Self-adaptive label sensing graph neural network credit card fraud detection method

Abstract

The invention belongs to the technical field of financial industry transaction fraud detection, and relates to a self-adaptive label sensing graph neural network credit card fraud detection method, which comprises the following steps: acquiring credit card transaction data and inputting the credit card transaction data into a trained credit card fraud detection model to obtain a fraud detection result; the training process of the fraud detection model comprises the following steps: obtaining a credit card transaction record data set to construct an initial multi-relation heterogeneous graph; inputting the initial multi-relation heterogeneous graph into a plurality of graph aggregation layers which are sequentially connected in series; inputting the node features output by the last graph aggregation layer into a classification module to obtain a fraud detection result; updating model parameters according to a fraud detection result until a training credit card fraud detection model is obtained; according to the method, node features are aggregated for each relationship by using a graph attention mechanism in a graph aggregation layer, and different types of neighbors are further processed by using a conversion module, so that the nodes adaptively adjust information aggregated from the neighbors with different sex and the neighbors with same sex, and the capability of credit card fraud detection tasks is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of financial transaction fraud detection, and relates to an adaptive label-aware graph neural network credit card fraud detection method. Background Art

[0002] Credit card fraud detection is a key challenge in the field of financial security. With the popularity of electronic payments, fraudulent behavior has become more and more complex and difficult to identify. Although traditional methods such as rule-based systems and machine learning algorithms can identify and detect fraud to a certain extent, they face many challenges in processing large-scale, high-dimensional, complex and changeable transaction data.

[0003] With the development of deep learning, especially the introduction of Graph Neural Networks (GNN), new solutions have been provided for credit card fraud detection. Credit card transaction data can usually be expressed through a graph structure. Entities such as users, merchants, and transactions can be modeled as nodes in the graph, and the transaction behaviors between these nodes can be regarded as edges. GNN is good at processing this non-Euclidean data structure and can capture complex transaction patterns and high-order interactions between entities by modeling nodes and edges, which is highly consistent with the intrinsic structure of credit card transaction data. Among them, the Graph Convolutional Network (GCN) can effectively aggregate the information of the node neighborhood by extending the convolution operation to non-Euclidean data, thereby capturing the local structural characteristics of the graph. Another method, the Graph Attention Network (GAT), enhances the expressiveness and flexibility of the model in the process of information aggregation by assigning different importance weights to different neighbor nodes. The multi-head attention mechanism of GAT not only improves the stability of the model, but also allows the capture of multi-scale node interactions, further improving the performance of the model in complex fraud detection tasks.

[0004] Shortcomings of current credit card fraud detection methods: Existing fraud detection models based on graph neural networks (GNNs) do not distinguish and handle this difference well when dealing with neighbors of different label types, which affects the accuracy and robustness of fraud detection. Summary of the invention

[0005] In order to solve the above problems of the prior art, the present invention adopts an adaptive label-aware graph neural network credit card fraud detection method, including: obtaining credit card transaction data, inputting the credit card transaction data into a trained credit card fraud detection model, and obtaining a credit card fraud detection result; the credit card fraud detection model includes: a graph neural network and a classification module; the graph neural network includes multiple layers of graph aggregation layers connected in series;

[0006] The training process of the credit card fraud detection model includes:

[0007] S1: Obtain a credit card transaction record dataset, and construct an initial multi-relation heterogeneous graph based on the credit card transaction record dataset; wherein the nodes of the initial multi-relation heterogeneous graph are credit card transaction records, and the edges are the relationships between credit card transaction records;

[0008] S2: The initial multi-relation heterogeneous graph is input into a series of multiple graph aggregation layers, and the last graph aggregation layer outputs the updated multi-relation heterogeneous graph and its node features;

[0009] S3: Input the node features of the multi-relation heterogeneous graph output by the last graph aggregation layer into the classification module to obtain the fraud detection result;

[0010] S4: Calculate the loss function value according to the fraud detection result, and update the model parameters according to the loss function value. When the loss function value is minimized, the trained credit card fraud detection model is obtained.

[0011] The credit card transaction record dataset includes multiple transaction records between users and credit card supporters, and each transaction record includes a real label and multiple attribute features; constructing an initial multi-relationship heterogeneous graph based on the credit card transaction record dataset includes: taking the transaction records as nodes, and dividing the nodes into fraud nodes, good nodes, and unknown nodes according to the real labels of the transaction records; taking the attribute features of the transaction records as node features, selecting multiple attribute features from the attribute features of the transaction records, taking the selected attribute features as the relationship type of the edge, and constructing edges of corresponding relationship types between transaction record nodes based on the selected attribute features.

[0012] The processing of the initial multi-relation heterogeneous graph by the sequentially connected multi-layer graph aggregation layers includes:

[0013] S21: inputting the initial multi-relation heterogeneous graph into the first graph aggregation layer to obtain the multi-relation heterogeneous graph output by the first graph aggregation layer;

[0014] S22: inputting the multi-relation heterogeneous graph output by the first graph aggregation layer into the second graph aggregation layer to obtain the multi-relation heterogeneous graph output by the second graph aggregation layer;

[0015] S23: inputting the multi-relation heterogeneous graph output by the previous graph aggregation layer into the current graph aggregation layer to obtain the multi-relation heterogeneous graph output by the current graph aggregation layer;

[0016] S24: Repeat step S23 until a multi-relation heterogeneous graph output by the last graph aggregation layer is obtained.

[0017] Each graph aggregation layer includes: heterogeneous graph decomposition module, attention module, conversion module and multi-head attention aggregation module; the current graph aggregation layer l processes the multi-relation heterogeneous graph output by the previous graph aggregation layer l-1 including:

[0018] S231, input the multi-relation heterogeneous graph output by the previous graph aggregation layer l-1 into the heterogeneous graph decomposition module to obtain R subgraphs;

[0019] S232. Each subgraph corresponds to an attention module. The R subgraphs are input into the corresponding attention modules respectively to obtain the node features of the R subgraphs under each neighbor type k. Among them, r is the index of the subgraph, i is the index of the node;

[0020] S233, each subgraph corresponds to a conversion module, which converts the node features of R subgraphs under each neighbor type And the node features of the multi-relation heterogeneous graph output by the aggregation layer l-1 of the previous graph Input the corresponding conversion module to obtain the final node features of R subgraphs

[0021] S234, the final node features of the R subgraphs Input the multi-head attention aggregation module for aggregation to obtain the multi-relation heterogeneous graph and its node features output by the current graph aggregation layer l

[0022] The attention module processes the corresponding sub-graph including:

[0023]

[0024] in, is the feature of node i of subgraph r under the k-th type of neighbor in the attention module of the current graph aggregation layer l, σ is the activation function, j is the k-th type of neighbor node of node i of subgraph r, is the set of neighbor nodes of the kth type of node i in subgraph r, is the attention coefficient of node i and node j of subgraph r in the attention module of the current graph aggregation layer l, is the weight matrix of the subgraph r for the k-th type of neighbor nodes, It is the feature of node j in the multi-relation heterogeneous graph output by the l-1th graph aggregation layer.

[0025] The conversion module includes: a self-conversion module, a fraudulent neighbor type conversion module, a benign neighbor type conversion module and an unknown neighbor type conversion module; the conversion module processes the node features of the corresponding subgraph r under each neighbor type, including: converting the node features of the subgraph r under each neighbor type Input the corresponding fraudulent neighbor type conversion module, benign neighbor type conversion module and unknown neighbor type conversion module respectively; Input the self-conversion module, combine the outputs of the self-conversion module, the fraudulent neighbor type conversion module, the benign neighbor type conversion module, and the unknown neighbor type conversion module to obtain the final node features of the R subgraphs

[0026] The weight matrices of the fraudulent neighbor type conversion module, the benign neighbor type conversion module, and the unknown neighbor type conversion module are as well as in, is the adjustment weight regarding the node type.

[0027] Weight Matrix Node type adjustment weight Among them, fr , be , Φ are both single-layer perceptrons.

[0028] The multi-head attention aggregation module includes multiple attention heads; the multi-head attention aggregation module aggregates the final node features of R subgraphs by: inputting the final node features of R subgraphs into each attention head, splicing the output of each attention head, and obtaining the features of each node i of the multi-relation heterogeneous graph output by the current graph aggregation layer l

[0029] Each attention head aggregates the final node features of R subgraphs including:

[0030]

[0031] in, is the feature of node i in attention head q, σ is the activation function, r is the index of the subgraph, is the attention coefficient of node i of subgraph r in attention head q, The weight matrix of sub-graph r in attention head q.

[0032] Loss Function for:

[0033]

[0034] in, Represents the node set of the preliminary multi-relation heterogeneous graph, y i is the true label of node i, represents the probability that node i is a fraudulent node.

[0035] Beneficial effects:

[0036] 1. The present invention constructs a multi-relationship heterogeneous graph by selecting multiple attribute features as relationship types in the credit card transaction record data set, and updates the node features under each relationship type in the graph aggregation layer, making full use of the neighbor information of the node features in multiple relationship types, and improving the model's ability to deal with complex credit card fraud detection tasks; 2. The present invention uses an attention mechanism to aggregate node features for each relationship in the graph aggregation layer, and uses a conversion function to further process different types of neighbors, so that the node can adaptively adjust the information aggregated from its opposite-sex and same-sex neighbors, thereby improving the ability of the credit card fraud detection task. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A structural diagram of a credit card fraud detection model provided by an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of the connection between a central node and its different types of neighboring nodes provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] like Figure 1 , Figure 2 As shown, the embodiment of the present invention adopts an adaptive label-aware graph neural network credit card fraud detection method, including: obtaining credit card transaction data, inputting the credit card transaction data into a trained credit card fraud detection model, and obtaining a credit card fraud detection result; the credit card fraud detection model includes: a graph neural network and a classification module; the graph neural network includes multiple layers of graph aggregation layers connected in series;

[0041] The training process of the credit card fraud detection model includes:

[0042] S1: Obtain a credit card transaction record dataset, and construct an initial multi-relation heterogeneous graph based on the credit card transaction record dataset; wherein the nodes of the initial multi-relation heterogeneous graph are credit card transaction records, and the edges are the relationships between credit card transaction records;

[0043] The credit card transaction record dataset includes multiple actual transaction records of users and credit card supporters, and each transaction record includes a real label and multiple attribute features; wherein the labels include fraud (fr), good (be) and unknown (un), and the attribute features include transaction type, transaction location (city), transaction amount, transaction time, etc.; multiple attribute features are selected from the attribute features of the transaction records, and each selected attribute feature is used as a relationship type. A multi-relationship heterogeneous graph is constructed according to the similarity of the transaction records on each selected attribute feature. Then, the nodes of the multi-relationship heterogeneous graph are transaction records, and the nodes are divided into fraud nodes, good nodes and unknown nodes according to the real label nodes of the transaction records, and the edges are the relationships between transaction records on each selected attribute feature.

[0044] In one embodiment, some data examples of constructing a multi-relation heterogeneous graph are shown in Table 1. It can be found that the types of transactions of time0, time2, time4, and time5 are the same, so time0->time2, time4->time 0, time5->time2, time4->time5, time5->time0, time2->time4 are connected in the transaction type relationship; it can be found that the addresses of transactions of time0, time2, time3, time4, and time5 are the same, so time2->time0, time3->time0, time2->time4, time3->time5, time4->time5, time0->time4, time0->time5, time2->time3, time4->time3, time5->time2 are connected in the transaction address relationship. The selection of the number of connections is achieved by setting a connection upper limit for a single point single relationship and limiting the maximum time span (for example: in the transaction data, the upper limit of the number of neighbors connected by attribute features is set to 8, and the time span of the connected transaction records is limited to 500 time slices).

[0045] Table 1

[0046]

[0047]

[0048] S2: The initial multi-relation heterogeneous graph is input into a series of multiple graph aggregation layers, and the last graph aggregation layer outputs the updated multi-relation heterogeneous graph and its node features;

[0049] The processing of the initial multi-relation heterogeneous graph by the sequentially connected multi-layer graph aggregation layers includes:

[0050] S21: inputting the initial multi-relation heterogeneous graph into the first graph aggregation layer to obtain the multi-relation heterogeneous graph output by the first graph aggregation layer;

[0051] S22: inputting the multi-relation heterogeneous graph output by the first graph aggregation layer into the second graph aggregation layer to obtain the multi-relation heterogeneous graph output by the second graph aggregation layer;

[0052] S23: inputting the multi-relation heterogeneous graph output by the previous graph aggregation layer into the current graph aggregation layer to obtain the multi-relation heterogeneous graph output by the current graph aggregation layer;

[0053] S24: Repeat step S23 until a multi-relation heterogeneous graph output by the last graph aggregation layer is obtained.

[0054] Each graph aggregation layer includes: heterogeneous graph decomposition module, attention module, conversion module and multi-head attention aggregation module; the current graph aggregation layer l processes the multi-relation heterogeneous graph output by the previous graph aggregation layer l-1 including:

[0055] S231, input the multi-relation heterogeneous graph output by the previous graph aggregation layer l-1 into the heterogeneous graph decomposition module to obtain R subgraphs;

[0056] S232, each subgraph corresponds to an attention module, and the R subgraphs are respectively input into the corresponding attention modules to obtain the node features of the R subgraphs under each neighbor type;

[0057] The attention module processes the corresponding sub-graph r including:

[0058]

[0059] in, is the feature of node i of subgraph r under the k-th type of neighbor in the attention module of the current graph aggregation layer l, σ is the activation function, j is the k-th type of neighbor node of node i of subgraph r, is the set of neighbor nodes of the kth type of node i in subgraph r, is the attention coefficient of node i and node j of subgraph r in the attention module of the current graph aggregation layer l, is the weight matrix of the subgraph r for the k-th type of neighbor nodes, It is the feature of node j in the multi-relation heterogeneous graph output by the l-1th graph aggregation layer.

[0060] Attention coefficient The calculation formula is:

[0061]

[0062] Among them, || represents the splicing operation, is a learnable vector used to measure the importance of node pairs, j′ is the neighbor node of node i in subgraph r, is the weight matrix of the attention head k of the graph attention aggregation layer corresponding to the subgraph r in the l-th graph aggregation layer.

[0063] S233, each subgraph corresponds to a conversion module, which converts the node features of the R subgraphs under each neighbor type and the node features of the multi-relation heterogeneous graph output by the previous graph aggregation layer l-1 Input the corresponding conversion module to obtain the final node features of R subgraphs;

[0064] The conversion module includes: a self-conversion module, a fraudulent neighbor type conversion module, a benign neighbor type conversion module, and an unknown neighbor type conversion module; the conversion module processes the node features of the corresponding subgraph r under each neighbor type, including:

[0065] The node features of subgraph r under each neighbor type are input into the corresponding fraudulent neighbor type conversion module, benign neighbor type conversion module and unknown neighbor type conversion module for further conversion and processing, which further refines the contribution of different types of neighbors, thereby effectively improving the quality of node representation and detection performance. The features of node i of subgraph r output by the conversion module at layer l as follows:

[0066]

[0067] Among them, Comb (l) For combined operation, and All of them are MLP (Multi-layer Perceptron), which are self-conversion function, fraudulent neighbor type conversion function, benign neighbor type conversion function and unknown neighbor type conversion function. Each conversion function is represented by the corresponding weight matrix Parameterized.

[0068] In order to better reflect the uncertainty of unknown neighbors, the weighted combination of the weight matrices of the fraudulent neighbor type conversion function and the benign neighbor type conversion function is used as the weight matrix of the unknown neighbor type conversion function:

[0069]

[0070] in, is a scalar that adjusts the class tendency of the unknown neighbors associated with the central node i.

[0071] It will be adaptively adjusted according to the characteristics of the central node i, defined as a function of node i: is a single-layer MLP with sigmoid activations shared among all nodes.

[0072] Weight Matrix and Specific to the central node i, it will be adaptively adjusted according to the characteristics of the central node i and is defined as:

[0073]

[0074] Among them, ft , be : Implementation with a single-layer MLP:

[0075]

[0076] Among them, d ′ is the dimension of the node features, and diag() is the diagonal matrix of the input features.

[0077] S234. Input the final node features of the R subgraphs into the multi-head attention aggregation module for aggregation to obtain a multi-relation heterogeneous graph output by the current graph aggregation layer.

[0078] Specifically, each attention head aggregates the final node features of R subgraphs as follows:

[0079]

[0080] in, is the feature of node i in attention head q, σ is the activation function, r is the index of the subgraph,

[0081] is the attention coefficient of the node of subgraph r in the attention head q, is the weight matrix of subgraph r in attention head q, N a is the number of attention heads.

[0082] Attention coefficient The calculation is as follows:

[0083]

[0084] Among them, || represents the concatenation operation, σ is the activation function, is a learnable vector used to measure the importance of relation r. is the weight matrix of attention head q, and R is the number of relations.

[0085] The features output by each attention head are concatenated to obtain the features of each node i of the multi-relation heterogeneous graph output by the current graph aggregation layer l

[0086] S3: Input the node features of the multi-relation heterogeneous graph output by the last graph aggregation layer into the classification module to obtain the fraud detection result;

[0087] Specifically, after multiple layers of iteration, the final node representation is input into the multi-layer perceptron MPL for fraud detection:

[0088]

[0089] in, represents the probability that node i is a fraudulent node, is the output of the Lth graph aggregation layer.

[0090] S4: Calculate the loss function value according to the fraud detection result, and update the model parameters according to the loss function value. When the loss function value is minimized, the trained credit card fraud detection model is obtained.

[0091] Loss Function Defined as:

[0092]

[0093] in, Represents the node set of a multi-relation heterogeneous graph, y i is the true label of node i.

[0094] The above embodiments further illustrate the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above embodiments are only preferred implementation modes of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made to the present invention within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An adaptive label-aware graph neural network credit card fraud detection method, characterized in that: include: Obtain credit card transaction data, input the credit card transaction data into a trained credit card fraud detection model, and obtain credit card fraud detection results; The credit card fraud detection model includes: a graph neural network and a classification module; the graph neural network includes multiple layers of graph aggregation layers connected in series; The training process of the credit card fraud detection model includes: S1: Obtain a credit card transaction record dataset, and construct an initial multi-relation heterogeneous graph based on the credit card transaction record dataset; wherein the nodes of the initial multi-relation heterogeneous graph are credit card transaction records, and the edges are the relationships between credit card transaction records; S2: Input the initial multi-relation heterogeneous graph into the multi-layer graph aggregation layer connected in series, and obtain the multi-relation heterogeneous graph and its node features output by the last graph aggregation layer; S3: Input the node features of the multi-relation heterogeneous graph output by the last graph aggregation layer into the classification module to obtain the fraud detection result; S4: Calculate the loss function value according to the fraud detection result, and update the model parameters according to the loss function value. When the loss function value is minimized, a trained credit card fraud detection model is obtained.

2. The adaptive label-aware graph neural network credit card fraud detection method according to claim 1 is characterized in that: The credit card transaction record dataset includes multiple transaction records between users and credit card supporters. Each transaction record includes a true label and multiple attribute features. Constructing an initial multi-relation heterogeneous graph based on a credit card transaction record dataset includes: taking transaction records as nodes, and dividing the nodes into fraud nodes, good nodes, and unknown nodes according to the true labels of the transaction records; The attribute features of the transaction records are used as node features, multiple attribute features are selected from the attribute features of the transaction records, the selected attribute features are used as edge relationship types, and edges of corresponding relationship types between transaction record nodes are constructed according to the selected attribute features.

3. The adaptive label-aware graph neural network credit card fraud detection method according to claim 2 is characterized in that: The processing of the initial multi-relation heterogeneous graph by the sequentially connected multi-layer graph aggregation layers includes: S21: inputting the initial multi-relation heterogeneous graph into the first graph aggregation layer to obtain the multi-relation heterogeneous graph output by the first graph aggregation layer; S22: inputting the multi-relation heterogeneous graph output by the first graph aggregation layer into the second graph aggregation layer to obtain the multi-relation heterogeneous graph output by the second graph aggregation layer; S23: inputting the multi-relation heterogeneous graph output by the previous graph aggregation layer into the current graph aggregation layer to obtain the multi-relation heterogeneous graph output by the current graph aggregation layer; S24: Repeat step S23 until a multi-relation heterogeneous graph output by the last graph aggregation layer is obtained.

4. The adaptive label-aware graph neural network credit card fraud detection method according to claim 3 is characterized in that: Each graph aggregation layer includes: a heterogeneous graph decomposition module, an attention module, a conversion module, and a multi-head attention aggregation module; the current graph aggregation layer l processes the multi-relation heterogeneous graph output by the previous graph aggregation layer l-1, including: S231, input the multi-relation heterogeneous graph output by the previous graph aggregation layer l-1 into the heterogeneous graph decomposition module to obtain R subgraphs; S232. Each subgraph corresponds to an attention module. The R subgraphs are input into the corresponding attention modules respectively to obtain the node features of the R subgraphs under each neighbor type k. Among them, r is the index of the subgraph, i is the index of the node; S233, each subgraph corresponds to a conversion module, which converts the node features of R subgraphs under each neighbor type And the node features of the multi-relation heterogeneous graph output by the aggregation layer l-1 of the previous graph Input the corresponding conversion module to obtain the final node features of R subgraphs S234, the final node features of the R subgraphs Input the multi-head attention aggregation module for aggregation to obtain the multi-relation heterogeneous graph and its node features output by the current graph aggregation layer l 5. The adaptive label-aware graph neural network credit card fraud detection method according to claim 4 is characterized in that: The attention module processes the corresponding sub-graph including: in, is the feature of node i of subgraph r under the k-th type of neighbor in the attention module of the current graph aggregation layer l, σ is the activation function, j is the k-th type of neighbor node of node i of subgraph r, is the set of neighbor nodes of the kth type of node i in subgraph r, is the attention coefficient of node i and node j of subgraph r in the attention module of the current graph aggregation layer l, is the weight matrix of the subgraph r for the k-th type of neighbor nodes, It is the feature of node j in the multi-relation heterogeneous graph output by the l-1th graph aggregation layer.

6. The adaptive label-aware graph neural network credit card fraud detection method according to claim 4 is characterized in that: The conversion module includes: a self-conversion module, a fraudulent neighbor type conversion module, a benign neighbor type conversion module and an unknown neighbor type conversion module; the conversion module processes the node features of the corresponding subgraph r under each neighbor type, including: converting the node features of the subgraph r under each neighbor type Input the corresponding fraudulent neighbor type conversion module, benign neighbor type conversion module and unknown neighbor type conversion module respectively; transform the node features Input the self-conversion module, combine the outputs of the self-conversion module, the fraudulent neighbor type conversion module, the benign neighbor type conversion module, and the unknown neighbor type conversion module to obtain the final node features of the R subgraphs 7. The adaptive label-aware graph neural network credit card fraud detection method according to claim 6, characterized in that: The weight matrices of the fraudulent neighbor type conversion module, the benign neighbor type conversion module, and the unknown neighbor type conversion module are as well as in, is the adjustment weight regarding the node type.

8. The adaptive label-aware graph neural network credit card fraud detection method according to claim 7, characterized in that: Weight Matrix Adjust weight Among them, fr , be , Φ are both single-layer perceptrons.

9. The adaptive label-aware graph neural network credit card fraud detection method according to claim 4, characterized in that: The multi-head attention aggregation module includes multiple attention heads; The multi-head attention aggregation module aggregates the final node features of the R subgraphs, including: inputting the final node features of the R subgraphs into each attention head, concatenating the outputs of each attention head, and obtaining the features of each node i of the multi-relation heterogeneous graph output by the current graph aggregation layer l Each attention head aggregates the final node features of R subgraphs including: in, is the feature of node i in attention head q, σ is the activation function, r is the index of the subgraph, is the attention coefficient of node i of subgraph r in attention head q, The weight matrix of sub-graph r in attention head q.

10. The adaptive label-aware graph neural network credit card fraud detection method according to claim 1, characterized in that: Loss Function for: in, Represents the node set of the preliminary multi-relation heterogeneous graph, y i is the true label of node i, represents the probability that node i is a fraudulent node.

Images