A collaborative fraud number detection method and system based on a graph neural network

Abstract

The application discloses a kind of collaborative fraud number detection method and system based on graph neural network, it is related to information security technical field, wherein the method includes: obtaining the historical communication data of target mobile phone number;Based on historical communication data, obtain the original feature and interactive feature of each number;Based on historical communication data, the community information and collaborative information of target mobile phone number are obtained by screening;Based on original feature, interactive feature, community information and collaborative information, integrated to obtain heterogeneous graph;Based on heterogeneous graph input to graph neural network model, obtain neighbor node feature, community node feature and time sequence node feature;Based on neighbor node feature, community node feature and time sequence node feature fusion, obtain comprehensive node feature;Based on comprehensive node feature input to classification layer, obtain prediction result.In complex scene, effectively identify fraud number, improve the accuracy and response speed of fraud detection, and then improve the anti-fraud capability.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically to a collaborative method and system for detecting fraudulent phone numbers based on graph neural networks. Background Technology

[0002] Currently, with the rapid development of the internet, more and more users are flocking to this emerging entertainment and social field. However, this has also attracted a large number of criminals who fabricate false information through phone calls, text messages, and various applications to commit fraud, inducing victims to make payments or transfers, causing financial losses and a crisis of trust. In recent years, to reduce telecommunications fraud, various fraud detection models have emerged. These include semi-supervised static probabilistic graphical models such as FFD, FRAUDER, PC_GNN, and RIO_GNN, which are classifier-based algorithms, and sequence-based methods such as HAINt-LSTM, NHA-LSTM, BiDyn, and CORE-DGNN.

[0003] Traditional static behavioral pattern analysis methods can uncover rich patterns of telecom fraud behavior and effectively distinguish between fraudulent and normal user behavior patterns. However, the stability of these pattern characteristics is poor, requiring constant updates to the fraud behavior pattern database based on the latest telecom network fraud data, making it difficult to adapt to the rapidly changing impact of fraud methods.

[0004] Therefore, how to effectively identify fraudulent numbers in complex scenarios and improve the accuracy and response speed of fraud detection is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides a collaborative fraud number detection method and system based on graph neural networks, which can effectively identify fraud numbers in complex scenarios, improve the accuracy and response speed of fraud detection, and thus enhance anti-fraud capabilities.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A collaborative method for detecting fraudulent phone numbers based on graph neural networks includes:

[0008] Obtain historical communication data for the target mobile phone number;

[0009] Based on the historical communication data, the original characteristics and interaction characteristics of each number are obtained;

[0010] Community information and collaboration information of the target mobile phone number are obtained by filtering based on the historical communication data;

[0011] A heterogeneous graph is obtained by integrating the original features, the interaction features, the community information, and the collaboration information.

[0012] Based on heterogeneous graph input to graph neural network model, neighbor node features, community node features and temporal node features are obtained;

[0013] A comprehensive node feature is obtained by fusing the neighbor node features, the community node features, and the time-series node features.

[0014] The comprehensive node features are input into the classification layer to obtain the prediction result.

[0015] Preferably, the method for obtaining community information is as follows:

[0016] Based on the historical communication data, determine whether the communication behavior occurred on a weekday or a holiday, and obtain the determination result;

[0017] Based on the judgment results, obtain the behavioral difference characteristics between the weekdays and the holidays;

[0018] Based on the historical communication data, the call behavior characteristics of the target mobile phone number at different times of the day are obtained;

[0019] The community information is generated based on the behavioral difference features and the call behavior features.

[0020] Preferably, the collaborative information acquisition method is as follows:

[0021] Based on the historical communication data, timestamps and location information of multiple user numbers that communicate with the target mobile phone number are obtained;

[0022] The time interval is obtained based on the timestamp;

[0023] Based on the location information, obtain the cross-regional dialing mode;

[0024] Based on the time interval and the cross-regional dialing pattern, characteristics of coordinated crime are identified.

[0025] The collaborative information between the user numbers is extracted based on the characteristics of the collaborative crime.

[0026] Preferably, the heterogeneous graph construction method is as follows:

[0027] Based on the historical communication data, obtain all user numbers that communicate with the target mobile phone number;

[0028] Based on the target mobile phone number and the user number as nodes;

[0029] Community tags are obtained based on the community information;

[0030] Information nodes are obtained by binding the community tags and the original features as node attributes to the corresponding nodes;

[0031] Generate a call link diagram and an SMS link diagram based on the interaction relationships between all the information nodes;

[0032] Based on the interaction features, the collaboration information, and the community information as edge features, they are respectively bound to the call link graph and the SMS link graph to obtain the first link graph and the second link graph.

[0033] The heterogeneous graph is obtained by integrating the information nodes, the first link graph, and the second link graph.

[0034] Preferably, community tags are obtained based on the community information, specifically including:

[0035] Encoding is performed on a time dimension based on the aforementioned community information:

[0036] The workdays and holidays are represented using 2-bit binary, resulting in the first dimension encoding;

[0037] The second dimension encoding is obtained by using 5-bit binary representations for different times of the day.

[0038] The community label is obtained by using the first dimension encoding and the second dimension encoding as the multidimensional encoding.

[0039] Preferably, the graph neural network model includes a multi-frequency collaborative neural network, a self-attention temporal convolutional network, and a multi-frequency processing module;

[0040] The heterogeneous graph is sequentially input into the multi-frequency collaborative neural network and the multi-frequency processing module to obtain the neighbor node features and the community node features;

[0041] The heterogeneous graph is input into the self-attention temporal convolutional network to obtain temporal node features.

[0042] Preferably, the method for obtaining community node features is as follows:

[0043] Based on the time dimension information of the heterogeneous graph, all information nodes are assigned to corresponding communities;

[0044] Clustering is performed based on nodes within the community, and the cluster center node is selected as a single community feature of the current community;

[0045] The community node features are obtained by aggregating all the individual community node features.

[0046] Preferably, the method for obtaining the neighbor node features is as follows:

[0047] Based on any one of the information nodes in the heterogeneous graph as the current central node;

[0048] Based on the collaborative information, select all neighboring nodes that are collaboratively connected with the central node;

[0049] Based on the similarity between the central node and the neighboring nodes, multiple neighboring nodes with a similarity greater than a threshold are selected as filtering nodes.

[0050] The neighbor node weights are generated based on the filtered nodes;

[0051] The initial neighbor features of the central node are updated based on the edge features of the central node and the neighbor nodes, as well as the original features of the neighbor nodes.

[0052] Based on the neighbor node weights and the initial neighbor features, the updated neighbor features are obtained;

[0053] The neighbor node features are obtained by aggregating the first link graph and the second link graph based on the updated neighbor features.

[0054] Preferably, the method for obtaining the temporal node features is as follows:

[0055] A time series is constructed based on each information node in the heterogeneous graph;

[0056] Based on the time series, extract the node features of the central node in the l-th layer;

[0057] Based on the node features, a max pooling operation is performed to obtain the hierarchical features of the l-th layer at time step t.

[0058] Based on the hierarchical features, a max pooling operation is performed to obtain the global features;

[0059] The initial attention score of the central node is obtained based on the global features and then normalized to obtain the final attention weight.

[0060] The temporal node features are obtained by fusing the final attention weights, the hierarchical features, and the global features.

[0061] A collaborative fraud number detection system based on graph neural networks includes: a data acquisition module, a data feature extraction module, a heterogeneous graph construction module, a node feature acquisition module, and a prediction result output module;

[0062] The data acquisition module is used to acquire historical communication data of the target mobile phone number;

[0063] The data feature extraction module is used to obtain the original features and interaction features of each number based on the historical communication data; and to filter out the community information and collaboration information of the target mobile phone number based on the historical communication data.

[0064] The heterogeneous graph construction module is used to integrate the original features, the interaction features, the community information, and the collaboration information to obtain a heterogeneous graph;

[0065] The node feature acquisition module is used to input a heterogeneous graph into a graph neural network model to obtain neighbor node features, community node features, and temporal node features; and to fuse the neighbor node features, community node features, and temporal node features to obtain a comprehensive node feature.

[0066] The prediction result output module is used to input the comprehensive node features into the classification layer to obtain the prediction result.

[0067] As can be seen from the above technical solution, compared with the prior art, this invention discloses a collaborative fraud number detection method and system based on graph neural networks. This invention constructs a multi-level heterogeneous graph data structure by combining multi-dimensional data such as time information, call and SMS records, community information, and collaborative information, and performs detection and identification through a collaborative multi-frequency graph neural network model. This enables effective identification of fraud numbers in complex scenarios, improving anti-fraud capabilities. Furthermore, by comprehensively utilizing basic feature data, this invention identifies the communication behavior and types of fraudulent calls, effectively improving the detection capability for telecommunications fraud. Through in-depth analysis of fraudulent behavior, this invention can identify new fraud models, thereby effectively combating telecommunications fraud and protecting user safety and interests. Attached Figure Description

[0068] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0069] Figure 1 The flowchart of a collaborative fraud number detection method based on graph neural networks provided by this invention is shown.

[0070] Figure 2 The flowchart of the heterogeneous graph construction method provided by the present invention is shown.

[0071] Figure 3 This is a schematic diagram of the graph neural network model structure provided by the present invention.

[0072] Figure 4 This is a schematic diagram of a collaborative fraud number detection system based on graph neural networks provided by the present invention. Detailed Implementation

[0073] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] Example 1

[0075] like Figure 1 As shown, this embodiment of the invention discloses a collaborative fraudulent number detection method based on graph neural networks, including:

[0076] Obtain historical communication data for the target mobile phone number;

[0077] The original characteristics and interaction characteristics of each number are obtained based on historical communication data;

[0078] Community and collaboration information for the target mobile phone number is obtained by filtering based on historical communication data;

[0079] Heterogeneous graphs are obtained by integrating original features, interaction features, community information, and collaborative information;

[0080] Based on heterogeneous graph input to graph neural network model, neighbor node features, community node features and temporal node features are obtained;

[0081] A comprehensive node feature is obtained by fusing neighbor node features, community node features, and time-series node features;

[0082] The prediction result is obtained by inputting the comprehensive node features into the classification layer.

[0083] Example 2

[0084] This invention discloses a collaborative fraud number detection method based on graph neural networks, comprising:

[0085] Obtain historical communication data for the target mobile phone number.

[0086] Preferably, call records and SMS records of the target mobile phone number from major operators are obtained, including communication data from the current day and the past 30 days, which are used as historical communication data.

[0087] The original characteristics and interaction characteristics of each number are obtained based on historical communication data.

[0088] Preferably, detailed information about relevant numbers is extracted based on historical communication data, and the basic information of these numbers and their corresponding call or SMS counterparties for the day is recorded in a number filtering table to generate a call table and an SMS table. The call table includes key fields such as timestamp and the provinces of the calling and receiving parties, while the SMS table includes key fields such as sending time and sender / receiver numbers.

[0089] Preferably, the original features and interaction features of each number are extracted based on the call table and SMS table; wherein, the original features include: call features such as the number of outgoing calls, total number of calls, average call duration, and active call time periods, SMS features such as the number of SMS sent and received, and monthly frequency features such as the number of active days and the number of active cities in a month; the interaction features include: mutual dialing rate and mutual call time ratio.

[0090] Community and collaboration information for the target mobile phone number is obtained by filtering based on historical communication data.

[0091] The preferred method for obtaining community information is as follows:

[0092] Based on historical communication data, determine whether the communication behavior occurred on a weekday or a holiday, and obtain the judgment result;

[0093] Based on the judgment results, obtain behavioral differences between weekdays and holidays;

[0094] Based on historical communication data, obtain the call behavior characteristics of the target mobile phone number at different times of the day (such as early morning, morning, afternoon, and evening);

[0095] Community information is generated based on behavioral differences and call behavior characteristics.

[0096] Preferably, community information is formed based on time information such as date, time, and weekdays / holidays. In this example, "community" is defined as a set of numbers divided according to time, etc.

[0097] The preferred method for obtaining collaborative information is as follows:

[0098] Based on historical communication data, timestamps and location information of multiple user numbers that have communicated with the target mobile number are obtained;

[0099] Get the time interval based on the timestamp;

[0100] Obtain cross-regional calling modes based on location information;

[0101] Characteristics of coordinated crimes were identified based on time intervals and cross-regional dialing patterns.

[0102] Based on the characteristics of collaborative crime, collaborative information between user numbers is obtained.

[0103] Preferably, in coordinated fraud, the time intervals between calls made by fraudsters are usually short. By analyzing these timestamps, it is possible to extract short time intervals and cross-regional calling patterns between fraudsters, thereby identifying signs of coordinated operations and extracting collaborative information between user numbers.

[0104] Preferably, this embodiment analyzes time dimensions such as year, month, and day to assist in detecting potential abnormal behavior patterns. By identifying numbers that are frequently active during specific time periods, the ability to warn of potential fraudulent activities can be effectively improved. Furthermore, considering the existence of coordinated fraud, where multiple numbers jointly defraud the same victim. For example, one member might be responsible for making extensive calls to find potential victims, while another member further lures victims who have already taken the bait. The social structure of such behavior changes rapidly over time, resulting in significant differences between the behavior patterns of fraudsters and ordinary users. Based on this, this embodiment analyzes the relationship between the calling (sender) number and the called (receiver) number to filter out coordinated information and identify coordinated fraud.

[0105] Heterogeneous graphs are obtained by integrating original features, interaction features, community information, and collaborative information.

[0106] Preferred, such as Figure 2 As shown, the heterogeneous graph construction method is as follows:

[0107] Obtain all user numbers that communicate with the target mobile number based on historical communication data;

[0108] Based on the target mobile phone number and user number as nodes;

[0109] Community tags are obtained based on community information;

[0110] Information nodes are obtained by binding community tags and original features as node attributes to corresponding nodes;

[0111] Generate call link diagrams and SMS link diagrams based on the interaction relationships between all information nodes;

[0112] Based on interaction features, collaborative information, and community information as edge features, they are bound to the call link graph and the SMS link graph respectively, resulting in the first link graph and the second link graph.

[0113] A heterogeneous graph is obtained by integrating information nodes, the first link graph, and the second link graph.

[0114] Preferably, community tags are obtained based on community information, specifically including:

[0115] Encoding community information over time:

[0116] Weekdays and holidays are represented using 2-bit binary (e.g., 01 represents a weekday), resulting in the first dimension encoding;

[0117] Different time periods within a day are represented using 5-bit binary (e.g., 00100 represents 8:00 AM - 12:00 PM), resulting in the second dimension encoding;

[0118] Based on the first-dimensional encoding and the second-dimensional encoding, a multi-dimensional encoding is obtained as a unique community label, which clearly identifies the behavioral characteristics of each node in the time dimension.

[0119] Preferably, a call link diagram is generated based on call data, and an SMS link diagram is generated based on SMS data, reflecting the interaction of different types of nodes.

[0120] Preferably, the heterogeneous graph includes a single node type (telephone node) and multiple edge types (call edge, SMS edge).

[0121] Preferably, heterogeneous graphs are generated daily as graph datasets required for subsequent model training.

[0122] Based on the heterogeneous graph input to the graph neural network model, the features of neighbor nodes, community nodes, and time-series nodes are obtained.

[0123] Preferred, such as Figure 3 As shown, the graph neural network model includes a multi-frequency collaborative neural network, a self-attention temporal convolutional network, and a multi-frequency processing module;

[0124] The heterogeneous graph is sequentially input into the multi-frequency collaborative neural network and the multi-frequency processing module to obtain the features of neighbor nodes and community nodes.

[0125] The heterogeneous graph is input into a self-attention temporal convolutional network to obtain temporal node features.

[0126] Preferably, the graph neural network model is trained on a graph dataset composed of heterogeneous graphs to obtain a trained graph neural network model.

[0127] Preferably, before model training, the overall graph is converted into local graphs for training and testing. This aims to improve the model's training efficiency and processing power. Local graph training reduces computational complexity, allowing the model to focus on smaller-scale node relationships, thus more accurately capturing local structural features and interrelationships. This method helps reduce memory usage and accelerate the training process, while improving the learning effect on local graph features. Specifically, the entire graph is divided into multiple batches, each batch being an independent local subgraph. For each local subgraph, the model is trained and evaluated independently, and model parameter updates are globally shared.

[0128] Preferably, the loss function used during training is:

[0129]

[0130] Where V represents the set of central nodes, y v Let z represent the true label of the center node v, σ represent the activation function, and z represent the true label of the center node v. v =h' v This represents the final embedding obtained from the central node v.

[0131] The preferred method for obtaining community node features is as follows:

[0132] All information nodes are assigned to corresponding communities based on the time dimension information of the heterogeneous graph;

[0133] Clustering is performed based on nodes within the community, and the cluster center node is selected as a single community feature of the current community;

[0134] Community node features are obtained by aggregating all individual community node features.

[0135] Preferably, this embodiment uses the K-Means algorithm for clustering.

[0136] Preferably, a single community feature h v,w for:

[0137] h v,w =RELU(Mean AGG(h v',w ):v'∈N' w );

[0138] Where ReLU represents the activation function, Mean AGG represents the average node aggregation function, and N' w This represents the set of nodes generated by the aggregation.

[0139] Preferably, the community node feature h com for:

[0140] h com =AGG(⊕h v,w );

[0141] Where AGG represents the aggregation function, and w represents different community information tags.

[0142] The preferred method for obtaining neighbor node features is as follows:

[0143] Based on any information node in the heterogeneous graph as the current central node;

[0144] Based on collaborative information, all neighboring nodes that are collaboratively connected with the central node are selected first.

[0145] Based on the similarity between the central node and its neighboring nodes, multiple neighboring nodes with similarity greater than a threshold are selected as the filtering nodes.

[0146] Based on all the nodes selected above (including neighboring nodes that are collaboratively connected with the central node and nodes with similarity greater than the threshold), the weights of the neighboring nodes are generated.

[0147] The initial neighbor features of the central node are obtained by updating the edge features of the central node and its neighbor nodes, as well as the original features of the neighbor nodes.

[0148] Based on the neighbor node weights and initial neighbor features, the updated neighbor features are obtained;

[0149] Based on the updated neighbor features, the neighbor node features are obtained by aggregating the first link graph and the second link graph.

[0150] Preferably, in this embodiment, the similarity D(v,v') is calculated by measuring the Manhattan distance between the central node and its neighboring nodes:

[0151]

[0152] Where tanh represents a nonlinear activation function, FCN represents a fully connected network, and h v h represents the original characteristics of the central node v. v' This represents the original characteristics of the neighbor node v'.

[0153] Preferably, in this embodiment, the central node is downsampled, and the K neighboring nodes that are closest to the central node are selected based on similarity using the TOP-K downsampling algorithm.

[0154] Preferably, considering that wavelet transform is used to generate node features, it can capture not only the similarity but also the differences between nodes within a subgraph, thus providing better neighborhood flexibility. Therefore, within each relation edge, wavelet transform is used to further update the node features. A Beta distribution is chosen as the graph kernel function to generate the weights W for the neighbor node features. p,q :

[0155]

[0156] Where p and q are the shape parameters of the Beta distribution, p + q = C, C is a constant, B(p,q) represents the Beta function used for normalization, λ represents the eigenvalues, I represents an identity matrix, and W p,q =(W 0,C W 1,C-1 ...,W C,0 ).

[0157] Preferably, the initial neighbor features h' of the central node are updated based on the edge features of the central node and its neighboring nodes, as well as the original features of the neighboring nodes. r,adj :

[0158] h' r,adj =FCN(d v,v’,r *h v',r );

[0159] Where FCN represents the activation function, d v,v’,r Let r be the edge features (such as mutual transfer rate, collaborative information, etc.) between the central node v and its neighboring node v' under relation r, where r∈(0,R), and in this example, R=2.

[0160] Preferably, based on the neighbor node weight W p,q and initial neighbor features h' r,adj The updated neighbor features h are obtained. r,adj :

[0161] h r,adj =AGG(W p,q *h' r,adj ) = AGG(W i,C-i *h' r,adj :i∈(0,C));

[0162] Here, index i is used to represent the filtering process under different waveform kernels.

[0163] Preferably, the neighbor node features h are generated by aggregating the first and second link graphs based on the updated neighbor features. adj :

[0164] h adj =AGG(h r,adj :r∈(0,R))).

[0165] The preferred method for obtaining temporal node features is as follows:

[0166] Construct a time series based on each information node in the heterogeneous graph;

[0167] Extracting node features of the central node in the l-th layer based on time series analysis;

[0168] Max pooling is performed based on node features to obtain the hierarchical features of the l-th layer at time step t.

[0169] Max pooling is performed based on hierarchical features to obtain global features;

[0170] The initial attention score of the central node is obtained based on global features and then normalized to obtain the final attention weight;

[0171] The temporal node features are obtained by fusing the final attention weight, hierarchical features, and global features.

[0172] Preferably, for each node, a time series is constructed based on the heterogeneous graph, containing features generated daily within a month. Temporal modeling of these features using a temporal convolutional network effectively captures the temporal variation characteristics of the nodes.

[0173] Preferably, to prevent time leakage, the TCN network employs a one-dimensional fully convolutional network and causal convolution, with zero-length padding, based on the input time series. and one-dimensional fully convolutional kernels Extract the node features of the center node in layer l:

[0174]

[0175] Among them, f (l-1) f represents the convolution kernel of the (l-1)th layer. (l-1) (i) represents the convolution kernel f (l-1) The i-th element represents the dilation factor (d), the filter size (k), the convolution operation (*), the time step (s), and the time point (t). The length of is equal to T, t∈(0,T).

[0176] Preferably, to further improve the model's learning of global and local temporal features, max pooling is used to aggregate features based on the temporal convolution module. Max pooling is used to select the most significant feature values ​​in the time dimension, avoiding the omission of important information.

[0177] Preferably, the embedding representation of each time step s is calculated by accumulating the data point by point. Get Then, perform max pooling for each pair of inputs. and Compare the two elements one by one and select the maximum value as the output. The value of . This operation halves the feature length of each layer, progressively compressing the sequence length to form a multi-scale feature representation:

[0178]

[0179] Where L is the maximum number of layers, and Max_pool represents the max pooling operation. and These represent the local features obtained at two different time points, 2t+1 and 2t, after the l-th temporal convolution. Length is It retains the most salient local features of the nodes.

[0180] Preferably, for the last layer The total sequence length T / 2 L Perform a global max pooling operation to select from each Capture global information, and then obtain global features.

[0181]

[0182] in, Representing hierarchical features The final hierarchical features are obtained after layer-by-layer max pooling.

[0183] Preferably, a self-attention module is added to extract short- and long-term features from the time-series data of nodes. It can dynamically adjust the importance weights of features according to the time dimension. Especially in the process of node aggregation to form the final embedding, the self-attention mechanism can effectively collect the embedded features scattered over time, ensuring a balance between local and global information.

[0184] Preferably, the initial attention score of the central node is obtained based on global features and then normalized to obtain the final attention weight:

[0185] Initial attention score

[0186]

[0187] Where W represents the weight matrix, b represents the bias vector, and q represents the shared attention vector. in, Representing hierarchical features The final hierarchical features are obtained after layer-by-layer max pooling. This indicates that it is aimed at the last layer. The total sequence length T / 2 L The final global feature is obtained after performing a global max pooling operation.

[0188] Preferably, the initial attention score is adjusted using the softmax function. Normalization is performed to obtain the final attention weights of the central node v.

[0189]

[0190] in,

[0191] Preferably, the temporal node feature h is obtained by fusing the final attention weight, hierarchical features, and global features. tcn :

[0192]

[0193] in, Representing hierarchical features The final hierarchical features are obtained after layer-by-layer max pooling. This indicates that it is aimed at the last layer. The total sequence length T / 2 L The final global feature is obtained after performing a global max pooling operation.

[0194] A comprehensive node feature is obtained by fusing neighbor node features, community node features, and time-series node features.

[0195] Preferably, the comprehensive node feature h' v Specifically:

[0196] h' v =h v +W1*h com +W2*AGG(h adj )+W3*h tcn ;

[0197] Where W1, W2, and W3 all represent the set of learnable parameters, h v h represents the original characteristics of the central node v. adj h represents the neighbor node embedding of the central node v. com h represents the community node embedding of the central node v. tcn This represents the temporal node embedding of the central node v.

[0198] The prediction result is obtained by inputting the comprehensive node features into the classification layer.

[0199] Preferably, the method also includes evaluating model performance based on test data, generating a prediction report through incremental learning, and selecting whether to retain the model as the latest model.

[0200] Preferably, after completing the initial training of the machine learning model, this example uses test data to conduct an in-depth evaluation of the model's recognition results. The purpose of this process is to verify the model's performance in practical applications, ensuring its accuracy and effectiveness. Specifically, the constructed heterogeneous graph is input into the pre-trained graph neural network model to identify fraudulent numbers, and a predicted blacklist is output periodically by setting thresholds. This method not only evaluates the model's performance in identifying fraudulent behavior but also continuously optimizes the model through incremental learning, improving its adaptability in dynamic environments.

[0201] Preferably, by generating prediction reports, this example provides a comprehensive understanding of the model's actual performance. Testing the trained model and calculating its recall and precision helps determine whether to adopt it as the latest standard model. This approach ensures that the model used accurately addresses real-world problems and continuously improves as data and needs evolve, thus providing a more reliable fraud detection service.

[0202] Example 3

[0203] like Figure 4 As shown, a collaborative fraud number detection system based on graph neural networks includes: a data acquisition module, a data feature extraction module, a heterogeneous graph construction module, a node feature acquisition module, and a prediction result output module;

[0204] The data acquisition module is used to acquire historical communication data of the target mobile phone number;

[0205] The data feature extraction module is used to obtain the original features and interaction features of each number based on historical communication data; and to filter the target mobile phone number to obtain community information and collaboration information based on historical communication data.

[0206] The heterogeneous graph construction module is used to integrate heterogeneous graphs based on original features, interaction features, community information, and collaboration information.

[0207] The node feature acquisition module is used to obtain neighbor node features, community node features, and temporal node features based on the heterogeneous graph input to the graph neural network model; and to obtain comprehensive node features by fusing the neighbor node features, community node features, and temporal node features.

[0208] The prediction result output module is used to input the comprehensive node features into the classification layer to obtain the prediction result.

[0209] Preferably, the functions of each module in this embodiment correspond one-to-one with the above method steps, and will not be described in detail here.

[0210] Preferably, the system also includes a user interface module that displays the prediction results in tabular or graphical form, including fraudulent numbers, predicted probabilities, and related information. This module provides user feedback functionality, allowing users to flag false positives or false negatives to ensure the accuracy of the predictions. Furthermore, the system supports periodic manual intervention to address emerging fraud patterns and prevent system performance degradation over time, thereby ensuring the long-term effective operation of the system.

[0211] Example 4

[0212] Based on the same inventive concept, the present invention also provides a computer device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0213] Memory, used to store computer programs;

[0214] When the processor executes a program stored in memory, it is able to implement a collaborative fraud number detection method based on a graph neural network, as shown in Embodiment 1 or 2.

[0215] The electronic device may include a processor, a communications interface, a memory, and a communication bus, wherein the processor, communications interface, and memory communicate with each other via the communication bus. The processor can invoke logical instructions in the memory to execute a collaborative fraudulent number detection method based on a graph neural network as described in Embodiment 1 or 2.

[0216] Furthermore, when the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0217] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0218] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting collaborative fraud numbers based on a graph neural network, characterized in that, The method comprises: acquiring historical communication data of a target mobile phone number; acquiring original features and interaction features of each number based on the historical communication data; filtering community information and collaboration information of the target mobile phone number based on the historical communication data; the community information acquisition method comprises: judging whether the communication behavior is on a working day or a holiday based on the historical communication data to obtain a judgment result; acquiring behavior difference features between the working day and the holiday based on the judgment result; acquiring call behavior features of the target mobile phone number at different time periods in a day based on the historical communication data; generating the community information based on the behavior difference features and the call behavior features; the collaboration information acquisition method comprises: acquiring time stamps and location information of multiple user numbers that have communication with the target mobile phone number based on the historical communication data; acquiring time intervals based on the time stamps; acquiring cross-regional calling patterns based on the location information; identifying collaboration crime features based on the time intervals and the cross-regional calling patterns; extracting the collaboration information between the user numbers based on the collaboration crime features; integrating heterogeneous graphs based on the original features, the interaction features, the community information, and the collaboration information; the heterogeneous graph construction method comprises: acquiring all user numbers that have communication with the target mobile phone number based on the historical communication data; taking the target mobile phone number and the user numbers as nodes; obtaining community labels based on the community information; binding the community labels and the original features as node attributes to the corresponding nodes to obtain information nodes; generating a call link graph and a short message link graph based on the interaction relationships between all the information nodes; binding the interaction features, the collaboration information, and the community information as edge features to the call link graph and the short message link graph respectively to correspondingly obtain a first link graph and a second link graph; integrating the information nodes, the first link graph, and the second link graph to obtain the heterogeneous graph; inputting the heterogeneous graph into a graph neural network model to obtain neighbor node features, community node features, and time sequence node features; fusing the neighbor node features, the community node features, and the time sequence node features to obtain comprehensive node features; inputting the comprehensive node features into a classification layer to obtain a prediction result.

2. The collaborative fraud number detection method based on a graph neural network according to claim 1, characterized in that, obtaining community labels based on the community information, specifically comprising: encoding in the time dimension based on the community information: using 2-bit binary representation for the working day and the holiday to obtain a first dimension encoding; using 5-bit binary representation for different time periods in a day to obtain a second dimension encoding; obtaining a multi-dimensional encoding as the community label based on the first dimension encoding and the second dimension encoding.

3. The collaborative fraud number detection method based on a graph neural network according to claim 2, characterized in that, The graph neural network model comprises a multi-frequency collaboration neural network, a self-attention time sequence convolution network, and a multi-frequency processing module; the heterogeneous graph is sequentially inputted into the multi-frequency collaboration neural network and the multi-frequency processing module to obtain the neighbor node features and the community node features; the heterogeneous graph is inputted into the self-attention time sequence convolution network to obtain the time sequence node features.

4. The collaborative fraud number detection method based on a graph neural network according to claim 3, characterized in that, The community node feature acquisition method is: All the information nodes are divided into corresponding communities based on the time dimension information of the heterogeneous graph; Based on the nodes within the community, clustering is performed, and the cluster center node is selected as the single community feature of the current community; Based on the aggregation of all the single community features, the community node feature is obtained.

5. The collaborative fraud number detection method based on graph neural network according to claim 4, characterized in that, The neighbor node feature acquisition method is: Based on any one information node in the heterogeneous graph as the current center node; Based on the collaborative information, all neighbor nodes connected with the center node are selected; Based on the similarity between the center node and the neighbor nodes, multiple neighbor nodes with a similarity greater than a threshold value are selected as screening nodes; Based on the screening nodes, neighbor node weights are generated; Based on the edge features of the center node and the neighbor nodes and the original features of the neighbor nodes, the initial neighbor features of the center node are updated; Based on the neighbor node weights and the initial neighbor features, updated neighbor features are obtained; Based on the updated neighbor features, the first link graph and the second link graph are aggregated to obtain the neighbor node features.

6. The collaborative fraud number detection method based on a graph neural network according to claim 5, characterized in that, The time sequence node feature acquisition method is: Based on each information node in the heterogeneous graph, a time sequence is constructed; Based on the time sequence, the node features of the center node at the lth layer are extracted; Based on the node features, a maximum pooling operation is performed to obtain the hierarchical features at the lth layer and the tth time step; Based on the hierarchical features, a maximum pooling operation is performed to obtain global features; Based on the global features, the initial attention scores of the center node are obtained and normalized to obtain the final attention weights; Based on the final attention weights, the hierarchical features and the global features are fused to obtain the time sequence node features.

7. A collaborative fraud number detection system based on graph neural network, applied to the collaborative fraud number detection method based on graph neural network according to any one of claims 1-6, characterized in that, It includes: Data acquisition module, data feature extraction module, heterogeneous graph construction module, node feature acquisition module and prediction result output module; The data acquisition module is used to acquire the historical communication data of the target mobile phone number; The data feature extraction module is used to acquire the original features and interaction features of each number based on the historical communication data; Based on the historical communication data, the community information and collaborative information of the target mobile phone number are screened; The heterogeneous graph construction module is used to integrate the original features, interaction features, community information and collaborative information to obtain a heterogeneous graph; The node feature acquisition module is used to input the heterogeneous graph into a graph neural network model to obtain neighbor node features, community node features and time sequence node features; Based on the neighbor node features, the community node features and the time sequence node features, comprehensive node features are obtained; The prediction result output module is used to input the comprehensive node features into a classification layer to obtain a prediction result.

Images