Fraud detection method based on graph data and related equipment

Abstract

The invention provides a fraud detection method based on graph data and related equipment, and relates to the technical field of artificial intelligence, and the method comprises the steps: obtaining user data; constructing a user social graph based on the user data; and performing graph calculation based on the user social graph to obtain a detection result. By constructing the user social graph, the complex relationship among the user groups can be grasped on the whole, and fraud detection can be carried out more comprehensively. Different from the prior art which only pays attention to behavior data of users, the method has the advantages that a relation network between user accounts and equipment and basic information association among different accounts are included into core features of fraud detection. The defects in the aspect in the prior art are effectively overcome, and the fraud detection accuracy, efficiency and recall rate are improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and more specifically, to a fraud detection method based on graph data, a fraud detection device based on graph data, an electronic device, and a storage medium. Background Art

[0002] With the in-depth advancement of Internet technology, the digital transformation process of various industries has accelerated, and the Internet has been widely used in many areas of people's lives and economic activities. E-commerce has developed rapidly, online financial services have become increasingly popular, social networks have become an important platform for information exchange and social interaction, and emerging formats such as online education and remote office have also emerged rapidly. However, in this digital process, more and more security risks have emerged in the Internet field. For example, using virtual private networks (VPNs) to hide real IP addresses, using fake device information to bypass device identification mechanisms, and obtaining user account information through social engineering means and sharing and using them. When detecting the above-mentioned security risks, only the behavioral characteristics of a single user can be analyzed and judged, and it is impossible to deeply explore the association between users and the pattern characteristics of the user's organization, making it difficult to effectively identify and intercept security risks.

[0003] Therefore, a new technical solution is urgently needed to solve the above technical problems. Summary of the invention

[0004] A series of simplified concepts are introduced in the Summary of the Invention, which will be further described in detail in the Detailed Description of the Invention. The Summary of the Invention does not mean to attempt to define the key features and essential technical features of the claimed technical solution, nor does it mean to attempt to determine the scope of protection of the claimed technical solution.

[0005] In a first aspect, the present invention proposes a fraud detection method based on graph data, comprising:

[0006] Get user data;

[0007] Build a user social graph based on user data;

[0008] Graph calculation is performed based on the user's social graph to obtain detection results.

[0009] In some implementations, performing graph calculation based on the user social graph to obtain a detection result includes:

[0010] Locate the relationship paths between users in their social graph;

[0011] Based on the community detection algorithm, the user social graph is divided into multiple different communities;

[0012] Identify target organizations in multiple different communities to identify key users in the target organizations based on relationship paths.

[0013] In some implementations, locating the relationship path between users in the user social graph includes:

[0014] The graph database Nebula is used to retrieve node relationships in the user social graph to determine the user nodes in the relationship path and other user nodes and device nodes related to the user nodes.

[0015] In some implementations, before constructing a user social graph based on user data, the method further includes:

[0016] Preprocess user data;

[0017] Based on user data, build a user social graph, including:

[0018] Using data fusion technology, the pre-processed user data is integrated to obtain the user social graph.

[0019] In some embodiments, user data includes user behavior data and user account attribute data, wherein user behavior data includes operation record data, transaction record data, and login log; user account attribute data includes user basic information, device information, and geographic location information.

[0020] In some embodiments, the method further comprises:

[0021] Leverage historical data to optimize detection models.

[0022] In some embodiments, the method further comprises:

[0023] Based on the detection results, an early warning signal is generated to take corresponding measures based on the early warning information.

[0024] In the second aspect, a fraud detection device based on graph data is also proposed, including:

[0025] A data acquisition unit, used for acquiring user data;

[0026] A construction unit, used to construct a user social graph based on user data;

[0027] The computing detection unit is used to perform graph calculation based on the user's social graph to obtain a detection result.

[0028] In a third aspect, an electronic device is proposed, including a processor and a memory, wherein the memory stores computer program instructions, and the computer program instructions are used by the processor to execute the fraud detection method based on graph data as described above when the processor is running.

[0029] In a fourth aspect, a storage medium is also proposed, on which program instructions are stored, and the program instructions are used to execute the fraud detection method based on graph data as described above during runtime.

[0030] According to the above scheme, user data is obtained; based on the user data, a user social graph is constructed; and graph calculation is performed based on the user social graph to obtain detection results. By constructing a user social graph, it is possible to grasp the complex relationships between user groups as a whole, and to more comprehensively detect potential safety hazards, such as fraud detection. Unlike the existing technologies that mostly focus only on the user's own behavior data, the present invention incorporates the relationship network between user accounts and devices and the basic information associations between different accounts into the core features of fraud detection. It effectively makes up for the deficiencies of the existing technologies in this regard and improves the accuracy, efficiency and recall rate of fraud detection.

[0031] The graph data-based fraud detection method of the present invention, and other advantages, objectives, and features of the present invention will be partially reflected through the following description, and will also be partially understood by those skilled in the art through research and practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0034] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the exemplary embodiments below. The accompanying drawings are only for the purpose of illustrating exemplary embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0035] Figure 1 A schematic flow chart of a fraud detection method based on graph data provided in an embodiment of the present application;

[0036] Figure 2 A schematic block diagram of a fraud detection device based on graph data provided in an embodiment of the present application;

[0037] Figure 3 A schematic block diagram of an electronic device according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0038] In order to more clearly understand the above-mentioned purposes, features and advantages of the present application, the scheme of the present application will be further described below. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0039] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0040] In the following description, many specific details are set forth to facilitate a full understanding of the present application, but the present application may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only part of the embodiments of the present application, rather than all of the embodiments.

[0041] With the diversification of Internet business and the continuous expansion of user groups, the interactive relationships between users have become extremely complex. To comprehensively sort out and query these relationships, not only does it require processing massive amounts of data, but the relevance and diversity of the data also make the query process extremely time-consuming. For example, on a large e-commerce platform, users may log in to their accounts through multiple devices to shop, browse, and evaluate, and may also have social interactions, transactions, shared devices, and other complex relationships with other users. To accurately query these relationships and analyze whether there are security risks, traditional database query technology and data processing methods are often unable to cope with the task. Even if a lot of manpower and time are invested, the final results are relatively low.

[0042] There are also difficulties in finding directly related users. Due to the lack of effective relationship analysis tools and comprehensive data integration perspectives, it is often necessary to rely on manual experience to conduct a large amount of data analysis and investigation. This not only requires staff to have rich industry experience and keen risk insight, but also the efficiency and accuracy of manual operations are difficult to guarantee when facing large-scale data. Even experienced professionals may miss some key related information due to the complexity and concealment of the data, resulting in the inability to effectively identify security risks.

[0043] Although the current anti-fraud services are constantly evolving, they still have significant limitations. Most of their feature engineering focuses only on deriving user features from the user's own behavioral data. This perspective ignores a key factor - the relationship network between user accounts and devices. In the Internet environment, there are complex connections between user accounts and devices. An account may be logged in and used on multiple devices, and a device may be shared by multiple accounts. There is a wealth of information hidden behind these relationships, which is of great significance for identifying security risks.

[0044] For example, the target organization may control a large number of fake accounts and simulate normal user operations on different devices, such as fake registration, fake orders, fake transaction evaluations, etc. The operating modes, time series, geographic location distribution and other relationships between these accounts and devices often show certain regularity and correlation. If these relationship networks can be incorporated into the anti-fraud system as identification features, the accuracy of fraudulent behavior identification will be greatly improved. However, the existing technology fails to fully recognize this point and does not take the relationship network between the complex accounts of the target organization and the device entities as one of the core features of identification, and is easily confused by the seemingly normal behavior of a single account.

[0045] At the same time, existing technologies are also insufficient in mining the basic information associations between different accounts. There may be many potential association clues between different accounts, such as the same registered email address, the same contact number, the same delivery address, etc. These basic information associations may imply that there is some kind of connection behind the account, which may be a normal family or friend relationship, but it is also very likely that the target organization deliberately set up an associated account to achieve certain purposes. However, due to the lack of effective data mining and analysis methods, existing technologies have failed to deeply mine the basic information associations between these accounts, and cannot conduct association analysis on user groups from a more macro perspective, making it difficult to achieve precise strikes.

[0046] To sum up, when dealing with Internet fraud, existing anti-fraud technologies have been unable to meet the needs of increasingly complex business scenarios due to their neglect of user relationship networks and insufficient mining of basic information associations. There is an urgent need for a new fraud detection technology that can comprehensively and deeply analyze user relationship networks.

[0047] In order to solve the above technical problems, according to the first aspect of the present application, a fraud detection method based on graph data is proposed. Figure 1 A schematic flow chart of a fraud detection method based on graph data provided in an embodiment of the present application. Figure 1 As shown, the method includes:

[0048] Step S110, obtaining user data.

[0049] In some embodiments, user data includes user behavior data and user account attribute data. Among them, user behavior data includes operation record data, transaction record data and login log. Exemplarily, user behavior data covers various operation records of users on the platform, such as click behavior, browsing history, search keywords, etc.; transaction records include information such as transaction time, amount, type of goods or services, etc.; login logs record detailed information such as user login time, location, and device. By collecting and organizing these behavior data, we can have a preliminary understanding of the user's behavior patterns and habits. User account attribute data includes user basic information, device information, and geographic location information. Exemplarily, user basic information may include name, age, gender, occupation, etc.; device information may include, for example, device model, operating system version, device unique identifier, etc.; geographic location information is the geographic location where the user is located when logging in or operating. These attribute data can provide richer dimensions for analyzing the associations between users.

[0050] In some implementations, the method further includes: preprocessing the user data.

[0051] For example, after obtaining the above-mentioned original user data, a series of pre-processing operations such as data cleaning and processing can be performed on it. Data cleaning mainly removes noise data, duplicate data and invalid data to ensure the quality and consistency of the data. Data processing can include data formatting, standardization and feature extraction, etc., so as to better perform subsequent analysis and modeling.

[0052] Step S120, constructing a user social graph based on the user data.

[0053] For example, pre-processed data from different sources can be integrated together through data fusion technology to form a user social graph, providing a solid data foundation for subsequent graph computing and fraud detection.

[0054] Step S130, performing graph calculation based on the user social graph to obtain a detection result.

[0055] Exemplarily, the graph database Nebula is used to perform node relationship retrieval in the user's social graph to determine the user node in the relationship path and other user nodes and device nodes related to the user node. Specifically, based on the stand-alone performance and distributed architecture of the graph database Nebula, it is possible to store and efficiently query large-scale graph data. The graph database Nebula provides a flexible data model and query language that can store, retrieve, and update entities and relationships in the user's social graph. For example, through a simple query statement, you can quickly find other user nodes or device nodes that have a specific relationship with a specific user node, which improves the efficiency of data query.

[0056] Locate the relationship paths between users in their social graph.

[0057] For example, by writing complex graph query statements, it is possible to quickly locate complex relationship paths between users, such as finding user groups that have similar behavior patterns and share certain devices or geographic locations within a specific time period, thereby achieving fraud detection.

[0058] Based on the community detection algorithm, the user social graph is divided into multiple different communities.

[0059] For example, by building a relationship network of user behavior data, we can deeply explore the potential relationship between accounts and devices, not only focusing on the behavioral characteristics of a single user, but also focusing on analyzing the association patterns between user groups as a whole. For example, when it is found that multiple accounts frequently use the same device to log in and operate in a short period of time, and there are similar characteristics such as fund flows and transaction behaviors between these accounts, there may be security risks. Combined with community detection algorithms, such as the Louvain algorithm, it can divide the entire social graph into multiple communities based on the closeness of the connection between users.

[0060] Identify target organizations in multiple different communities to identify key users in the target organizations based on relationship paths.

[0061] For example, the target organization tends to form a relatively tight community structure due to its close organizational collaboration. By analyzing and comparing these community structures, communities that may have security risks can be quickly located. After determining the target organization, users and accounts within the community can be focused on and investigated in depth. Various complex graph algorithms can be implemented using graph computing functions. For example, the PageRank algorithm can be used to evaluate the importance and influence of user nodes in the entire social graph, thereby discovering key users who may be at the core of the target organization. It should be noted that the above technical solution can detect not only a single user, but also the entire target organization.

[0062] According to the above scheme, user data is obtained; based on the user data, a user social graph is constructed; and graph calculation is performed based on the user social graph to obtain detection results. By constructing a user social graph, it is possible to grasp the complex relationships between user groups as a whole, and to more comprehensively detect potential safety hazards, such as fraud detection. Unlike the existing technologies that mostly focus only on the user's own behavior data, the present invention incorporates the relationship network between user accounts and devices and the basic information associations between different accounts into the core features of fraud detection. It effectively makes up for the deficiencies of the existing technologies in this regard and improves the accuracy, efficiency and recall rate of fraud detection.

[0063] In addition, it combines mainstream technologies such as the graph database Nebula and the graph computing engine SparkGraphx, giving full play to their respective advantages in graph data storage, query and computing. This deeply integrated technical architecture enables the system to efficiently process large-scale user social graph data, realize the rapid operation and real-time analysis of complex graph algorithms, and provide strong technical support for timely and accurate identification of security risks. Compared with traditional technical solutions, it has higher performance and scalability.

[0064] In some embodiments, the method further comprises:

[0065] Use historical data to optimize detection models. For example, use historical data to conduct regular deep mining and model training to continuously optimize fraud detection models and rules. This can monitor group fraud.

[0066] In some embodiments, the method further comprises:

[0067] Based on the detection results, an early warning signal is generated to take corresponding measures based on the early warning information.

[0068] For example, while the user behavior is occurring, it is monitored in real time to see if there are any abnormalities. Once an abnormality is found, an early warning signal is immediately issued so that appropriate measures can be taken in time to intercept and process it, thereby achieving effective identification and interception of the above-mentioned security risks.

[0069] In order to better support the implementation of the above technical solutions, the present invention designs and develops a graph application platform based on a graph database and a graph computing engine. The overall architecture of the platform is divided into three main layers, namely the basic component layer, the intermediate component layer and the application component layer. The specific functions of each layer are as follows:

[0070] Basic component layer: mainly includes functional modules such as data import, data storage and data management. The data import module is responsible for efficiently importing user data from different data sources into the graph database, supporting multiple data formats and transmission protocols to ensure timely update and integrity of data. The data storage module relies on the graph database Nebula to achieve reliable storage of large-scale user social graph data, and improves data storage efficiency and query performance through reasonable data partitioning and indexing strategies. The data management module is responsible for managing the life cycle of data, including data backup, recovery, cleanup and version control operations to ensure data security and availability.

[0071] Middle component layer: covers core functions such as data request and graph computing. The data request module serves as the interactive interface between the platform and external systems or users, receives various data query and analysis requests, and converts them into operation instructions for the graph database and graph computing engine. The graph computing module implements the calculation and execution of various complex graph algorithms based on Spark Graphx. According to different business needs and analysis scenarios, it calls the corresponding graph algorithm to conduct in-depth mining and analysis of the user's social graph, providing data support and decision-making basis for upper-level applications.

[0072] Application component layer: mainly includes data visualization and result display functions. Through data visualization technology, complex graph data and analysis results are displayed to users in an intuitive and easy-to-understand graphical interface, such as node-link diagrams, bar charts, pie charts, etc., so that users can quickly understand the overall structure of the user's social graph, the distribution of relationships between users, and the distribution of fraud risks. The result display module presents fraud detection results, warning information, and related analysis reports to users, making it easier for users to view and make decisions, thereby improving the efficiency and accuracy of risk control decisions.

[0073] Therefore, the above-mentioned fraud detection method and platform use graph data technology to deeply explore the complex relationship network between users and build a comprehensive user social graph to address the limitations of existing technologies in identifying and responding to Internet security risks and improve the accuracy and efficiency of fraud detection.

[0074] According to the second aspect of the present application, a fraud detection device based on graph data is also proposed. Figure 2 A schematic block diagram of a fraud detection device based on graph data provided in an embodiment of the present application. Figure 2 As shown, the apparatus 200 may include:

[0075] A data acquisition unit 210, configured to acquire user data;

[0076] A construction unit 220, configured to construct a user social graph based on user data;

[0077] The calculation detection unit 230 is used to perform graph calculation based on the user social graph to obtain a detection result.

[0078] According to a third aspect of the present application, an electronic device is also provided. Figure 3 FIG. 1 shows a schematic block diagram of an electronic device according to an embodiment of the present invention. Figure 3 As shown, the electronic device 300 may include a processor 310 and a memory 320. The memory 320 stores computer program instructions, which are used by the processor 310 to execute the fraud detection method based on graph data as described above when the computer program instructions are executed.

[0079] According to a fourth aspect of the present application, a storage medium is also provided, on which program instructions are stored, and the program instructions are used to execute the fraud detection method based on graph data as described above when running. The storage medium may include, for example, a storage component of a tablet computer, a hard disk of a computer, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disk read-only memory (CD-ROM), a USB memory, or any combination of the above storage media. The computer-readable storage medium may be any combination of one or more computer-readable storage media.

[0080] A person of ordinary skill in the art may understand the specific details and beneficial effects of the fraud detection device, electronic device, and storage medium based on graph data by reading the above description of the fraud detection method based on graph data, which will not be elaborated here for the sake of brevity.

[0081] In the several embodiments provided in the present application, it should be understood that the disclosed devices and / or equipment can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0082] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0083] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0084] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0085] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A fraud detection method based on graph data, characterized in that: include: Get user data; Based on the user data, construct a user social graph; Graph calculation is performed based on the user social graph to obtain a detection result.

2. The fraud detection method based on graph data according to claim 1, characterized in that: The performing graph calculation based on the user social graph to obtain a detection result includes: Locating the relationship path between users in the user social graph; Based on a community detection algorithm, the user social graph is divided into a plurality of different communities; A target organization is determined in the plurality of different communities to determine key users in the target organization based on the relationship path.

3. The fraud detection method based on graph data according to claim 2, characterized in that: The step of locating the relationship path between users in the user social graph includes: The graph database Nebula is used to perform node relationship retrieval in the user social graph to determine the user node in the relationship path and other user nodes and device nodes related to the user node.

4. The fraud detection method based on graph data according to claim 1, characterized in that: Before constructing a user social graph based on the user data, the method further includes: Preprocessing the user data; The step of constructing a user social graph based on the user data includes: The pre-processed user data is integrated using data fusion technology to obtain the user social graph.

5. The fraud detection method based on graph data according to claim 4, characterized in that: The user data includes user behavior data and user account attribute data, wherein the user behavior data includes operation record data, transaction record data and login log; the user account attribute data includes user basic information, device information and geographic location information.

6. The fraud detection method based on graph data according to claim 1, characterized in that: The method further comprises: Leverage historical data to optimize detection models.

7. The fraud detection method based on graph data according to claim 1, characterized in that: The method further comprises: Based on the detection result, an early warning signal is generated to take corresponding measures based on the early warning information.

8. A fraud detection device based on graph data, characterized in that: include: A data acquisition unit, used for acquiring user data; A construction unit, used to construct a user social graph based on the user data; A computing detection unit is used to perform graph calculation based on the user social graph to obtain a detection result.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores computer program instructions, and the computer program instructions are used by the processor to execute the fraud detection method based on graph data as claimed in any one of claims 1 to 7 when the processor is running.

10. A storage medium having program instructions stored thereon, wherein the program instructions are used to execute the fraud detection method based on graph data as claimed in any one of claims 1 to 7 when run.

Images