Abnormal financial user detection method and device and abnormal financial user detection system

Abstract

The invention provides an abnormal financial user detection method and device and an abnormal financial user detection system, and the method comprises the steps: building a heterogeneous graph model which comprises a plurality of element paths; a positive sample matrix corresponding to each meta path is constructed, a random mask algorithm is adopted to process each positive sample matrix, a plurality of negative sample matrixes are obtained, and the positive sample matrixes are used for describing whether financial transaction relations exist among the user nodes in the meta paths; training the graph neural network model by using a comparative learning method according to the plurality of positive sample matrixes and the corresponding negative sample matrixes to obtain an anomaly detection model; all the positive sample matrixes are input into an anomaly detection model, the anomaly probability of each user node is obtained, and the anomaly probability is used for representing the probability that a user corresponding to the user node belongs to an abnormal user. The method solves the problem that in the prior art, due to label data scarcity, the accuracy rate of abnormal user detection is low.

Description

Technical Field

[0001] The present invention relates to the field of graph deep learning, and in particular, to an abnormal financial user detection method, device, computer-readable storage medium, computer program product and abnormal financial user detection system. Background Art

[0002] In the early work of graph anomaly detection, it usually relied on statistical models and feature engineering established by domain experts. This approach essentially limits the ability to detect unknown anomalies. Due to this limitation, researchers have introduced many machine learning techniques, such as support vector machines and matrix decomposition. Although machine learning methods are relatively effective compared to manual designs, these technologies are difficult to scale in the face of large-scale graphs of millions of levels in real scenarios, and show considerable overhead in storage and execution time.

[0003] With the development of graph deep learning technology, methods based on graph neural networks and graph representation learning have become popular. This type of technology usually uses deep learning to capture high-order information of the graph structure. By extracting rich feature vector representations, abnormal objects and normal objects in the graph can be easily separated, and abnormal information in graph data can be more accurately identified. However, for the current methods of deep learning anomaly detection on graphs, most of them are based on homogeneous graphs, and many models rely on labeled data. In the case of real graph networks, graphs have heterogeneous characteristics, that is, the nodes and edges contained in the graph have multiple types. Ignoring the heterogeneity characteristics makes the graph modeling inaccurate, and the semantics between nodes are missing. At the same time, most of the current methods for graph anomaly detection using deep learning are based on labeled data sets, but in large-scale graphs in financial scenarios, labeled data is very scarce. Relying solely on labeled data for design may reduce the model's generalization ability for unknown data. Direct migration methods on homogeneous graphs are very difficult in heterogeneous graphs. Therefore, when performing graph data mining tasks, it is necessary to comprehensively consider heterogeneity issues and the use of unlabeled data to better make the model closer to the actual situation of the task. Summary of the invention

[0004] The main purpose of the present application is to provide an abnormal financial user detection method, device, computer-readable storage medium, computer program product and abnormal financial user detection system, so as to at least solve the problem of low accuracy of abnormal user detection caused by scarcity of label data in the prior art.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for detecting abnormal financial users is provided, comprising: establishing a heterogeneous graph model, the heterogeneous graph model comprising multiple meta-paths, the heterogeneous graph model being a graph data structure having multiple node types and multiple edge types, the node types comprising user nodes, device nodes and bank nodes, the meta-path being a financial transaction path formed between the user node and other different types of nodes; constructing a positive sample matrix corresponding to each meta-path, and processing each positive sample matrix using a random masking algorithm to obtain multiple negative sample matrices, the positive sample matrix being used to describe whether there is a financial transaction relationship between each user node in the meta-path, and the elements of the negative sample matrix being in one-to-one correspondence with the elements of the positive sample matrix; training a graph neural network model using a contrastive learning method according to the multiple positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model; inputting all the positive sample matrices into the anomaly detection model to obtain an abnormal probability of each user node, the abnormal probability being used to indicate the probability that the user corresponding to the user node is an abnormal user, and limiting the operation authority of the user corresponding to the user node when the abnormal probability of the user node exceeds a predetermined threshold.

[0006] Optionally, constructing a positive sample matrix corresponding to each of the meta-paths includes: obtaining a plurality of node sequences corresponding to each of the meta-paths according to the heterogeneous graph model by means of a random walk, the node sequence being a sequence representation of the meta-paths followed between the nodes in the heterogeneous graph model; determining the financial transaction relationship between the user nodes according to each of the node sequences, and constructing a positive sample matrix corresponding to each of the meta-paths according to the financial transaction relationship, the positive sample matrix being an N-order square matrix, where N is the total number of the user nodes.

[0007] Optionally, a random mask algorithm is used to process each of the positive sample matrices to obtain multiple negative sample matrices, including: obtaining multiple corresponding all-one matrices having the same dimension as each of the positive sample matrices; setting a mask ratio, randomly selecting an element of the mask ratio in each of the all-one matrices as a target element, and setting the target element to 0, and determining each of the all-one matrices processed by the mask ratio as a negative sample matrix.

[0008] Optionally, a graph neural network model is trained using a contrastive learning method based on multiple positive sample matrices and corresponding negative sample matrices to obtain an anomaly detection model, including: weighted averaging the positive sample matrices corresponding to each meta-path to obtain a first sample node matrix, and weighted averaging the negative sample matrices corresponding to each meta-path to obtain a second sample node matrix; substituting the first sample node matrix and the second sample node matrix into a loss function to calculate a loss value, wherein the loss function is Among them, z i and z j is a single positive sample node vector in the first sample node matrix, z k is a single negative sample node vector in the second sample node matrix, the sim(·) function calculates the cosine similarity between two vectors, and τ represents the temperature coefficient; at least the parameters of the graph neural network model are adjusted until the loss value converges to obtain the anomaly detection model.

[0009] Optionally, performing weighted averaging on the positive sample matrices corresponding to the meta-paths to obtain a first sample node matrix, and performing weighted averaging on the negative sample matrices corresponding to the meta-paths to obtain a second sample node matrix, including: performing feature vector aggregation on each of the positive sample matrices to obtain a first aggregation matrix corresponding to each of the positive sample matrices Among them, σ is the LeakyRelu activation function, is the positive sample matrix for the Pth element path, I P1 is the identity matrix of the positive sample matrix for the Pth element path, D P1 is the degree matrix of the positive sample matrix for the P-th element path, is the first aggregation matrix under the P-th element path of the l-th layer, is the trainable parameter of the lth layer when the positive sample matrix is ​​aggregated, and the feature vectors of each negative sample matrix are aggregated to obtain the second aggregation matrix corresponding to each negative sample matrix in, is the negative sample matrix for the Pth element path, I P2 is the identity matrix of the negative sample matrix for the Pth element path, D P2 is the degree matrix of the negative sample matrix for the Pth element path, is the second aggregation matrix under the P-th element path of the l-th layer, is the trainable parameter of the lth layer when the negative sample matrix is ​​aggregated; performing a linear transformation on each of the first aggregate matrices to obtain the weight corresponding to each of the first aggregate matrices Among them, V is the total number of nodes, W is the weight parameter, b is the bias parameter, qT is a meta-path attention vector that can be trained for the task, and each of the second aggregation matrices is linearly transformed to obtain the weight corresponding to each of the second aggregation matrices The softmax function is used to normalize the weights corresponding to each of the first aggregation matrices to obtain the first target weights corresponding to each of the first aggregation matrices. The weights corresponding to each of the second aggregation matrices are normalized to obtain the second target weights corresponding to each of the second aggregation matrices. The first sample node matrix is ​​obtained by weighted averaging each of the first aggregation matrices according to the first target weights corresponding to each of the first aggregation matrices. And according to the second target weights corresponding to the second aggregation matrices, each second aggregation matrix is ​​weighted averaged to obtain the second sample node matrix

[0010] Optionally, the anomaly detection model includes a probability function y=sigmoid(W * ·Z + +b * ), where W * To optimize the weight parameter, b * To optimize the bias parameters, all the positive sample matrices are input into the anomaly detection model to obtain the anomaly probability of each user node, including: inputting all the positive sample matrices into the anomaly detection model to obtain a probability vector y, wherein the elements of the probability vector y are respectively the anomaly probabilities of each user node in the first sample node matrix.

[0011] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an abnormal financial user detection device is provided, comprising: a first establishing unit, used to establish a heterogeneous graph model, the heterogeneous graph model includes multiple meta-paths, the heterogeneous graph model is a graph data structure with multiple node types and multiple edge types, the node types include user nodes, device nodes and bank nodes, the meta-path is a financial transaction path composed of the user node and other different types of nodes; a second establishing unit, used to construct a positive sample matrix corresponding to each meta-path, and use a random mask algorithm to process each positive sample matrix to obtain multiple negative sample matrices, the positive sample matrix is ​​used to describe the meta-path Whether there is a financial transaction relationship between each of the user nodes in the path, the elements of the negative sample matrix correspond to the elements of the positive sample matrix one by one; a first training unit, used to train the graph neural network model according to the multiple positive sample matrices and the corresponding negative sample matrices using a contrastive learning method to obtain an anomaly detection model; a first control unit, used to input all the positive sample matrices into the anomaly detection model to obtain the anomaly probability of each user node, the anomaly probability is used to indicate the probability that the user corresponding to the user node is an abnormal user, and when the anomaly probability of the user node exceeds a predetermined threshold, the operation authority of the user corresponding to the user node is restricted.

[0012] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the method described in any one of the devices where the computer-readable storage medium is located is controlled.

[0013] According to another aspect of the present application, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, any one of the methods described above is implemented.

[0014] According to another aspect of the present application, an abnormal financial user detection system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include methods for executing any one of the described methods.

[0015] Applying the technical solution of the present application, in the above-mentioned abnormal financial user detection method, it includes: establishing a heterogeneous graph model, the above-mentioned heterogeneous graph model includes multiple meta-paths, the above-mentioned heterogeneous graph model is a graph data structure with multiple node types and multiple edge types, the above-mentioned node types include user nodes, device nodes and bank nodes, and the above-mentioned meta-path is a financial transaction path composed of the above-mentioned user node and other different types of nodes; constructing a positive sample matrix corresponding to each of the above-mentioned meta-paths, and using a random masking algorithm to process each of the above-mentioned positive sample matrices to obtain multiple negative sample matrices, the above-mentioned positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above-mentioned user nodes in the above-mentioned meta-path, and the elements of the above-mentioned negative sample matrix correspond to the elements of the above-mentioned positive sample matrix one-to-one; according to the multiple above-mentioned positive sample matrices and the corresponding above-mentioned negative sample matrices, a contrastive learning method is used to train a graph neural network model to obtain an anomaly detection model; all the above-mentioned positive sample matrices are input into the above-mentioned anomaly detection model to obtain the anomaly probability of each of the above-mentioned user nodes, the above-mentioned anomaly probability is used to indicate the probability that the user corresponding to the above-mentioned user node is an abnormal user, and when the above-mentioned anomaly probability of the above-mentioned user node exceeds a predetermined threshold, the operation authority of the user corresponding to the above-mentioned user node is restricted. The present application establishes a heterogeneous graph model, constructs positive sample matrices and negative sample matrices corresponding to each meta-path according to the meta-path in the heterogeneous graph model, and trains the graph neural network model using a contrastive learning method according to each positive sample matrix and each negative sample matrix to obtain an anomaly detection model, and obtains the anomaly probability of all user nodes according to all positive sample matrices input into the anomaly detection model. The positive sample matrix and the negative sample matrix are constructed by using the heterogeneous graph model to obtain the anomaly detection model, that is, the training of the graph neural network model is completed through a self-supervised learning method without introducing other label data, thereby solving the problem of low accuracy in detecting abnormal users in the prior art due to the scarcity of label data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A hardware structure block diagram of a mobile terminal for executing an abnormal financial user detection method provided in an embodiment of the present application is shown;

[0017] Figure 2 A schematic diagram of a process of detecting an abnormal financial user provided according to an embodiment of the present application is shown;

[0018] Figure 3 A schematic diagram of a heterogeneous graph network of an abnormal financial user detection method provided according to an embodiment of the present application is shown;

[0019] Figure 4 A model framework diagram of an abnormal financial user detection method provided according to an embodiment of the present application is shown;

[0020] Figure 5 A structural block diagram of an abnormal financial user detection device provided according to an embodiment of the present application is shown.

[0021] The above drawings include the following reference numerals:

[0022] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0023] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] As introduced in the background technology, the existing deep learning anomaly detection in graphs does not take the heterogeneity problem into consideration, and label data is very scarce. To solve this technical problem, the embodiments of the present application provide an abnormal financial user detection method, device, computer-readable storage medium, computer program product and abnormal financial user detection system.

[0027] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0028] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1FIG. 1 is a hardware structure block diagram of a mobile terminal of an abnormal financial user detection method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0029] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to an abnormal financial user detection method in an embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0030] In this embodiment, a method for detecting abnormal financial users running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] Figure 2 is a flow chart of an abnormal financial user detection method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0032] Step S201, establishing a heterogeneous graph model, wherein the heterogeneous graph model includes multiple meta-paths, and the heterogeneous graph model is a graph data structure having multiple node types and multiple edge types, wherein the node types include user nodes, device nodes, and bank nodes, and the meta-path is a financial transaction path formed between the user node and other different types of nodes;

[0033] Specifically, a heterogeneous graph framework is constructed. The model includes multiple meta-paths, which is a complex graph data structure that integrates different types of nodes and edges. The node categories cover users, devices and banks, while the meta-paths describe the financial transaction paths between users and other types of nodes in the graph. This model design aims to enhance the ability to identify abnormal financial transaction patterns by capturing multiple types of interactive relationships in heterogeneous networks. By constructing a heterogeneous graph model containing nodes such as users, devices and banks and their multi-paths, it is possible to more comprehensively analyze the financial transaction network and understand the transaction paths between users.

[0034] It can be understood that a heterogeneous graph can be represented by G = (V, E), where V represents a node set and E represents an edge relationship set. The mapping function between nodes and node types in the graph network is The mapping function between edges and edge types is and Represent the node type and edge type respectively. If Then the graph network is a heterogeneous graph. The meta-path P is in the network mode The path instance defined above, Can be used to represent a meta-path, where Defined The compound relationship between Represents a composite operator on a relation.

[0035] In a specific embodiment, Figure 3 As shown, the heterogeneous graph network includes user nodes U, bank nodes B, and device nodes D. The diagram shows the financial transaction relationship between the nodes and explains the user characteristics of the user nodes. The user characteristics include name, age, gender and other characteristics. At the same time, the heterogeneous graph network includes the following meta-paths UDU, UBU and UBDBU composed of user nodes, bank nodes and device nodes.

[0036] Step S202, constructing a positive sample matrix corresponding to each of the above meta-paths, and processing each of the above positive sample matrices using a random masking algorithm to obtain a plurality of negative sample matrices, wherein the above positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above user nodes in the above meta-path, and the elements of the above negative sample matrix correspond one-to-one to the elements of the above positive sample matrix;

[0037] Specifically, a corresponding positive sample adjacency matrix is ​​generated for each meta-path, and then these positive sample matrices are transformed using random masking technology to generate a series of negative sample matrices; the positive sample matrix clearly reflects the financial transaction relationship between user nodes based on specific meta-paths, while the negative sample matrix simulates the missing or associated elements in the transaction network through the correspondence with the elements of the positive sample matrix. This positive and negative sample construction strategy helps the graph neural network learn more stable and comprehensive node representations during training, thereby performing better in abnormal user detection tasks.

[0038] Step S203, training the graph neural network model using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model;

[0039] Specifically, multiple sets of positive sample matrices and corresponding negative sample matrices are used to train the graph neural network by implementing a contrastive learning strategy, and then a model for anomaly detection is constructed. The core advantage of this method is that through the comparison of positive and negative samples, the graph neural network can more deeply understand the difference between normal and abnormal trading patterns, and improve the model's ability to identify anomalies.

[0040] It should be noted that the above-mentioned graph neural network model is an existing deep learning method based on graph data structure, which is used to process the relationship between entities in the above-mentioned graph data structure.

[0041] Step S204, input all the above positive sample matrices into the above anomaly detection model to obtain the anomaly probability of each of the above user nodes, where the above anomaly probability is used to indicate the probability that the user corresponding to the above user node is an abnormal user, and when the above anomaly probability of the above user node exceeds a predetermined threshold, the operation authority of the user corresponding to the above user node is restricted.

[0042] Specifically, all positive sample matrices are sent to the anomaly detection model for analysis to obtain the predicted probability of the user represented by each user node becoming an abnormal user. Based on this prediction result, when the abnormal probability value of the user node exceeds the preset critical point, the system automatically restricts the user's access rights.

[0043] Through this embodiment, in the above-mentioned abnormal financial user detection method, a heterogeneous graph model is established, the above-mentioned heterogeneous graph model includes multiple meta-paths, the above-mentioned heterogeneous graph model is a graph data structure with multiple node types and multiple edge types, the above-mentioned node types include user nodes, device nodes and bank nodes, and the above-mentioned meta-path is a financial transaction path composed of the above-mentioned user node and other different types of nodes; a positive sample matrix corresponding to each of the above-mentioned meta-paths is constructed, and each of the above-mentioned positive sample matrices is processed by a random masking algorithm to obtain multiple negative sample matrices, the above-mentioned positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above-mentioned user nodes in the above-mentioned meta-path, and the elements of the above-mentioned negative sample matrix correspond to the elements of the above-mentioned positive sample matrix one by one; a graph neural network model is trained by a contrastive learning method according to the multiple above-mentioned positive sample matrices and the corresponding above-mentioned negative sample matrices to obtain an anomaly detection model; all of the above-mentioned positive sample matrices are input into the above-mentioned anomaly detection model to obtain the anomaly probability of each of the above-mentioned user nodes, the above-mentioned anomaly probability is used to indicate the probability that the user corresponding to the above-mentioned user node is an abnormal user, and when the above-mentioned anomaly probability of the above-mentioned user node exceeds a predetermined threshold, the operation authority of the user corresponding to the above-mentioned user node is restricted. The present application establishes a heterogeneous graph model, constructs positive sample matrices and negative sample matrices corresponding to each meta-path according to the meta-path in the heterogeneous graph model, and trains the graph neural network model using a contrastive learning method according to each positive sample matrix and each negative sample matrix to obtain an anomaly detection model, and obtains the anomaly probability of all user nodes according to all positive sample matrices input into the anomaly detection model. The positive sample matrix and the negative sample matrix are constructed by using the heterogeneous graph model to obtain the anomaly detection model, that is, the training of the graph neural network model is completed through a self-supervised learning method without introducing other label data, thereby solving the problem of low accuracy in detecting abnormal users in the prior art due to the scarcity of label data.

[0044] In order to establish a positive sample matrix, in an optional implementation, a positive sample matrix corresponding to each of the above meta-paths is constructed, and the above step S202 includes:

[0045] Step S2021, using a random walk method to obtain multiple node sequences corresponding to each of the meta-paths according to the heterogeneous graph model, wherein the node sequence is a sequence representation of each of the nodes following the meta-path in the heterogeneous graph model;

[0046] Specifically, a random walk approach is adopted to extract a series of node sequences for each meta-path based on the constructed heterogeneous graph model. These sequences accurately represent the connection order of the nodes in the graph according to the specific meta-path. The key effect of this strategy is that it can effectively capture the complex semantic relationships contained in the heterogeneous graph. Through the generation of node sequences, it provides a basis for the subsequent construction of the positive sample matrix. According to the node sequence, it can be determined whether the user nodes under the current meta-path are connected, so as to determine the elements in the positive sample matrix.

[0047] Step S2022, determining the financial transaction relationship between the user nodes according to the node sequences, and constructing a positive sample matrix corresponding to the meta-paths according to the financial transaction relationship, wherein the positive sample matrix is ​​an N-order square matrix, where N is the total number of the user nodes.

[0048] Specifically, based on the acquired node sequence, the financial transaction relationship between each user node is clarified, and then based on these transaction relationships, a positive sample adjacency matrix matching each meta-path is constructed. The key achievement of this step is that it can systematically characterize the financial transaction network structure of the user under a specific meta-path, providing structured information for the model, thereby promoting the understanding of abnormal transaction behavior. The constructed positive sample matrix not only reflects the user's direct transaction connection, but also indirectly links the user's transaction environment through the meta-path, thereby improving the recognition accuracy and generalization ability of the anomaly detection model.

[0049] In order to establish a negative sample matrix, in an optional implementation, a random mask algorithm is used to process each of the positive sample matrices to obtain multiple negative sample matrices, and the step S202 further includes:

[0050] Step S2023, obtaining a plurality of corresponding all-one matrices having the same dimension as each of the above positive sample matrices;

[0051] Specifically, an all-one matrix with the same dimension as each positive sample matrix is ​​obtained. The essence of this operation is to provide a basis for the subsequent establishment of the negative sample matrix.

[0052] Step S2024, setting a mask ratio, randomly selecting an element of the mask ratio in each of the above all-one matrices as a target element, and setting the target element to 0, and determining each of the above all-one matrices processed by the mask ratio as a negative sample matrix.

[0053] Specifically, a fixed mask rate is set, and then in each all-one matrix of the same dimension as the positive sample matrix, elements that account for the proportion of the mask rate are randomly selected, and the values ​​of these selected elements are set to 0. The operation at random position 0 can be understood as randomly removing the edge relationship between nodes in the graph. After this masking operation, the all-one matrix is ​​converted into a negative sample matrix. The main effect of this process is to provide the model with positive and negative samples.

[0054] In order to obtain an anomaly detection model, in an optional implementation, a graph neural network model is trained using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model. The step S203 includes:

[0055] Step S2031, performing weighted averaging on the positive sample matrices corresponding to the meta-paths to obtain a first sample node matrix, and performing weighted averaging on the negative sample matrices corresponding to the meta-paths to obtain a second sample node matrix;

[0056] Specifically, a weighted average operation is performed on the positive sample matrix under each meta-path to generate a comprehensive first sample node matrix. Similarly, a weighted average is performed on the negative sample matrix associated with each meta-path to obtain a second comprehensive sample node matrix. Through this step, the diverse information provided by different meta-paths is effectively integrated, the node representation is optimized, and the feature vector of each node is more comprehensive and accurate.

[0057] Step S2032, substituting the first sample node matrix and the second sample node matrix into the loss function to calculate the loss value, wherein the loss function is Among them, z i and z j is a single positive sample node vector in the first sample node matrix above, z k is a single negative sample node vector in the second sample node matrix, the sim(·) function is to calculate the cosine similarity between two vectors, and τ represents the temperature coefficient;

[0058] Specifically, by calculating the loss value between each positive sample node vector in the first sample node matrix and each negative sample node vector in the second sample node matrix, the model is guided to minimize the distance between the positive sample node vectors and maximize the distance between the negative sample node vectors. This mechanism helps to improve the efficiency of the model in automatically learning abnormal financial user behavior patterns from unlabeled data under the self-supervised learning framework, ensuring that the model can accurately distinguish between abnormal transactions and normal transactions.

[0059] Step S2033, at least adjust the parameters of the above-mentioned graph neural network model until the above-mentioned loss value converges to obtain the above-mentioned anomaly detection model.

[0060] Specifically, by continuously optimizing the parameters of the graph neural network model to minimize the loss value obtained by the above calculation until the loss value reaches a stable state, a trained anomaly detection model is obtained. The key effect of this optimization process is that it prompts the model to continuously learn and adjust until it can effectively distinguish between normal and abnormal financial transaction behaviors, thereby significantly improving the detection accuracy and efficiency of the model.

[0061] In order to further determine the first sample node matrix and the second sample node matrix, in an optional implementation, weighted average is performed on the positive sample matrices corresponding to the above-mentioned meta-paths to obtain the first sample node matrix, and weighted average is performed on the negative sample matrices corresponding to the above-mentioned meta-paths to obtain the second sample node matrix. The above-mentioned step S2031 includes:

[0062] Step S20311, perform feature vector aggregation on each of the above positive sample matrices to obtain a first aggregation matrix corresponding to each of the above positive sample matrices Among them, σ is the LeakyRelu activation function, is the positive sample matrix for the Pth element path, I P1 is the identity matrix of the positive sample matrix for the Pth element path, D P1 is the degree matrix of the above positive sample matrix for the Pth element path, is the first aggregation matrix under the P-th element path of the l-th layer, is the trainable parameter of the lth layer when the above positive sample matrix is ​​aggregated, and the feature vectors of each of the above negative sample matrices are aggregated to obtain the second aggregation matrix corresponding to each of the above negative sample matrices in, is the negative sample matrix for the Pth element path, I P2 is the identity matrix of the negative sample matrix for the Pth element path, D P2 is the degree matrix of the negative sample matrix for the Pth element path, is the above second aggregation matrix under the P-th element path of the l-th layer, is the trainable parameter of the lth layer when the negative sample matrix is ​​aggregated;

[0063] Specifically, a feature vector aggregation operation is performed on each positive sample matrix to generate a corresponding first aggregation matrix. At the same time, a similar feature aggregation step is performed on each negative sample matrix to obtain a second aggregation matrix. Through feature vector aggregation, the model can extract the comprehensive characteristics of nodes from multiple angles of heterogeneous graphs, and then capture more complex transaction semantics and structural information, which helps to improve the model's understanding and identification capabilities of abnormal financial behaviors.

[0064] It should be noted that when performing feature vector aggregation on each of the above positive sample matrices and each of the above negative sample matrices, the present invention may choose to splice each of the above positive sample matrices. The splicing process is: The matrix is ​​the matrix after the original heterogeneous graph is enhanced. The feature vector aggregation is performed on the spliced ​​matrix, which can better retain the characteristics of each positive sample matrix. The matrix of the negative sample matrix is ​​spliced ​​to obtain The processing process is the same as the concatenation process of the positive sample matrix.

[0065] Step S20312: Perform a linear transformation on each of the first aggregation matrices to obtain the weights corresponding to each of the first aggregation matrices. Among them, V is the total number of nodes, W is the weight parameter, b is the bias parameter, q T is a meta-path attention vector that can be trained for the task, and each of the above second aggregation matrices is linearly transformed to obtain the weights corresponding to each of the above second aggregation matrices

[0066] Specifically, a linear transformation operation is performed on each first aggregation matrix to generate corresponding weights. Similarly, a linear transformation is applied to each second aggregation matrix to obtain corresponding weights. It allows the model to calculate the attention weights of different meta-paths based on the comprehensive feature vector of the node, so that information can be more intelligently integrated. Through this process, the model can automatically identify which meta-paths are most critical for detecting abnormal users, ensuring the accuracy of the final node representation and sensitivity to abnormal behavior.

[0067] Step S20313: Use the softmax function to normalize the weights corresponding to each of the above first aggregation matrices to obtain the first target weights corresponding to each of the above first aggregation matrices. The weights corresponding to the above second aggregation matrices are normalized to obtain the second target weights corresponding to the above second aggregation matrices.

[0068] Specifically, the softmax function is used to normalize the weights related to each first aggregation matrix to obtain their respective first target weights, ensuring that the sum of all weights is equal to 1, so as to provide a probabilistic distributed weight distribution when the fusion node is represented. Similarly, the same normalization step is performed on the weights corresponding to each second aggregation matrix to generate their respective second target weights, which helps to consider the contribution of each meta-path in a more intuitive and balanced way in the subsequent weighted fusion process.

[0069] Step S20314: weighted average each of the first aggregation matrices according to the first target weights corresponding to each of the first aggregation matrices to obtain the first sample node matrix And according to the second target weights corresponding to the second aggregation matrices, the weighted average of the second aggregation matrices is performed to obtain the second sample node matrix

[0070] Specifically, based on the first target weight corresponding to each first aggregation matrix, a weighted average operation is performed on all first aggregation matrices to obtain a first sample node matrix that integrates the information of each meta-path. Similarly, based on the second target weight associated with each second aggregation matrix, a weighted average is performed on all second aggregation matrices to obtain a second sample node matrix that incorporates negative sample features, thereby constructing a more comprehensive and accurate node vector representation.

[0071] In order to obtain the abnormal probability of the user node through the abnormal detection model, in an optional implementation, the above abnormal detection model includes a probability function y=sigmoid(W * ·Z + +b * ), where W * To optimize the weight parameter, b * To optimize the bias parameters, all the above positive sample matrices are input into the above anomaly detection model to obtain the anomaly probability of each of the above user nodes. The above step S204 includes:

[0072] Step S2041: input all the above positive sample matrices into the above anomaly detection model to obtain a probability vector y, wherein the elements of the above probability vector y are respectively the anomaly probabilities of the above user nodes in the above first sample node matrix.

[0073] Specifically, by inputting the positive sample matrix into the trained model, the abnormal probability of each user node can be directly obtained. The positive sample matrix mentioned here is obtained based on the graph data to be detected. Furthermore, after performing the above-mentioned node aggregation and weighting operations, the first sample node matrix to be detected is obtained, and finally input into the trained anomaly detection model to obtain the abnormal probability of the user node in the graph data to be detected.

[0074] Figure 4 A model framework diagram of an abnormal financial user detection method provided according to an embodiment of the present application is shown, such as Figure 4As shown, the original heterogeneous graph data includes multiple meta-paths, and the positive sample matrix can be obtained according to the meta-paths. The negative sample matrix is ​​obtained by using a random masking algorithm based on the positive sample matrix. Then, the GNN graph neural network model is used to perform vector aggregation on the positive sample matrix and the negative sample matrix to obtain the first aggregation matrix and the second aggregation matrix. Furthermore, the first sample node matrix and the second sample node matrix can be obtained after fusion processing. The graph neural network model is trained by contrasting the learning loss function, and finally an anomaly detection model for calculating the user anomaly probability is obtained, thereby obtaining the user anomaly probability.

[0075] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0076] The embodiment of the present application also provides an abnormal financial user detection device. It should be noted that the abnormal financial user detection device of the embodiment of the present application can be used to execute the abnormal financial user detection method provided by the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0077] The following introduces an abnormal financial user detection device provided in an embodiment of the present application.

[0078] Figure 5 is a structural block diagram of an abnormal financial user detection device according to an embodiment of the present application. Figure 5 As shown, the device comprises:

[0079] A first establishing unit 10 is used to establish a heterogeneous graph model, wherein the heterogeneous graph model includes a plurality of meta-paths, and the heterogeneous graph model is a graph data structure having a plurality of node types and a plurality of edge types, wherein the node types include user nodes, device nodes, and bank nodes, and the meta-path is a financial transaction path formed between the user node and other nodes of different types;

[0080] Specifically, a heterogeneous graph framework is constructed. The model includes multiple meta-paths, which is a complex graph data structure that integrates different types of nodes and edges. The node categories cover users, devices and banks, while the meta-paths describe the financial transaction paths between users and other types of nodes in the graph. This model design aims to enhance the ability to identify abnormal financial transaction patterns by capturing multiple types of interactive relationships in heterogeneous networks. By constructing a heterogeneous graph model containing nodes such as users, devices and banks and their multi-paths, it is possible to more comprehensively analyze the financial transaction network and understand the transaction paths between users.

[0081] The second establishing unit 20 is used to construct a positive sample matrix corresponding to each of the above-mentioned meta-paths, and process each of the above-mentioned positive sample matrices using a random mask algorithm to obtain a plurality of negative sample matrices, wherein the above-mentioned positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above-mentioned user nodes in the above-mentioned meta-path, and the elements of the above-mentioned negative sample matrix correspond to the elements of the above-mentioned positive sample matrix one by one;

[0082] Specifically, a corresponding positive sample adjacency matrix is ​​generated for each meta-path, and then these positive sample matrices are transformed using random masking technology to generate a series of negative sample matrices; the positive sample matrix clearly reflects the financial transaction relationship between user nodes based on specific meta-paths, while the negative sample matrix simulates the missing or associated elements in the transaction network through the correspondence with the elements of the positive sample matrix. This positive and negative sample construction strategy helps the graph neural network learn more stable and comprehensive node representations during training, thereby performing better in abnormal user detection tasks.

[0083] A first training unit 30 is used to train the graph neural network model using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model;

[0084] Specifically, multiple sets of positive sample matrices and corresponding negative sample matrices are used to train the graph neural network by implementing a contrastive learning strategy, and then a model for anomaly detection is constructed. The core advantage of this method is that through the comparison of positive and negative samples, the graph neural network can more deeply understand the difference between normal and abnormal trading patterns, and improve the model's ability to identify anomalies.

[0085] The first control unit 40 is used to input all the above-mentioned positive sample matrices into the above-mentioned anomaly detection model to obtain the anomaly probability of each of the above-mentioned user nodes, where the above-mentioned anomaly probability is used to indicate the probability that the user corresponding to the above-mentioned user node is an abnormal user, and when the above-mentioned anomaly probability of the above-mentioned user node exceeds a predetermined threshold, limit the operation authority of the user corresponding to the above-mentioned user node.

[0086] Specifically, all positive sample matrices are sent to the anomaly detection model for analysis to obtain the predicted probability of the user represented by each user node becoming an abnormal user. Based on this prediction result, when the abnormal probability value of the user node exceeds the preset critical point, the system automatically restricts the user's access rights.

[0087] Through this embodiment, the first establishment unit is used to establish a heterogeneous graph model, the heterogeneous graph model includes multiple meta-paths, the heterogeneous graph model is a graph data structure with multiple node types and multiple edge types, the node types include user nodes, device nodes and bank nodes, and the meta-path is a financial transaction path composed of the user node and other different types of nodes; the second establishment unit is used to construct a positive sample matrix corresponding to each of the above meta-paths, and use a random mask algorithm to process each of the above positive sample matrices to obtain multiple negative sample matrices, the positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above user nodes in the above meta-path, and the elements of the above negative sample matrix correspond to the elements of the above positive sample matrix one by one; the first training unit is used to train the graph neural network model according to the multiple positive sample matrices and the corresponding negative sample matrices using a contrastive learning method to obtain an anomaly detection model; the first control unit is used to input all the above positive sample matrices into the above anomaly detection model to obtain the anomaly probability of each of the above user nodes, the above anomaly probability is used to indicate the probability that the user corresponding to the above user node is an abnormal user, and when the above anomaly probability of the above user node exceeds a predetermined threshold, the operation authority of the user corresponding to the above user node is restricted. The present application establishes a heterogeneous graph model, constructs positive sample matrices and negative sample matrices corresponding to each meta-path according to the meta-path in the heterogeneous graph model, and trains the graph neural network model using a contrastive learning method according to each positive sample matrix and each negative sample matrix to obtain an anomaly detection model, and obtains the anomaly probability of all user nodes according to all positive sample matrices input into the anomaly detection model. The positive sample matrix and the negative sample matrix are constructed by using the heterogeneous graph model to obtain the anomaly detection model, that is, the training of the graph neural network model is completed through a self-supervised learning method without introducing other label data, thereby solving the problem of low accuracy in detecting abnormal users in the prior art due to the scarcity of label data.

[0088] In order to establish a positive sample matrix, in an optional implementation, a positive sample matrix corresponding to each of the above-mentioned meta-paths is constructed, and the above-mentioned second establishing unit includes:

[0089] A first establishing module is used to obtain a plurality of node sequences corresponding to each of the meta-paths according to the heterogeneous graph model by using a random walk method, wherein the node sequence is a sequence representation of each of the nodes following the meta-path in the heterogeneous graph model;

[0090] Specifically, a random walk approach is adopted to extract a series of node sequences for each meta-path based on the constructed heterogeneous graph model. These sequences accurately represent the connection order of the nodes in the graph according to the specific meta-path. The key effect of this strategy is that it can effectively capture the complex semantic relationships contained in the heterogeneous graph. Through the generation of node sequences, it provides a basis for the subsequent construction of the positive sample matrix. According to the node sequence, it can be determined whether the user nodes under the current meta-path are connected, so as to determine the elements in the positive sample matrix.

[0091] The second establishment module is used to determine the above-mentioned financial transaction relationship between each of the above-mentioned user nodes according to each of the above-mentioned node sequences, and construct a positive sample matrix corresponding to each of the above-mentioned meta-paths according to the above-mentioned financial transaction relationship, wherein the above-mentioned positive sample matrix is ​​an N-order square matrix, and N is the total number of the above-mentioned user nodes.

[0092] Specifically, based on the acquired node sequence, the financial transaction relationship between each user node is clarified, and then based on these transaction relationships, a positive sample adjacency matrix matching each meta-path is constructed. The key achievement of this step is that it can systematically characterize the financial transaction network structure of the user under a specific meta-path, providing structured information for the model, thereby promoting the understanding of abnormal transaction behavior. The constructed positive sample matrix not only reflects the user's direct transaction connection, but also indirectly links the user's transaction environment through the meta-path, thereby improving the recognition accuracy and generalization ability of the anomaly detection model.

[0093] In order to establish a negative sample matrix, in an optional implementation, a random mask algorithm is used to process each of the positive sample matrices to obtain multiple negative sample matrices, and the second establishing unit further includes:

[0094] A third establishment module is used to obtain a plurality of corresponding all-one matrices having the same dimension as each of the above positive sample matrices;

[0095] Specifically, an all-one matrix with the same dimension as each positive sample matrix is ​​obtained. The essence of this operation is to provide a basis for the subsequent establishment of the negative sample matrix.

[0096] The fourth establishment module is used to set the mask ratio, randomly select the elements of the mask ratio in each of the above-mentioned all-one matrices as target elements, and set the above-mentioned target elements to 0, and determine each of the above-mentioned all-one matrices processed by the mask ratio as a negative sample matrix.

[0097] Specifically, a fixed mask rate is set, and then in each all-one matrix of the same dimension as the positive sample matrix, elements that account for the proportion of the mask rate are randomly selected, and the values ​​of these selected elements are set to 0. After this masking operation, the all-one matrix is ​​converted into a negative sample matrix. The main effect of this process is to provide the model with positive and negative samples.

[0098] In order to obtain an anomaly detection model, in an optional implementation, a graph neural network model is trained using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model, and the first training unit includes:

[0099] A first training module is used to perform weighted averaging on the positive sample matrices corresponding to the meta-paths to obtain a first sample node matrix, and perform weighted averaging on the negative sample matrices corresponding to the meta-paths to obtain a second sample node matrix;

[0100] Specifically, a weighted average operation is performed on the positive sample matrix under each meta-path to generate a comprehensive first sample node matrix. Similarly, a weighted average is performed on the negative sample matrix associated with each meta-path to obtain a second comprehensive sample node matrix. Through this step, the diverse information provided by different meta-paths is effectively integrated, the node representation is optimized, and the feature vector of each node is more comprehensive and accurate.

[0101] The second training module is used to substitute the first sample node matrix and the second sample node matrix into the loss function to calculate the loss value, wherein the loss function is Among them, z i and z j is a single positive sample node vector in the first sample node matrix above, z k is a single negative sample node vector in the second sample node matrix, the sim(·) function is to calculate the cosine similarity between two vectors, and τ represents the temperature coefficient;

[0102] Specifically, by calculating the loss value between each positive sample node vector in the first sample node matrix and each negative sample node vector in the second sample node matrix, the model is guided to minimize the distance between the positive sample node vectors and maximize the distance between the negative sample node vectors. This mechanism helps to improve the efficiency of the model in automatically learning abnormal financial user behavior patterns from unlabeled data under the self-supervised learning framework, ensuring that the model can accurately distinguish between abnormal transactions and normal transactions.

[0103] The third training module is used to at least adjust the parameters of the above-mentioned graph neural network model until the above-mentioned loss value converges to obtain the above-mentioned anomaly detection model.

[0104] Specifically, by continuously optimizing the parameters of the graph neural network model to minimize the loss value obtained by the above calculation until the loss value reaches a stable state, a trained anomaly detection model is obtained. The key effect of this optimization process is that it prompts the model to continuously learn and adjust until it can effectively distinguish between normal and abnormal financial transaction behaviors, thereby significantly improving the detection accuracy and efficiency of the model.

[0105] In order to further determine the first sample node matrix and the second sample node matrix, in an optional implementation, the positive sample matrices corresponding to the above-mentioned meta-paths are weighted averaged to obtain the first sample node matrix, and the negative sample matrices corresponding to the above-mentioned meta-paths are weighted averaged to obtain the second sample node matrix. The above-mentioned first training module includes:

[0106] The first training submodule is used to aggregate the feature vectors of each of the above positive sample matrices to obtain the first aggregation matrix corresponding to each of the above positive sample matrices. Among them, σ is the LeakyRelu activation function, is the positive sample matrix for the Pth element path, I P1 is the identity matrix of the positive sample matrix for the Pth element path, D P1 is the degree matrix of the above positive sample matrix for the Pth element path, is the first aggregation matrix under the P-th element path of the l-th layer, is the trainable parameter of the lth layer when the above positive sample matrix is ​​aggregated, and the feature vectors of each of the above negative sample matrices are aggregated to obtain the second aggregation matrix corresponding to each of the above negative sample matrices in, is the negative sample matrix for the Pth element path, I P2 is the identity matrix of the negative sample matrix for the Pth element path, D P2 is the degree matrix of the negative sample matrix for the Pth element path, is the above second aggregation matrix under the P-th element path of the l-th layer, is the trainable parameter of the lth layer when the negative sample matrix is ​​aggregated;

[0107] Specifically, a feature vector aggregation operation is performed on each positive sample matrix to generate a corresponding first aggregation matrix. At the same time, a similar feature aggregation step is performed on each negative sample matrix to obtain a second aggregation matrix. Through feature vector aggregation, the model can extract the comprehensive characteristics of nodes from multiple angles of heterogeneous graphs, and then capture more complex transaction semantics and structural information, which helps to improve the model's understanding and identification capabilities of abnormal financial behaviors.

[0108] The second training submodule is used to perform a linear transformation on each of the above first aggregation matrices to obtain the weights corresponding to each of the above first aggregation matrices. Among them, V is the total number of nodes, W is the weight parameter, b is the bias parameter, q T is a meta-path attention vector that can be trained for the task, and each of the above second aggregation matrices is linearly transformed to obtain the weights corresponding to each of the above second aggregation matrices

[0109] Specifically, a linear transformation operation is performed on each first aggregation matrix to generate corresponding weights. Similarly, a linear transformation is applied to each second aggregation matrix to obtain corresponding weights. It allows the model to calculate the attention weights of different meta-paths based on the comprehensive feature vector of the node, so that information can be more intelligently integrated. Through this process, the model can automatically identify which meta-paths are most critical for detecting abnormal users, ensuring the accuracy of the final node representation and sensitivity to abnormal behavior.

[0110] The third training submodule is used to use the softmax function to perform weight normalization processing on the weights corresponding to each of the above first aggregation matrices to obtain the first target weights corresponding to each of the above first aggregation matrices. The weights corresponding to the above second aggregation matrices are normalized to obtain the second target weights corresponding to the above second aggregation matrices.

[0111] Specifically, the softmax function is used to normalize the weights related to each first aggregation matrix to obtain their respective first target weights, ensuring that the sum of all weights is equal to 1, so as to provide a probabilistic distributed weight distribution when the fusion node is represented. Similarly, the same normalization step is performed on the weights corresponding to each second aggregation matrix to generate their respective second target weights, which helps to consider the contribution of each meta-path in a more intuitive and balanced way in the subsequent weighted fusion process.

[0112] The fourth training submodule is used to perform weighted averaging on each of the first aggregation matrices according to the first target weights corresponding to each of the first aggregation matrices to obtain the first sample node matrix And according to the second target weights corresponding to the second aggregation matrices, the weighted average of the second aggregation matrices is performed to obtain the second sample node matrix

[0113] Specifically, based on the first target weight corresponding to each first aggregation matrix, a weighted average operation is performed on all first aggregation matrices to obtain a first sample node matrix that integrates the information of each meta-path. Similarly, based on the second target weight associated with each second aggregation matrix, a weighted average is performed on all second aggregation matrices to obtain a second sample node matrix that incorporates negative sample features, thereby constructing a more comprehensive and accurate node vector representation.

[0114] In order to obtain the abnormal probability of the user node through the abnormal detection model, in an optional implementation, the above abnormal detection model includes a probability function y=sigmoid(W * ·Z + +b* ), where W * To optimize the weight parameter, b * In order to optimize the bias parameters, all the above positive sample matrices are input into the above anomaly detection model to obtain the anomaly probability of each of the above user nodes. The above first control unit includes:

[0115] The first control module is used to input all the above positive sample matrices into the above anomaly detection model to obtain a probability vector y, wherein the elements of the above probability vector y are respectively the anomaly probabilities of each of the above user nodes in the above first sample node matrix.

[0116] Specifically, by inputting the positive sample matrix into the trained model, the abnormal probability of each user node can be directly obtained. The positive sample matrix mentioned here is obtained based on the graph data to be detected. Furthermore, after performing the above-mentioned node aggregation and weighting operations, the first sample node matrix to be detected is obtained, and finally input into the trained anomaly detection model to obtain the abnormal probability of the user node in the graph data to be detected.

[0117] The above-mentioned abnormal financial user detection device includes a processor and a memory, and the above-mentioned first establishment unit, the second establishment unit, the first training unit and the first control unit are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions. The above-mentioned modules are all located in the same processor; or, the above-mentioned modules are located in different processors in the form of any combination.

[0118] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the accuracy of the model's detection of abnormal users can be improved by adjusting the kernel parameters.

[0119] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0120] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned abnormal financial user detection method.

[0121] Specifically, an abnormal financial user detection method includes:

[0122] Step S201, establishing a heterogeneous graph model, wherein the heterogeneous graph model includes multiple meta-paths, and the heterogeneous graph model is a graph data structure having multiple node types and multiple edge types, wherein the node types include user nodes, device nodes, and bank nodes, and the meta-path is a financial transaction path formed between the user node and other different types of nodes;

[0123] Step S202, constructing a positive sample matrix corresponding to each of the above meta-paths, and processing each of the above positive sample matrices using a random masking algorithm to obtain a plurality of negative sample matrices, wherein the above positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above user nodes in the above meta-path, and the elements of the above negative sample matrix correspond one-to-one to the elements of the above positive sample matrix;

[0124] Step S203, training the graph neural network model using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model;

[0125] Step S204, input all the above positive sample matrices into the above anomaly detection model to obtain the anomaly probability of each of the above user nodes, where the above anomaly probability is used to indicate the probability that the user corresponding to the above user node is an abnormal user, and when the above anomaly probability of the above user node exceeds a predetermined threshold, the operation authority of the user corresponding to the above user node is restricted.

[0126] An embodiment of the present invention provides a processor, and the processor is used to run a program, wherein the program executes the above-mentioned abnormal financial user detection method when running.

[0127] Specifically, an abnormal financial user detection method includes:

[0128] Step S201, establishing a heterogeneous graph model, wherein the heterogeneous graph model includes multiple meta-paths, and the heterogeneous graph model is a graph data structure having multiple node types and multiple edge types, wherein the node types include user nodes, device nodes, and bank nodes, and the meta-path is a financial transaction path formed between the user node and other different types of nodes;

[0129] Step S202, constructing a positive sample matrix corresponding to each of the above meta-paths, and processing each of the above positive sample matrices using a random masking algorithm to obtain a plurality of negative sample matrices, wherein the above positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above user nodes in the above meta-path, and the elements of the above negative sample matrix correspond one-to-one to the elements of the above positive sample matrix;

[0130] Step S203, training the graph neural network model using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model;

[0131] Step S204, input all the above positive sample matrices into the above anomaly detection model to obtain the anomaly probability of each of the above user nodes, where the above anomaly probability is used to indicate the probability that the user corresponding to the above user node is an abnormal user, and when the above anomaly probability of the above user node exceeds a predetermined threshold, the operation authority of the user corresponding to the above user node is restricted.

[0132] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0133] Step S201, establishing a heterogeneous graph model, wherein the heterogeneous graph model includes multiple meta-paths, and the heterogeneous graph model is a graph data structure having multiple node types and multiple edge types, wherein the node types include user nodes, device nodes, and bank nodes, and the meta-path is a financial transaction path formed between the user node and other different types of nodes;

[0134] Step S202, constructing a positive sample matrix corresponding to each of the above meta-paths, and processing each of the above positive sample matrices using a random masking algorithm to obtain a plurality of negative sample matrices, wherein the above positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above user nodes in the above meta-path, and the elements of the above negative sample matrix correspond one-to-one to the elements of the above positive sample matrix;

[0135] Step S203, training the graph neural network model using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model;

[0136] Step S204, input all the above positive sample matrices into the above anomaly detection model to obtain the anomaly probability of each of the above user nodes, where the above anomaly probability is used to indicate the probability that the user corresponding to the above user node is an abnormal user, and when the above anomaly probability of the above user node exceeds a predetermined threshold, the operation authority of the user corresponding to the above user node is restricted.

[0137] An embodiment of the present application also provides an abnormal financial user detection system, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, including executing any one of the above methods in the above abnormal financial user detection system.

[0138] Specifically, an abnormal financial user detection method includes:

[0139] Step S201, establishing a heterogeneous graph model, wherein the heterogeneous graph model includes multiple meta-paths, and the heterogeneous graph model is a graph data structure having multiple node types and multiple edge types, wherein the node types include user nodes, device nodes, and bank nodes, and the meta-path is a financial transaction path formed between the user node and other different types of nodes;

[0140] Step S202, constructing a positive sample matrix corresponding to each of the above meta-paths, and processing each of the above positive sample matrices using a random masking algorithm to obtain a plurality of negative sample matrices, wherein the above positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the above user nodes in the above meta-path, and the elements of the above negative sample matrix correspond one-to-one to the elements of the above positive sample matrix;

[0141] Step S203, training the graph neural network model using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model;

[0142] Step S204, input all the above positive sample matrices into the above anomaly detection model to obtain the anomaly probability of each of the above user nodes, where the above anomaly probability is used to indicate the probability that the user corresponding to the above user node is an abnormal user, and when the above anomaly probability of the above user node exceeds a predetermined threshold, the operation authority of the user corresponding to the above user node is restricted.

[0143] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0144] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0145] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0146] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0147] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0148] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0149] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0150] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0151] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0152] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0153] 1) A method for detecting abnormal financial users in the present application, establishing a heterogeneous graph model, the heterogeneous graph model includes multiple meta-paths, the heterogeneous graph model is a graph data structure with multiple node types and multiple edge types, the node types include user nodes, device nodes and bank nodes, the meta-path is a financial transaction path formed between the user node and other different types of nodes; constructing a positive sample matrix corresponding to each of the meta-paths, and using a random masking algorithm to process each of the positive sample matrices to obtain multiple negative sample matrices, the positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each of the user nodes in the meta-path, and the elements of the negative sample matrix correspond to the elements of the positive sample matrix one-to-one; training a graph neural network model using a contrastive learning method based on the multiple positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model; inputting all of the positive sample matrices into the anomaly detection model to obtain the anomaly probability of each of the user nodes, the anomaly probability is used to indicate the probability that the user corresponding to the user node is an abnormal user, and when the anomaly probability of the user node exceeds a predetermined threshold, limiting the operation authority of the user corresponding to the user node. The present application establishes a heterogeneous graph model, constructs positive sample matrices and negative sample matrices corresponding to each meta-path according to the meta-path in the heterogeneous graph model, and trains the graph neural network model using a contrastive learning method according to each positive sample matrix and each negative sample matrix to obtain an anomaly detection model, and obtains the anomaly probability of all user nodes according to all positive sample matrices input into the anomaly detection model. The positive sample matrix and the negative sample matrix are constructed by using the heterogeneous graph model to obtain the anomaly detection model, that is, the training of the graph neural network model is completed through a self-supervised learning method without introducing other label data, thereby solving the problem of low accuracy in detecting abnormal users in the prior art due to the scarcity of label data.

[0154] 2) An abnormal financial user detection device of the present application, the first establishment unit is used to establish a heterogeneous graph model, the above-mentioned heterogeneous graph model includes multiple meta-paths, the above-mentioned heterogeneous graph model is a graph data structure with multiple node types and multiple edge types, the above-mentioned node types include user nodes, device nodes and bank nodes, and the above-mentioned meta-path is a financial transaction path composed of the above-mentioned user node and other different types of nodes; the second establishment unit is used to construct a positive sample matrix corresponding to each of the above-mentioned meta-paths, and use a random mask algorithm to process each of the above-mentioned positive sample matrices to obtain multiple negative sample matrices, the above-mentioned positive sample matrix is ​​used to describe each of the above-mentioned user nodes in the above-mentioned meta-path. Whether there is a financial transaction relationship between the two, the elements of the negative sample matrix correspond to the elements of the positive sample matrix one by one; the first training unit is used to train the graph neural network model according to the multiple positive sample matrices and the corresponding negative sample matrices using a contrastive learning method to obtain an anomaly detection model; the first control unit is used to input all the positive sample matrices into the anomaly detection model to obtain the anomaly probability of each of the user nodes, the anomaly probability is used to indicate the probability that the user corresponding to the user node is an abnormal user, and when the anomaly probability of the user node exceeds a predetermined threshold, the operation authority of the user corresponding to the user node is restricted. The present application establishes a heterogeneous graph model, constructs positive sample matrices and negative sample matrices corresponding to each meta-path according to the meta-path in the heterogeneous graph model, and trains the graph neural network model using a contrastive learning method according to each positive sample matrix and each negative sample matrix to obtain an anomaly detection model, and obtains the anomaly probability of all user nodes according to all positive sample matrices input into the anomaly detection model. The positive sample matrix and the negative sample matrix are constructed by using the heterogeneous graph model to obtain the anomaly detection model, that is, the training of the graph neural network model is completed through a self-supervised learning method without introducing other label data, thereby solving the problem of low accuracy in detecting abnormal users in the prior art due to the scarcity of label data.

[0155] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting abnormal financial users, characterized in that: include: Establishing a heterogeneous graph model, wherein the heterogeneous graph model includes a plurality of meta-paths, wherein the heterogeneous graph model is a graph data structure having a plurality of node types and a plurality of edge types, wherein the node types include user nodes, device nodes, and bank nodes, and the meta-path is a financial transaction path formed between the user node and other nodes of different types; Constructing a positive sample matrix corresponding to each meta-path, and processing each positive sample matrix using a random mask algorithm to obtain a plurality of negative sample matrices, wherein the positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each user node in the meta-path, and the elements of the negative sample matrix correspond to the elements of the positive sample matrix one by one; The graph neural network model is trained using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model; All the positive sample matrices are input into the anomaly detection model to obtain the anomaly probability of each user node, where the anomaly probability is used to indicate the probability that the user corresponding to the user node is an abnormal user, and when the anomaly probability of the user node exceeds a predetermined threshold, the operation authority of the user corresponding to the user node is restricted.

2. The method according to claim 1, characterized in that Constructing a positive sample matrix corresponding to each meta-path, including: Acquire multiple node sequences corresponding to each meta-path according to the heterogeneous graph model by using a random walk method, wherein the node sequence is a sequence representation of the meta-paths followed between the nodes in the heterogeneous graph model; The financial transaction relationship between each of the user nodes is determined according to each of the node sequences, and a positive sample matrix corresponding to each of the meta-paths is constructed according to the financial transaction relationship. The positive sample matrix is ​​an N-order square matrix, where N is the total number of the user nodes.

3. The method according to claim 2, characterized in that The positive sample matrices are processed by a random mask algorithm to obtain multiple negative sample matrices, including: Acquire a plurality of corresponding all-one matrices having the same dimension as each of the positive sample matrices; A mask ratio is set, an element of the mask ratio is randomly selected in each of the all-one matrices as a target element, and the target element is set to 0, and each of the all-one matrices processed by the mask ratio is determined as a negative sample matrix.

4. The method according to claim 3, characterized in that The graph neural network model is trained using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model, including: Performing weighted averaging on the positive sample matrices corresponding to the meta-paths to obtain a first sample node matrix, and performing weighted averaging on the negative sample matrices corresponding to the meta-paths to obtain a second sample node matrix; Substitute the first sample node matrix and the second sample node matrix into the loss function to calculate the loss value, where the loss function is: Among them, z i and z j is a single positive sample node vector in the first sample node matrix, z k is a single negative sample node vector in the second sample node matrix, the sim(·) function is used to calculate the cosine similarity between two vectors, and τ represents the temperature coefficient; At least adjust the parameters of the graph neural network model until the loss value converges to obtain the anomaly detection model.

5. The method according to claim 4, characterized in that The positive sample matrices corresponding to the meta-paths are weighted averaged to obtain a first sample node matrix, and the negative sample matrices corresponding to the meta-paths are weighted averaged to obtain a second sample node matrix, including: Perform feature vector aggregation on each of the positive sample matrices to obtain a first aggregation matrix corresponding to each of the positive sample matrices Among them, σ is the LeakyRelu activation function, is the positive sample matrix for the Pth element path, I P1 is the identity matrix of the positive sample matrix for the Pth element path, D P1 is the degree matrix of the positive sample matrix for the P-th element path, is the first aggregation matrix under the P-th element path of the l-th layer, is the trainable parameter of the lth layer when the positive sample matrix is ​​aggregated, and the feature vectors of each negative sample matrix are aggregated to obtain the second aggregation matrix corresponding to each negative sample matrix in, is the negative sample matrix for the Pth element path, I P2 is the identity matrix of the negative sample matrix for the Pth element path, D P2 is the degree matrix of the negative sample matrix for the Pth element path, is the second aggregation matrix under the P-th element path of the l-th layer, is the trainable parameter of the lth layer when the negative sample matrix is ​​aggregated; Perform a linear transformation on each of the first aggregation matrices to obtain a weight corresponding to each of the first aggregation matrices Among them, V is the total number of nodes, W is the weight parameter, b is the bias parameter, q T is a meta-path attention vector that can be trained for the task, and each of the second aggregation matrices is linearly transformed to obtain the weight corresponding to each of the second aggregation matrices The softmax function is used to normalize the weights corresponding to each of the first aggregation matrices to obtain the first target weights corresponding to each of the first aggregation matrices. The weights corresponding to each of the second aggregation matrices are normalized to obtain the second target weights corresponding to each of the second aggregation matrices. The first sample node matrix is ​​obtained by weighted averaging each of the first aggregation matrices according to the first target weights corresponding to each of the first aggregation matrices. And according to the second target weights corresponding to the second aggregation matrices, each second aggregation matrix is ​​weighted averaged to obtain the second sample node matrix 6. The method according to claim 5, characterized in that The anomaly detection model includes a probability function y=sigmoid(W * ·Z + +b * ), where W * To optimize the weight parameter, b * To optimize the bias parameters, all the positive sample matrices are input into the anomaly detection model to obtain the anomaly probability of each user node, including: All the positive sample matrices are input into the anomaly detection model to obtain a probability vector y, wherein the elements of the probability vector y are respectively the anomaly probabilities of the user nodes in the first sample node matrix.

7. An abnormal financial user detection device, characterized in that: include: A first establishing unit is used to establish a heterogeneous graph model, wherein the heterogeneous graph model includes multiple meta-paths, and the heterogeneous graph model is a graph data structure with multiple node types and multiple edge types, wherein the node types include user nodes, device nodes, and bank nodes, and the meta-path is a financial transaction path formed between the user node and other different types of nodes; A second establishing unit is used to construct a positive sample matrix corresponding to each meta-path, and process each positive sample matrix using a random mask algorithm to obtain a plurality of negative sample matrices, wherein the positive sample matrix is ​​used to describe whether there is a financial transaction relationship between each user node in the meta-path, and the elements of the negative sample matrix correspond to the elements of the positive sample matrix one by one; A first training unit is used to train a graph neural network model using a contrastive learning method according to the plurality of positive sample matrices and the corresponding negative sample matrices to obtain an anomaly detection model; A first control unit is used to input all the positive sample matrices into the anomaly detection model to obtain the anomaly probability of each user node, where the anomaly probability is used to indicate the probability that the user corresponding to the user node is an abnormal user, and to limit the operation authority of the user corresponding to the user node when the anomaly probability of the user node exceeds a predetermined threshold.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 6.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. An abnormal financial user detection system, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include methods for executing any one of claims 1 to 6.

Images