Fraud detection method, device and system based on graph neural network

Abstract

The application is suitable for the field of intelligent risk control and anti-fraud technology, and provides a fraud detection method, device and system based on a graph neural network, which comprises the following steps: obtaining data of users and corresponding intermediate media, and constructing a relationship graph between the users and the intermediate media; constructing a heterogeneous relationship graph containing user nodes and intermediate medium nodes; converting the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and edge weights therebetween; performing feature coding processing on the converted homogeneous relationship graph to generate a high-dimensional feature vector of each user node; inputting the high-dimensional feature vector of the coded user node into an anti-fraud model based on a graph neural network for training; performing reasoning on the high-dimensional feature vector of a target user node input based on the trained anti-fraud model, calculating and outputting a fraud probability of the target user node, and generating a corresponding fraud detection result. The application solves the problems of low efficiency and accuracy of existing fraud detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent risk control and fraud detection, and particularly relates to a fraud detection method, device and system based on a graph neural network. BACKGROUND

[0002] With the rapid development of Internet finance and e-commerce, fraud behaviors are increasingly complex and diversified. In high-risk fields such as finance, insurance and the Internet, fraud behaviors emerge in an endless stream, causing huge economic losses to enterprises and society. Existing anti-fraud systems have played an important role in identifying and preventing fraud behaviors, but in the current anti-fraud field, with the continuous upgrading of fraud methods and the tightening of privacy protection requirements, existing anti-fraud modeling methods still face many challenges and limitations.

[0003] Firstly, label acquisition is a major pain point in anti-fraud modeling. The positive samples relied on by anti-fraud models mostly need experts to dig through long-term experience and single-point feature analysis. However, due to the concealment and complexity of fraud behaviors, many potential fraud risks cannot be discovered in time, resulting in label loss or inaccurate labeling. More seriously, many labeled positive samples have already caused economic losses, increasing the risk burden of enterprises, leading to lag and high cost, making the cost of label acquisition high.

[0004] Secondly, existing anti-fraud models mainly analyze isolated point samples, i.e. only single samples are used for risk assessment, and similar fraud patterns are mined, but the correlation between samples in fraud behaviors is ignored, especially the risk of gang fraud. Single-point analysis cannot effectively capture these complex correlation information, thereby affecting the model's ability to capture complex fraud patterns. Among them, gang fraud behavior cooperates through multiple subjects, and uses hidden correlation to commit fraud. The lack of such correlation information greatly weakens the effectiveness of traditional anti-fraud models.

[0005] Furthermore, in actual fraud detection, the proportion of positive and negative samples in the anti-fraud scene is often extremely low, and the proportion of positive samples (i.e. fraud behaviors) is extremely low. In particular, in some scenarios, the proportion of positive samples to negative samples may be as low as one in a thousand or even lower. This sample imbalance not only increases the difficulty of model training and increases the complexity of the model, but also puts higher requirements on the performance of the model, and easily leads the model to be biased towards negative samples, thereby reducing the accuracy of fraud detection and making it impossible to accurately predict fraud risks.

[0006] Finally, with the strengthening of data privacy protection, the collection and use of user data are subject to more stringent restrictions, and traditional explicit association-based models face the risk of weakening, where the mining of implicit association relationships becomes particularly critical. At the same time, anti-fraud models need to have high explainability, especially in the face of regulatory review or internal audit or decision-making process, the transparency and traceability of the model directly affect its credibility and acceptability in practical application. SUMMARY

[0007] Therefore, the purpose of the present application is to provide a fraud detection method, device and system based on a graph neural network, to fundamentally solve the problem of low efficiency and accuracy of existing fraud detection.

[0008] According to the fraud detection method based on the graph neural network, the method comprises:

[0009] Obtaining data of users and corresponding intermediate media, constructing a relationship graph between users and intermediate media, the relationship graph comprising user nodes, intermediate media nodes, and association relationships between user nodes and intermediate media nodes;

[0010] Based on the association relationships between the user nodes and the intermediate media nodes in the relationship graph, a heterogeneous relationship graph comprising the user nodes and the intermediate media nodes is constructed, the heterogeneous relationship graph comprising different types of nodes and different types of edges;

[0011] Based on the intermediate media nodes in the heterogeneous relationship graph representing the association relationships between the user nodes, the heterogeneous relationship graph is converted into a homogeneous relationship graph containing only user nodes and edge weights between the user nodes;

[0012] Performing feature encoding processing on the converted homogeneous relationship graph, aggregating features of each user node and its adjacent nodes to generate a high-dimensional feature vector of each user node;

[0013] Inputting the encoded high-dimensional feature vector of the user node into an anti-fraud model based on a graph neural network for training to learn the feature representation of each user node;

[0014] Based on the trained anti-fraud model, the high-dimensional feature vector of the target user node is inferred, the fraud probability of the target user node is calculated and output, and the corresponding fraud detection result is generated.

[0015] In addition, the fraud detection method based on the graph neural network according to the above embodiments of the present application can also have the following additional technical features:

[0016] Further, the step of obtaining data of users and corresponding intermediate media, and constructing a relationship graph between users and intermediate media comprises:

[0017] Collecting user data and intermediate medium data of user interaction from multiple data sources;

[0018] Defining user nodes and intermediate medium nodes based on the collected user data and intermediate medium data, wherein the user nodes represent each user entity and the intermediate medium nodes represent intermediate medium entities interacting with the users;

[0019] Generating edges between the user nodes and the intermediate medium nodes according to the associated interactions between the user nodes and the intermediate medium nodes, wherein the edges represent the associated relationships between the user nodes and the intermediate medium nodes;

[0020] Combining all user nodes, intermediate medium nodes and edges therebetween to construct a relationship graph of users and intermediate media.

[0021] Further, the step of constructing a heterogeneous relationship graph containing user nodes and intermediate medium nodes based on the associated relationships between the user nodes and the intermediate medium nodes in the relationship graph comprises:

[0022] Extracting all user nodes and intermediate medium nodes from the constructed relationship graph, and labeling the node types of each user node and intermediate medium node respectively;

[0023] Defining edge types in the heterogeneous relationship graph according to the interaction types between the user nodes and the intermediate medium nodes;

[0024] Creating edges in the heterogeneous relationship graph based on the interaction relationships between the user nodes and the intermediate medium nodes, and assigning corresponding weights to each edge;

[0025] Combining the labeled user nodes, intermediate medium nodes and different types of edges to construct a heterogeneous relationship graph containing user nodes and intermediate medium nodes.

[0026] Further, the step of converting the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and edge weights between them based on the intermediate medium nodes in the heterogeneous relationship graph representing the associated relationships between the user nodes comprises:

[0027] Identifying the interaction relationships between each user node and the intermediate medium nodes in the heterogeneous relationship graph;

[0028] For each intermediate medium node, detecting all user nodes directly connected thereto and determining pairs of user nodes associated with other user nodes through the intermediate medium;

[0029] Based on the associated relationships between the user node pairs through the intermediate medium nodes, calculating the associated strength between the user node pairs, wherein the associated strength is calculated by weighting according to the types, shared quantities, interaction frequencies and time intervals of the intermediate medium nodes;

[0030] generating a new edge for each pair of user nodes, and assigning a weight to the edge according to the association strength between the pair of user nodes;

[0031] deleting the intermediate medium nodes in the heterogeneous relation graph, retaining the user nodes and the edges generated therebetween, and constructing a homogeneous relation graph containing only the user nodes and the edge weights therebetween.

[0032] Further, the step of performing feature encoding processing on the transformed homogeneous relation graph and aggregating the features of each user node and its adjacent nodes to generate a high-dimensional feature vector of each user node includes:

[0033] initializing a feature vector for each user node in the homogeneous relation graph, the feature vector containing basic attribute information of the user node;

[0034] Based on the neighbor node set of each user node, extracting the corresponding feature vector from each neighbor node, and weighting and converging the features of the neighbor nodes according to the edge weights between the neighbor nodes and the user node to generate an aggregated feature vector;

[0035] Combining the feature vector of each user node itself with the aggregated feature vector of its neighbor nodes to generate a high-dimensional feature vector of each user node.

[0036] Further, the step of inputting the encoded high-dimensional feature vector of the user node into the anti-fraud model based on the graph neural network for training includes:

[0037] Inputting the high-dimensional feature vectors of all user nodes after feature encoding processing into the anti-fraud model based on the graph neural network, the anti-fraud model including multiple graph convolution layers, each graph convolution layer performing feature aggregation and update operations to generate a new feature representation of each user node;

[0038] For each user node, the feature representation of the node is updated in turn through each graph convolution layer in the anti-fraud model, wherein each layer of graph convolution layer performs weighted aggregation according to the feature vector of the current node and the feature vectors of its neighbor nodes to generate a new node feature representation;

[0039] In the training phase of the model, the pre-labeled fraud labels are used as supervision signals, and the parameters of the anti-fraud model are optimized by minimizing the loss function, which is calculated according to the difference between the fraud probability predicted by the model and the true label;

[0040] During the training process, the gradient descent optimization algorithm is used to adjust the weights of the graph neural network, and the model parameters are updated iteratively by calculating the gradient to gradually learn the feature representation of each user node;

[0041] The iterative training process is repeated until the model reaches a convergence condition, and the learning of the feature representation of each user node is completed.

[0042] Further, the step of performing inference on the high-dimensional feature vector of the target user node based on the trained anti-fraud model, calculating and outputting the fraud probability of the target user node, and generating the corresponding fraud detection result comprises:

[0043] receiving the high-dimensional feature vector of the target user node generated after the feature encoding processing;

[0044] inputting the high-dimensional feature vector of the target user node into the trained anti-fraud model based on the graph neural network for inference;

[0045] In the inference stage of the anti-fraud model, the feature representation of the target user node is calculated through the forward propagation of the graph neural network, and the context neighbor information and the global graph structure of the target user node are combined to generate a new feature representation of the target user node;

[0046] Based on the finally generated feature representation of the target user node, the anti-fraud model outputs the fraud probability of the target user node, which represents the possibility of the target user node being a fraudulent user;

[0047] According to the comparison between the fraud probability of the target user node and the preset fraud threshold, a fraud detection result is generated, which includes the fraud probability and its corresponding prediction label.

[0048] Further, the step of generating the corresponding fraud detection result further comprises:

[0049] Based on the generated fraud detection result, corresponding prevention or emergency response measures are taken for the target user node whose fraud probability is higher than the fraud threshold, and the response measures include freezing the target user account, limiting the transaction authority of the target user, or marking the target user account for further review;

[0050] The fraud detection results of all target user nodes are stored in a database, and the fraud probability, prediction label, and associated feature information of each user node are recorded;

[0051] For user nodes with fraud detection results, an explainability report is generated, which includes the association between user nodes detected by the anti-fraud model, key intermediate nodes and their interaction behaviors;

[0052] The generated fraud detection result is transmitted to a risk control system to trigger corresponding business decisions.

[0053] The application also aims to provide a fraud detection device based on a graph neural network.

[0054] A relationship graph construction module is configured to acquire data of users and corresponding intermediate media, and construct a relationship graph between the users and the intermediate media, the relationship graph including user nodes, intermediate media nodes, and an association relationship between the user nodes and the intermediate media nodes.

[0055] A heterogeneous relationship graph construction module is configured to construct a heterogeneous relationship graph including the user nodes and the intermediate media nodes based on the association relationship between the user nodes and the intermediate media nodes in the relationship graph, the heterogeneous relationship graph including different types of nodes and different types of edges.

[0056] A homogeneous relationship graph construction module is configured to convert the heterogeneous relationship graph into a homogeneous relationship graph including only the user nodes and edge weights therebetween based on the intermediate media nodes representing the association relationship between the user nodes in the heterogeneous relationship graph.

[0057] An encoding processing module is configured to perform feature encoding processing on the converted homogeneous relationship graph, aggregate features of each user node and adjacent nodes thereof, and generate a high-dimensional feature vector of each user node.

[0058] A model training module is configured to input the high-dimensional feature vector of the encoded user node into an anti-fraud model based on a graph neural network for training, and learn a feature representation of each user node.

[0059] A fraud detection module is configured to perform reasoning on a high-dimensional feature vector of a target user node input based on the trained anti-fraud model, calculate and output a fraud probability of the target user node, and generate a corresponding fraud detection result.

[0060] The application also aims to provide a fraud detection system based on a graph neural network, including a memory, a processor, and a program stored in the memory and executable on the processor, and the processor implements the fraud detection method based on the graph neural network as described above when executing the program.

[0061] The fraud detection method based on graph neural networks provided in this invention constructs a relationship graph between users and intermediate media, and transforms it based on heterogeneous relationship graphs. This effectively captures the potential associations and interaction patterns between users and other nodes, enabling not only accurate identification of individual user fraudulent behavior, but also improved identification of group fraudulent behavior by capturing complex relationship networks between users, especially in the presence of implicit associations. The introduction of intermediate media nodes effectively represents implicit associations between users, helping to reveal complex interaction relationships that are not easily observed directly, particularly effectively capturing group fraudulent behavior that often cannot be identified through the analysis of a single node. By transforming heterogeneous relationship graphs into homogeneous relationship graphs and utilizing the associations between nodes, the class imbalance problem in fraud detection is effectively solved. Furthermore, the aggregation mechanism of graph neural networks can focus on high-risk clusters. Clustered nodes, often closely associated with fraudulent behavior, enable effective modeling even with scarce labels, supporting unsupervised or semi-supervised learning and enhancing the model's adaptability to sparse labeled data. By capturing complex relationships and latent features between nodes, the model's interpretability is improved. Decision-makers can understand which relationships and interactions between user nodes are key factors leading to fraud detection results through the model's output features and results, making anti-fraud decisions more transparent and actionable. Through feature encoding of isomorphic graphs, not only are the feature information of user nodes preserved, but the complex relationships between nodes and their neighbors are also captured. Especially in anti-fraud scenarios, this effectively uncovers potential latent associations and clues to organized fraud. Furthermore, graph neural networks, through feature aggregation, help improve the overall model's detection capabilities under different complex situations, ultimately solving the problems of low efficiency and accuracy in existing fraud detection methods. Attached Figure Description

[0062] Figure 1 This is a flowchart of the fraud detection method based on graph neural networks in the first embodiment of the present invention;

[0063] Figure 2 This is a schematic diagram of the structure of the fraud detection device based on graph neural network provided in the second embodiment of the present invention;

[0064] Figure 3 This is a schematic diagram of the structure of the fraud detection system based on graph neural networks provided in the third embodiment of the present invention;

[0065] The following detailed description of the embodiments will further illustrate the present invention in conjunction with the above-described accompanying drawings. Detailed Implementation

[0066] For the purpose of promoting an understanding of the principles of the application, reference will now be made to the embodiments illustrated in the drawings. There is shown in the drawings several embodiments of the application. It is expressly understood that the drawings are only for the purpose of illustration and are not intended to limit the present application in any in any way. In the drawings:

[0067] It should be noted that when an element as a "set" on another element, it can be directly on another element or there can be a middle element. When an element is considered to be "connected" to another element, it can be directly connected to another element or there can be a middle element. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0068] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0069] Embodiment one

[0070] Please refer to Figure 1 , the fraud detection method based on graph neural network in the first embodiment of the application is shown, for the purpose of illustration, only the part related to the embodiment of the application is shown, the fraud detection method based on graph neural network provided by the embodiment of the application includes:

[0071] Step S10, acquiring the data of the user and the corresponding intermediate medium, constructing the relationship graph between the user and the intermediate medium, the relationship graph contains the user node, the intermediate medium node and the association relationship between the user node and the intermediate medium node;

[0072] In an embodiment of the application, constructing the relationship graph of the user and the intermediate medium is the first step to realize the anti-fraud model based on graph neural network, the purpose is to express the association relationship between the user and various intermediate media through the graph structure. By connecting the user and its associated intermediate medium nodes, the hidden relationship network is revealed. The above steps of acquiring the data of the user and the corresponding intermediate medium, constructing the relationship graph of the user and the intermediate medium include:

[0073] Collecting user data and intermediate medium data interacting with the user from multiple data sources;

[0074] Based on the collected user data and intermediate medium data, define user nodes and intermediate medium nodes, wherein the user nodes represent each user entity, and the intermediate medium nodes represent the intermediate medium entities interacting with the users;

[0075] According to the associated interaction between the user nodes and the intermediate medium nodes, generate edges between the user nodes and the intermediate medium nodes, wherein the edges represent the associated relationship between the user nodes and the intermediate medium nodes;

[0076] Combine all user nodes, intermediate medium nodes and edges therebetween to construct a relationship graph of users and intermediate media.

[0077] Specifically, user data and various intermediate medium data associated with the user are collected from various data sources, wherein the user data is basic information related to the user, including but not limited to user ID, registration information, registration time, geographic location, etc. And the intermediate medium data is characteristic information associated with the user for identifying or contacting the user, including but not limited to IP address, mobile phone number, email address, device information, other media, etc., wherein the IP address is the network address of the user in the Internet environment, used to identify the user's online behavior; the mobile phone number is the mobile phone number used by the user when registering or binding the account, used for identity verification and communication; the email address is the email address of the user when registering on the platform or using the service; the device information is the device ID, MAC address, etc., used to identify the user device; and the other media is the bank card number, social account, etc., which can also be regarded as intermediate medium data. Further, the collected user and intermediate medium data are cleaned to remove missing values, duplicates and outliers. Then different types of data are standardized to conform to a unified format. For example, the IP address and mobile phone number need to be converted to a specific string format. Further, based on the collected user data and intermediate medium data, two types of nodes are defined in the relationship graph, namely user nodes and intermediate medium nodes, wherein each user corresponds to a node, representing each user entity in the system. And each intermediate medium (such as each IP address, mobile phone number, etc.) corresponds to a node, representing the intermediate medium entity interacting with the user, i.e. the specific attribute of the user. Further, according to the association interaction between the user nodes and the intermediate medium nodes, edges between the user nodes and the intermediate medium nodes are generated, wherein in the graph model, the association between nodes is represented by edges, and in order to describe the association relationship between the user and the intermediate medium, an edge needs to be added between each user and its corresponding intermediate medium. At this time, for each user, identify the intermediate medium used (such as the IP address or mobile phone number used by the user when logging in), and establish an edge between each user node and its intermediate medium node in the relationship graph to form the association relationship between the user and the intermediate medium. For example, if a user accesses a service through an IP address, an edge is established between the user node and the IP address node. And if the user uses a mobile phone number when registering, a corresponding edge is established between the user node and the mobile phone number node. Further, in an optional embodiment of the present application, a weight can be assigned to each edge based on the interaction frequency, interaction type, interaction time, etc. between the user node and the intermediate medium node, wherein the importance of different types of intermediate media in anti-fraud detection may be different. For example, the mobile phone number association can more accurately reflect the user's identity than the IP address association, so in the process of constructing the relationship graph between the user and the intermediate medium, different weights are assigned to different types of intermediate media according to the interaction type between the user node and the intermediate medium to enhance the expression ability of the graph model.Of course, optionally, weights can also be assigned to each edge according to the interaction frequency, interaction time, etc. Further, all user nodes and intermediate medium nodes are combined together to form a relationship graph according to the edges and weights defined above, and a user and intermediate medium relationship graph is constructed. At this time, the generated relationship graph structure includes nodes and edges, wherein the nodes include user nodes and intermediate medium nodes, and the edges are associated edges between users and their corresponding intermediate media, and the edges can have corresponding weights assigned. Further, the relationship graph can also be represented by using a graph data structure (such as an adjacency list or an adjacency matrix). The adjacency matrix is a two-dimensional matrix representation, and the rows and columns of the matrix represent user nodes and intermediate medium nodes, respectively. The elements in the matrix represent the association strength between nodes (such as 1 representing association and 0 representing no association). The adjacency list maintains a list for each user node, which contains all the associated intermediate medium nodes.

[0078] Through the above steps, the user and intermediate medium relationship graph is finally constructed, and each user node is connected to its corresponding intermediate medium node. This graph structure can well capture the potential association relationship between users through intermediate media, especially in fraud gang behavior, different users share intermediate media such as IP addresses or device information, and exhibit a certain association pattern. At this time, by analyzing these association relationships, possible abnormal or fraudulent behavior can be identified. In the anti-fraud scenario, there are often various implicit connections between users through intermediate media (such as IP addresses, mobile phone numbers, device IDs, etc.). The relationship graph can intuitively represent this complex relationship structure, and is the basis for subsequent construction of an anti-fraud model.

[0079] In step S20, a heterogeneous relationship graph containing user nodes and intermediate medium nodes is constructed based on the association relationship between the user nodes and the intermediate medium nodes in the relationship graph, and the heterogeneous relationship graph includes different types of nodes and different types of edges.

[0080] In an embodiment of the present application, constructing a heterogeneous relationship graph containing user nodes and intermediate medium nodes is a key step in modeling various relationships between users and intermediate media. The heterogeneous relationship graph (Heterogeneous Graph) contains multiple types of nodes and multiple types of edges, which are used to capture the complex associations between different entities, wherein different types of nodes represent different entities, and different types of edges represent different relationships. Specifically, in the anti-fraud scenario, the heterogeneous relationship graph can reflect the multi-level relationship between users and various intermediate media (such as IP addresses, device IDs, mobile phone numbers, etc.), thereby enhancing the model's ability to mine potential fraudulent behavior. The above step of constructing a heterogeneous relationship graph containing user nodes and intermediate medium nodes based on the association relationship between the user nodes and the intermediate medium nodes in the relationship graph includes:

[0081] Extract all user nodes and intermediate medium nodes from the constructed relationship graph, and label the node type of each user node and intermediate medium node respectively;

[0082] According to the interaction type between the user node and the intermediate medium node, the edge type in the heterogeneous relationship graph is defined;

[0083] Based on the interaction relationship between the user node and the intermediate medium node, the edge in the heterogeneous relationship graph is created, and the corresponding weight is assigned to each edge;

[0084] Combine the labeled user nodes, intermediate medium nodes and different types of edges to construct a heterogeneous relationship graph containing user nodes and intermediate medium nodes.

[0085] Specifically, all user nodes and intermediate medium nodes are extracted from the constructed relationship graph, where user nodes can represent different user identities, and intermediate medium nodes can represent various media of interaction between users. Then each node is labeled with its node type, where all user nodes are labeled as "user" type, and all intermediate medium nodes are labeled as "intermediate medium" type. Of course, the labeling of node types can be identified in the attributes of the nodes, such as adding an attribute field in the metadata of the nodes to indicate the node type. Further, according to the interaction type between user nodes and intermediate medium nodes, the edge type in the heterogeneous relationship graph is defined. For example, the interaction between users and intermediate media can have different types, such as transaction edges, access edges, device edges, etc., where, for example, transaction edges are transaction behaviors between user and intermediate medium nodes. Access edge is the access behavior of user through intermediate medium (such as login through IP address). Device edge is the interaction of user through specific device (such as mobile phone, computer, etc.). At this time, each interaction type can be defined as an edge type in the heterogeneous relationship graph, and the edge type is usually taken as a metadata attribute of the graph structure. Further, according to the interaction relationship between user nodes and intermediate medium nodes, edges are created. For example, if user A accesses intermediate platform P through device D, an edge between user A and device D is created, and the interaction type is defined as "access". If user A and user B transact through device D, an edge between user A and user B is created, and the interaction type is "transaction". Further, each edge is assigned a corresponding weight, where the weight of the edge can be set according to the specific business requirements, and the weight can be calculated according to the type weight, frequency weight, distance weight, and timeliness weight, where the type weight is based on the type of intermediate medium (for example, the edge weight of mobile phone number is higher). The frequency weight is based on the frequency of interaction between user and intermediate medium (for example, the edge weight of frequent transaction or access is higher). The distance weight is based on the similarity or distance between user and intermediate medium (for example, the edge between users with the same IP address can be set to a higher weight). The timeliness weight is based on the time window of interaction behavior, where the most recent interaction can have a higher weight. The weight calculation method can be defined by statistical methods, machine learning models, or domain knowledge. For example, the frequency weight can be obtained by calculating the number of interactions between user and intermediate medium. Further, the labeled user nodes, intermediate medium nodes, and different types of edges are combined into a complete heterogeneous relationship graph. At this time, the node types in the graph include "user" and "intermediate medium", and the edge types include various interaction relationships (such as "transaction edge", "access edge", "device edge", etc.). Then the heterogeneous relationship graph is represented by a graph data structure. Where a graph database (such as Neo4j) or a graph processing framework (such as DGL or PyTorch Geometric) can be used to store and process the heterogeneous relationship graph.The graph data structure generally contains a set of nodes, a set of edges, and attributes of the nodes and edges (such as types, weights, timestamps, etc.).

[0086] In this step, the heterogeneous relationship graph can represent multiple types of nodes and edges, embodying different association dimensions between users and intermediate media. Therefore, the purpose of constructing a heterogeneous relationship graph between user nodes through intermediate media is to establish an association relationship between users through intermediate media (such as IP addresses, mobile phone numbers, device IDs, etc.) as a bridge. At this time, the heterogeneous relationship graph constructed contains the direct association relationship between users and intermediate media, and the implicit association relationship between users and users implied through intermediate media. Therefore, the heterogeneous relationship graph can better capture the multiple behavior characteristics of users and can also mine potential complex association relationships, providing richer feature inputs for subsequent anti-fraud models. In anti-fraud modeling, the behavior of multiple users sharing the same intermediate medium in a fraud gang can be better simulated through the heterogeneous relationship graph.

[0087] Further, in actual application, the interaction relationship data between users and intermediate media is basic information. These data need to be first explicitly structured into a simple association graph between users and intermediate media (i.e., an initial relationship graph). At this time, the user converts the original data into a graph structure suitable for modeling, so that the source, type, and relationship of the data are more clear. By first constructing a relationship graph, the accuracy of data organization and processing can be ensured, and the problem of inconsistent or redundant data types when directly constructing a heterogeneous relationship graph can be avoided. At the same time, the initial relationship graph separately processes the original relationship of the data, providing a clear graph model structure. This processing can be used as a basic graph, and any extension or enhancement (such as the construction of a heterogeneous relationship graph) can be based on this basic structure. Therefore, by separating the relationship graph and the heterogeneous relationship graph, different levels of data processing can be clearly divided, making each step more logical and controllable. Therefore, in the embodiment of the present application, the initial relationship graph is first constructed in step S10 to provide greater flexibility for the construction of the heterogeneous relationship graph in step S20. If the data source or structure changes, only the initial relationship graph needs to be adjusted, and the entire construction method of the heterogeneous relationship graph does not need to be adjusted from the beginning. At the same time, the initial relationship graph as an independent module provides flexibility for the adjustment of the graph structure, and the construction of the heterogeneous relationship graph can also be extended and adjusted based on different needs. At the same time, the construction of the relationship graph first helps to add more complexity to the subsequent heterogeneous relationship graph. For example, in addition to user nodes and some intermediate medium nodes, new node types or association relationships can also be introduced, and the relationship graph can be gradually expanded into a heterogeneous relationship graph containing more entities and relationships. Directly constructing a heterogeneous relationship graph can complicate this expansion process, while first constructing a simple relationship graph and then transitioning to a heterogeneous relationship graph can maintain the clarity of the structure.

[0088] In addition, for the anti-fraud model based on the graph neural network, specific encoding methods are required to process different types of nodes and relationship graphs. By constructing a relationship graph first, the graph structure can be more clearly defined, which helps the effectiveness of subsequent feature encoding, aggregation, and model training. If a heterogeneous relationship graph is directly constructed, more complex node and edge information may need to be processed during model training, which may cause the size of the graph to be too large, affecting the training efficiency and model performance. Therefore, constructing a simple relationship graph first and then constructing a heterogeneous relationship graph through information aggregation helps to discover potential problems in the data structure, and the processing results at each step can be tested and optimized separately, making the debugging process simpler. If a heterogeneous relationship graph is directly constructed, it may be more difficult to locate and fix the problem.

[0089] In step S30, the association relationship between the user nodes is represented based on the intermediate medium nodes in the heterogeneous relationship graph, and the heterogeneous relationship graph is converted into a homogeneous relationship graph containing only user nodes and edge weights between the user nodes.

[0090] In an embodiment of the present application, the heterogeneous relationship graph contains multiple different types of nodes and edges. For fraud detection, user nodes and intermediate medium nodes can be different types of nodes, and the association relationship between them can also be represented as different types of edges. Therefore, when performing feature encoding, different feature encoding methods need to be designed for different types of nodes and edges. This increases the complexity of the graph neural network model, resulting in a more complex model structure and higher requirements for computing resources. The message passing mechanism in the graph neural network (GNN) is usually based on information transmission between nodes. In a heterogeneous relationship graph, different types of nodes and edges make message passing more complex. For example, the interaction between user nodes and intermediate medium nodes is different from the relationship between users. This requires designing specific message passing methods for each different node and edge, making model design more difficult. In actual fraud detection scenarios, the amount of data samples may be limited, especially the relationship between different types of nodes and edges. Direct encoding and training on a heterogeneous relationship graph may result in excessive model complexity, increasing the risk of overfitting. Directly processing a heterogeneous relationship graph usually requires larger-scale data and a more complex parameter tuning process.

[0091] Therefore, to solve the above problems, in an embodiment of the present application, the heterogeneous relationship graph is converted into a homogeneous relationship graph containing only user nodes and edge weights between the user nodes, so that the core relationship between users is retained, the dimension is reduced, the calculation of the graph neural network model is simplified, and the standard graph neural network anti-fraud model is used for training. The step of converting the heterogeneous relationship graph into a homogeneous relationship graph containing only user nodes and edge weights between the user nodes based on the association relationship between the user nodes represented by the intermediate medium nodes in the heterogeneous relationship graph includes:

[0092] identify the interaction between each user node and the intermediate medium node in the heterogeneous relationship graph;

[0093] For each intermediate medium node, detect all user nodes directly connected thereto and determine the user node pairs associated with other user nodes through the intermediate medium;

[0094] Based on the association between the user node pairs through the intermediate medium node, calculate the association strength between the user node pairs, which is weighted according to the type, sharing quantity, interaction frequency, and time interval of the intermediate medium node;

[0095] Generate a new edge for each pair of user node pairs, and the weight of the edge is assigned according to the association strength between the user node pairs;

[0096] Delete the intermediate medium nodes in the heterogeneous relationship graph, retain the user nodes and the edges generated therebetween, and construct a homogeneous relationship graph containing only the user nodes and the edge weights therebetween.

[0097] Specifically, first, extract all user nodes and intermediate medium nodes from the heterogeneous relationship graph and identify the interaction therebetween. Each edge represents a specific interaction (such as transaction, access, login, etc.). Then, record the relevant interaction type and weight for each interaction. These information can be represented by the attributes of the nodes and edges. Further, traverse each intermediate medium node in the heterogeneous relationship graph. For each intermediate medium node, identify all directly connected user nodes (i.e., user nodes connected to the intermediate medium node through edges). For each intermediate medium node, consider all pairs of user nodes directly connected thereto. That is, if the intermediate medium node connects user node A and user node B, then user A and user B are associated through the intermediate medium node. Further, calculate the association strength between each pair of user nodes. The association strength can be weighted according to the type, sharing quantity, interaction frequency, or time interval of the intermediate medium node. For example, if user u1 and user u2 share multiple intermediate media, the weight of the edge can increase with the number of shared intermediate media. Or some intermediate media (such as IP addresses) can be shared among multiple users, but their weights are relatively low; while other intermediate media (such as mobile phone numbers) are more unique, and their weights are relatively high. In an embodiment of the present application, when constructing the homogeneous relationship graph, the edge weight w(u i ,u j ) between user nodes can be calculated by the following formula:

[0098]

[0099] where w(u i ,u j ) is the user node ui and user node u j , the edge weight between them, V Medium is a set of intermediate medium nodes, m is an intermediate medium node, A UM (u i ,m) is the adjacency relationship between user node u i and intermediate medium node m, where if user node u i is associated with intermediate medium node m, then A UM (u i ,m) is 1, otherwise 0; A UM (u j ,m) is the adjacency relationship between user node u j and intermediate medium node m, where if user node u j is associated with intermediate medium node m, then A UM (u j ,m) is 1, otherwise 0; f type (m) is the type weight of intermediate medium node m, f frequency (u i ,u j ) is the interaction frequency weight between user node u i and user node u j , f time (u i ,u j ) is the interaction time interval weight between user node u i and user node u j , where degree(m) represents the degree of intermediate medium node m, that is, how many users are associated with the intermediate medium, where the weight of the intermediate medium with a higher degree (shared by many users) is lower, and vice versa. Where w1, w2, w3, w4 are weight parameters adjusted according to actual business needs.

[0100] That is, when two user nodes u i and u j share an intermediate medium node m, A UM (u i ,m)·A UM (u jm) = 1, indicating that the two are associated through the intermediate medium node. At this time, by calculating these features, the association strength between each pair of user nodes is obtained. Further, according to the calculated association strength, a new edge is generated for each pair of user nodes. In the isomorphic relation graph, the starting point and the end point of the edge are user nodes, and the weight of the edge is a value calculated from the above association strength. The weight of the edge represents the association strength between the user nodes, reflecting the strength of the indirect contact between the two user nodes through the intermediate node. For example, a pair of user nodes with frequent and time-sensitive associations will have a higher edge weight. Further, all intermediate medium nodes and their related edges in the heterogeneous relation graph are deleted, so that only user nodes and edges generated from the association between user node pairs are retained. Then all user nodes and the edges between them are retained, and the weight of each edge is set to the association strength calculated above. Finally, an isomorphic relation graph is obtained, in which each node only represents a user, and the weight of the edge represents the association strength between the users.

[0101] In this step, after the heterogeneous relation graph is converted into an isomorphic relation graph, usually only user nodes and their direct edges (user-user relationships) are left, and the intermediate medium nodes are abstracted into edge weights or other information. The advantage of converting the heterogeneous relation graph into an isomorphic relation graph is that the structure of the isomorphic relation graph is simple, all nodes are of the same type (such as all user nodes), and there is only one type of edge, which greatly simplifies the design of the graph neural network. At this time, the graph neural network can pass and aggregate information between nodes of the same type through the standard message passing mechanism, without the need to distinguish between node types or edge types. Feature encoding and training in the isomorphic relation graph are relatively low in computational cost, and the parameter quantity and model complexity of the network can be effectively controlled, and the training efficiency is higher. Especially in large-scale data scenarios, reducing the computational complexity of the model can improve the response speed of the system.

[0102] At the same time, by converting the intermediate medium nodes (such as devices, IP addresses, etc.) in the heterogeneous relation graph into edge weights or other features between user nodes, the implicit association between users is actually aggregated. This process enables the user nodes in the isomorphic relation graph to retain the information in the heterogeneous relation graph, but makes the structure more concise, and the potential fraudulent association between users is easier to be captured by the model through feature aggregation. In the isomorphic relation graph, the graph neural network can more efficiently aggregate the features of the user nodes. Since all nodes are of the same type, the message passing mechanism no longer needs to distinguish between different types of nodes and edges, which enables each node to fully utilize the information from adjacent nodes for efficient feature aggregation, thereby improving the quality of feature representation.

[0103] Meanwhile, when converting the heterogeneous relation graph into the homogeneous relation graph, the relationships between different types of nodes are abstracted into uniform edge weights or features, which helps to improve the generalization ability of the model. Uniformly processing the relationships between user nodes can reduce the inconsistency problems caused by different node types and edge types, thereby improving the adaptability and prediction effect of the model in different fraud scenarios. After conversion to the homogeneous relation graph, the model does not need to process different types of nodes and edges, greatly reducing the parameter quantity and complexity of the model, which helps to prevent overfitting. Especially in the scene of limited data or less labeled data, training based on the homogeneous relation graph can effectively improve the robustness of the model.

[0104] Meanwhile, in the homogeneous relation graph, the complex association relationship between user nodes is more intuitive, and the potential fraud association between users can usually be displayed in the form of weights or direct edges. This makes the output of the model easier to explain, especially in fraud detection applications, interpretability helps to analyze suspicious behavior patterns between users and the organizational structure of fraud gangs. After converting the heterogeneous relation graph into the homogeneous relation graph, the reasoning process of the model on the edges between users is more transparent. Compared with the complex relationship of multiple node types and edges when processing the heterogeneous relation graph, the edge weight of the homogeneous relation graph can directly represent the similarity or potential risk between users, which helps to explain and analyze the model decision.

[0105] Step S40, feature encoding processing is performed on the converted homogeneous relation graph, the features of each user node and its adjacent nodes are aggregated, and a high-dimensional feature vector of each user node is generated;

[0106] In an embodiment of the present application, the step of performing feature encoding processing on the converted homogeneous relation graph, aggregating the features of each user node and its adjacent nodes, and generating a high-dimensional feature vector of each user node includes:

[0107] Initializing the feature vector of each user node in the homogeneous relation graph, the feature vector contains the basic attribute information of the user node;

[0108] Based on the neighbor node set of each user node, the corresponding feature vector is extracted from each neighbor node, and the features of the neighbor nodes are weighted and converged according to the edge weight between the neighbor nodes and the user nodes, to generate an aggregated feature vector;

[0109] Combine the feature vector of each user node itself with the aggregated feature vector of its neighbor nodes to generate a high-dimensional feature vector of each user node.

[0110] Specifically, for each user node in the isomorphic relation graph, its feature vector is initialized. The initialized feature vector usually contains the basic attribute information of the user node, such as: the basic identity information of the user, historical behavior data, transaction records, etc. These basic attribute information can be represented as a vector where u represents a user node, and its initial feature vector is usually a fixed-dimensional numerical vector. Then for each user node u, the feature vectors of its neighbor nodes are extracted. Where the neighbor nodes are other user nodes connected to the current user node through edges. Then through the way of weighted aggregation, the feature vectors of each neighbor node are combined to generate the aggregated feature of the user node. Where each edge has a weight, representing the association strength between two nodes. By weighting the aggregation of the feature vectors of the neighbor nodes, considering the weight of the edge, a new feature vector can be obtained. The feature vector of the user node itself is combined with the weighted aggregated feature vector of its neighbor nodes. Where the common way is to concatenate or weighted sum the two vectors to form a new feature vector, and the specific combination method depends on the graph neural network architecture used.

[0111] The feature encoding processing method can efficiently combine the basic features of each user node with the features of its neighbor nodes to form a comprehensive representation. This not only considers the features of a single user, but also combines the influence of neighbor nodes on the user, so that the model can capture the mutual relationship between users. Through the weighted aggregation of neighbor node features, the model can more accurately understand and represent the potential association between users, especially in fraud detection tasks, this information fusion helps to identify users with similar behavior patterns or abnormal patterns. At the same time, by introducing edge weights (representing the association strength between user nodes), the method can dynamically adjust the influence of different neighbor nodes on the feature of the user node. At the same time, the high-dimensional feature vector after feature encoding provides more rich node representation for the graph neural network, which can help the graph neural network to better learn and predict the behavior characteristics of the user node, thereby improving the accuracy of fraud detection. At this time, through the feature aggregation and learning of the graph neural network, even if the label is less, the model can also mine the potential fraud patterns through the relationship of neighbor nodes, thereby reducing the dependence on a large amount of labeled data.

[0112] Step S50, input the high-dimensional feature vector of the encoded user node into the anti-fraud model based on the graph neural network for training to learn the feature representation of each user node;

[0113] In an embodiment of the present application, the step of inputting the high-dimensional feature vector of the encoded user node into the anti-fraud model based on the graph neural network for training includes:

[0114] The high-dimensional feature vectors of all user nodes after feature encoding processing are input into the anti-fraud model based on graph neural network, which contains multiple graph convolution layers, each of which performs feature aggregation and update operation to generate a new feature representation of each user node.

[0115] For each user node, the feature representation of the node is updated in turn by each graph convolution layer in the anti-fraud model, where each layer of graph convolution layer generates a new node feature representation by weighted aggregation according to the feature vector of the current node and the feature vectors of its neighbor nodes.

[0116] In the training phase of the model, the pre-labeled fraud labels are used as supervision signals, and the parameters of the anti-fraud model are optimized by minimizing the loss function, which is calculated according to the difference between the fraud probability predicted by the model and the true label.

[0117] In the training process, the gradient descent optimization algorithm is used to adjust the weights of the graph neural network, and the model parameters are updated iteratively by calculating the gradient, gradually learning the feature representation of each user node.

[0118] The iterative training process is repeated until the model reaches the convergence condition, and the learning of the feature representation of each user node is completed.

[0119] Specifically, the high-dimensional feature vectors of all user nodes after feature encoding processing are input into the anti-fraud model based on graph neural network. The model contains multiple graph convolution layers, each of which is responsible for performing feature aggregation and update operation to generate a new feature representation of each user node. Then in each graph convolution layer, the feature vectors of the current node and its neighbor nodes are weighted and aggregated. After aggregation, the node's features are updated to generate a new feature representation. Further, in the training phase, the pre-labeled fraud labels are used as supervision signals. The goal of the anti-fraud model is to predict the fraud probability of each user node based on the feature representation of the node. The loss function is calculated according to the difference between the fraud probability predicted by the model and the true label, and the commonly used loss function is cross-entropy loss. Further, the gradient descent optimization algorithm is used to adjust the weights of the graph neural network, and the gradient of the loss function with respect to the model parameters (including the weight matrix of each layer) is calculated by backpropagation. According to the gradient update rule, the weights are updated iteratively. Repeat the above training steps (feature update, loss calculation, gradient optimization) until the model reaches the convergence condition. During the training process, the parameters in the graph neural network are constantly adjusted, and finally a trained anti-fraud model is obtained.

[0120] The model can gradually learn the complex relationship between the user node and its neighbor nodes through multi-layer feature aggregation of the graph convolution layer, thereby obtaining more accurate node feature representation, and help capture the potential pattern of fraudulent behavior and improve the accuracy of fraud detection. By aggregating the features of the neighbor nodes, the representation of each user node not only depends on its own features, but also fully considers the relationship with other nodes. It is very important for identifying similar or abnormal behavior of user groups, especially in fraud detection, which often needs to rely on multi-party associated information. Through supervised learning, the model can be trained according to the true label, and the optimized model can provide accurate fraud prediction in actual application. In addition, the structure of the graph neural network makes the model have good interpretability in processing the relationship between nodes, and can clearly determine which associated relationship between nodes affects the fraud prediction. During the training process, through the feature propagation and aggregation of the graph convolution layer, the model can learn the internal relationship between the graph structure and the node features with less labeled data, so that it does not need to rely on a large amount of labeled data, thereby improving the prediction effect of unlabeled samples and alleviating the challenge of label acquisition. Through the gradient descent algorithm, the model can gradually adjust the parameters in multiple iterations to optimize the fraud detection effect. The parameter adjustment of each layer of graph convolution layer makes the final node feature representation better match the actual fraud label, improving the accuracy and generalization ability of the model.

[0121] Step S60, based on the trained anti-fraud model, the high-dimensional feature vector of the input target user node is inferred, the fraud probability of the target user node is calculated and output, and the corresponding fraud detection result is generated;

[0122] In an embodiment of the present application, the step of inferring the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculating and outputting the fraud probability of the target user node, and generating the corresponding fraud detection result comprises:

[0123] Receiving the high-dimensional feature vector of the target user node generated by the feature encoding processing;

[0124] Inputting the high-dimensional feature vector of the target user node into the trained anti-fraud model based on the graph neural network for inference;

[0125] In the inference stage of the anti-fraud model, the feature representation of the target user node is calculated through the forward propagation of the graph neural network, the context neighbor information and the global graph structure of the target user node are combined, and the new feature representation of the target user node is generated;

[0126] Based on the finally generated feature representation of the target user node, the anti-fraud model outputs the fraud probability of the target user node, and the fraud probability represents the possibility of the target user node as a fraudulent user;

[0127] According to the comparison between the fraud probability of the target user node and the preset fraud threshold, a fraud detection result is generated, the fraud detection result including the fraud probability and a corresponding prediction label.

[0128] Specifically, first, the system receives the high-dimensional feature vector of the target user node after feature encoding processing. This feature vector contains the basic attribute information of the target user node and the deep information obtained through neighbor node feature aggregation. These information will be input as input data into the trained anti-fraud model for reasoning. Then the high-dimensional feature vector of the target user node is input into the trained anti-fraud model for reasoning. The anti-fraud model is composed of multiple graph convolution layers, which will calculate and update the features of the target user node during the reasoning process. In the reasoning phase of the graph neural network, the model calculates the final feature representation of the target user node through forward propagation. This process takes into account the neighbor information of the target node (i.e. the features of other user nodes connected to the target node) and the global graph structure. Through the reasoning process of the graph neural network, the final feature representation of the target user node is generated. The anti-fraud model uses this feature representation, after passing through the fully connected layer and the activation function, outputs the fraud probability of the target user node, which represents the possibility of the target user node as a fraudulent user. Then according to the fraud probability of the target user node and the preset fraud threshold, the fraud detection result is generated. If the fraud probability is greater than the fraud threshold, the model predicts that the user is a fraudulent user, otherwise it is a normal user.

[0129] In the embodiment of the present application, through the reasoning process of the graph neural network, the model can effectively integrate the feature information of the target user node and the context information of its neighbor nodes, generating an accurate fraud probability. This can provide data-based fraud prediction for decision makers, helping to identify potential fraud risks in a timely manner. At this time, the fraud detection can set appropriate fraud thresholds according to different scenarios to ensure that appropriate prediction results are generated under different risk preferences. In high-risk scenarios, a lower threshold can be set to detect potential fraudulent behavior with higher accuracy. The model not only relies on the features of the target user node, but also captures the relationship between the target user node and other nodes through the graph structure, which helps to identify fraudulent behavior caused by behavioral similarity or historical association. Therefore, this step can efficiently perform reasoning and fraud detection in large-scale graph data, and is suitable for large-scale financial, social network and other scenarios, and can process a large amount of user information in real time and make accurate predictions. Due to the characteristics of the graph neural network, the model can provide explicit prediction probability and corresponding label, which provides a guarantee for the explainability of the fraud detection result. Users can evaluate the risk according to the fraud probability and decide whether to take further action.

[0130] Further, in one embodiment of the present application, the step of generating the corresponding fraud detection result further comprises:

[0131] Based on the generated fraud detection result, a corresponding prevention or emergency response measure is taken for the target user node with a fraud probability higher than a fraud threshold, the response measure including freezing the target user account, limiting the transaction authority of the target user, or marking the target user account for further review;

[0132] The fraud detection results of all target user nodes are stored in a database, recording the fraud probability, prediction label, and associated feature information of each user node;

[0133] For the user node with a detection result of fraud, an explainability report is generated, wherein the report includes the association between the user nodes detected by the anti-fraud model, the key intermediate medium nodes and their interaction behaviors;

[0134] The generated fraud detection result is transmitted to a risk control system to trigger a corresponding business decision.

[0135] Specifically, by analyzing the fraud probability of the target user node and the preset fraud threshold, when the fraud probability is greater than the fraud threshold, it is considered that the target user node may be a fraudulent user, at this time the corresponding prevention or emergency measures will be taken according to the set response strategy, which can freeze the user account, limit the transaction or review mark according to the preset strategy. The operation. The specific implementation includes: by calling the account management system interface of the background, the user account with a fraud probability higher than the threshold is frozen to prevent further fund operation. Limit the withdrawal, transfer and other fund flow operations of the target user account to ensure that no loss is caused before further review. Mark the target user as a high-risk user and hand it over to manual review or further risk control model for processing. Further, for each user node, record and store the fraud detection results (including fraud probability, prediction label, and user node related feature information) into the database for subsequent query, analysis and report generation. Further, for the user nodes determined to be fraudulent, according to the associated information output by the anti-fraud model, extract the key intermediate medium nodes and interaction behaviors, and combine the model weights and features to automatically generate an explainability report. The report can be presented in the form of charts, graphs or text to help decision makers understand the reasons for the fraud prediction results. The report should include: the association between user nodes, such as the interaction information between the user and other user nodes or intermediate medium nodes. And the key intermediate medium nodes and their interaction behaviors, which are used to reveal which intermediate medium nodes affect the user behavior, help analyze whether the user has a gang fraud behavior or is associated with a specific pattern. Further, the generated fraud detection results are passed to the risk control system to trigger the corresponding business decisions. The risk control system can automatically execute related decision-making processes such as freezing funds, investigation and handling according to the received fraud prediction results.

[0136] Therefore, by applying fraud detection results to prevention and emergency response measures, the damage of fraudulent behavior can be effectively prevented, and suspicious accounts can be frozen and malicious behavior can be limited in a timely manner to reduce losses. Storing fraud detection results and related feature information in a database can provide a comprehensive record of each decision-making process, ensuring transparency and providing data support for subsequent audits and analysis. By generating an explainability report, the risk management team can clearly understand the reasons behind the fraud prediction results and make more targeted decisions. The explainability of the model improves the confidence and accuracy of decision-making. Passing the fraud detection results to the risk control system enables automated response to fraud detection. Reduces the need for manual intervention and improves the speed and efficiency of business response. Storing and tracking detection results, combined with actual fraud detection and response measures, can provide valuable feedback data for subsequent model training, helping to further optimize the anti-fraud model and improve future detection accuracy and response capabilities.

[0137] Therefore, by constructing the relationship graph between the user and the intermediate medium, converting the heterogeneous relationship graph and feature coding, the potential association and interaction mode between the user and other nodes can be effectively captured; by constructing the heterogeneous relationship graph between the users, the complex relationship network between the users is mined, and the recognition ability of the gang fraud is improved; by representing the user nodes by the intermediate medium and constructing the heterogeneous relationship graph, the implicit association between the users can be effectively captured, the heterogeneous relationship graph can reflect the association of different types of intermediate medium, and by assigning different weights to different edge types, the accuracy and detection ability of the model in the anti-fraud scene can be improved; and by the feature coding processing of the homogeneous relationship graph, not only the feature information of the node is retained, but also the complex relationship between the node and the neighbor node can be captured, especially in the anti-fraud scene, the implicit association and the clues of the gang fraud can be effectively mined; and by constructing the relationship graph between the user and the intermediate medium, the homogeneous relationship graph is gradually converted, the features of the nodes and the association relationship between the nodes can be comprehensively utilized, the class imbalance problem is solved, and unsupervised or semi-supervised learning is supported, so that effective modeling can be performed even in the case of label scarcity; by constructing the implicit association network between the users by the intermediate medium, the gang fraud behavior that cannot be found by isolated analysis can be captured; the aggregation mechanism of the graph neural network and the aggregation feature of the graph help to improve the class imbalance problem, and the nodes with aggregation are often more risky.

[0138] In summary, the fraud detection method based on the graph neural network in the above embodiments of the present application can effectively capture the potential association and interaction mode between the user and other nodes by constructing the relationship graph between the user and the intermediate medium and converting based on the heterogeneous relationship graph, so that not only the fraud behavior of individual users can be accurately identified, but also the identification ability of the gang fraud behavior can be improved by capturing the complex relationship network between users, especially in the case of implicit association; by introducing the intermediate medium node, the implicit association between users can be effectively represented, which helps to reveal the complex interaction relationship between users that is not easy to observe directly, especially the gang fraud behavior can be effectively captured, which is often difficult to identify through single node analysis; by converting the heterogeneous relationship graph into a homogeneous relationship graph and utilizing the association relationship between nodes, the class imbalance problem in fraud detection is effectively solved; and through the aggregation mechanism of the graph neural network, the high-risk aggregation nodes can be focused on, which are often closely related to fraud behavior, so that even in the case of label scarcity, effective modeling can be performed to support unsupervised or semi-supervised learning, thereby enhancing the adaptability of the model to scarce label data; by capturing the complex relationship and implicit features between nodes, the explainability of the model is improved, and the decision maker can understand which relationship between user nodes and interaction behavior is the key factor leading to the fraud detection result through the features and results output by the model, so that the anti-fraud decision is more transparent and operable; through the feature encoding processing of the homogeneous relationship graph, not only the feature information of the user node is retained, but also the complex relationship between the node and the neighbor node can be captured, especially in the anti-fraud scene, potential implicit association and clues of gang fraud can be effectively mined; and the graph neural network helps to improve the detection ability of the overall model in different complex situations through feature aggregation, finally solving the problems of low efficiency and accuracy of existing fraud detection.

[0139] Embodiment two

[0140] Please refer to Figure 2 is a structural schematic diagram of the fraud detection device based on the graph neural network provided by the second embodiment of the present application, only the part related to the embodiment of the present application is shown for the convenience of description, and the device comprises:

[0141] The relationship graph construction module 11 is configured to acquire the data of the user and the corresponding intermediate medium, construct the relationship graph between the user and the intermediate medium, and the relationship graph comprises the user node, the intermediate medium node, and the association relationship between the user node and the intermediate medium node.

[0142] The heterogeneous relationship graph construction module 12 is configured to construct the heterogeneous relationship graph comprising the user node and the intermediate medium node based on the association relationship between the user node and the intermediate medium node in the relationship graph, and the heterogeneous relationship graph comprises different types of nodes and different types of edges.

[0143] The isomorphic relationship graph construction module 13 is configured to convert the heterogeneous relationship graph into an isomorphic relationship graph containing only user nodes and edge weights between the user nodes based on the intermediate medium nodes representing the association between the user nodes in the heterogeneous relationship graph;

[0144] The encoding processing module 14 is configured to perform feature encoding processing on the converted isomorphic relationship graph, aggregate features of each user node and adjacent nodes of the user node, and generate a high-dimensional feature vector of each user node;

[0145] The model training module 15 is configured to input the high-dimensional feature vector of the encoded user node into a graph neural network-based anti-fraud model for training, and learn a feature representation of each user node;

[0146] The fraud detection module 16 is configured to perform reasoning on the high-dimensional feature vector of a target user node based on the trained anti-fraud model, calculate and output a fraud probability of the target user node, and generate a corresponding fraud detection result.

[0147] Further, in an embodiment of the present application, the relationship graph construction module 11 includes:

[0148] The data acquisition unit is configured to collect user data and intermediate medium data interacting with the user from a plurality of data sources;

[0149] The node definition unit is configured to define user nodes and intermediate medium nodes based on the collected user data and intermediate medium data, wherein the user nodes represent each user entity, and the intermediate medium nodes represent intermediate medium entities interacting with the user;

[0150] The edge generation unit is configured to generate edges between the user nodes and the intermediate medium nodes according to the associated interactions between the user nodes and the intermediate medium nodes, wherein the edges represent the association between the user nodes and the intermediate medium nodes;

[0151] The relationship graph construction unit is configured to combine all the user nodes, the intermediate medium nodes, and the edges therebetween to construct a relationship graph of the user and the intermediate medium.

[0152] Further, in an embodiment of the present application, the isomorphic relationship graph construction module 12 includes:

[0153] The node extraction unit is configured to extract all the user nodes and the intermediate medium nodes from the constructed relationship graph, and label a node type of each user node and intermediate medium node;

[0154] The edge definition unit is configured to define edge types in the isomorphic relationship graph according to interaction types between the user nodes and the intermediate medium nodes;

[0155] An edge creating unit is configured to create edges in the heterogeneous relation graph based on the interaction relationship between the user nodes and the intermediate medium nodes, and assign corresponding weights to each edge.

[0156] A heterogeneous relation graph creating unit is configured to combine the labeled user nodes, intermediate medium nodes and different types of edges to build a heterogeneous relation graph containing the user nodes and the intermediate medium nodes.

[0157] Further, in an embodiment of the present application, the isomorphic relation graph constructing module 13 comprises:

[0158] An interaction identifying unit is configured to identify the interaction relationship between each user node and the intermediate medium node in the heterogeneous relation graph.

[0159] A user node pair determining unit is configured to detect all user nodes directly connected to each intermediate medium node and determine the user node pair associated with other user nodes through the intermediate medium for each intermediate medium node.

[0160] An association strength calculating unit is configured to calculate the association strength between the user node pair based on the association relationship between the user node pair through the intermediate medium node, wherein the association strength is calculated by weighting according to the type, shared quantity, interaction frequency and time interval of the intermediate medium node.

[0161] An edge generating unit is configured to generate a new edge for each user node pair, and the weight of the edge is assigned according to the association strength between the user node pair.

[0162] An isomorphic relation graph constructing unit is configured to delete the intermediate medium nodes in the heterogeneous relation graph, retain the user nodes and the edges generated therebetween, and construct an isomorphic relation graph containing only the user nodes and the edge weights therebetween.

[0163] Further, in an embodiment of the present application, the encoding processing module 14 comprises:

[0164] A feature vector initializing unit is configured to initialize the feature vector of each user node in the isomorphic relation graph, wherein the feature vector contains the basic attribute information of the user node.

[0165] A feature vector aggregating unit is configured to extract the corresponding feature vector from each neighbor node based on the neighbor node set of each user node, and weight and converge the features of the neighbor nodes according to the edge weight between the neighbor nodes and the user node to generate the aggregated feature vector.

[0166] A high-dimensional feature vector generating unit is configured to combine the feature vector of each user node itself with the aggregated feature vector of its neighbor nodes to generate the high-dimensional feature vector of each user node.

[0167] Further, in an embodiment of the present application, the model training module 15 comprises:

[0168] an input unit configured to input the high-dimensional feature vectors of all user nodes after feature encoding processing into the anti-fraud model based on graph neural network, wherein the anti-fraud model comprises a plurality of graph convolution layers, and each graph convolution layer performs feature aggregation and update operation to generate a new feature representation of each user node;

[0169] a feature update unit configured to update the feature representation of each user node through each graph convolution layer in the anti-fraud model in sequence, wherein each graph convolution layer performs weighted aggregation according to the feature vector of the current node and the feature vectors of its neighbor nodes to generate a new node feature representation;

[0170] a model optimization unit configured to use pre-labeled fraud labels as supervision signals to optimize the parameters of the anti-fraud model by minimizing a loss function during the training phase of the model, wherein the loss function is calculated according to the difference between the fraud probability predicted by the model and the true label;

[0171] a model parameter adjustment unit configured to adjust the weights of the graph neural network by using a gradient descent optimization algorithm during the training process, and iteratively update the model parameters by calculating the gradient to gradually learn the feature representation of each user node;

[0172] a model training unit configured to repeat the iterative training process until the model reaches a convergence condition, and complete the learning of the feature representation of each user node.

[0173] Further, in an embodiment of the present application, the fraud detection module 16 comprises:

[0174] a feature vector receiving unit configured to receive the high-dimensional feature vector of the target user node generated after feature encoding processing;

[0175] a model inference unit configured to input the high-dimensional feature vector of the target user node into the trained anti-fraud model based on graph neural network for inference;

[0176] a feature representation calculation unit configured to calculate the feature representation of the target user node by forward propagation of the graph neural network during the inference phase of the anti-fraud model, and generate a new feature representation of the target user node by combining the context neighbor information and the global graph structure of the target user node;

[0177] a model output unit configured to output the fraud probability of the target user node by the anti-fraud model based on the finally generated feature representation of the target user node, wherein the fraud probability represents the possibility of the target user node as a fraudulent user;

[0178] The fraud detection result generation unit is configured to generate a fraud detection result by comparing the fraud probability of the target user node with a preset fraud threshold, wherein the fraud detection result comprises the fraud probability and a corresponding prediction label.

[0179] Further, in one embodiment of the present application, the device further comprises:

[0180] The response measure implementation module is configured to take corresponding preventive or emergency response measures for the target user node with a fraud probability higher than the fraud threshold based on the generated fraud detection result, wherein the response measures comprise freezing the target user account, limiting the transaction authority of the target user, or marking the target user account for further review.

[0181] The data storage module is configured to store the fraud detection results of all target user nodes in a database, and record the fraud probability, prediction label, and associated feature information of the user node for each user node.

[0182] The report generation unit is configured to generate an explainability report for the user node with a fraud detection result, wherein the report comprises the associated relationship between the user nodes detected by the anti-fraud model, the key intermediate medium node, and the interaction behavior thereof.

[0183] The detection result transmission module is configured to transmit the generated fraud detection result to a risk control system to trigger corresponding business decisions.

[0184] The fraud detection device based on the graph neural network provided by the embodiment of the present application has the same implementation principle and technical effects as the foregoing method embodiment, and for brevity of description, the part not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiment.

[0185] Embodiment three

[0186] Another aspect of the present application further provides a fraud detection system based on a graph neural network, please refer to Figure 3 , which is a fraud detection system based on a graph neural network in the third embodiment of the present application, comprising a memory 20, a processor 10, and a program 30 stored in the memory 20 and executable on the processor, wherein the processor 10 implements the fraud detection method based on the graph neural network of the above-mentioned embodiments when executing the program 30.

[0187] In some embodiments, the processor 10 can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips, configured to run program codes or process data stored in the memory 20, such as executing access restriction programs.

[0188] The memory 20 includes at least one type of readable storage medium, including a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. The memory 20 can be an internal storage unit of the graph neural network-based fraud detection system in some embodiments, such as a hard disk of the graph neural network-based fraud detection system. The memory 20 can also be an external storage device of the graph neural network-based fraud detection system in other embodiments, such as a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the graph neural network-based fraud detection system. Further, the memory 20 can include both an internal storage unit and an external storage device of the graph neural network-based fraud detection system. The memory 20 can be used not only to store application software and various data installed on the graph neural network-based fraud detection system, but also to temporarily store data that has been output or will be output.

[0189] It should be noted that, Figure 3 The illustrated structure does not constitute a limitation on the graph neural network-based fraud detection system, and in other embodiments, the graph neural network-based fraud detection system can include fewer or more components than illustrated, or combine certain components, or different component arrangements.

[0190] In summary, the fraud detection system based on the graph neural network in the above-mentioned embodiments of the present application can effectively capture the potential association and interaction mode between the user and other nodes by constructing the relationship graph between the user and the intermediate medium and converting based on the heterogeneous relationship graph, so that not only the individual user fraud behavior can be accurately identified, but also the identification ability of the gang fraud behavior can be improved by capturing the complex relationship network between the users, especially in the case of implicit association; by introducing the intermediate medium node, the implicit association between the users can be effectively represented, which helps to reveal the complex interaction relationship between the users which is not easy to directly observe, especially the gang fraud behavior can be effectively captured, which is often difficult to be identified by single node analysis; by converting the heterogeneous relationship graph into the homogeneous relationship graph and utilizing the association relationship between the nodes, the class imbalance problem in fraud detection is effectively solved; and by the aggregation mechanism of the graph neural network, the high-risk aggregation nodes can be focused on, which are often closely related to the fraud behavior, so that even in the case of label scarcity, effective modeling can be performed to support unsupervised or semi-supervised learning, thereby enhancing the adaptability of the model to the scarce label data; by capturing the complex relationship and implicit features between the nodes, the explainability of the model is improved, and the decision maker can understand which relationship between the user nodes and the interaction behavior is the key factor leading to the fraud detection result through the features and results output by the model, so that the anti-fraud decision is more transparent and operable; by the feature coding processing of the homogeneous relationship graph, not only the feature information of the user node is retained, but also the complex relationship between the node and the neighbor node can be captured, especially in the anti-fraud scene, the potential implicit association and the clue of the gang fraud can be effectively mined; and the graph neural network helps to improve the detection ability of the overall model in different complex situations by feature aggregation, so that the problem of low fraud detection efficiency and accuracy is finally solved.

[0191] The embodiment of the present application also provides a readable storage medium, which stores a program, and the program is executed by a processor to realize the fraud detection method based on the graph neural network as described in the above-mentioned embodiments.

[0192] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional units and modules is exemplified, and in actual application, the above functions can be completed by different functional units or modules according to needs, that is, the internal structure of the storage device is divided into different functional units or modules to complete all or part of the above described functions. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of software functional unit. In addition, the specific names of each functional unit and module are only for the convenience of mutual distinction, and do not limit the protection scope of the present application.

[0193] Those skilled in the art can understand that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a list of executable instructions for implementing logical functions, which can be specifically implemented in any storage medium for use by or in conjunction with an instruction execution system, device or equipment, such as a computer-based system, a system including a processor or other system that can fetch and execute instructions from an instruction execution system, device or equipment. For the present specification, "storage medium" can be any device that can contain, store, communicate, propagate or transport programs for use by or in conjunction with an instruction execution system, device or equipment.

[0194] More specific examples (a non-exhaustive list) of the computer-readable storage medium include the following: an electrical connection having one or more wires (electrical devices), a portable computer diskette (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). In addition, the storage medium can even be paper or other suitable medium on which the program can be printed, because the program can be electronically obtained, for example, by optical scanning of the paper or other medium, followed by editing, interpretation or necessary processing, if any, in other suitable manner, and then stored in the memory.

[0195] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the embodiments described above, various steps or methods can be implemented, for example, in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and in another embodiment, any of the following techniques, or combinations thereof, can be employed to implement the described functionality: discrete logic circuitry having logic gates for implementing logic functions upon data signals, application specific integrated circuits having logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and / or the like.

[0196] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the application. In the specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0197] The above-described embodiments only express several implementation manners of the present application, which are described in a more specific and detailed manner, but cannot be understood as a limitation on the scope of the present application. It should be noted that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, which are all within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A fraud detection method based on graph neural networks, characterized in that, The method includes: Data on users and corresponding intermediate media is obtained, and a relationship graph between users and intermediate media is constructed. The relationship graph includes user nodes, intermediate media nodes, and the association between user nodes and intermediate media nodes. The intermediate media are features associated with users to identify or contact users, including IP address, mobile phone number, email address, device information, and other media. Based on the association between user nodes and intermediate media nodes in the relationship graph, a heterogeneous relationship graph containing user nodes and intermediate media nodes is constructed. The heterogeneous relationship graph includes different types of nodes and different types of edges. Based on the intermediate node in the heterogeneous relation graph representing the association between user nodes, the heterogeneous relation graph is transformed into a homogeneous relation graph containing only user nodes and the edge weights between them. The transformed isomorphic graph is subjected to feature encoding processing, and the features of each user node and its neighboring nodes are aggregated to generate a high-dimensional feature vector for each user node. The high-dimensional feature vectors of the encoded user nodes are input into the anti-fraud model based on graph neural networks for training, so as to learn the feature representation of each user node. Based on the trained anti-fraud model, inference is performed on the high-dimensional feature vector of the input target user node, the fraud probability of the target user node is calculated and output, and the corresponding fraud detection results are generated. The step of transforming a heterogeneous relational graph into a homogeneous relational graph containing only user nodes and their edge weights, based on the intermediate medium nodes in the heterogeneous relational graph representing the association relationships between user nodes, includes: Identify the interaction relationships between each user node and intermediate media node in the heterogeneous relationship graph; For each intermediate media node, detect all user nodes directly connected to it, and determine the user node pairs that are associated with other user nodes through the intermediate media; Based on the association relationship between user node pairs through intermediate media nodes, the association strength between user node pairs is calculated. The association strength is calculated by weighting the intermediate media node type, number of shares, interaction frequency, and time interval. Generate a new edge for each pair of user nodes, and assign the weight of the edge based on the strength of the association between the user node pairs; Remove the intermediate nodes in the heterogeneous graph, retain the user nodes and the edges generated between them, and construct a homogeneous graph containing only the user nodes and the edge weights between them.

2. The fraud detection method based on graph neural networks according to claim 1, characterized in that, The steps of acquiring user and corresponding intermediate medium data and constructing a relationship graph between users and intermediate mediums include: Collect user data and data from intermediate media of user interaction from multiple data sources; Based on the collected user data and intermediate media data, user nodes and intermediate media nodes are defined, where user nodes represent each user entity and intermediate media nodes represent intermediate media entities that interact with users. Based on the association and interaction between user nodes and intermediate media nodes, generate edges between user nodes and intermediate media nodes, where the edges represent the association relationship between user nodes and intermediate media nodes; Combine all user nodes, intermediate media nodes, and the edges between them to construct a relationship graph between users and intermediate media.

3. The fraud detection method based on graph neural networks according to claim 1, characterized in that, The step of constructing a heterogeneous relationship graph containing user nodes and intermediate media nodes based on the association relationship between user nodes and intermediate media nodes in the relationship graph includes: Extract all user nodes and intermediate media nodes from the constructed relationship graph, and label the node type of each user node and intermediate media node; Define the edge types in the heterogeneous relationship graph based on the interaction type between user nodes and intermediate media nodes; Based on the interaction relationship between user nodes and intermediate media nodes, edges are created in the heterogeneous relationship graph, and corresponding weights are assigned to each edge; Combine the labeled user nodes, intermediate nodes, and edges of different types to construct a heterogeneous relationship graph containing user nodes and intermediate nodes.

4. The fraud detection method based on graph neural networks according to claim 1, characterized in that, The step of performing feature encoding on the transformed isomorphic graph, aggregating the features of each user node and its neighboring nodes, and generating a high-dimensional feature vector for each user node includes: For each user node in the isomorphic graph, initialize its feature vector, which contains the basic attribute information of the user node; Based on the set of neighbor nodes for each user node, the corresponding feature vector is extracted from each neighbor node, and the features of the neighbor nodes are weighted and aggregated according to the edge weights between the neighbor nodes and the user nodes to generate the aggregated feature vector. By combining the feature vector of each user node with the aggregated feature vectors of its neighboring nodes, a high-dimensional feature vector for each user node is generated.

5. The fraud detection method based on graph neural networks according to claim 1, characterized in that, The step of inputting the encoded high-dimensional feature vector of the user node into the anti-fraud model based on graph neural network for training includes: The high-dimensional feature vectors of all user nodes after feature encoding are input into a graph neural network-based anti-fraud model. The anti-fraud model contains multiple graph convolutional layers, each of which performs feature aggregation and update operations to generate a new feature representation for each user node. For each user node, the feature representation of the node is updated sequentially through each graph convolutional layer in the anti-fraud model. Each graph convolutional layer generates a new node feature representation by weighted aggregation based on the feature vector of the current node and the feature vectors of its neighboring nodes. During the training phase of the model, pre-labeled fraudulent labels are used as supervision signals, and the parameters of the anti-fraud model are optimized by minimizing the loss function, which is calculated based on the difference between the fraud probability predicted by the model and the true label. During training, the gradient descent optimization algorithm is used to adjust the weights of the graph neural network. The model parameters are updated iteratively by calculating gradients, and the feature representation of each user node is learned step by step. Repeat the iterative training process until the model reaches the convergence condition, completing the learning of the feature representation for each user node.

6. The fraud detection method based on graph neural networks according to claim 1, characterized in that, The steps of reasoning about the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculating and outputting the fraud probability of the target user node, and generating the corresponding fraud detection result include: Receive the high-dimensional feature vector of the target user node generated after feature encoding processing; The high-dimensional feature vector of the target user node is input into the trained anti-fraud model based on graph neural network for inference; In the inference phase of the anti-fraud model, the feature representation of the target user node is calculated through the forward propagation of the graph neural network. Combined with the contextual neighbor information of the target user node and the global graph structure, a new feature representation of the target user node is generated. Based on the feature representation of the final generated target user node, the anti-fraud model outputs the fraud probability of the target user node, which represents the likelihood that the target user node is a fraudulent user. Fraud detection results are generated by comparing the fraud probability of the target user node with a preset fraud threshold. The fraud detection results include the fraud probability and its corresponding predicted label.

7. The fraud detection method based on graph neural networks according to claim 1, characterized in that, Following the step of generating the corresponding fraud detection results, the following is also included: Based on the generated fraud detection results, corresponding preventive or emergency response measures are taken for target user nodes whose fraud probability is higher than the fraud threshold. Response measures include freezing the target user's account, restricting the target user's transaction permissions, or marking the target user's account for further review. The fraud detection results of all target user nodes are stored in the database, recording the fraud probability, predicted label, and related feature information of each user node. For user nodes whose detection results are fraudulent, an interpretable report is generated, which includes the relationship between user nodes detected by the anti-fraud model, key intermediate nodes and their interaction behaviors; The generated fraud detection results are transmitted to the risk control system to trigger corresponding business decisions.

8. A fraud detection device based on graph neural networks, characterized in that, The device includes: The relationship graph construction module is used to obtain data between users and corresponding intermediate media, and construct a relationship graph between users and intermediate media. The relationship graph includes user nodes, intermediate media nodes, and the association between user nodes and intermediate media nodes. The intermediate media are features associated with users to identify or contact users, including IP address, mobile phone number, email address, device information, and other media. The heterogeneous relationship graph construction module is used to construct a heterogeneous relationship graph containing user nodes and intermediate media nodes based on the association relationship between user nodes and intermediate media nodes in the relationship graph. The heterogeneous relationship graph includes different types of nodes and different types of edges. The isomorphic graph construction module is used to represent the association between user nodes based on the intermediate medium nodes in the heterogeneous graph, and to transform the heterogeneous graph into an isomorphic graph containing only user nodes and the edge weights between them. The encoding processing module is used to perform feature encoding processing on the transformed isomorphic graph, aggregate the features of each user node and its neighboring nodes, and generate a high-dimensional feature vector for each user node. The model training module is used to input the high-dimensional feature vectors of the encoded user nodes into the anti-fraud model based on graph neural networks for training, and to learn the feature representation of each user node. The fraud detection module is used to reason about the high-dimensional feature vector of the input target user node based on the trained anti-fraud model, calculate and output the fraud probability of the target user node, and generate the corresponding fraud detection results. The isomorphic relationship graph construction module includes: The interaction recognition unit is used to identify the interaction relationship between each user node and the intermediate medium node in the heterogeneous relationship graph; The user node pair determination unit is used to detect all user nodes directly connected to each intermediate medium node and determine user node pairs that are associated with other user nodes through the intermediate medium. The association strength calculation unit is used to calculate the association strength between user node pairs based on the association relationship between user node pairs through intermediate medium nodes. The association strength is calculated by weighting according to the type of intermediate medium node, the number of shares, the interaction frequency, and the time interval. The edge generation unit is used to generate new edges for each pair of user nodes, and the weight of the edge is assigned according to the correlation strength between the user node pairs. The isomorphic graph construction unit is used to delete intermediate nodes in the heterogeneous graph, retain user nodes and the edges generated between them, and construct an isomorphic graph containing only user nodes and the edge weights between them.

9. A fraud detection system based on graph neural networks, characterized in that, The method includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the fraud detection method based on a graph neural network as described in any one of claims 1-7.

Images