Unsupervised abnormal identity recognition method based on causal deentanglement

Abstract

The invention relates to an unsupervised abnormal identity recognition method based on causal deentanglement. The method comprises the following steps: S1, carrying out feature coding on identity input data by adopting a graph neural network; s2, carrying out feature embedding calculation on the nodes by adopting a GraphSAGE algorithm to obtain embedded features Z of the nodes, further processing the embedded features Z by adopting a graph convolutional neural network to obtain a feature decomposition mask, and calculating causal features Zc and environmental features Zs of the nodes according to the embedded representation Z of the nodes and the feature decomposition mask; s3, based on the causal feature Zc and the environmental feature Zs, using a comparative learning algorithm to perform unsupervised feature learning to obtain a causal deentanglement model; and S4, extracting causal feature representations of the nodes by adopting a causal deentanglement model, clustering the causal feature representations of the nodes by adopting a clustering algorithm, and automatically identifying potential abnormal nodes. Compared with the prior art, the method has the advantages of high accuracy, high reliability and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal identity recognition, and in particular to an unsupervised abnormal identity recognition method based on causal disentanglement. Background Art

[0002] With the rapid development of Internet finance, online fraud has become more common, especially in e-commerce platforms, social networks and financial systems. Fraud has become a serious threat to user privacy and system security. Therefore, fraud identity detection has become particularly important, with the goal of identifying potential fraudulent accounts or activities and preventing economic losses and reputation damage caused by fraud.

[0003] In the existing field of fraud detection, many scholars have proposed different solutions. For example, Wang Xiaoxiao et al. (2021) proposed a credit risk assessment method for online loan borrowers based on deep forests to address the credit risk problem in the lending process. This method extracts features through the borrower's basic information and historical borrowing data, and constructs a deep forest model through multi-granular scanning and cascade forest modules for default prediction. In addition, Chen Xiangzhou et al. (2021) built a credit risk assessment model based on a multi-layer perceptron (MLP) model, which can perform well in terms of accuracy and stability. Wang Zhongren et al. (2020) proposed a fused deep neural network model (LSTM-CNN) based on a long short-term memory (LSTM) neural network and a convolutional neural network (CNN), which models user information from the time dimension and behavior dimension, combines sequence features and local features, and achieves better default prediction results, and is superior to traditional machine learning methods and single models in terms of KS and AUC indicators. The graph-based fraud detection task has received widespread attention in recent years. By aggregating tabular data in different dimensions to construct a graph structure representation, complex correlation information and potential fraud behavior patterns can be mined. The CARE-GNN algorithm proposed by Dou et al. (2020) focuses on fraud node detection in graph data, and improves the fraud detection capability in graph data by using a similarity-based neighbor selection strategy and setting filtering thresholds.

[0004] Although the above methods have achieved certain results, they still face the following two major problems: (1) It is still difficult to obtain a large amount of fraud identity data, especially when new fraud methods continue to emerge. Labeled data is extremely scarce, making model training difficult. Existing methods often rely on supervised learning. However, due to the lack of sufficient labeled data, they cannot fully utilize unlabeled data to be effective. (2) Fraudulent behavior usually involves the interaction of multiple factors, which may have highly correlated or complex relationships in the original data. In graph data, fraudulent nodes are often disguised in the relationship network constructed by normal nodes, and their abnormal behavior is concealed by establishing connections with a large number of normal nodes. Traditional unsupervised learning methods cannot effectively disentangle these complex features and relationship entanglements, making it difficult for the model to capture potential fraud features, thereby affecting the detection effect. Summary of the invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a highly accurate and reliable unsupervised abnormal identity recognition method based on causal disentanglement.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] An unsupervised abnormal identity recognition method based on causal disentanglement, comprising:

[0008] S1, use graph neural network to encode the identity input data;

[0009] S2. Use the GraphSAGE algorithm to embed the node features to obtain the node embedding feature Z. Use the graph convolutional neural network to further process the embedded feature Z to obtain the feature decomposition mask. Calculate the node causal feature Z based on the node embedding representation Z and the feature decomposition mask. c and environmental characteristics Z s ;

[0010] S3. Based on causal feature Z c and environmental characteristics Z s ,Using contrastive learning algorithm for unsupervised feature learning, we obtain a causal disentanglement model;

[0011] S4. The causal disentanglement model is used to extract the causal feature representation of the node, and the clustering algorithm is used to cluster the causal feature representation of the node to automatically identify potential abnormal nodes.

[0012] Preferably, the GraphSAGE algorithm is used to perform feature embedding calculation on the node to obtain the embedded feature Z of the node, specifically:

[0013] For each node i and its neighbor node set The calculation expression of the GraphSAGE algorithm is:

[0014]

[0015] Where: AGG represents the feature aggregation operation, θ l is the weight of the l-th layer network, is the node feature of the lth layer, is the activation function;

[0016] Through multiple aggregations and updates, the embedded feature Z of the node is finally obtained.

[0017] Preferably, the embedded feature Z is further processed by a graph convolutional neural network to obtain a feature decomposition mask, and the calculation expression is:

[0018]

[0019] Where: X is the original feature of the node, A is the adjacency matrix with self-loop connections added, D is the degree matrix of each node, θ is the network parameter, and σ(·) is the activation function.

[0020] Preferably, the causal feature Z of the node is calculated based on the embedding representation Z of the node and the feature decomposition mask mask c and environmental characteristics Z s , the calculation expression is:

[0021] Z c =Z mask (3)

[0022] Z s =Z·(1-mask) (4)

[0023] Preferably, the causal feature Z based on c and environmental characteristics Z s , use the contrastive learning algorithm for unsupervised feature learning, specifically:

[0024] The causal feature Z obtained by causal decomposition c and randomly matched environmental features Z s Fusion is performed to obtain an enhanced view of causal features. The fusion process is expressed as:

[0025] Z f =MLP([Z c ,Z s ]) (5)

[0026] Where: MLP is a multi-layer perceptron.

[0027] After obtaining two views, a contrastive learning algorithm is used to maximize the mutual information between two views of the same sample.

[0028] Preferably, when the contrastive learning algorithm is used for unsupervised feature learning, the loss function includes a contrast loss term, an independence loss term and a reconstruction loss term, and the calculation expression is:

[0029]

[0030] Where: is the contrast loss term, is the independence loss term, is the reconstruction loss term, and α and β are the coefficients of the corresponding terms.

[0031] Preferably, the independence loss term is specifically: using the Hilbert-Schmidt independence index HSIC to characterize the independence between the causal feature and the environmental feature, and using the normalized Hilbert-Schmidt independence index HISC as the independence loss term between the causal feature and the environmental feature

[0032] Preferably, the reconstruction loss term includes positive sample loss and negative sample loss, specifically:

[0033] The adjacency matrix of the original graph is negatively sampled to construct a new adjacency matrix, and then the edges between nodes are reconstructed according to the enhanced feature view through the graph self-encoder;

[0034] The positive sample loss is:

[0035]

[0036] The negative sample loss is:

[0037]

[0038] Formula: E + and E - Respectively represent the original adjacency matrix and the adjacency matrix obtained after negative sampling;

[0039] Preferably, the contrast loss term is calculated as:

[0040]

[0041] Where: Z (1) and Z (2) represents the node features in two views, τ is the temperature parameter, and sim is the feature similarity function.

[0042] Preferably, the clustering algorithm is a K-means clustering algorithm.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] (1) The present invention introduces causal disentanglement technology to extract causal features directly related to fraudulent behavior from graph data, avoiding the defects of relying on correlation, identifying and eliminating redundant features, and improving the identifiability of fraudulent features.

[0045] (2) Through an unsupervised learning framework based on graph data, unlabeled graph data is used for representation learning training to adaptively identify fraud patterns and improve the generalization ability of the model.

[0046] (3) Combining causal disentanglement with unsupervised learning effectively solves the existing methods’ dependence on labeled data and enhances the model’s ability to identify and robustly detect new types of fraudulent behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a flow chart of the method of the present invention;

[0048] Figure 2 It is the sample feature composition from a causal perspective;

[0049] Figure 3 It is an unsupervised method based on causal disentanglement;

[0050] Figure 4 Flowchart of the unsupervised anomaly identity recognition method based on causal disentanglement. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0052] Example

[0053] like Figure 1 As shown, this embodiment provides an unsupervised abnormal identity recognition method based on causal disentanglement, including:

[0054] S1, use graph neural network to encode the identity input data;

[0055] S2. Use the GraphSAGE algorithm to embed the node features to obtain the node embedding feature Z. Use the graph convolutional neural network to further process the embedded feature Z to obtain the feature decomposition mask. Calculate the node causal feature Z based on the node embedding representation Z and the feature decomposition mask. c and environmental characteristics Z s ;

[0056] S3. Based on causal feature Z c and environmental characteristics Z s ,Using contrastive learning algorithm for unsupervised feature learning, we obtain a causal disentanglement model;

[0057] S4. The causal disentanglement model is used to extract the causal feature representation of the node, and the clustering algorithm is used to cluster the causal feature representation of the node to automatically identify potential abnormal nodes.

[0058] Next, the method of the embodiment is described in detail.

[0059] 1. Fraud disguise phenomenon: In fraud detection, fraud users disguise themselves by interacting with normal users, so that their behavior characteristics are similar to those of normal nodes, thereby avoiding being identified by traditional anomaly detection methods. Fraudulent nodes imitate the behavior patterns of normal nodes, especially by increasing edge connections with normal nodes, so that the environment in which the fraudulent nodes are located is almost indistinguishable from that of normal nodes, thereby reducing the accuracy of detection. As can be seen from Table 1, in multiple fraud detection datasets, the proportion of heterogeneous edges of fraudulent nodes is usually high, which indicates that fraudulent nodes try to disguise themselves by imitating the connection patterns of normal nodes (i.e., heterogeneous edges) to reduce their abnormality in the graph.

[0060] Table 1 Statistics of edge types on the fraud detection dataset

[0061] Dataset Overall isomorphic edge ratio The proportion of heterogeneous edges of fraudulent nodes Amazon 0.9536 0.9625 Yelpchi 0.7730 0.8988 T-finance 0.9708 0.6908 T-social 0.6239 0.9562

[0062] Traditional graph neural networks (GNNs) usually rely on information transfer and aggregation between nodes to generate embedded representations of nodes. In this method, fraudulent nodes can hide their abnormal features in connections with normal nodes by disguising their neighbor relationships, thereby misleading the model.

[0063] 2. Feature analysis from a causal perspective: Based on the above-mentioned fraudulent disguise phenomenon, it is necessary to analyze node features from a new perspective. To this end, the feature composition of the sample is re-examined from a causal perspective.

[0064] like Figure 2 As shown, the characteristics of the sample can be decomposed into two parts: environmental characteristics and causal characteristics.

[0065] Environmental features mainly come from the environment where the node is located, that is, the interaction between the node and its neighbors, the structure of the subgraph where the node is located, etc. Environmental features are usually related to the node label. For example, most of the nodes around a normal node are also normal nodes. Therefore, these features may cause disguised nodes to be misclassified as normal nodes in some cases. Causal features represent the behavioral characteristics of the node itself, which are driven by the behavior of the node itself and can reveal whether the node is fraudulent.

[0066] 3. Feature disentanglement through causal decomposition: In order to achieve causal disentanglement, the goal of the present invention is to extract causal features and environmental features by decomposing node features.

[0067] First, we use the GraphSAGE (Graph Sample and Aggregation) method to calculate the feature embedding of the nodes. GraphSAGE combines the features of a node with the features of its neighboring nodes through neighborhood aggregation to generate an embedded representation of the node. This method is particularly suitable for modeling local structures in graphs and can effectively capture the relationship between a node and its neighbors, while environmental features mainly focus on the interactive relationship between a node and its neighbors. For each node i and its set of neighboring nodes The operation steps of GraphSAGE are as follows:

[0068]

[0069] Where: AGG represents the feature aggregation operation, θ l is the weight of the l-th layer network, is the node feature of the lth layer, is the activation function.

[0070] Through multiple aggregations and updates, the embedded feature Z of the node is finally obtained.

[0071] Next, GCN (Graph Convolutional Network) is used to further process the node features and generate a mask to separate the node's environmental features from the causal features. GCN performs convolution operations in the spectral domain through the Laplacian matrix of the graph to learn the global structural information of the node and learn the importance of the features through spectral transformation. In particular, GCN can be used to decompose the node features well when the node features have complex dependencies. The convolution operation of GCN is as follows:

[0072]

[0073] Where: X is the original feature of the node, A is the adjacency matrix with self-loop connections added, D is the degree matrix of each node, θ is the network parameter, and σ(·) is the activation function.

[0074] After obtaining the embedded representation and feature decomposition mask of the node, the causal feature Z of the node is obtained through the following two formulas: c and environmental characteristics Z s :

[0075] Z c =Z mask (3)

[0076] Z s =Z·(1-mask) (4)

[0077] 4. Unsupervised node feature learning: After obtaining the causal features and environmental features, unsupervised feature learning is performed using contrastive learning. By fusing the decomposed causal features with the randomly matched environmental features, an enhanced view of the causal features can be obtained. This fusion process can be expressed as:

[0078] Z f =MLP([Z c ,Z s ]) (5)

[0079] After obtaining the two views, the contrastive learning algorithm is applied to maximize the mutual information between the two views of the same sample. The loss function of contrastive learning is as follows:

[0080]

[0081] Where: Z (1) and Z (2) Represents the node features in two views, τ is the temperature parameter, and sim is the function for calculating feature similarity. Generally, cosine similarity or vector inner product can be used.

[0082] 5. Feature independence measurement:

[0083] During the experiment, it was found that if the above-mentioned contrastive learning loss is used alone for learning, the similarity between the causal features and environmental features decomposed by the model will become higher and higher, which is inconsistent with the decoupling goal.

[0084] Therefore, this embodiment introduces the Hilbert-Schmidt independence index (HSIC) to ensure the independence between causal features and environmental features, and to ensure the effect of causal disentanglement.

[0085]

[0086] Where: K X and K Y are the kernel matrices of X and Y respectively, Whereas I is the identity matrix and Tr(·) is the trace of the matrix.

[0087] Although HSIC can measure the independence between variables well, it does not have the invariance of scaling in all directions. Therefore, the normalized HISC is finally used as the independence regularization loss between causal features and environmental features:

[0088]

[0089] 6. Reconstruction effect measurement: In the process of unsupervised node feature learning, the enhanced view is obtained by fusing causal features and random environmental features, and the representation ability of the model is optimized through contrastive learning. The reconstruction loss is introduced to improve the reconstruction effect of the view. By reconstructing the edges of the input graph, the representation learned by the model can reflect the true relationship between the nodes in the graph, thereby improving the accuracy and robustness of the model in the fraudulent node detection task. Specifically, a new adjacency matrix is ​​constructed by negatively sampling the adjacency matrix of the existing graph, and then the edges between the nodes are reconstructed according to the enhanced feature view through the graph autoencoder (VGAE). The reconstruction loss consists of the losses of positive samples and negative samples, where the positive sample loss is:

[0090]

[0091] Similarly, the loss for negative samples is:

[0092]

[0093] In the above two formulas, E + and E - Represent the original adjacency matrix and the adjacency matrix obtained after negative sampling. The positive sample loss and negative sample loss can get the total reconstruction loss:

[0094]

[0095] In summary, the main network architecture diagram of the present invention is as follows: Figure 3 As shown, the loss function of unsupervised feature learning is as follows:

[0096]

[0097] Where: is the contrast loss term, is the independence loss term, is the reconstruction loss term, and α and β are the coefficients of the corresponding terms. Contrast loss, independence loss, and reconstruction loss are sensitive to the size of the dataset. Adjust α and β so that during the training process, the loss and reconstruction loss are smaller than the independence loss, and can be adjusted adaptively according to the size of the dataset.

[0098] 7. Unsupervised node classification: After unsupervised training, the model is able to effectively extract the causal feature representation of the node. Next, the K-means clustering method is used to classify the nodes. By clustering the node embedding vectors, potential fraud nodes can be automatically identified, which are usually significantly different from normal nodes in the feature space. The K-means algorithm can classify similar nodes into the same cluster, thereby helping to effectively classify nodes without labels. The overall flow chart of the method is shown below. Figure 4shown.

[0099] The unsupervised abnormal identity recognition method based on causal disentanglement proposed in the present invention has the following advantages:

[0100] By introducing causal disentanglement technology, we can extract causal features directly related to fraudulent behavior from graph data, avoid the defects of relying on correlation, identify and eliminate redundant features, and improve the identifiability of fraud features. This method not only improves the detection ability of the model under complex data structures, but also makes full use of the structural information of graph data and unlabeled data for training in the absence of labeled data, thereby improving training efficiency and generalization ability. Through this graph-based unsupervised learning method, the excessive dependence of existing methods on labeled data is solved, and the model's recognition ability and robustness to new types of fraudulent behavior are enhanced.

[0101] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. An unsupervised abnormal identity recognition method based on causal disentanglement, characterized in that: include: S1, use graph neural network to encode the identity input data; S2. Use the GraphSAGE algorithm to embed the node features to obtain the node embedding feature Z. Use the graph convolutional neural network to further process the embedded feature Z to obtain the feature decomposition mask. Calculate the node causal feature Z based on the node embedding representation Z and the feature decomposition mask. c and environmental characteristics Z s ; S3. Based on causal feature Z c and environmental characteristics Z s ,Using contrastive learning algorithm for unsupervised feature learning, we obtain a causal disentanglement model; S4. The causal disentanglement model is used to extract the causal feature representation of the node, and the clustering algorithm is used to cluster the causal feature representation of the node to automatically identify potential abnormal nodes.

2. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 1 is characterized in that: The GraphSAGE algorithm is used to perform feature embedding calculation on the node to obtain the node embedding feature Z, which is specifically: For each node i and its neighbor node set The calculation expression of the GraphSAGE algorithm is: Where: AGG represents the feature aggregation operation, θ l is the weight of the l-th layer network, is the node feature of the lth layer, is the activation function; Through multiple aggregations and updates, the embedded feature Z of the node is finally obtained.

3. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 1 is characterized in that: The graph convolutional neural network is used to further process the embedded feature Z to obtain the feature decomposition mask mask, and the calculation expression is: Where: X is the original feature of the node, A is the adjacency matrix with self-loop connections added, D is the degree matrix of each node, θ is the network parameter, and σ(·) is the activation function.

4. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 1 is characterized in that: The causal feature Z of the node is calculated based on the node embedding representation Z and the feature decomposition mask mask c and environmental characteristics Z s , the calculation expression is: WITH c =Z mask (3) WITH s =Z (1-mask) (4)。 5. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 1 is characterized in that: The causal feature Z based on c and environmental characteristics Z s , use the contrastive learning algorithm for unsupervised feature learning, specifically: The causal feature Z decomposed from the causal c and randomly matched environmental features Z s Fusion is performed to obtain an enhanced view of causal features. The fusion process is expressed as: WITH f =MLP([Z c ,WITH s ]) (5) Where: MLP is a multi-layer perceptron. After obtaining two views, a contrastive learning algorithm is used to maximize the mutual information between two views of the same sample.

6. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 5 is characterized in that: When the contrastive learning algorithm is used for unsupervised feature learning, the loss function includes contrast loss term, independence loss term and reconstruction loss term, and the calculation expression is: Where: is the contrast loss term, is the independence loss term, is the reconstruction loss term, and α and β are the coefficients of the corresponding terms.

7. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 6 is characterized in that: The independence loss term is specifically: using the Hilbert-Schmidt independence index HSIC to characterize the independence between the causal feature and the environmental feature, and using the normalized Hilbert-Schmidt independence index HISC as the independence loss term between the causal feature and the environmental feature 8. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 6 is characterized in that: The reconstruction loss term includes positive sample loss and negative sample loss, specifically: The adjacency matrix of the original graph is negatively sampled to construct a new adjacency matrix, and then the edges between nodes are reconstructed according to the enhanced feature view through the graph self-encoder; The positive sample loss is: The loss of negative samples is: Formula: E + and E - Represent the original adjacency matrix and the adjacency matrix obtained after negative sampling respectively.

9. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 6 is characterized in that: The contrast loss term is calculated as follows: Where: Z (1) and Z (2) represents the node features in two views, τ is the temperature parameter, and sim is the feature similarity function.

10. The unsupervised abnormal identity recognition method based on causal disentanglement according to claim 1 is characterized in that: The clustering algorithm is the K-means clustering algorithm.

Images