Abnormal node identification model training method and abnormal transaction account identification method

Abstract

The invention relates to a training method of an abnormal node identification model and an abnormal transaction account identification method. The training method comprises the following steps: receiving a transaction network diagram, wherein the transaction network diagram comprises nodes formed by transaction accounts and edges formed by transaction paths; performing comparison learning of the nodes based on the transaction network diagram to obtain a first comparison model of the nodes; based on the transaction network graph, performing comparative learning of nodes and sub-graphs to obtain a first comparative model of the nodes and the sub-graphs, the sub-graphs being obtained by walking from any node; and fusing the first comparison model of the nodes and the first comparison model of the nodes and the subgraph to obtain a first abnormal node identification model. According to the invention, the abnormal behavior mode in the financial transaction network can be accurately detected.

Description

Technical Field

[0001] The present invention relates to computer technology, and particularly to a training method for an abnormal node recognition model based on multi-scale self-supervised contrast learning and an abnormal transaction account recognition method based on the abnormal node recognition model. Background Art

[0002] Financial transactions are usually transactions between users or between users and merchants, forming a complex transaction network among them. Since graph neural networks can model complex relationships between nodes, they are widely used in the field of financial fraud detection.

[0003] There are generally two detection methods in the prior art: (1) supervised anomaly detection method and (2) unsupervised graph anomaly detection method based on autoencoders.

[0004] Among them, the disadvantages of method (1) include: for tasks such as fraud detection, high-quality labeled data is usually difficult to directly obtain, and the lack of sufficient labeled data will limit the performance of supervised learning methods; due to relying on labeled data for training, supervised learning methods may not be able to fully capture the potential patterns and structures of the data, and when facing new and unseen fraud behaviors, the generalization ability of the model may be limited.

[0005] Among them, the disadvantages of method (2) include: being prone to overfitting to abnormal information. Since there are already abnormalities in the original graph data, the model targeted at autoencoder reconstruction may overfit these abnormal information during the training process, which will lead to a decline in the model's performance when identifying new abnormalities because it may have learned some abnormal patterns as normal patterns; having limited ability to handle the complexity of the graph structure. Autoencoders may have certain limitations when dealing with complex graph structures. For example, for large graphs or graphs with complex topological structures, the performance of autoencoders may be affected. In addition, it may be difficult to capture some subtle abnormal patterns in the graph. Summary of the Invention

[0006] In order to solve the above problems in the prior art, the present invention provides a training method for an abnormal node recognition model that can accurately detect abnormal behavior patterns in a financial transaction network and an abnormal transaction account recognition method based on the abnormal node recognition model.

[0007] The training method for the abnormal node recognition model according to one aspect of the present invention, the abnormal node recognition model is used to identify abnormal transaction accounts, and the training method includes:

[0008] Receiving a transaction network graph, the transaction network graph includes nodes composed of transaction accounts and edges composed of transaction paths;

[0009] Perform contrastive learning between nodes based on the transaction network graph to obtain a first contrast model between nodes;

[0010] Perform contrastive learning between nodes and subgraphs based on the transaction network graph to obtain a first contrast model between nodes and subgraphs, where the subgraph is obtained by walking starting from any one node; and

[0011] Fuse the first contrast model between nodes and the first contrast model between nodes and subgraphs to obtain a first abnormal node recognition model.

[0012] Optionally, further include:

[0013] Obtain the abnormal scores of the nodes in the transaction network graph based on the first abnormal node recognition model.

[0014] Optionally, further include:

[0015] Perform random perturbation on the transaction network graph to obtain an enhanced perspective graph;

[0016] Perform contrastive learning between nodes based on the enhanced perspective graph to obtain a second contrast model between nodes;

[0017] Perform contrastive learning between nodes and subgraphs based on the enhanced perspective graph to obtain a second contrast model between nodes and subgraphs, where the subgraph is obtained by walking starting from any one node; and

[0018] Fuse the second contrast model between nodes and the second contrast model between nodes and subgraphs to obtain a second abnormal node recognition model; and

[0019] Obtain the abnormal scores of the nodes in the enhanced perspective graph based on the second abnormal node recognition model.

[0020] Optionally, further include:

[0021] Fuse the abnormal scores of the nodes in the transaction network graph and the abnormal scores of the nodes in the enhanced perspective graph to obtain the total abnormal score.

[0022] Optionally, further include:

[0023] Obtain the mean and standard deviation of the total abnormal score by repeatedly executing the training method of the abnormal node recognition model, and obtain the final abnormal score based on the mean and standard deviation of the total abnormal score.

[0024] Optionally, the random perturbation includes: randomly cropping the edges of the transaction network graph and randomly masking the risk features.

[0025] Optionally, the step of performing contrastive learning between nodes based on the transaction network graph to obtain a first contrast model between nodes includes:

[0026] Selecting adjacent nodes as positive contrast pairs;

[0027] Randomly selecting non - adjacent nodes as negative contrast pairs; and

[0028] Performing contrastive learning based on the positive contrast pairs and the negative contrast pairs using a multi - layer perceptron and a graph convolutional network to obtain a first contrast model between nodes.

[0029] Optionally, the adjacent nodes include: nodes co - occurring in the same sub - graph or nodes connected by edges,

[0030] The non - adjacent nodes include: nodes not directly connected by edges.

[0031] Optionally, the step of performing contrastive learning based on the positive contrast pairs and the negative contrast pairs using a multi - layer perceptron and a graph convolutional network to obtain a first contrast model between nodes includes:

[0032] In the contrastive learning, making the distance between the positive contrast pairs tend to be close and making the distance between the negative contrast pairs tend to be far.

[0033] Optionally, the step of performing contrastive learning based on the positive contrast pairs and the negative contrast pairs using a multi - layer perceptron and a graph convolutional network to obtain a first contrast model between nodes includes:

[0034] Performing contrastive learning according to the loss function \(l\) of the contrastive learning between nodes in the following formula node-node where \(N\) represents the nodes not adjacent to node \(i\), \(K\) is the index of the neighbors of node \(i\), \(z\)

[0035]

[0036] is the feature of node \(i\) obtained by GCN, node_i is the feature of node \(i\) obtained by MLP, is the feature of node \(k\) obtained by MLP. is the feature of node \(k\) obtained by MLP.

[0037] Optionally, the step of performing contrastive learning between a node and a sub - graph based on the transaction network graph to obtain a first contrast model between the node and the sub - graph includes:

[0038] Selecting a node and the sub - graph where the node is located as a positive contrast pair;

[0039] Selecting a node and any sub - graph where the node does not exist as a negative contrast pair;

[0040] Using a multi-layer perceptron and a graph convolutional network for contrastive learning based on the positive contrast pairs and the negative contrast pairs to obtain a first contrast model of nodes and subgraphs.

[0041] Optionally, the using a multi-layer perceptron and a graph convolutional network for contrastive learning based on the positive contrast pairs and the negative contrast pairs to obtain a first contrast model of nodes and subgraphs includes:

[0042] In the contrastive learning, making the distances between the positive contrast pairs closer and the distances between the negative contrast pairs farther apart.

[0043] Optionally, the using a multi-layer perceptron and a graph convolutional network for contrastive learning based on the positive contrast pairs and the negative contrast pairs to obtain a first contrast model of nodes and subgraphs includes:

[0044] Performing contrastive learning according to the loss function l of the contrastive learning of nodes and subgraphs in the following formula node-subgraph where N represents the nodes not adjacent to node i, k is the index of the neighbors of node i, z

[0045]

[0046] is the feature of node i obtained by GCN, z node_i is the feature of subgraph i with node i obtained by MLP, z g_i is the feature of subgraph k without node i obtained by MLP. g_k is the feature of subgraph k without node i obtained by MLP.

[0047] Optionally, the fusing the first contrast model of nodes and nodes and the first contrast model of nodes and subgraphs to obtain an abnormal node recognition model includes:

[0048] Fusing the first contrast model of nodes and nodes and the first contrast model of nodes and subgraphs according to the following formula

[0049] l total = l node-node + l node-subgraph ,

[0050] where l total is the total loss function of contrastive learning,

[0051] l node-node is the loss function of contrastive learning of nodes and nodes,

[0052] l node-subgraph is the loss function of contrastive learning of nodes and subgraphs.

[0053] Optionally, the obtaining the abnormal score of the nodes in the transaction network diagram based on the first abnormal node recognition model includes:

[0054] Calculate the anomaly score of nodes in the transaction network graph according to the following formula

[0055]

[0056] where score i represents the anomaly score of node i in the transaction network graph, and represent the similarity between the negative comparison pair and the positive comparison pair corresponding to node i respectively.

[0057] Optionally, obtaining the total anomaly score by fusing the anomaly scores of nodes in the transaction network graph and the anomaly scores of nodes in the enhanced perspective graph includes: calculating the total anomaly score according to the following formula

[0058]

[0059] where S i represents the total anomaly score, scosr i represents the anomaly score of node i in the transaction network graph, represents the anomaly score of node i in the enhanced perspective graph, and β represents the balance coefficient of anomaly scores from different perspectives.

[0060] Optionally, obtaining the final anomaly score based on the mean and standard deviation of the total anomaly score includes:

[0061] Calculating the final anomaly score based on the following formula

[0062]

[0063] where R represents the number of runs, represents the mean of the total anomaly scores of multiple runs, represents the standard deviation of the total anomaly score, and S i represents the final anomaly score.

[0064] Optionally, the transaction account is any one or more of the following:

[0065] Bank card;

[0066] Electronic trading account.

[0067] The method for identifying abnormal trading accounts according to one aspect of the present invention includes:

[0068] Receiving original transaction data;

[0069] Cleaning the original transaction data to remove noise;

[0070] Construct a transaction network graph based on the cleaned transaction data, where the transaction network graph includes nodes formed by transaction accounts and edges formed by transaction paths, and the nodes include the transaction accounts to be identified; and

[0071] Input the transaction network graph into an abnormal node recognition model obtained by using the training method of the abnormal node recognition model as described above to obtain a recognition result.

[0072] An abnormal node recognition model training device according to an aspect of the present invention, where the abnormal node recognition model is used to identify abnormal transaction accounts, and the training device includes:

[0073] A receiving module that receives a transaction network graph, where the transaction network graph includes nodes formed by transaction accounts and edges formed by transaction paths;

[0074] An enhanced perspective graph construction module for randomly perturbing the transaction network graph to obtain an enhanced perspective graph;

[0075] A node-to-node comparison model that performs node-to-node contrast learning based on the transaction network graph to obtain a first node-to-node comparison model and performs node-to-node contrast learning based on the enhanced perspective graph to obtain a second node-to-node comparison model;

[0076] A node-to-subgraph comparison model that performs node-to-subgraph contrast learning based on the transaction network graph to obtain a first node-to-subgraph comparison model and performs node-to-subgraph contrast learning based on the enhanced perspective graph to obtain a second node-to-subgraph comparison model, where the subgraph is obtained by walking starting from any one node;

[0077] A fusion module that fuses the first node-to-node comparison model and the first node-to-subgraph comparison model to obtain a first abnormal node recognition model and fuses the second node-to-node comparison model and the second node-to-subgraph comparison model to obtain a second abnormal node recognition model; and

[0078] A score calculation module for calculating the abnormal score of the nodes in the transaction network graph based on the first abnormal node recognition model and calculating the abnormal score of the nodes in the enhanced perspective graph based on the second abnormal node recognition model, and fusing the abnormal score of the nodes in the transaction network graph and the abnormal score of the nodes in the enhanced perspective graph to obtain a total abnormal score.

[0079] An abnormal transaction account recognition device according to an aspect of the present invention includes:

[0080] A receiving module for receiving original transaction data;

[0081] A preprocessing module for cleaning the original transaction data to remove noise;

[0082] A transaction network graph construction module for constructing a transaction network graph based on the cleaned transaction data, where the transaction network graph includes nodes composed of transaction accounts and edges composed of transaction paths, and the nodes include transaction accounts to be identified; and

[0083] An identification module for inputting the transaction network graph into an abnormal node identification model obtained by the training method of the abnormal node identification model to obtain an identification result.

[0084] An apparatus for training an abnormal node identification model according to an aspect of the present invention includes:

[0085] At least one processor; and

[0086] A memory communicatively connected to the at least one processor,

[0087] wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the training method of the abnormal node identification model as described above.

[0088] An abnormal transaction account identification apparatus according to an aspect of the present invention includes:

[0089] At least one processor; and

[0090] A memory communicatively connected to the at least one processor,

[0091] wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the abnormal transaction account identification method as described above.

[0092] A computer-readable medium according to an aspect of the present invention, on which a computer program is stored, and the computer program implements the method described above when executed by a processor.

[0093] A computer device according to an aspect of the present invention includes a storage module, a processor, and a computer program stored on the storage module and executable on the processor, and the processor implements the method described above when executing the computer program.

[0094] A computer program product according to an aspect of the present invention includes a computer program, and the computer program implements the method described above when executed by a processor. Brief Description of the Drawings

[0095] The following detailed description in conjunction with the accompanying drawings will make the above and other objects and advantages of the present application more fully clear, wherein the same or similar elements are denoted by the same reference numerals.

[0096] Figure 1 It is a schematic diagram of a Kaka transfer diagram of an exemplary graph structure.

[0097] Figure 2 It is a schematic diagram of the overall framework of the abnormal node recognition model based on multi-scale self-supervised contrast learning of the present invention.

[0098] Figure 3 It is a schematic diagram of the model comparison process and objectives of the present invention.

[0099] Figure 4 It is a schematic diagram of the process of the abnormal transaction account recognition method according to an embodiment of the present invention.

[0100] Figure 5 It is a schematic diagram of the training device of the abnormal node recognition model according to an embodiment of the present invention.

[0101] Figure 6 It is a schematic diagram of the abnormal transaction account recognition device according to an embodiment of the present invention.

[0102] Figure 7 It is a schematic diagram of the training device of the abnormal node recognition model according to an embodiment of the present invention.

[0103] Figure 8 It is a schematic diagram of the abnormal transaction account recognition device according to an embodiment of the present invention. Detailed Embodiments

[0104] The following are some of the multiple embodiments of the present invention, aiming to provide a basic understanding of the present invention. It is not intended to identify the key or decisive elements of the present invention or to limit the scope to be protected.

[0105] For the sake of brevity and illustrative purposes, the principles of the present invention are mainly described herein with reference to its exemplary embodiments. However, those skilled in the art will readily recognize that the same principles can be equivalently applied to all types of training methods for abnormal node recognition models based on multi-scale self-supervised contrast learning, and these same principles can be implemented therein, and any such variations do not depart from the true spirit and scope of this patent application.

[0106] Moreover, in the following description, reference is made to the accompanying drawings which illustrate specific exemplary embodiments. Electrical, mechanical, logical, and structural changes may be made to these embodiments without departing from the spirit and scope of the present invention. In addition, although a feature of the present invention is disclosed in connection with only one of several embodiments / implementations, this feature may be combined with one or more other features of the other embodiments / implementations as may be desired and / or advantageous for any given or identifiable function. Accordingly, the following description should not be taken in a limiting sense, and the scope of the present invention is defined by the appended claims and their equivalents.

[0107] Terms such as "comprising" and "including" mean that the technical solutions of the present invention do not exclude the case of having other units (modules) and steps that are not directly or explicitly stated in addition to the units (modules) and steps directly and explicitly stated in the specification and claims.

[0108] The present invention proposes an anomaly node recognition model based on multi-scale self-supervised contrast learning, which can perform contrast consistency learning at different scales to discover abnormal behavior patterns in the graph structure.

[0109] The following specifically describes the training method of the anomaly node recognition model of the present invention.

[0110] The training method of the anomaly node recognition model based on multi-scale self-supervised contrast learning of the present invention mainly includes the following two stages:

[0111] (1) Construction of the transaction graph network; and

[0112] (2) Construction of the anomaly node recognition model for cross-perspective graph contrast learning based on transaction data.

[0113] (1) Construction of the transaction graph network

[0114] The construction of the transaction graph network mainly includes the following steps:

[0115] Clean the original transaction data (such as transfer transaction data) to remove noise (such as anomalies, missing data, etc.);

[0116] Construct bank card features based on the cleaned transaction data; and

[0117] Construct a graph-structured card-to-card transfer graph based on the bank card features.

[0118] Figure 1 is a schematic diagram of an exemplary graph-structured card-to-card transfer graph.

[0119] In Figure 1Among them, the bank card account is used as a node, and the bank card features are used as node features. The edges between nodes are composed of card-to-card transactions (for example, transfer transactions). It should be noted that transfer transactions have directions.

[0120] Among them, as an example, the bank card features are, for example, risk features calculated based on transaction data. As risk features, the following can be listed: for example, short-term rapid in and out, large amounts and frequent transactions at night, the number of transaction counterparties, etc.

[0121] (2) Construction of an abnormal node recognition model based on cross-perspective graph contrast learning of transaction data

[0122] Here we formally define the main problem to be solved. Given a graph G=(V, E r , X), where V represents nodes, and E r represents the edges corresponding to the relationship r, where r = {transfer}, and X = {x1,..., x n} ∈ R d represents the attributes of nodes, where d << N.

[0123] Since for abnormal and illegal behaviors such as gambling, there is no directly corresponding label, an unsupervised method is adopted. Therefore, based on the risk features of abnormal cards (such as gambling cards), multi-scale self-supervised contrast learning is used here to detect abnormal cards (such as gambling cards). The method we propose is based on an assumption that if it is a receiving card of a gambling website, then the risk features of this card are not similar to the features of other surrounding graphs such as subgraphs. Based on this assumption, the subsequent model training process is proposed.

[0124] Figure 2 is the overall framework schematic diagram of the abnormal node recognition model based on multi-scale self-supervised contrast learning of the present invention.

[0125] First, as shown in the middle part of Figure 2 For the already constructed card-to-card transfer graph G ( Figure 1 the upper part of the middle part of Figure 2 ) is randomly perturbed to form an enhanced perspective of the card-to-card transfer graph G ( Figure 2 the lower part of the middle part of

[0126] Here, as an example, the random perturbation can, for example, include: (1) random cropping of edges; and (2) feature masking (such as random masking of risk features). Figure 2 In this way, in this step, an enhanced perspective of the card-to-card transfer graph is formed, that is, two perspectives are obtained, and then the node-to-node comparison shown on the left Figure 2The comparison between the nodes shown on the right and the subgraphs, through such comparisons from multiple angles, can achieve the propagation of risk features and the learning of the degree of abnormality.

[0127] The following will further elaborate specifically. Figure 2 The comparison between the nodes shown on the left and the nodes, as well as Figure 2 the process of comparing the nodes shown on the right with the subgraphs. Figure 2 The target node in [] refers to a specific node whose feature representation is desired to be learned. Figure 2 Parameter sharing in [] means using the same parameters in different parts of the model. In Figure 2 it is shown that the same parameters are used from two perspectives (i.e., the Kakatuo transfer graph G and the enhanced perspective ).

[0128] Furthermore, Figure 2 The MLP in [] refers to a multi-layer perceptron, which is a feed-forward neural network composed of an input layer, an output layer, and at least one hidden layer. The MLP passes information layer by layer through weighted summation and non-linear activation functions to learn the feature representation of data. Figure 2 In the self-supervised learning framework in [], the MLP is used to process the node features of the target node (i.e., the "risk features" mentioned above are the inputs of the MLP). Figure 2 The GCN in [] refers to a graph convolutional network, which is a neural network specifically designed to process graph-structured data. It updates the representation of each node by aggregating the information of its neighbor nodes, enabling the effective utilization of the structural information in the graph data. The GCN is also used to process the node features of the target node (i.e., the "risk features" mentioned above are the inputs of the MLP).

[0129] Furthermore, the MLP mainly performs non-linear transformations on the node features of the target node through a multi-layer neural network. This transformation can capture the complex relationships of the node features and generate new feature representations, focusing on the in-depth mining and transformation of features. The GCN, on the other hand, aggregates the neighbor information of nodes through graph convolution operations to update the feature representations of nodes. This method fully utilizes the topological information in the graph structure, enabling the node features to contain not only their own information but also the information of neighbor nodes, enhancing the expressiveness of the features.

[0130] Next, specifically explain Figure 2 the comparison between the nodes shown on the left and the nodes.

[0131] The comparison between nodes is mainly carried out by comparing different nodes within the same view to capture node-level abnormal information.

[0132] The process of comparing nodes includes:

[0133] First, a graph neural network (GCN) is used to calculate the node embedding features. The graph neural network can be represented by the following formula:

[0134]

[0135] Here, A represents the adjacency matrix, D represents the degree matrix of the graph, and W represents the parameters that the model needs to train.

[0136] After passing through the graph neural network and the fully connected layer (the fully connected layer is a step in the MLP), we obtain the representation of the node, namely z node and

[0137] Positive Pairs refer to: Selecting adjacent nodes (nodes that co-occur in the same subgraph or are connected by edges) to form positive pairs because these nodes have strong similarity. Since positive pairs are formed by selecting adjacent nodes (i.e., nodes that co-occur in the same subgraph or are connected by edges), these nodes have a direct connection relationship and usually have strong similarity. In contrastive learning, positive pairs are used to guide the model to learn the common features or similarities between nodes. By optimizing the model, the nodes in the positive pairs are made closer in the embedding space, and the model can better capture and represent the correlation and similarity between nodes.

[0138] Negative Pairs refer to: Randomly selecting non-adjacent nodes (i.e., nodes without a direct connection) to form negative pairs. The similarity between these nodes is low and they are suitable as negatives. Since negative pairs are formed by randomly selecting non-adjacent nodes (i.e., nodes without a direct connection), the similarity between these nodes is low (because there is no direct connection between them). In contrastive learning, negative pairs are used to help the model distinguish the features or differences between different nodes. By optimizing the model, the nodes in the negative pairs are made farther apart in the embedding space, and the model can better distinguish and differentiate the heterogeneity between different nodes.

[0139] By combining positive pairs and negative pairs, the contrastive learning between nodes can effectively improve the model's ability to recognize node features and capture node-level abnormal information. This contrastive learning method not only helps the model learn the similarities between nodes but also enables the model to better understand the differences and uniqueness between nodes.

[0140] Finally, the contrastive learning process between nodes can be optimized by the following formula:

[0141]

[0142] Among them, sim() represents the similarity between nodes i and j, which can be calculated using cosine similarity. N represents the nodes that are not adjacent to node i, and K refers to the indices of the neighbors of node i.

[0143] Here, z node_i is the feature of node i obtained by GCN, is the feature of node j obtained by MLP, is the feature of node k obtained by MLP, l node-node is the loss function for contrastive learning between node and node.

[0144] This loss function reflects the performance of the model in distinguishing positive and negative contrast pairs. For example, when the model can accurately identify positive contrast pairs and make their similarity higher than that of negative contrast pairs, the loss value will be smaller. On the contrary, when the model cannot effectively distinguish positive and negative contrast pairs, the loss value will be larger.

[0145] Therefore, by minimizing this loss function, the model can learn better node embedding representations, which makes similar nodes (i.e., nodes in positive contrast pairs) closer in the embedding space, while dissimilar nodes (i.e., nodes in negative contrast pairs) are farther apart in the embedding space. This optimization method can help improve the model's ability to identify node features and anomaly detection performance because it can better capture and represent the similarities and differences between nodes.

[0146] Next, specifically explain Figure 2 The illustration of node and subgraph comparison shown on the right.

[0147] Node and subgraph comparison aims to capture anomaly information by comparing the relationship between the target node and its subgraph.

[0148] The process of node and subgraph comparison includes:

[0149] First, for any node in the graph, the random walk algorithm is used to obtain its subgraph.

[0150] Then, positive and negative sample pairs for contrastive learning are formed according to the matching relationship between the target node and the subgraph:

[0151] Among them, positive contrast pairs are those where the target node and its subgraph form a positive contrast pair because the target node has a strong correlation with its surrounding subgraph.

[0152] Negative contrast pairs are those where the target node and other random subgraphs form negative contrast pairs, and these subgraphs have a weak correlation with the target node.

[0153] Here, the graph neural network is also used to calculate the features of the subgraph, that is

[0154]

[0155] Here, H represents the features of the nodes in the calculated graph. However, we also need to obtain the features of the subgraphs. Therefore, we use the ReadOut method to obtain the feature representation at the subgraph level:

[0156] z = ReadOut(H)

[0157] Here, ReadOut adopts the method of taking the mean of the node features. By the above calculation, the node feature z node and the subgraph feature z g can be obtained respectively.

[0158] Finally, the following contrast objective is used to optimize the contrast learning process between the subgraph and the nodes:

[0159]

[0160] l node-subgraph : represents the loss function of the contrast learning between the nodes and the subgraph.

[0161] Among them, sim(z node_i , z g_i ) represents the similarity between node i and the subgraph i where node i is located, and can be calculated using cosine similarity.

[0162] Among them, N represents the nodes that are not adjacent to node i, k is the index of the neighbors of node i, z node_i is the feature of node i obtained by GCN, z g_i is the feature of the subgraph i where node i is located obtained by MLP, and z g_k is the feature of the subgraph k that does not contain node i obtained by MLP.

[0163] Figure 3 is a schematic diagram of the model contrast process and objective of the present invention. Figure 3 shows the contrast process and optimization objective of the training method of the abnormal node recognition model of the present invention.

[0164] Figure 3 The left side of Figure 3 reflects the above loss function l node-node of the contrast learning between nodes and nodes. That is, in the self-supervised process of node-to-node contrast, the distance between negative pairs is enlarged, so as to distinguish different categories of nodes and make them far away from each other in the feature space, while the distance between positive pairs is shortened, so as to strengthen the similarity between nodes of the same category and make them closer to each other in the feature space, thereby realizing unsupervised node self-representation learning.

[0165] On the other hand, Figure 3The right side shows the loss function l of the contrastive learning between the above nodes and subgraphs node-subgraph , that is, in the self-supervised process of node and subgraph contrast, for the positive pair of node and subgraph, that is, the target node and its corresponding subgraph form a positive sample pair, indicating that the node and the subgraph belong to the same category or environment, which can ensure the similarity between the node and its corresponding subgraph. For the negative pair of node and subgraph, that is, the target node and any other subgraph where the target node does not belong form a negative sample pair, indicating that the node and the subgraph do not belong to the same category or environment. In this way, by comparing the similarity between the node and its corresponding subgraph, anomaly detection can be carried out, that is, the more similar the node and the subgraph environment are, the more normal it is, and the dissimilarity may indicate an anomaly.

[0166] As mentioned above Figure 3 schematically shows two self-supervised learning methods. The contrast between nodes focuses on achieving self-supervised learning through the distance contrast between nodes, while the contrastive self-supervised learning between nodes and subgraphs realizes the consistency between nodes and their surrounding environmental context nodes. The contrast between nodes and subgraphs enhances the effect of node representation by comparing the relationship between nodes and their corresponding subgraphs.

[0167] Combining the above two self-supervised learning methods, the overall optimization goal of the self-supervised contrastive learning detection model is:

[0168] l total = l node-node + l node-subgraph

[0169] l total represents the overall loss function of the model, which combines the losses from both node-node contrast and node-subgraph contrast.

[0170] Finally, the anomaly score is calculated.

[0171] Combined with the above multi-scale self-supervised contrastive learning process, the similarity between nodes and nodes as well as between nodes and subgraphs is calculated using sim() when calculating the contrastive learning loss function. Because for the normal node i in the graph, it is similar to other nodes and subgraph features around it. For the abnormal node, it should be dissimilar to other nodes and subgraph features around it. Therefore, the anomaly score of the node in the graph is defined as:

[0172]

[0173] Here, score i represents the anomaly score of node i in the graph, while and represent the similarities between the negative sample and the positive sample corresponding to node i, respectively.

[0174] In the above process, we only obtained the anomaly scores score of the nodes in the figure for the Kaka transfer figure G, and then obtained the enhanced perspective in the same way. The anomaly scores of the nodes in In this way, the total anomaly score is:

[0175]

[0176] Here, S i represents the final anomaly score. β represents the balance coefficient of the anomaly scores from different perspectives.

[0177] Finally, in order to cope with the contingency brought by data randomness, when making predictions, the inference process is run multiple times to obtain the mean and standard deviation of the anomaly scores, and thus the final anomaly score with statistical significance is obtained:

[0178]

[0179] Here, R represents the number of runs. represents the average value of multiple runs. S i represents the final anomaly score.

[0180] Next, the anomaly transaction account recognition method of the present invention is described.

[0181] Figure 4 is a schematic flow chart of the anomaly transaction account recognition method according to an embodiment of the present invention.

[0182] As Figure 4 shown, the anomaly transaction account recognition method according to an embodiment of the present invention includes:

[0183] Receiving step S100: Receiving original transaction data;

[0184] Preprocessing step S200: Cleaning the original transaction data to remove noise;

[0185] Transaction network graph construction step S300: Constructing a transaction network graph based on the cleaned transaction data, wherein the transaction network graph includes nodes composed of transaction accounts and edges composed of transaction paths, and the nodes include the transaction accounts to be identified; and

[0186] Recognition step S400: Inputting the transaction network graph into the anomaly node recognition model trained by the method described above to obtain a recognition result.

[0187] It can be seen that in the present invention, the input of the abnormal node recognition model is a transaction network graph composed of transaction flow data. As an example, it includes basic transaction fields such as the characteristic time and amount of transactions. The output of the abnormal node recognition model is an abnormal score given to each bank card. The larger the score, the higher the risk.

[0188] The abnormal node recognition model and the abnormal transaction account recognition method of the present invention can be applied not only to identify abnormal accounts of bank cards, but also to other fields. For example, it can identify abnormal accounts of electronic transaction accounts and abnormal account transfers, etc.

[0189] The following are two example scenarios of applying the abnormal node recognition model and the abnormal transaction account recognition method of the present invention to identify abnormalities:

[0190] (1) Credit card money laundering or gambling account detection

[0191] In the transfer network of financial institutions, some bank cards may be gathering points for gambling funds. Through the abnormal node recognition model of the present invention, when the characteristics of a certain bank card (such as transaction frequency, transaction amount distribution, attribute characteristics of associated cards, etc.) are significantly inconsistent with the characteristics of its surrounding subgraph, the model will assign a higher abnormal score to it. The financial risk control department can use this result to conduct key reviews on suspected gambling or money laundering accounts.

[0192] Therefore, according to the abnormal node recognition model and the abnormal transaction account recognition method of the present invention, by applying the abnormal recognition model based on multi-scale self-supervised contrast learning to the abnormal detection process of gambling violations, it can effectively alleviate the problem that it is difficult to detect gambling scenarios with supervised models due to the high difficulty of obtaining labels.

[0193] (2) Abnormal account recognition on network payment platforms

[0194] For large online payment platforms, there are a huge number of transfer records and associated merchant information every day. Through the abnormal node recognition model of the present invention, by performing contrast learning between nodes and between nodes and subgraphs on the user account - transaction network, abnormal accounts can be automatically discovered without labeled information. For example, an abnormal account may have an abnormal concentration of trading partners, frequent and high-value cross-regional transactions, but significantly different behavior patterns from other nodes in the subgraph where it is located. The model will assign a higher abnormal score to this account, thereby helping the payment platform quickly screen out potential risk accounts from the massive data and further take corresponding risk control measures.

[0195] As described above, according to the training method of the anomaly node recognition model based on multi-scale self-supervised contrast learning of the present invention, by introducing multi-scale self-supervised contrast learning, feature contrast is performed not only at the node level, but also at the local context scale of nodes and subgraphs, so as to enrich the information source for anomaly detection and overcome the defect of incomplete anomaly recognition at a single level.

[0196] Moreover, the training method of the anomaly node recognition model based on multi-scale self-supervised contrast learning of the present invention does not require a large number of high-quality labels. This is because anomaly detection is achieved through a completely self-supervised contrast method, enabling the model to still have strong anomaly recognition ability in the case of unlabeled or few-labeled data, effectively alleviating the problem of obtaining high-quality labels.

[0197] Furthermore, the training method of the anomaly node recognition model based on multi-scale self-supervised contrast learning of the present invention can improve robustness by using enhanced perspectives. By randomly perturbing the original graph data (edge pruning, feature masking) to construct multiple enhanced views, the sensitivity and robustness of the model to noise and abnormal structures are improved.

[0198] In summary, the anomaly node recognition model of the present invention can effectively identify anomaly points in graph structure data under unlabeled conditions, reduce the dependence on labeled data, and significantly improve the detection performance and practicality in fields such as financial fraud detection (such as gambling violation recognition).

[0199] Furthermore, the present invention also provides a training device for an anomaly node recognition model.

[0200] Figure 5 It is a schematic diagram showing a training device for an anomaly node recognition model according to an embodiment of the present invention.

[0201] As Figure 5 shown, a training device 100 for an anomaly node recognition model according to an embodiment of the present invention includes:

[0202] A receiving module 110, configured to receive a transaction network graph, where the transaction network graph includes nodes formed by transaction accounts and edges formed by transaction paths;

[0203] An enhanced perspective graph construction module 120, configured to perform random perturbation on the transaction network graph to obtain an enhanced perspective graph;

[0204] A node-to-node contrast model 130, performing node-to-node contrast learning based on the transaction network graph to obtain a first contrast model between nodes and performing node-to-node contrast learning based on the enhanced perspective graph to obtain a second contrast model between nodes;

[0205] The node and sub - graph comparison model 140 performs comparison learning of nodes and sub - graphs based on the transaction network graph to obtain the first comparison model of nodes and sub - graphs, and performs comparison learning of nodes and sub - graphs based on the enhanced perspective graph to obtain the second comparison model of nodes and sub - graphs. Among them, the sub - graph is obtained by random walk starting from any one node;

[0206] The fusion module 150 fuses the first comparison model of nodes and nodes and the first comparison model of nodes and sub - graphs to obtain the first abnormal node recognition model, and fuses the second comparison model of nodes and nodes and the second comparison model of nodes and sub - graphs to obtain the second abnormal node recognition model; and

[0207] The score calculation module 160 is used to calculate the abnormal score of nodes in the transaction network graph based on the first abnormal node recognition model, calculate the abnormal score of nodes in the enhanced perspective graph based on the second abnormal node recognition model, and fuse the abnormal score of nodes in the transaction network graph and the abnormal score of nodes in the enhanced perspective graph to obtain the total abnormal score.

[0208] Furthermore, the present invention also provides an abnormal transaction account recognition device.

[0209] Figure 6 It is a schematic diagram of the abnormal transaction account recognition device showing an embodiment of the present invention.

[0210] As Figure 6 shown, the abnormal transaction account recognition device 200 according to an embodiment of the present invention includes:

[0211] The receiving module 210 is used to receive the original transaction data;

[0212] The pre - processing module 220 is used to clean the original transaction data to remove noise;

[0213] The transaction network graph construction module 230 is used to construct a transaction network graph based on the cleaned transaction data. Among them, the transaction network graph includes nodes composed of transaction accounts and edges composed of transaction paths, and the nodes include the transaction accounts to be identified; and

[0214] The recognition module 240 is used to input the transaction network graph into the abnormal node recognition model trained by the method according to any one of claims 1 - 18 to obtain the recognition result.

[0215] The present invention also provides a training device for an abnormal node recognition model.

[0216] Figure 7 It is a schematic diagram of the training device for the abnormal node recognition model showing an embodiment of the present invention.

[0217] As Figure 7 shown, the training device 300 of the abnormal node recognition model according to an embodiment of the present invention includes:

[0218] at least one processor 310; and

[0219] a memory 320 communicatively connected to the at least one processor,

[0220] wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the above-mentioned training method of the abnormal node recognition model.

[0221] The present invention also provides an abnormal transaction account recognition device.

[0222] Figure 8 is a schematic diagram showing the abnormal transaction account recognition device according to an embodiment of the present invention.

[0223] As Figure 8 shown, the abnormal transaction account recognition device 400 according to an embodiment of the present invention includes:

[0224] at least one processor 410; and

[0225] a memory 420 communicatively connected to the at least one processor,

[0226] wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the above-mentioned abnormal transaction account recognition method.

[0227] The present invention also provides a computer-readable medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the above-mentioned training method of the abnormal node recognition model or the above-mentioned abnormal transaction account recognition method.

[0228] The present invention also provides a computer device, including a storage module, a processor, and a computer program stored on the storage module and executable on the processor. When the processor executes the computer program, it implements the above-mentioned training method of the abnormal node recognition model or the above-mentioned abnormal transaction account recognition method.

[0229] The present invention also provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the above-mentioned training method of the abnormal node recognition model or the above-mentioned abnormal transaction account recognition method.

[0230] The above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Those skilled in the art can think of other feasible changes or substitutions according to the technical scope disclosed in the present application, and such changes or substitutions are all covered by the protection scope of the present application. Without conflict, the implementation manners of the present application and the features in the implementation manners can also be combined with each other. The protection scope of the present application shall be subject to the claims.

Claims

1. A training method for an abnormal node recognition model, characterized in that The abnormal node recognition model is used to recognize abnormal trading accounts, and the training method includes: Receiving a transaction network graph, which includes nodes composed of trading accounts and edges composed of transaction paths; Performing contrastive learning between nodes based on the transaction network graph to obtain a first contrast model between nodes; Performing contrastive learning between nodes and subgraphs based on the transaction network graph to obtain a first contrast model between nodes and subgraphs, where the subgraph is obtained by walking starting from any one node; and Fusing the first contrast model between nodes and the first contrast model between nodes and subgraphs to obtain a first abnormal node recognition model.

2. The training method of the abnormal node recognition model according to claim 1, characterized in that Further includes: Obtaining the abnormal scores of nodes in the transaction network graph based on the first abnormal node recognition model.

3. The training method of the abnormal node recognition model according to claim 2, characterized in that Further includes: Randomly perturbing the transaction network graph to obtain an enhanced perspective graph; Performing contrastive learning between nodes based on the enhanced perspective graph to obtain a second contrast model between nodes; Performing contrastive learning between nodes and subgraphs based on the enhanced perspective graph to obtain a second contrast model between nodes and subgraphs, where the subgraph is obtained by walking starting from any one node; and Fusing the second contrast model between nodes and the second contrast model between nodes and subgraphs to obtain a second abnormal node recognition model; and Obtaining the abnormal scores of nodes in the enhanced perspective graph based on the second abnormal node recognition model.

4. The training method of the abnormal node recognition model according to claim 3, characterized in that, Further includes: Fusing the abnormal scores of nodes in the transaction network graph and the abnormal scores of nodes in the enhanced perspective graph to obtain the total abnormal score.

5. The training method of the abnormal node recognition model according to claim 4, characterized in that, Further includes: Obtaining the mean and standard deviation of the total abnormal score by repeatedly executing the training method of the abnormal node recognition model, and obtaining the final abnormal score based on the mean and standard deviation of the total abnormal score.

6. The training method of the abnormal node recognition model according to claim 3, characterized in that The random perturbation includes: randomly cropping the edges of the transaction network graph and randomly masking the risk features.

7. The training method of the abnormal node recognition model according to claim 2, characterized in that The performing contrastive learning between nodes based on the transaction network graph to obtain a first contrast model between nodes includes: Selecting adjacent nodes as positive contrast pairs; Randomly selecting non-adjacent nodes as negative contrast pairs; and Performing contrastive learning based on the positive contrast pairs and the negative contrast pairs using a multi-layer perceptron and a graph convolutional network to obtain a first contrast model between nodes.

8. The training method of the abnormal node recognition model according to claim 7, characterized in that The adjacent nodes include: nodes that co-occur in the same subgraph or are connected by edges, The non-adjacent nodes include: nodes that are not directly connected by edges.

9. The training method of the abnormal node recognition model according to claim 7, characterized in that The performing contrastive learning based on the positive contrast pairs and the negative contrast pairs using a multi-layer perceptron and a graph convolutional network to obtain a first contrast model between nodes includes: In the contrastive learning, the distance between the positive contrast pairs is made to tend to be close, and the distance between the negative contrast pairs is made to tend to be far away.

10. The training method of the abnormal node recognition model according to claim 9, wherein The contrastive learning based on the positive contrast pairs and the negative contrast pairs using a multi-layer perceptron and a graph convolutional network to obtain a first contrast model between nodes includes: The loss function l for contrastive learning of node-to-node comparison according to the following formula node-node Perform contrastive learning where N represents the nodes not adjacent to node i, K refers to the index of the neighbors of node i, and z node_i is the feature of node i obtained by GCN, is the feature of node i obtained by MLP, is the feature of node k obtained by MLP.

11. The training method of the abnormal node recognition model according to claim 10, wherein The contrastive learning based on the transaction network graph for nodes and subgraphs to obtain a first contrast model between nodes and subgraphs includes: Select a node and the subgraph where the node is located as a positive contrast pair; Select a node and any subgraph without the node as a negative contrast pair; Based on the positive contrast pairs and the negative contrast pairs, use a multi-layer perceptron and a graph convolutional network for contrastive learning to obtain a first contrast model between nodes and subgraphs.

12. The training method of the abnormal node recognition model according to claim 11, wherein The contrastive learning based on the positive contrast pairs and the negative contrast pairs using a multi-layer perceptron and a graph convolutional network to obtain a first contrast model between nodes and subgraphs includes: In the contrastive learning, the distance between the positive contrast pairs is made closer, and the distance between the negative contrast pairs is made farther away.

13. The training method of the abnormal node recognition model according to claim 12, wherein The contrastive learning based on the positive contrast pairs and the negative contrast pairs using a multi-layer perceptron and a graph convolutional network to obtain a first contrast model between nodes and subgraphs includes: The loss function l for contrastive learning of nodes and subgraphs according to the following formula node-subgraph Perform contrastive learning Where N represents the nodes not adjacent to node i, and k is the index of the neighbors of node i, z node_i is the feature of node i obtained by GCN, z g_i is the feature of subgraph i with node i obtained by MLP, z g_k is the feature of subgraph k without node i obtained by MLP.

14. The training method of the abnormal node recognition model according to claim 13, wherein The method of fusing the first contrast model between nodes and the first contrast model between nodes and subgraphs to obtain an abnormal node recognition model includes: Fuse the first contrast model between nodes and the first contrast model between nodes and subgraphs according to the following formula l total ＝l node-node +l node-subgraph ， where l total is the total contrastive learning loss function l node-node is the loss function for contrastive learning between nodes l node-subgraph is the loss function for the contrastive learning between nodes and subgraphs.

15. The training method of the abnormal node recognition model according to claim 14, wherein The method of obtaining the abnormal score of the nodes in the transaction network graph based on the first abnormal node recognition model includes: Calculate the abnormal score of the nodes in the transaction network graph according to the following formula Among them, score i represents the anomaly score of node i in the transaction network diagram, and respectively represent the similarity between the negative comparison pair and the positive comparison pair corresponding to node i.

16. The training method of the abnormal node recognition model according to claim 15, wherein The method of fusing the abnormal scores of the nodes in the transaction network graph and the abnormal scores of the nodes in the enhanced perspective graph to obtain the total abnormal score includes: Calculate the total abnormal score according to the following formula Among them, S i represents the total anomaly score, score i represents the anomaly score of node i in the transaction network diagram, represents the anomaly score of node i in the enhanced perspective diagram, and β represents the balance coefficient of the anomaly scores of different perspectives.

17. The training method of the abnormal node recognition model according to claim 16, wherein The method of obtaining the final abnormal score based on the mean and standard deviation of the total abnormal score includes: Calculate the final abnormal score based on the following formula where R represents the number of runs, represents the mean of the total anomaly scores for multiple runs, represents the standard deviation of the total anomaly scores, S i represents the final anomaly score.

18. The training method of the abnormal node recognition model according to claim 1, wherein The transaction account is any one or more of the following: Bank card; Electronic trading account.

19. A method for identifying abnormal trading accounts, characterized in that, Including: Receiving the original transaction data; Clean the original transaction data to remove noise; Construct a transaction network graph based on the cleaned transaction data, where the transaction network graph includes nodes formed by transaction accounts and edges formed by transaction paths, and the nodes include transaction accounts to be identified; and Input the transaction network graph into an abnormal node recognition model obtained by using the training method of the abnormal node recognition model according to any one of claims 1 to 18 to obtain a recognition result.

20. A training device for an abnormal node recognition model, characterized in that, The abnormal node recognition model is used to identify abnormal transaction accounts, and the training device includes: A receiving module that receives a transaction network graph, which includes nodes formed by transaction accounts and edges formed by transaction paths; An enhanced perspective graph construction module for randomly perturbing the transaction network graph to obtain an enhanced perspective graph; A node-to-node comparison model that performs node-to-node contrast learning based on the transaction network graph to obtain a first node-to-node comparison model and performs node-to-node contrast learning based on the enhanced perspective graph to obtain a second node-to-node comparison model; A node-to-subgraph comparison model that performs node-to-subgraph contrast learning based on the transaction network graph to obtain a first node-to-subgraph comparison model and performs node-to-subgraph contrast learning based on the enhanced perspective graph to obtain a second node-to-subgraph comparison model, where the subgraph is obtained by walking from any one node; A fusion module that fuses the first node-to-node comparison model and the first node-to-subgraph comparison model to obtain a first abnormal node recognition model and fuses the second node-to-node comparison model and the second node-to-subgraph comparison model to obtain a second abnormal node recognition model; and A score calculation module for calculating the abnormal score of the nodes in the transaction network graph based on the first abnormal node recognition model and calculating the abnormal score of the nodes in the enhanced perspective graph based on the second abnormal node recognition model, and fusing the abnormal score of the nodes in the transaction network graph and the abnormal score of the nodes in the enhanced perspective graph to obtain a total abnormal score.

21. An abnormal transaction account recognition device, characterized in that, Includes: A receiving module for receiving original transaction data; A preprocessing module for cleaning the original transaction data to remove noise; A transaction network graph construction module for constructing a transaction network graph based on the cleaned transaction data, where the transaction network graph includes nodes formed by transaction accounts and edges formed by transaction paths, and the nodes include transaction accounts to be identified; And An identification module for inputting the transaction network graph into an abnormal node recognition model obtained by using the training method of the abnormal node recognition model according to any one of claims 1 to 18 to obtain a recognition result.

22. A training device for an abnormal node recognition model, characterized in that, Includes: At least one processor; And A memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the training method of the abnormal node recognition model according to any one of claims 1 to 18.

23. An abnormal transaction account recognition device, characterized in that, Includes: At least one processor; And A memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the abnormal transaction account identification method according to claim 19.

24. A computer-readable medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the method according to any one of claims 1 to 18 or the method according to claim 19.

25. A computer device, comprising a storage module, a processor, and a computer program stored on the storage module and executable on the processor, characterized in that, when the processor executes the computer program, it implements the method according to any one of claims 1 to 18 or the method according to claim 19.

26. A computer program product, comprising a computer program, characterized in that, when the computer program is executed by a processor, it implements the method according to any one of claims 1 to 18 or the method according to claim 19.

Images