Knowledge Graph Enhanced Transaction Chain Abnormal Node Identification Method

Abstract

The present invention discloses a method for identifying abnormal nodes in a transaction chain enhanced by a knowledge graph, belonging to the field of network security technology. Specifically, it includes: constructing a transaction chain knowledge graph, endowing nodes and edges with dynamic attributes based on historical data, and calculating transaction entropy values; collecting transaction data in real time, using a temporal knowledge graph embedding algorithm to map participants and relationships into low-dimensional vectors, generating a dynamically updated knowledge graph representation, and updating the transaction entropy values; based on the dynamic knowledge graph, combining topology and features, calculating an abnormal score through comprehensive calculation, and identifying potential abnormal nodes according to the topological structure; collecting the transaction chain context information of potential abnormal nodes and their neighborhood nodes for secondary verification, and outputting a final list of abnormal nodes, effectively improving the accuracy and reliability of abnormal detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and specifically relates to a method for identifying abnormal nodes in a transaction chain enhanced by a knowledge graph. Background Art

[0002] In modern various transaction scenarios, a transaction chain often contains a large number of transaction nodes and complex transaction relationships. With the continuous expansion of the transaction scale and the increasing diversification of transaction forms, the emergence of abnormal nodes in the transaction chain may trigger serious problems such as financial fraud and data leakage. Therefore, accurately identifying abnormal nodes in the transaction chain is crucial.

[0003] Currently, traditional methods for identifying abnormal nodes mainly rely on rule matching and statistical analysis. The rule matching method depends on pre-set rules. When a transaction behavior conforms to a specific rule, it is determined as abnormal. However, this method is difficult to cope with complex and changeable abnormal patterns and has poor flexibility. The statistical analysis method analyzes the statistical characteristics of transaction data and sets thresholds to identify abnormalities. However, for some low-frequency and new abnormal behaviors, it is often unable to effectively identify them. As a semantic network, a knowledge graph can represent entities and their relationships in a structured manner. Applying it to the identification of abnormal nodes in a transaction chain is expected to solve the limitations of traditional methods.

[0004] For example, a Chinese patent with the authorization announcement number CN115345736B discloses a method for detecting abnormal financial transaction behaviors, including: constructing a transaction structure diagram based on historical transaction records, and the nodes in the diagram are accounts; two nodes with transactions are respectively out-degree nodes and in-degree nodes, and the connection line between the out-degree node and the in-degree node is a transaction route; obtaining the transaction information of each transaction route; inputting the transaction graph structure and the transaction information of each transaction route into a TAD-GCN neural network, and outputting the feature vector of each transaction route through an embedding layer; outputting the description vector of each transaction route through the graph convolution layer of the TAD-GCN neural network based on the updated weight and convolution times corresponding to each transaction route; outputting the transaction anomaly recognition result of the transaction route through the description vector of each transaction route passing through the classification layer of the TAD-GCN neural network. This technical solution can accurately identify the transaction routes of abnormal transaction behaviors.

[0005] The above existing technologies have the following deficiencies: there are limitations in static analysis, that is, relying on static historical data, unable to capture the dynamic changes of the transaction chain in real time and lacking dynamic attributes; ignoring the topological relationship between transaction participants, resulting in difficulty in identifying cross-node abnormal behaviors; the abnormal detection results lack context support and are difficult to assist manual decision-making. Summary of the Invention

[0006] In view of the deficiencies of the prior art, the present invention proposes a method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement, constructs a transaction chain knowledge graph, and assigns dynamic attributes to nodes and edges based on historical data and calculates the transaction entropy value; real-time collects transaction data, uses the temporal knowledge graph embedding algorithm to map participants and relationships into low-dimensional vectors, generates a dynamically updated knowledge graph representation and updates the transaction entropy value; based on the dynamic knowledge graph, combines topology and features, calculates the abnormal score through comprehensive calculation, and identifies potential abnormal nodes based on the topological structure; collects the transaction chain context information of potential abnormal nodes and their neighborhood nodes for secondary verification, and outputs the final list of abnormal nodes, effectively improving the accuracy and reliability of abnormal detection.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement, including:

[0009] S1: Construct a transaction chain knowledge graph, assign dynamic attributes to the nodes and edges in the transaction chain knowledge graph based on historical transaction chain data, and calculate the transaction entropy value of the dynamic attribute values of the nodes and edges; the nodes represent transaction participants, and the edges represent transaction relationships;

[0010] S2: Real-time collect the transaction data in the transaction chain, map the transaction participants and transaction relationships into low-dimensional vectors through the temporal knowledge graph embedding algorithm, generate a dynamically updated knowledge graph representation, and update the transaction entropy value of the dynamic attribute values of the nodes and edges;

[0011] S3: Based on the dynamically updated knowledge graph representation, calculate the abnormal score of each node through an abnormal detection method based on topology and features, and identify potential abnormal nodes in combination with the topological structure of the transaction chain;

[0012] S4: Collect the transaction chain context information of potential abnormal nodes and their neighborhood nodes, conduct secondary verification on the potential abnormal nodes, and output the final list of abnormal nodes.

[0013] Specifically, the steps of calculating the transaction entropy value of the dynamic attribute values of the nodes and edges in S1 include:

[0014] S1.1: Create an empty dictionary A, dictionary B, and dictionary C; the dictionaries A, B, and C are in the form of key-value pairs, and the keys in dictionary A are node identifiers, the keys in dictionary B are transaction counterparty node identifiers, and the keys in dictionary C are edge identifiers, and the values are initialized to 0;

[0015] S1.2: For each node i in the transaction chain knowledge graph, count the number of transactions between this node and each transaction counterparty , and obtain the trading probability of this node with each counterparty by dividing the number of transactions between this node and any counterparty by the total number of transactions of this node , and store it in dictionary B, where j represents the counterparty node identifier;

[0016] S1.3: Traverse dictionary B. For the trading probability of each counterparty, obtain the trading entropy value of node i according to the information entropy formula , and store it in dictionary A;

[0017] S1.4: Take the calculated trading entropy value of node i as a new attribute and add it to the nodes of the trading chain knowledge graph;

[0018] S1.5: For each edge k in the trading chain knowledge graph, by traversing all the trading records corresponding to this edge, count the distribution of different trading attributes to obtain the trading amount interval distribution dictionary and the trading type distribution dictionary;

[0019] S1.6: Obtain the probability distribution of this trading amount interval by calculating the number of transactions in any trading amount interval divided by the sum of all values in the trading amount interval distribution dictionary of this edge ;

[0020] S1.7: Obtain the probability distribution of this trading type by calculating the number of transactions of the current type divided by the sum of all values in the trading type distribution dictionary of this edge ;

[0021] S1.8: Calculate the trading amount entropy value and the trading type entropy value respectively according to the information entropy formula in S1.3. Combine the preset weights and obtain the edge trading entropy value through weighted summation, and add the edge trading entropy value as a new attribute to the edges of the trading chain knowledge graph. At the same time, store the edge trading entropy value in dictionary C.

[0022] Specifically, the specific steps of S2 include:

[0023] S2.1: Obtain trading data from the trading system in real time and perform preprocessing;

[0024] S2.2: Use the dynamic relationship modeling method to model the preprocessed trading data into a dynamic graph with timestamps , where I represents the node set, represents the edge set, represents the dynamic attribute set of nodes and edges, and t represents the current time;

[0025] S2.3: Map the nodes and edges in the timestamped dynamic graph to low-dimensional vectors using a temporal knowledge graph embedding algorithm to obtain the low-dimensional node vectors and low-dimensional edge vectors , where represents the size of the node set, represents the size of the edge set;

[0026] S2.4: Set the batch threshold for data collection. Each time a new batch of transaction data is collected, trigger an update of the embedding vectors, integrate the newly collected transaction data with the existing timestamped dynamic graph data, and re-execute S2.3 to obtain the updated low-dimensional node vectors and low-dimensional edge vectors;

[0027] S2.5: Set the time window T. For node i, count the set of trading counterparts within the time window T, as well as the number of transactions between this node and each trading counterpart , and recalculate the trading probability and trading entropy value according to S1.2 and S1.3;

[0028] S2.6: For each edge k, count the distribution dictionary of transaction amount intervals and the distribution dictionary of transaction types within the time window T, and recalculate the edge trading entropy value according to S1.5 - S1.8;

[0029] S2.7: Add the recalculated node trading entropy value and edge trading entropy value as new attributes to the dynamic graph, and update the dynamic attribute sets of nodes and edges .

[0030] Specifically, the specific steps of S2.3 include:

[0031] S2.31: Collect the timestamped dynamic graph data;

[0032] S2.32: Set the embedding dimension d, create a set of low-dimensional node vectors and a set of low-dimensional edge vectors , and randomly initialize each element in the set of low-dimensional node vectors and the set of low-dimensional edge vectors to a random number in the interval [-0.01, 0.01]. After random initialization, take out the vectors corresponding to the head node h and the tail node e from the set of low-dimensional node vectors as the head node low-dimensional vector , tail node low-dimensional vector , where represents the low-dimensional vector of node i, represents the low-dimensional vector of the k-th edge;

[0033] S2.33: Set the objective function , the formula is:

[0034] ;

[0035] Among them, represents the head node embedding vector of time perception, represents the edge embedding vector of time perception, represents the tail node embedding vector of time perception, represents the time regularization weight, represents the timestamp, represents the timestamp mapping function and satisfies , represents the attention mechanism function, represents the attention mechanism weight, represents the structural constraint weight, represents the structural constraint term and satisfies , represents element-wise multiplication, represents the 1-norm, represents the 2-norm, g represents the embedding dimension index, and .

[0036] Specifically, the specific steps of S2.3 further include:

[0037] S2.34: Extract positive samples and negative samples from the dynamic graph with timestamps to form training samples; the positive samples are quadruples of head nodes, edges, tail nodes, and timestamps; the negative samples are obtained by randomly replacing the head nodes, edges, or tail nodes in the positive samples;

[0038] S2.35: Input the training samples into the objective function, calculate the loss value corresponding to each training sample, and update the low-dimensional vectors of the head nodes, tail nodes, and edge low-dimensional vectors in the real number space , tail node low-dimensional vector and edge low-dimensional vector ;

[0039] S2.36: After iterative training, when the objective function converges, obtain the optimized node low-dimensional vectors and edge low-dimensional vector .

[0040] Specifically, the specific steps of S3 include:

[0041] S3.1: Load the dynamically updated knowledge graph representation from S2, including the low-dimensional vector representations of nodes and edges, and the dynamic attribute values of nodes and edges;

[0042] S3.2: Calculate the degree centrality of node i , where u represents the neighbor node of node i, represents the neighbor set of node i, including all nodes directly connected to node i;

[0043] S3.3: Calculate the closeness centrality of node i , where, represents the shortest path distance from node i to node s, and V represents the set of all nodes in the dynamically updated knowledge graph, represents traversing all nodes s except node i in the dynamically updated knowledge graph;

[0044] S3.4: Calculate the betweenness centrality of node i , where, represents the number of times node i passes through in the shortest path from node s to node l, represents the number of shortest paths from node s to node l;

[0045] S3.5: Calculate the embedding vector distance between node i and its neighbor node u , where, and represent the embedding vectors of node i and its neighbor node u respectively.

[0046] Specifically, the specific steps of S3 further include:

[0047] S3.6: Perform weighted summation on the , , , of each node to obtain the anomaly score of each node;

[0048] S3.7: Set an anomaly score threshold according to the historical transaction chain data;

[0049] If , then mark the node corresponding to this anomaly score as a potential anomaly node.

[0050] Specifically, the transaction chain context information in S4 includes transaction time series, transaction amount change trend, and relationship change between transaction parties.

[0051] [[ID=6 three]]Specifically, the secondary verification in step S4 includes:

[0052] Perform logical verification on the transaction behavior of potential anomaly nodes through a rules engine;

[0053] Perform cross-verification on the associated transactions of potential anomaly nodes in combination with external data sources;

[0054] Dynamically evaluate the trading patterns of potential abnormal nodes based on time series analysis.

[0055] Specifically, the method for identifying abnormal nodes in a trading chain enhanced by a knowledge graph further includes:

[0056] Visualize and output the final list of abnormal nodes and their associated trading paths, and generate an abnormal analysis report.

[0057] Compared with the prior art, the beneficial effects of the present invention are:

[0058] The present invention proposes a method for identifying abnormal nodes in a trading chain enhanced by a knowledge graph. By constructing a trading chain knowledge graph containing trading participants and trading relationships, and endowing nodes and edges with dynamic attributes and calculating trading entropy values, it can comprehensively and dynamically characterize trading features, capture changes and uncertainties in the trading process, and effectively improve the comprehensiveness and accuracy of abnormal detection.

[0059] The present invention proposes a method for identifying abnormal nodes in a trading chain enhanced by a knowledge graph. By collecting trading data in real time and generating a dynamically updated knowledge graph representation, combining topological and feature-based abnormal detection methods to calculate node abnormal scores, and then performing secondary verification on potential abnormal nodes, this solution realizes fine management of the entire process from data update, abnormal detection to verification and confirmation, and can more accurately identify real abnormal nodes, reducing the risks of misjudgment and missed judgment. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 Schematic diagram of the method for identifying abnormal nodes in a trading chain enhanced by the knowledge graph of the present invention;

[0061] Figure 2 Principle flowchart of the method for identifying abnormal nodes in a trading chain enhanced by the knowledge graph of the present invention;

[0062] Figure 3 Flowchart for implementing the trading entropy value of the method for identifying abnormal nodes in a trading chain enhanced by the knowledge graph of the present invention;

[0063] Figure 4 Flowchart for identifying potential abnormal nodes of the method for identifying abnormal nodes in a trading chain enhanced by the knowledge graph of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0064] Embodiment 1

[0065] Please refer to Figure 1 and Figure 2 . An embodiment provided by the present invention: A method for identifying abnormal nodes in a trading chain enhanced by a knowledge graph, the method includes steps S1 to S4, including the following steps:

[0066] S1: Construct a transaction chain knowledge graph, assign dynamic attributes to nodes and edges in the transaction chain knowledge graph based on historical transaction chain data, and calculate the transaction entropy value of the dynamic attribute values of nodes and edges; the nodes represent transaction participants, and the edges represent transaction relationships;

[0067] Among them, historical transaction chain data is collected from the company's internal business systems, such as order management systems, financial systems, logistics systems, etc., covering transaction participant information and transaction relationship information; transaction participant information includes company name, credit rating, and industry category; transaction relationship information includes transaction time, transaction amount, transaction commodity type, and transaction quantity, among which participants include suppliers, manufacturers, distributors, and retailers.

[0068] Furthermore, the process of building the transaction chain knowledge graph includes:

[0069] (1) Collect and preprocess multi-source heterogeneous historical supply chain transaction data;

[0070] (2) Define the ontology model of the knowledge graph, including node types and edge types;

[0071] (3) Based on the pre-processed historical supply chain transaction data, the transaction participants are added as nodes to the ontology model of the knowledge graph, the transaction relationships are used as edges to connect the corresponding nodes, and the transaction information on the edges is recorded. The transaction chain knowledge graph is formed through the connection between nodes.

[0072] Node dynamic attribute assignment process:

[0073] (1) Transaction frequency: Count the number of transactions per node within a preset time window;

[0074] (2) Transaction amount volatility: the ratio of the standard deviation of the transaction amount of the calculation node within the preset time window to the average value;

[0075] (3) Credit rating change rate: record the changes in the node credit rating and calculate the extent of the credit rating change within the preset time.

[0076] Edge dynamic attribute assignment process:

[0077] (1) Transaction time interval: calculate the time difference between two consecutive transactions;

[0078] (2) Transaction quantity change rate: Calculate the change in the number of transactions on the edge within a preset time period;

[0079] (3) Trading price volatility: Calculate the ratio of the standard deviation of the marginal trading prices to the average value.

[0080] It should be noted that the dynamic attributes are extracted from the knowledge graph. According to the constructed knowledge graph of the transaction chain, the dynamic attribute data of each node and edge are extracted using a graph query language. For example, the Cypher query statement is used to obtain the transaction frequency of supplier node A in the past month.

[0081] S2: Real-time collect the transaction data in the transaction chain, map the transaction participants and transaction relationships into low-dimensional vectors through the temporal knowledge graph embedding algorithm, generate a dynamically updated knowledge graph representation, and update the transaction entropy values of the node and edge dynamic attribute values;

[0082] S3: Based on the dynamically updated knowledge graph representation, calculate the anomaly score of each node through the anomaly detection method based on topology and features, and identify potential anomaly nodes in combination with the topological structure of the transaction chain;

[0083] S4: Collect the transaction chain context information of the potential anomaly nodes and their neighborhood nodes, conduct secondary verification on the potential anomaly nodes, and output the final list of anomaly nodes.

[0084] The transaction chain context information includes the transaction time series, the change trend of the transaction amount, and the change of the relationship between the transaction participants.

[0085] Furthermore, the specific steps of S4 include:

[0086] S4.1: Extract the relevant information of the potential anomaly nodes and their neighborhood nodes from the transaction chain knowledge graph, including transaction records and node attributes;

[0087] S4.2: According to the collected transaction chain context information, extract the node transaction behavior characteristics and perform standardization processing. The node transaction behavior characteristics include transaction amount, transaction frequency, and transaction time distribution;

[0088] S4.3: Divide the data set into a training set and a test set, use the training set to train the secondary verification model, and obtain the trained secondary verification model;

[0089] S4.4: Input the data of the potential anomaly nodes to be verified and their neighborhood nodes into the trained model to obtain the verification result;

[0090] S4.5: Generate the final list of anomaly nodes according to the results of the secondary verification.

[0091] The method for identifying anomaly nodes in the transaction chain based on knowledge graph enhancement further includes:

[0092] Visualize and output the final list of anomaly nodes and their associated transaction paths, and generate an anomaly analysis report. [[ID=�7]]

[0093] Embodiment 2

[0094] Please refer to Figure 3 , in this embodiment, the steps of calculating the transaction entropy value of the dynamic attribute values of nodes and edges in S1 include:

[0095] S1.1: Create empty dictionaries A, B, and C; the dictionaries A, B, and C are in the form of key-value pairs, where the keys in dictionary A are node identifiers, the keys in dictionary B are counterparty node identifiers, and the keys in dictionary C are edge identifiers, and the values are initialized to 0. Among them, the edge identifier is composed of the starting node and the ending node;

[0096] S1.2: For each node i in the transaction chain knowledge graph, count the number of transactions between this node and each counterparty , and obtain the transaction probability between this node and each counterparty by dividing the number of transactions between this node and any counterparty by the total number of transactions of this node , and store it in dictionary B, where j represents the counterparty node identifier;

[0097] Among them, in the transaction chain knowledge graph, the counterparty refers to another node that directly has a transaction relationship with a specific node. It should be noted that the transaction chain knowledge graph is essentially a network composed of nodes and edges. Nodes represent transaction participants, and edges represent the transaction relationships between these participants. For example, in a simple supply chain transaction chain knowledge graph, there are nodes such as suppliers, manufacturers, distributors, and retailers. When a supplier provides raw materials to a manufacturer, the supplier and the manufacturer are counterparties to each other, and there is a transaction edge between them. And counting the number of transactions between this node and each counterparty is to calculate the frequency of transactions between the specified node and the remaining nodes that have a transaction relationship with it.

[0098] Exemplarily, assume that in the transaction chain knowledge graph, there are three nodes: retailer , wholesaler , manufacturer , and their transaction relationships are as follows: has transacted 3 times, with the first transaction amount being 1000 yuan, the second transaction amount being 1500 yuan, and the third transaction amount being 1200 yuan;0] has transacted 2 times, with the first transaction amount being 800 yuan and the second transaction amount being 900 yuan, then:

[0099] For node : The counterparties are and ; By checking the transaction records, it is found that has[[ID=]]45 transacted 3 times with The number of transactions with is 3; similarly, The number of transactions between is 2, so The number of transactions with is 2.

[0100] For node : The counterparty is only ; The number of transactions between is 3, so The number of transactions with is 3.

[0101] For node : The counterparty is only ; The number of transactions between is 2, so The number of transactions with is 2.

[0102] S1.3: Traverse dictionary B. For the transaction probability of each counterparty, obtain the transaction entropy value of node i according to the information entropy formula , and store it in dictionary A, where log represents the logarithmic function;

[0103] S1.4: Add the calculated transaction entropy value of node i as a new attribute to the nodes of the transaction chain knowledge graph;

[0104] Furthermore, the specific steps of S1.4 include:

[0105] S1.41: Obtain the transaction entropy value of node i;

[0106] S1.42: Determine the storage method of the transaction chain knowledge graph;

[0107] S1.43: In the selected storage method, find the record corresponding to node i, and add the calculated transaction entropy value as a new attribute to the attribute list of this node.

[0108] S1.5: For each edge k in the transaction chain knowledge graph, by traversing all the transaction records corresponding to this edge, count the distribution of different transaction attributes to obtain the transaction amount interval distribution dictionary and the transaction type distribution dictionary;

[0109] Further, when counting the distribution of different transaction attributes, for the transaction amount, it is necessary to divide the transaction amount into intervals, and then count the number of transactions within each interval of the transaction amount to obtain a dictionary of the transaction amount interval distribution. Among them, the key in the dictionary of the transaction amount interval distribution is the amount interval, and the value is the number of transactions.

[0110] For the transaction type, it is necessary to count the number of transactions of each transaction type to obtain a dictionary of the transaction type distribution. Among them, the key in the dictionary of the transaction type distribution is the transaction type, and the value is the number of transactions.

[0111] S1.6: By calculating the number of transactions in any transaction amount interval divided by the sum of all values in the dictionary of the transaction amount interval distribution of this side, the probability distribution of this transaction amount interval is obtained ;

[0112] S1.7: By calculating the number of transactions of the current type divided by the sum of all values in the dictionary of the transaction type distribution of this side, the probability distribution of this transaction type is obtained ;

[0113] S1.8: According to the information entropy formula in S1.3, calculate the transaction amount entropy value and the transaction type entropy value , combined with the preset weight, obtain the edge transaction entropy value through weighted summation , and add the edge transaction entropy value as a new attribute to the edge of the transaction chain knowledge graph. At the same time, store the edge transaction entropy value in the dictionary C.

[0114] Example 3

[0115] Please refer to Figure 4 , the specific steps of S2 in this example include:

[0116] S2.1: Obtain transaction data from the transaction system in real time and perform preprocessing;

[0117] S2.2: Use the dynamic relationship modeling method to model the preprocessed transaction data into a dynamic graph with timestamps , where I represents the set of nodes, represents the set of edges, represents the set of dynamic attributes of nodes and edges, and t represents the current time;

[0118] Further, the specific steps of S2.2 include:

[0119] S2.21: Obtain the preprocessed transaction data, and identify entities and relationships from the preprocessed transaction data; the entity is the transaction participant; the relationship is the transaction type;

[0120] S2.22: Take all different entities involved in the preprocessed transaction data as elements of the node set I, and initialize an empty edge set and a timestamp set ;

[0121] S2.23: Traverse the preprocessed transaction data sequentially in chronological order. For each transaction record, according to the extracted entities and relationships, add the corresponding edges to the edge set and record the corresponding timestamp in the timestamp set to obtain a timestamped dynamic graph.

[0122] S2.3: Use the temporal knowledge graph embedding algorithm to map the nodes and edges in the timestamped dynamic graph into low-dimensional vectors, obtaining node low-dimensional vectors and edge low-dimensional vectors , where represents the size of the node set, represents the size of the edge set;

[0123] S2.4: Set the batch threshold for data collection. Each time a new batch of transaction data is collected, trigger an update of the embedding vectors, and integrate the newly collected transaction data with the existing timestamped dynamic graph data, and re-execute S2.3 to obtain updated node low-dimensional vectors and edge low-dimensional vectors;

[0124] Furthermore, the specific steps of S2.4 include:

[0125] S2.41: Set the batch threshold M according to the processing capacity of the system and the frequency of data updates, where the batch threshold indicates that when M new transaction data are reached, trigger an update of the embedding vectors;

[0126] S2.42: Configure a counter in the data collection system;

[0127] S2.43: Collect new transaction data. Each time a new transaction data is collected, increment the counter. When the counter reaches the batch threshold M, trigger the embedding vector update process and reset the counter;

[0128] S2.44: Integrate the newly collected transaction data with the existing timestamped dynamic graph data, including:

[0129] Add the entities and relationships in the new data to the node set I and the edge set and record the corresponding timestamps in the timestamp set ;

[0130] S2.45: Re-execute the embedding vector update process of the dynamic graph in S2.3 to update the low-dimensional vector representations of nodes and edges.

[0131] S2.5: Set the time window T. For node i, count the set of counterparties within the time window T , and the number of transactions between this node and each counterparty , and recalculate the transaction probability and transaction entropy value ;

[0132] S2.6: For each edge k, count the distribution dictionary of transaction amount intervals and the distribution dictionary of transaction types within the time window T, and recalculate the edge transaction entropy value ;

[0133] S2.7: Add the recalculated node transaction entropy value and edge transaction entropy value as new attributes to the dynamic graph, and update the dynamic attribute sets of nodes and edges .

[0134] Further, the specific steps of S2.7 include:

[0135] S2.71: Obtain the recalculated node transaction entropy value and edge transaction entropy value ;

[0136] S2.72: Determine the storage method of the dynamic graph;

[0137] S2.73: In the selected storage method, find the record corresponding to node i, and add the calculated node transaction entropy value to the dynamic attribute set of node i;

[0138] S2.74: Find the record corresponding to edge k, and add the calculated edge transaction entropy value to the dynamic attribute set of the edge.

[0139] The specific steps of S2.3 include:

[0140] S2.31: Collect dynamic graph data with timestamps;

[0141] S2.32: Set the embedding dimension d, and create a set of node low-dimensional vectors and a set of edge low-dimensional vectors , and randomly initialize each element in the node low-dimensional vector set and the edge low-dimensional vector set to a random number in the interval [-0.01, 0.01]. After random initialization, take out the vectors corresponding to the head node h and the tail node e from the node low-dimensional vector set as the head node low-dimensional vector , tail node low-dimensional vector , where represents the low-dimensional vector of node i, represents the low-dimensional vector of the k-th edge;

[0142] S2.33: Set the objective function , and the formula is:

[0143] ;

[0144] Among them, represents the time-aware head node embedding vector, represents the time-aware edge embedding vector, represents the time-aware tail node embedding vector, represents the time regularization weight, represents the timestamp, represents the timestamp mapping function, and satisfies , represents the attention mechanism function, represents the attention mechanism weight, represents the structure constraint weight, represents the structure constraint term, and satisfies , represents element-wise multiplication, that is, the elements at corresponding positions are multiplied, represents the 1-norm, represents the 2-norm, g represents the embedding dimension index, and ;

[0145] Furthermore, , , , where represents the time transformation matrix of the head and tail entities, represents the time transformation matrix of the tail entity, represents the time transformation matrix of the edge, and E represents the identity matrix.

[0146] It should be noted that in the traditional model, the node and relationship vectors are fixed and cannot capture dynamic changes. By introducing the timestamp mapping function to incorporate time information into the vectors, we obtain , , , capturing the temporal evolution of nodes and relationships, enabling the same entity to have different representations at different times, and enhancing the model's expressive power; meanwhile, in the present invention, an attention mechanism is introduced to evaluate the temporal credibility of quadruples, automatically identifying transactions at abnormal time points, such as the low credibility of large transfers late at night, alleviating the data sparsity problem, and assigning higher weights to low-frequency but important transactions; finally, a DistMult-style structural constraint term is added to retain the structural information of the static knowledge graph and avoid losing global relationships during temporal modeling.

[0147] S2.34: Extract positive and negative samples from the timestamped dynamic graph to form training samples;

[0148] The positive sample is a quadruple of head node, edge, tail node, and timestamp;

[0149] The negative sample is obtained by randomly replacing the head node, edge, or tail node in the positive sample;

[0150] S2.35: Input the training samples into the objective function, calculate the loss value corresponding to each training sample, and update the low-dimensional vectors of the head node, tail node, and edge in the real number space according to the loss value , tail node low-dimensional vector and edge low-dimensional vector ;

[0151] Further, the specific steps of S2.35 include:

[0152] (1) Obtain the training samples from S2.34;

[0153] (2) Randomly initialize a low-dimensional vector representation for each head node, tail node, and edge. These low-dimensional vectors are usually randomly initialized in the real number space. For example, a normal distribution or a uniform distribution is used;

[0154] (3) Input the training samples into the objective function in S2.33 and calculate the loss value corresponding to each training sample;

[0155] (4) According to the calculated loss value, use the backpropagation algorithm to calculate the gradient of each embedding vector. According to the gradient calculation result, update the low-dimensional vectors of the head node, tail node, and edge in the real number space , tail node low-dimensional vector and edge low-dimensional vector , where the backpropagation algorithm is the prior art content in the field and is not the creative solution of this application, so it will not be elaborated here.

[0156] S2.36: After iterative training, when the objective function converges, obtain the optimized low-dimensional vectors of the nodes and edge low-dimensional vectors .

[0157] The specific steps of S3 include:

[0158] S3.1: Load the dynamically updated knowledge graph representation from S2, including the low-dimensional vector representations of nodes and edges, as well as the dynamic attribute values of nodes and edges;

[0159] S3.2: Calculate the degree centrality of each node , where u represents the neighbor node of node i, represents the neighbor set of node i, which contains all the nodes directly connected to node i; the degree centrality represents the number of connections between a node and its neighbor nodes;

[0160] It should be noted that is to count each neighbor node u in the neighbor set of node i. If the neighbor node u is in the neighbor set , then add 1.

[0161] S3.3: Calculate the closeness centrality of node i , where represents the shortest path distance from node i to node s, V represents the set of all nodes in the dynamically updated knowledge graph, represents traversing all nodes s except node i in the dynamically updated knowledge graph; the closeness centrality represents the average distance from a node to all non-self nodes in the dynamically updated knowledge graph;

[0162] S3.4: Calculate the betweenness centrality of node i , where represents the number of times node i passes through in the shortest path from node s to node l, represents the number of shortest paths from node s to node l; the betweenness centrality represents the importance of a node as a mediator of the shortest paths between non-self nodes;

[0163] S3.5: Calculate the embedding vector distance between node i and its neighbor node u , where and respectively represent the embedding vectors of node i and its neighbor node u;

[0164] S3.6: Perform a weighted sum of the , , , of each node to obtain the anomaly score of each node;

[0165] S3.7: Set an anomaly score threshold according to the historical transaction chain data;

[0166] like , then the node corresponding to the anomaly score is marked as a potential anomaly node.

[0167] The secondary verification in step S4 includes:

[0168] Logically verify the transaction behavior of potentially abnormal nodes through a rule engine. The rule engine is a prior art in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0169] Cross-verify related transactions of potential abnormal nodes by combining external data sources;

[0170] Furthermore, cross-verification of related transactions of potential abnormal nodes is performed in combination with external data sources, including:

[0171] (1) Identify potential abnormal nodes and their associated transactions that need to be verified;

[0172] (2) Collect and integrate internal and external data, and perform data cleaning and preprocessing;

[0173] Collect internal data: extract data of potential abnormal nodes and their associated transactions from the internal database;

[0174] Collect external data: Collect transaction data related to potential abnormal nodes from external data sources, such as competitor data and industry reports.

[0175] (3) Associating internal data with external data based on matching rules, where the matching rules use unique identifiers such as customer ID, order number, and product number;

[0176] (4) cross-validation of related-party transactions using the mean analysis method. The mean analysis method is a prior art in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0177] (5) Analyze the results of cross-validation to identify truly abnormal nodes and abnormal transactions;

[0178] (6) Optimize product pricing and channel management based on the results of cross-validation to improve production efficiency.

[0179] The transaction patterns of potential abnormal nodes are dynamically evaluated based on time series analysis. Time series analysis is a prior art in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0180] The embodiments of the present invention have been described above in conjunction with the accompanying drawings. However, the present invention is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. Under the inspiration of the present invention, those of ordinary skill in the art can also make changes, modifications, substitutions, and variations to the above embodiments without departing from the spirit and scope of the present invention, and these all fall within the protection scope of the present invention.

Claims

1. The method for identifying abnormal nodes in transaction chains based on knowledge graph enhancement is characterized by: include: S1: Construct a transaction chain knowledge graph, assign dynamic attributes to nodes and edges in the transaction chain knowledge graph based on historical transaction chain data, and calculate the transaction entropy value of the dynamic attribute values of nodes and edges; the nodes represent transaction participants, and the edges represent transaction relationships; S2: Transaction data in the transaction chain is collected in real time. Transaction participants and transaction relationships are mapped into low-dimensional vectors through a time-series knowledge graph embedding algorithm. This generates a dynamically updated knowledge graph representation and updates the transaction entropy values of the dynamic attribute values of nodes and edges. S3: Based on the dynamically updated knowledge graph representation, the anomaly score of each node is calculated through a topology- and feature-based anomaly detection method, and potential anomaly nodes are identified in combination with the topological structure of the transaction chain; S4: Collect transaction chain context information of potential abnormal nodes and their neighboring nodes, perform secondary verification on potential abnormal nodes, and output the final abnormal node list.

2. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 1 is characterized in that: The step of calculating the transaction entropy value of the node and edge dynamic attribute value in S1 includes: S1.1: Create an empty dictionary A, dictionary B, and dictionary C. The dictionaries A, B, and C are in the form of key-value pairs, with the key in dictionary A being the node identifier, the key in dictionary B being the counterparty node identifier, and the key in dictionary C being the edge identifier. The values are initialized to 0. S1.2: For each node i in the transaction chain knowledge graph, count the number of transactions between the node and each transaction counterparty , and the transaction probability of the node with each trading counterparty is obtained by dividing the number of transactions between the node and any trading counterparty by the total number of transactions of the node , and stored in dictionary B, where j represents the counterparty node identifier; S1.3: Traverse dictionary B, and for each counterparty’s transaction probability, obtain the transaction entropy value of node i according to the information entropy formula , and store it in dictionary A; S1.4: The calculated transaction entropy value of node i Added as a new attribute to the node of the transaction chain knowledge graph; S1.5: For each edge k in the transaction chain knowledge graph, traverse all transaction records corresponding to that edge and calculate the distribution of different transaction attributes to obtain the transaction amount interval distribution dictionary and transaction type distribution dictionary; S1.6: The probability distribution of any transaction amount interval is obtained by dividing the number of transactions in that transaction amount interval by the sum of all values in the transaction amount interval distribution dictionary for that edge. ; S1.7: Calculate the probability distribution of the transaction type by dividing the number of transactions of the current type by the sum of all values in the transaction type distribution dictionary of this edge. ; S1.8: Calculate the entropy of transaction amounts based on the information entropy formula in S1.3 and transaction type entropy , combined with the preset weights, the edge transaction entropy value is obtained through weighted summation , and add the edge transaction entropy value as a new attribute to the edge of the transaction chain knowledge graph, and store the edge transaction entropy value in the dictionary C.

3. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 2 is characterized in that: The specific steps of S2 include: S2.1: Obtain transaction data from the trading system in real time and perform preprocessing; S2.2: Use dynamic relationship modeling to model the pre-processed transaction data into a dynamic graph with timestamps , where I represents the node set, represents the edge set, Represents the dynamic attribute set of nodes and edges, and t represents the current time; S2.3: Use the temporal knowledge graph embedding algorithm to map the nodes and edges in the dynamic graph with timestamps into low-dimensional vectors to obtain the node low-dimensional vector and edge low-dimensional vectors ,in, Indicates the size of the node set, Indicates the size of the edge set; S2.4: Set the batch threshold for data collection. Every time a new batch of transaction data is collected, trigger an embedding vector update. The newly collected transaction data is integrated with the existing dynamic graph data with timestamps, and S2.3 is re-executed to obtain the updated low-dimensional node vectors and edge low-dimensional vectors. S2.5: Set a time window T and count the set of counterparties within the time window T for node i. , and the node and each counterparty The number of transactions and recalculate the transaction probability according to S1.2 and S1.3 and transaction entropy ; S2.6: For each edge k, calculate the transaction amount interval distribution dictionary and transaction type distribution dictionary within the statistical time window T, and recalculate the edge transaction entropy value according to S1.5-S1.8 ; S2.7: Recalculate the node transaction entropy value and side transaction entropy Add as a new attribute to the dynamic graph, update the dynamic attribute set of nodes and edges .

4. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 3 is characterized in that: The specific steps of S2.3 include: S2.31: Collect dynamic graph data with time stamps; S2.32: Set the embedding dimension d and create a set of low-dimensional vectors for the nodes and edge low-dimensional vector set And randomly initialize each element in the node low-dimensional vector set and the edge low-dimensional vector set to a random number in the interval [-0.01, 0.01]. After random initialization, take the vector corresponding to the head node h and the tail node e from the node low-dimensional vector set as the head node low-dimensional vector , low-dimensional vector of the tail node ,in, represents the low-dimensional vector of node i, A low-dimensional vector representing the k-th edge; S2.33: Setting the objective function , the formula is: ； in, represents the time-aware head node embedding vector, represents the time-aware edge embedding vector, represents the time-aware tail node embedding vector, represents the time regularization weight, Indicates a timestamp, Represents a timestamp mapping function that satisfies , represents the attention mechanism function, represents the attention mechanism weight, represents the structural constraint weight, Represents a structural constraint term, and satisfies , represents element-wise multiplication, represents the 1 norm, represents the 2-norm, g represents the embedding dimension index, and .

5. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 4 is characterized in that: The specific steps of S2.3 also include: S2.34: Extract positive and negative samples from the timestamped dynamic graph to form training samples; the positive sample is a quadruple consisting of a head node, an edge, a tail node, and a timestamp; the negative sample is obtained by randomly replacing the head node, edge, or tail node in the positive sample; S2.35: Input the training samples into the objective function, calculate the loss value corresponding to each training sample, and update the low-dimensional vector of the head node in the real space according to the loss value , low-dimensional vector of the tail node and edge low-dimensional vectors ; S2.36: After iterative training, when the objective function converges, the optimized node low-dimensional vector is obtained and edge low-dimensional vectors .

6. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 5 is characterized in that: The specific steps of S3 include: S3.1: Load the dynamically updated knowledge graph representation from S2, including low-dimensional vector representations of nodes and edges, as well as dynamic attribute values of nodes and edges; S3.2: Calculate the degree centrality of node i , where u represents the neighbor node of node i, Represents the neighbor set of node i, including all nodes directly connected to node i; S3.3: Calculate the closeness centrality of node i ,in, represents the shortest path distance from node i to node s, V represents the set of all nodes in the dynamically updated knowledge graph, Indicates traversing all nodes s except node i in the dynamically updated knowledge graph; S3.4: Calculate the betweenness centrality of node i ,in, represents the number of nodes i in the shortest path from node s to node l. represents the number of shortest paths from node s to node l; S3.5: Calculate the embedding vector distance between node i and its neighbor node u ,in, and represent the embedding vectors of node i and its neighbor node u respectively.

7. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 6, characterized in that: The specific steps of S3 also include: S3.6: Set each node 、 、 、 Perform weighted summation to obtain the anomaly score of each node ; S3.7: Set an anomaly score threshold based on historical transaction chain data ; like , then the node corresponding to the anomaly score is marked as a potential anomaly node.

8. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 7 is characterized in that: The transaction chain context information in S4 includes transaction time series, transaction amount change trend, and relationship changes between transaction participants.

9. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 8, characterized in that: The secondary verification in step S4 includes: Perform logical verification of transaction behaviors of potential abnormal nodes through the rule engine; Cross-verify related transactions of potential abnormal nodes by combining external data sources; Dynamically evaluate the transaction patterns of potential abnormal nodes based on time series analysis.

10. The method for identifying abnormal nodes in a transaction chain based on knowledge graph enhancement according to claim 9, characterized in that: Also includes: The final abnormal node list and its associated transaction paths are visualized and output, and an abnormality analysis report is generated.

Images