high-dimensional feature vector for each user node; The model training module is used to input the encoded high-dimensional feature vector of the user node into the anti-fraud model based on the graph neural network for training and learn the feature representation of each user node; The fraud detection module is used to infer the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculate and output the fraud probability of the target user node, and generate the corresponding fraud detection result.

10. A fraud detection system based on graph neural network, characterized in that: It includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, a fraud detection method based on a graph neural network as described in any one of claims 1 to 8 is implemented.

Images