Graph Training and Fine-tuning Methods for Fraud Detection

Abstract

This invention discloses a graph training and fine-tuning method for fraud detection, comprising the following steps: S1: multi-source graph data integration and characterization; S2: graph structure preprocessing; S3: pre-trained model optimization; S4: few-shot feature engineering and migration; and S5: lightweight fine-tuning and optimization, including both the inference and model fine-tuning stages. Through multi-level feature decoupling and fusion, this method significantly improves the model's sensitivity to fraud patterns and generalization capabilities, while maintaining detection accuracy while reducing reliance on labeled data. This provides an effective technical solution for fraud prevention and control in complex scenarios.

Description

Technical Field

[0001] The present invention relates to the field of electronic digital data processing, and in particular to a graph training and fine-tuning method for fraud detection. Background Art

[0002] With the rapid development of the Internet and financial technology, fraudulent activities are becoming more complex, covert and large-scale. Traditional fraud identification methods based on rules or single-point detection are no longer able to cope with the ever-evolving fraud methods.

[0003] Graph neural networks (GNNs) have become a research hotspot in fraud detection due to their powerful relationship modeling capabilities. However, existing methods face two core challenges: first, the scarcity of labeled data in real-world scenarios limits the performance of supervised learning models; second, multi-source heterogeneous graph data suffers from feature space mismatches and noise interference, which hinders model generalization. Summary of the Invention

[0004] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a graph training fine-tuning method related to fraud detection.

[0005] The object of the present invention is achieved through the following technical solutions:

[0006] A first aspect of the present invention provides a graph training and fine-tuning method for fraud detection, comprising the following steps:

[0007] S1: Multi-source graph data integration and representation, including: collecting and integrating multi-source unlabeled graph data, where the unlabeled graph data includes node set matrix, node attribute set matrix, edge set matrix, and adjacency matrix. The node attribute set matrix, i.e., the original feature matrix, contains the eigenvalues ​​of each node, and the adjacency matrix contains the connection relationships between nodes.

[0008] S2: Graph structure preprocessing, including: performing dimension mapping, normalization, and smoothing on the original feature matrix to obtain an updated feature matrix; using the adjacency matrix and the updated feature matrix, calculating the first difference between the eigenvalue of each node and the average of the eigenvalues ​​of its neighboring nodes; calculating the cosine similarity distance between the first difference of each node and the first difference of other nodes, and recording the k nodes with the largest cosine similarity distance as the positive sample set of each node's high-frequency features;

[0009] S3: Pre-training model optimization, including: inputting the updated feature matrix and the adjacency matrix into the GPR-GNN model, and obtaining the propagation feature matrix after K-step propagation after GRP propagation; based on the propagation feature matrix, calculating the average of the sum of the eigenvalue of each node and the average value of the neighbors to obtain low-frequency features, and calculating the difference between the eigenvalue of each node and the average value of the neighbors to obtain high-frequency features, wherein the average value of the neighbors is specifically the average of the sum of the eigenvalues ​​of the neighboring nodes; calculating the low-frequency feature loss function based on the low-frequency features and the positive sample set of the low-frequency features of each node, and calculating the high-frequency feature loss function based on the high-frequency features and the positive sample set of the high-frequency features of each node, wherein the positive sample set of the low-frequency features of each node includes the neighboring nodes directly connected to the node; using the low-frequency feature loss function and the high-frequency feature loss function to train the GPR-GNN model until the model converges;

[0010] S4: Few-sample feature engineering and migration, including: sequentially performing the multi-source graph data integration and characterization steps and the graph structure preprocessing steps on the collected few-sample graph data related to fraud detection; wherein, in the graph structure preprocessing step, only the updated feature matrix of the few-sample graph data is calculated, and the few-sample graph data specifically refers to a small number of labeled samples;

[0011] S5: Lightweight fine-tuning optimization, including the inference stage and model fine-tuning stage;

[0012] The inference phase includes: inputting the updated feature matrix and adjacency matrix of the few-sample graph data into the frozen GPR-GNN model, performing feature decoupling on the few-sample nodes with labels, that is, calculating the low-frequency features and high-frequency features corresponding to the few-sample nodes with labels; performing the following operations on the low-frequency features and high-frequency features corresponding to the few-sample nodes: inputting them into a lightweight conditional network to generate dynamic prompts, and using element-by-element multiplication to adjust the node embedding to obtain low-frequency node embedding and high-frequency node embedding;

[0013] The model fine-tuning stage includes: inputting low-frequency node embeddings and high-frequency node embeddings into corresponding MLP classifiers for preliminary reasoning, then performing cross-entropy calculation on the importance weights of low-frequency paths and high-frequency paths, integrating the low-frequency node embeddings and high-frequency node embeddings with the corresponding importance weights, using a Softmax classifier to output the prediction results of fraud detection, and fine-tuning models other than the frozen GPR-GNN model using cross-entropy loss.

[0014] Furthermore, in step S1, the collecting and integrating of multi-source unlabeled graph data includes:

[0015] S11: Collect unsupervised graph data from different data sources and integrate them into a unified database, ensuring consistency in data format and structure, and uniformly numbering nodes;

[0016] S12: Identify and remove noise data in the graph, including isolated nodes and duplicate edges;

[0017] S13: For missing node features or edge features, use mean filling or interpolation to fill them;

[0018] S14: Extract the features of each node, the features of the edge, and the connection relationship.

[0019] Furthermore, in step S2, graph structure preprocessing includes the following sub-steps:

[0020] The unlabeled graph data G in step S1 = ( , , ), contains n nodes and m edges, where and They are the node set matrix and the edge set matrix respectively; the node attribute set matrix corresponds to the original feature matrix X, where each row represents the eigenvalue of the node; the connection relationship between nodes is represented by the adjacency matrix express; Collect the original feature matrix of k integrated graph data for step S1, where each Indicates the The node features of the graph data, is the number of nodes, is the characteristic dimension;

[0021] S21: Utilizing the Feature Projection Block , which maps the feature matrix of each graph to a unified feature dimension Above; the feature projection block is expressed as a function:

[0022]

[0023] For each graph data , apply the feature projection block to obtain a feature representation of uniform dimension:

[0024]

[0025] in, It is The unified dimension feature matrix of each graph data after being processed by the feature projection block;

[0026] S22: After feature projection, the unified dimension feature matrix of each graph data Perform normalization to obtain the normalized feature matrix , so that the L2 norm of each eigenvector is 1, which is achieved by the following formula:

[0027]

[0028] in, is the feature matrix The Frobenius norm of ;

[0029] S23: Calculate the smoothness score and sort all features of each node in descending order according to the smoothness score so that features with similar smoothness are aligned in the dimensional space. This is achieved by the following formula:

[0030]

[0031] in, represents the number of edges, and Node and In the Normalized feature matrix on feature dimensions The characteristic value of

[0032] Sort the eigenvalues ​​by smoothness from high to low, and get the updated feature matrix by rearranging the order of the features ;

[0033] S24: For each node , calculate the first difference between the eigenvalue of each node and the average of the eigenvalues ​​of its neighboring nodes:

[0034]

[0035] in, is a node In updating the feature matrix The eigenvalues ​​in is a node The degree of the node The number of neighbor nodes; Representation node With node There is a connection relationship, specifically expressed as the adjacency matrix A The value is 1;

[0036] S25: Calculate the cosine similarity distance between the first difference of each node and the first differences of other nodes, and record the k nodes with the largest cosine similarity distance as the positive sample set of the high-frequency feature of each node.

[0037] Furthermore, in step S21, the feature projection block Using linear transformation, nonlinear activation function, and normalization; when implemented using the fully connected layer of the neural network layer, the formula is as follows:

[0038]

[0039] in, is the weight matrix, is the bias vector, is a non-linear activation function including ReLU.

[0040] Furthermore, in step S3, the pre-trained model optimization includes the following sub-steps:

[0041] S31: Input the updated feature matrix and adjacency matrix into the GPR-GNN model. After GRP propagation, the propagation feature matrix after K steps of propagation is obtained. The specific GRP propagation is:

[0042]

[0043] in, represents the propagation feature matrix after K steps of propagation, It is The weight coefficient of step propagation, is the adjacency matrix with self-loops added, , is the initial node feature matrix, that is, the updated feature matrix ;

[0044] S32: Based on the propagation feature matrix, calculate the average value of each node's feature value and the average value of its neighbors to obtain the low-frequency feature , and calculate the difference between each node's eigenvalue and the average value of its neighbors to obtain the high-frequency feature , where the neighborhood average is specifically the average of the sum of the eigenvalues ​​of the neighboring nodes;

[0045] S33: Based on low-frequency features Calculate the low-frequency feature loss function with the positive sample set of low-frequency features of each node , specifically:

[0046]

[0047] in, is the node set matrix, yes Any node in yes Any node in yes The negative sample node set of low-frequency features, that is, except for the node A randomly selected node outside the positive sample set of low-frequency features; The temperature coefficient calculated for low-frequency features needs to be manually set during model training. It controls the sharpness of the distribution, that is, whether the predicted probability is concentrated in a certain category. is the cosine similarity, which measures the similarity of vectors; for Low-frequency features of nodes, For nodes The positive sample set of the low-frequency features of , including the directly connected neighboring nodes of its node; and Respectively The low-frequency characteristics of the node and Low-frequency features of nodes;

[0048] Based on high-frequency features And the high-frequency feature loss function is calculated based on the positive sample set of each node's high-frequency features , specifically:

[0049]

[0050] in, is the node set matrix, yes Any node in yes Any node in yes The negative sample node set of high-frequency features, that is, except for the node A randomly selected node outside the positive sample set of high-frequency features; The temperature coefficient calculated for high-frequency features needs to be manually set during model training to control the sharpness of the distribution; is the cosine similarity, which measures the similarity of vectors; for High-frequency features of nodes, For nodes The positive sample set of high-frequency features corresponds to the k nodes with the largest cosine similarity distance recorded in step S25 as the positive sample set of high-frequency features of each node; and Respectively High-frequency features of nodes and High-frequency features of nodes;

[0051] S34: Use the low-frequency feature loss function and the high-frequency feature loss function to train the GPR-GNN model until the model converges. The total loss function is:

[0052]

[0053] in, is the balance coefficient, ∈[0,1].

[0054] Furthermore, in step S4, the multi-source graph data integration and characterization step and the graph structure preprocessing step are sequentially performed on the collected fraud detection-related few-sample graph data, using the methods of steps S1 and S2 respectively;

[0055] Among them, in the step of graph structure preprocessing of the few-sample graph data, only the updated feature matrix of the few-sample graph data is calculated, that is, only steps S21 to S23 are executed; the few-sample graph data specifically refers to a small number of samples with labels.

[0056] Furthermore, in step S5, the reasoning stage includes the following sub-steps:

[0057] S51: Input the updated feature matrix and adjacency matrix of the few-sample graph data into the frozen GPR-GNN model to output the original node embedding , embed the original node Perform feature decoupling to obtain the features after feature decoupling , that is, calculating the low-frequency features and high-frequency features corresponding to a small number of sample nodes with labels; the calculation is performed using the method of step S31 and step S32;

[0058] S52: Two lightweight conditional networks CondNet receive the decoupled dual-path features to generate dynamic prompts. The formula is as follows:

[0059]

[0060] Where, are the learnable parameters of CondNet, For nodes Dynamic prompts, two channels corresponding to low-frequency personalized prompts and high-frequency personalized prompts respectively;

[0061] S53: Node embedding adjustment is performed using element-wise multiplication, as follows:

[0062]

[0063] Where, Represents the node embedding adjustment result, and the two paths correspond to low-frequency node embedding and high-frequency node embedding respectively.

[0064] Furthermore, in step S5, the model fine-tuning phase includes the following sub-steps:

[0065] S54: Input the low-frequency node embedding and the high-frequency node embedding into the corresponding MLP classifier for preliminary reasoning, and obtain the output results of the low-frequency node embedding and the high-frequency node embedding input into the two MLP classifiers and ;

[0066] S55: Perform cross entropy calculation on the importance weights of low-frequency paths and high-frequency paths:

[0067]

[0068] , is the classification result of node i output by the MLP classifier in step S54, including and ; The cross entropy calculation result of the classification result is included and , j represents the number of nodes;

[0069]

[0070] in, Indicates the sensitivity of adjusting weight distribution, and represents the weight coefficient;

[0071] S56: Dynamically aggregate the reasoning results of the two paths to obtain the aggregated features , the formula is as follows:

[0072]

[0073] S57: Aggregate features Input to the self-attention layer and use the Softmax classifier to output the prediction result;

[0074] S58: Aggregate features The input is sent to the self-attention layer and the MLP classifier for loss calculation, and the cross entropy loss is calculated using the cross entropy formula in step S55 to fine-tune the models except the frozen GPR-GNN model.

[0075] A second aspect of the present invention provides an electronic device comprising a storage unit and a processing unit, wherein the storage unit stores computer instructions that can be executed on the processing unit, and when the processing unit executes the computer instructions, the processing unit performs the steps of the graph training fine-tuning method for fraud detection as described in the first aspect.

[0076] A third aspect of the present invention provides a storage medium having computer instructions stored thereon, which, when executed, execute the steps of the graph training and fine-tuning method for fraud detection as described in the first aspect.

[0077] The beneficial effects of the present invention are:

[0078] In an exemplary embodiment of the present invention, multi-level feature decoupling and fusion are used to significantly improve the model's sensitivity and generalization ability to fraud patterns, while ensuring detection accuracy and reducing dependence on labeled data, providing an effective technical solution for fraud prevention and control in complex scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 A flowchart of a graph training and fine-tuning method for fraud detection provided in an exemplary embodiment of the present invention;

[0080] Figure 2 A pre-training flow chart of step S3 provided in an exemplary embodiment of the present invention;

[0081] Figure 3 Schematic diagram of training fine-tuning of step S4 provided in an exemplary embodiment of the present invention;

[0082] Figure 4 This is a schematic diagram of inference aggregation in step S5 provided in an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0083] The technical solution of the present invention is described clearly and completely below with reference to the accompanying drawings. It is apparent that the embodiments described are only a portion of the embodiments of the present invention, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0084] In the description of the present invention, it should be noted that the directions or positional relationships indicated by terms such as "center," "up," "down," "left," "right," "vertical," "horizontal," "inside," and "outside" are based on the directions or positional relationships described in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limitations on the present invention. Furthermore, terms such as "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0085] In the description of the present invention, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; mechanical connections or electrical connections; direct connections or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention.

[0086] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0087] See also Figure 1 , Figure 1 A flowchart of a graph training and fine-tuning method for fraud detection provided in an exemplary embodiment of the present invention is shown, comprising the following steps:

[0088] S1: Multi-source graph data integration and representation, including: collecting and integrating multi-source unlabeled graph data, where the unlabeled graph data includes node set matrix, node attribute set matrix, edge set matrix, and adjacency matrix. The node attribute set matrix, i.e., the original feature matrix, contains the eigenvalues ​​of each node, and the adjacency matrix contains the connection relationships between nodes.

[0089] S2: Graph structure preprocessing, including: performing dimension mapping, normalization, and smoothing on the original feature matrix to obtain an updated feature matrix; using the adjacency matrix and the updated feature matrix, calculating the first difference between the eigenvalue of each node and the average of the eigenvalues ​​of its neighboring nodes; calculating the cosine similarity distance between the first difference of each node and the first difference of other nodes, and recording the k nodes with the largest cosine similarity distance as the positive sample set of each node's high-frequency features;

[0090] S3: Pre-training model optimization, including: inputting the updated feature matrix and the adjacency matrix into the GPR-GNN model, and obtaining the propagation feature matrix after K-step propagation after GRP propagation; based on the propagation feature matrix, calculating the average of the sum of the eigenvalue of each node and the average value of the neighbors to obtain low-frequency features, and calculating the difference between the eigenvalue of each node and the average value of the neighbors to obtain high-frequency features, wherein the average value of the neighbors is specifically the average of the sum of the eigenvalues ​​of the neighboring nodes; calculating the low-frequency feature loss function based on the low-frequency features and the positive sample set of the low-frequency features of each node, and calculating the high-frequency feature loss function based on the high-frequency features and the positive sample set of the high-frequency features of each node, wherein the positive sample set of the low-frequency features of each node includes the neighboring nodes directly connected to the node; using the low-frequency feature loss function and the high-frequency feature loss function to train the GPR-GNN model until the model converges;

[0091] S4: Few-sample feature engineering and migration, including: sequentially performing the multi-source graph data integration and characterization steps and the graph structure preprocessing steps on the collected few-sample graph data related to fraud detection; wherein, in the graph structure preprocessing step, only the updated feature matrix of the few-sample graph data is calculated, and the few-sample graph data specifically refers to a small number of labeled samples;

[0092] S5: Lightweight fine-tuning optimization, including the inference stage and model fine-tuning stage;

[0093] The inference phase includes: inputting the updated feature matrix and adjacency matrix of the few-sample graph data into the frozen GPR-GNN model, performing feature decoupling on the few-sample nodes with labels, that is, calculating the low-frequency features and high-frequency features corresponding to the few-sample nodes with labels; performing the following operations on the low-frequency features and high-frequency features corresponding to the few-sample nodes: inputting them into a lightweight conditional network to generate dynamic prompts, and using element-by-element multiplication to adjust the node embedding to obtain low-frequency node embedding and high-frequency node embedding;

[0094] The model fine-tuning stage includes: inputting low-frequency node embeddings and high-frequency node embeddings into corresponding MLP classifiers for preliminary reasoning, then performing cross-entropy calculation on the importance weights of low-frequency paths and high-frequency paths, integrating the low-frequency node embeddings and high-frequency node embeddings with the corresponding importance weights, using a Softmax classifier to output the prediction results of fraud detection, and fine-tuning models other than the frozen GPR-GNN model using cross-entropy loss.

[0095] Specifically, in this exemplary embodiment, efficient detection in a few-sample scenario is achieved through the "pre-training-fine-tuning" paradigm:

[0096] In the pre-training phase (S1-S3), the method first integrates multi-source unsupervised graph data (such as social networks and communication networks), addresses data heterogeneity through feature projection and normalization, and innovatively introduces graph signal smoothness analysis to align and sort feature dimensions to capture structural consistency between nodes. Subsequently, a dual-channel feature learning mechanism is designed: a generalized PageRank algorithm adaptively propagates node information to generate initial features containing topological relationships. By separating low-frequency common features (smooth aggregation of node and neighbor features) and high-frequency difference features (significant differences between nodes and neighbors), the model is optimized using a contrastive loss function, allowing the model to simultaneously learn global patterns and local anomalies.

[0097] During the fine-tuning phase (S4-S5, including some computations in S2 and S3), a dynamic cue learning technique is proposed for low-sample labeled data. By constructing a two-path CondNet network, cue vectors adapted to node characteristics are generated to adjust pre-trained feature representations and address overfitting in low-sample conditions. Furthermore, an adaptive aggregation module based on information entropy is designed to dynamically fuse inference results from high- and low-frequency feature paths. Finally, a self-attention mechanism is used to enhance the representation of key features.

[0098] Compared with traditional methods, this exemplary embodiment significantly improves the model's sensitivity and generalization ability to fraud patterns through multi-level feature decoupling and fusion, reduces dependence on labeled data while ensuring detection accuracy, and provides an effective technical solution for fraud prevention and control in complex scenarios.

[0099] The following content will explain in detail the specific implementation of each step:

[0100] More preferably, in an exemplary embodiment, in step S1, collecting and integrating multi-source unlabeled graph data includes:

[0101] S11: Collect unsupervised graph data from different data sources and integrate them into a unified database, ensuring consistency in data format and structure, and uniformly numbering nodes;

[0102] S12: Identify and remove noise data in the graph, including isolated nodes and duplicate edges;

[0103] S13: For missing node features or edge features, use mean filling or interpolation to fill them;

[0104] S14: Extract the features of each node, the features of the edge, and the connection relationship.

[0105] Specifically, in this exemplary embodiment, in step S11, unsupervised graph data (such as social networks, communication networks, biological networks, etc.) are collected from different data sources, that is, each node in the graph is unlabeled, and integrated into a unified database to ensure consistency in data format and structure, and uniformly number the nodes; and subsequent steps S12 and S13 are basic data processing, and step S14 is data extraction.

[0106] More preferably, in an exemplary embodiment, in step S2, performing graph structure preprocessing includes the following sub-steps:

[0107] The unlabeled graph data G in step S1 = ( , , ), contains n nodes and m edges, where and They are the node set matrix and the edge set matrix respectively; the node attribute set matrix corresponds to the original feature matrix X, where each row represents the eigenvalue of the node; the connection relationship between nodes is represented by the adjacency matrix express; Collect the original feature matrix of k integrated graph data for step S1, where each Indicates the The node features of the graph data, is the number of nodes, is the characteristic dimension;

[0108] S21: Utilizing the Feature Projection Block , which maps the feature matrix of each graph to a unified feature dimension Above; the feature projection block is expressed as a function:

[0109]

[0110] For each graph data , apply the feature projection block to obtain a feature representation of uniform dimension:

[0111]

[0112] in, It is The unified dimension feature matrix of each graph data after being processed by the feature projection block;

[0113] Preferably, the feature projection block Using linear transformation, nonlinear activation function, and normalization; when implemented using the fully connected layer of the neural network layer, the formula is as follows:

[0114]

[0115] in, is the weight matrix, is the bias vector, is a non-linear activation function including ReLU.

[0116] In this way, the feature projection block Unify the feature dimensions of multiple graph datasets to the same dimension so that further analysis and processing can be carried out.

[0117] S22: After feature projection, the unified dimension feature matrix of each graph data Perform normalization to obtain the normalized feature matrix , so that the L2 norm of each eigenvector (i.e. the length of the vector) is 1, which is achieved by the following formula:

[0118]

[0119] in, is the feature matrix The Frobenius norm of .

[0120] S23: Calculate the smoothness score and sort all features of each node in descending order according to the smoothness score so that features with similar smoothness are aligned in the dimensional space. This is achieved by the following formula:

[0121]

[0122] in, represents the number of edges, and Node and In the Normalized feature matrix on feature dimensions The characteristic value of

[0123] Sort the eigenvalues ​​by smoothness from high to low, and get the updated feature matrix by rearranging the order of the features . The lower the value, the more significant the k-th feature is between connected nodes, which means that the feature corresponds to a high-frequency graph signal and exhibits strong heterogeneity. , sort the features from high to low in terms of smoothness. This means that dimensions with high smoothness (i.e. By rearranging the order of features, a new feature matrix can be obtained , where the feature dimensions have been sorted according to their smoothness. This helps align the feature spaces of different graph datasets so that similar feature dimensions have similar smoothness across different datasets.

[0124] It should be noted that the dimension unification in step S22 is the dimension unification of each data set as a whole; and the k feature dimensions in step S23 mean that each node has many features, and there are as many dimensions as there are features. If k is its k-th feature, it is the k-th dimension.

[0125] Specifically, for the calculation of the smoothness score in step S23, all feature dimensions are arranged in descending order according to the smoothness score, so that features with similar smoothness are aligned in the dimensional space, further optimizing the organizational structure of the features. This smoothness score is obtained by calculating the average of the square differences of the kth attribute of the i-th node in each data set on all edges. By calculating the sum of the squares of these attribute value differences and then taking the average, an indicator is obtained to measure the smoothness of the attribute distribution in the graph. By arranging the features in an orderly manner, it is easier to identify and select the most representative features, and the interpretability of the feature space can also be improved. This feature alignment strategy provides a clearer and more ordered feature basis for subsequent feature analysis and graph data modeling. In this way, the graph neural network-based model can learn to automatically filter graph signals with different levels of smoothness and predict anomalies accordingly.

[0126] From the perspective of graph signal processing, the inverse of the low-frequency energy ratio increases monotonically with the degree of anomaly. In other words, high-frequency graph signals often play a more important role in detecting anomalies. Similar findings have been observed from the perspective of spatial graph neural networks, where heterogeneous information plays a crucial role in distinguishing anomalies. The lower the value, the more significant the k-th feature is between connected nodes, which means that the feature corresponds to a high-frequency graph signal and exhibits strong heterogeneity. For the projection features of different datasets, the order of the features can be rearranged according to the descending order of each projection feature to align their feature spaces. For all datasets, the features in the first column are The lowest feature, the model will pay more attention to it.

[0127] S24: For each node , calculate the first difference between the eigenvalue of each node and the average of the eigenvalues ​​of its neighboring nodes:

[0128]

[0129] in, is a node In updating the feature matrix The eigenvalues ​​in is a node The degree of the node The number of neighbor nodes; Representation node With node There is a connection relationship, specifically expressed as the adjacency matrix A The value is 1;

[0130] S25: Calculate the cosine similarity distance between the first difference of each node and the first differences of other nodes, and record the k nodes with the largest cosine similarity distance as the positive sample set of the high-frequency feature of each node.

[0131] Specifically, in this exemplary implementation, a feature projection module is constructed in step S2, which preferably includes a fully connected neural network equipped with a ReLU activation function and a batch normalization layer, maps input features of different dimensions of different data sets to a unified dimensional feature space, uses the L2 norm normalization method to standardize the feature matrix, ensures that all feature vectors have a uniform scale, calculates the smoothness score of each feature dimension on the graph structure, evaluates the consistency of features between adjacent nodes, and arranges all feature dimensions in descending order according to the smoothness score so that features with similar smoothness are aligned in the dimensional space.

[0132] In step S21, constructing a feature projection module is a key technology in graph data analysis. It plays a vital role in integrating and analyzing graph data from different sources. This module maps input features of different dimensions into a unified feature space through a fully connected neural network, which improves the flexibility of data processing and enhances the model's ability to learn features. As the core of the feature projection module, the fully connected neural network can learn the complex relationship between input features and output features. The introduction of the ReLU activation function adds nonlinear characteristics to the network, allowing the network to capture richer feature representations. The batch normalization layer helps to accelerate the network training process and improve the generalization ability of the model.

[0133] In step S22, during the feature projection process, the feature matrix is ​​standardized using the L2 norm normalization method. This method ensures that all feature vectors are compared and analyzed on a unified scale by adjusting the scale of the feature vector, thereby avoiding analysis deviations caused by feature scale differences.

[0134] In step S23, calculating the smoothness score of each feature dimension on the graph structure is an effective way to assess the consistency of features between adjacent nodes. This step quantifies the distribution of features in the graph structure and identifies those with high consistency within the graph structure. These features can better reflect the inherent structure and patterns of the graph data.

[0135] More preferably, in an exemplary embodiment, Figure 2 As shown, in step S3, the pre-training model optimization includes the following sub-steps:

[0136] S31: Input the updated feature matrix and adjacency matrix into the GPR-GNN model. After GRP propagation, the propagation feature matrix after K steps of propagation is obtained. The specific GRP propagation is:

[0137]

[0138] in, represents the propagation feature matrix after K steps of propagation, It is The weight coefficient of step propagation, is the adjacency matrix with self-loops added, , is the initial node feature matrix, that is, the updated feature matrix .

[0139] Specifically, in step S31, the GPR-GNN model first receives the feature data describing the attributes of the nodes in the graph after data preprocessing is completed. and the adjacency matrix of the connection relationship between nodes As input. The GPR-GNN model extracts the initial deep feature representation of the node through a GPR-GNN neural network Traditional graph neural networks (GNNs) are neural networks specialized for processing graph-structured data. Their structure typically includes an input layer that receives node features and an adjacency matrix. A core graph convolutional layer updates node representations by aggregating neighbor node information. This layer may include a pooling layer for graph dimensionality reduction, followed by a fully connected layer that processes node representations. Finally, an output layer provides predictions based on specific tasks (such as node or graph classification). The entire network is trained using a loss function. In the GPR-GNN model, the core graph convolutional layer of the GNN updates node representations by aggregating neighbor node information, replacing it with the GPR method.

[0140] It uses an adaptive information propagation mechanism based on the generalized PageRank principle. The core of this mechanism is that the model can automatically learn a set of adjustable weight parameters. These weight parameters control the influence of each step in the information propagation process (from the node itself to its neighbors at varying distances) on the final result, and these weights can be either positive or negative. The depth of the propagation is determined by a preset number of steps, ensuring that each node incorporates its own information during the calculation. Ultimately, the model outputs a comprehensive feature representation of the node after this adaptive multi-step information propagation process.

[0141] The model has strong adaptive capabilities and can flexibly control the scope and intensity of information propagation in the graph according to the characteristics of specific tasks and data. , can autonomously decide whether to prioritize the node's own features, the information of its immediate neighbors, or the contributions of more distant neighbors, and can even suppress the influence of certain distance information (through negative weights). This flexibility greatly enhances the model's ability to capture complex graph structures and relationships. It also effectively prevents the "oversmoothing" problem where all node features become too similar when information propagates too deeply. It also balances the use of both near-neighbor and distant information, ultimately improving the model's ability to learn effective node representations.

[0142] S32: Based on the propagation feature matrix, calculate the average value of each node's feature value and the average value of its neighbors to obtain the low-frequency feature , and calculate the difference between each node's eigenvalue and the average value of its neighbors to obtain the high-frequency feature , where the neighborhood average is specifically the average of the sum of the eigenvalues ​​of the neighboring nodes. Figure 2 The central node in represents the processing node.

[0143] Specifically, in step S32, after completing the adaptive information propagation in step S31, the model further designs a dual-path feature extraction mechanism:

[0144] One path focuses on capturing the low-frequency signals shared by nodes and their neighbors that change slowly by calculating the average of the sum of the average of each node's features and the average of its neighboring features. ,These signals reflect the similarity and consistency of local regions in the graph;

[0145] The other path calculates the difference between each node feature and the average feature of its neighbors, highlighting the high-frequency signals that are different from those of its neighbors and that change dramatically. , these signals reflect the specificity and boundary information in the graph. The model then calculates the corresponding supervision losses for these two complementary feature perspectives (smooth consistency and significant difference) and integrates them into the final learning objective.

[0146] It enables the model to simultaneously focus on and balance two crucial information modes in graph data. On the one hand, it extracts low-frequency features. This ensures that the model can effectively learn the stable common patterns shared by nodes and their neighbors, which is crucial for identifying community structures or nodes with similar functions. On the other hand, extracting high-frequency features This drives the model to keenly capture the unique and distinctive properties of nodes, which is critical for discovering outliers, classification boundaries, or key connection points. By simultaneously optimizing the losses corresponding to these two complementary features, the model is able to learn a more comprehensive, robust, and informative node representation, significantly improving its ability to distinguish different node types, understand complex graph structures, and cope with noise interference, ultimately optimizing overall performance.

[0147] S33: Based on low-frequency features Calculate the low-frequency feature loss function with the positive sample set of low-frequency features of each node , specifically:

[0148]

[0149] in, is the node set matrix, yes Any node in yes Any node in yes The negative sample node set of low-frequency features, that is, except for the node A randomly selected node outside the positive sample set of low-frequency features; The temperature coefficient calculated for low-frequency features needs to be manually set during model training. It controls the sharpness of the distribution, that is, whether the predicted probability is concentrated in a certain category. is the cosine similarity, which measures the similarity of vectors; for Low-frequency features of nodes, For nodes The positive sample set of the low-frequency features of , including the directly connected neighboring nodes of its node; and Respectively The low-frequency characteristics of the node and Low-frequency features of nodes;

[0150] Based on high-frequency features And the high-frequency feature loss function is calculated based on the positive sample set of each node's high-frequency features , specifically:

[0151]

[0152] in, is the node set matrix, yes Any node in yes Any node in yes The negative sample node set of high-frequency features, that is, except for the node A randomly selected node outside the positive sample set of high-frequency features; The temperature coefficient calculated for high-frequency features needs to be manually set during model training to control the sharpness of the distribution; is the cosine similarity, which measures the similarity of vectors; for High-frequency features of nodes, For nodes The positive sample set of high-frequency features corresponds to the k nodes with the largest cosine similarity distance recorded in step S25 as the positive sample set of high-frequency features of each node; and Respectively High-frequency features of nodes and High-frequency features of nodes;

[0153] S34: Use the low-frequency feature loss function and the high-frequency feature loss function to train the GPR-GNN model until the model converges. The total loss function is:

[0154]

[0155] in, is the balance coefficient, ∈[0,1].

[0156] Specifically, in step S33 and step S34, further calculation processing is performed based on the constructed dual-channel contrastive learning mechanism:

[0157] For low-frequency feature paths, the model adopts a direct-neighbor comparison objective: it requires that the low-frequency representation of each node be as similar as possible to the representation of its first-order neighbor nodes in the feature space. This objective is achieved by calculating the vector similarity between the node and its neighbors, introducing a temperature parameter to adjust the learning difficulty, and selecting non-correlated nodes as counterexamples for comparison optimization on a global scale.

[0158] On high-frequency feature paths, the model employs a completely different comparison strategy: it requires that the high-frequency representation of each node be similarly correlated with a set of k pre-selected nodes (typically from topologically remote regions or regions with significant feature differences) during pre-training. This selection of comparison samples requires custom construction during the data preprocessing stage.

[0159] Ultimately, the model dynamically merges the two contrast losses mentioned above into a unified optimization objective through an adjustable balance parameter, and synchronously updates all parameters during the training process until the model converges and the fixed parameters are used for downstream task reasoning.

[0160] That is to say, in this exemplary embodiment, through the dual-path contrast learning framework, the model has achieved a major breakthrough in the feature decoupling level. The low-frequency contrast mechanism forces the consistency of adjacent nodes in the smooth feature space, effectively capturing the stable common patterns in the local area; while the high-frequency contrast mechanism creatively drives the model to mine the unique properties of nodes across the regular neighborhood range through predefined differentiation anchor points. The two contrast targets work together through adaptive weight coefficients during the training process, which not only avoids the feature bias caused by a single supervisory signal, but also significantly improves the discriminative power of features through a global negative sampling strategy. More importantly, this explicit dual-supervision mechanism enables the model to autonomously balance the relationship between common learning and feature mining, and simultaneously captures community cohesion and boundary discrimination in complex graph structure data, providing a feature representation basis that is both robust and sensitive for subsequent tasks such as node classification and anomaly detection. The entire training process uses end-to-end optimization, and the final parameter freezing mechanism ensures the stable transfer of learning results.

[0161] This technology intelligently separates information in graph data into two complementary dimensions: stable patterns and differential signals. Just as the human eye perceives both outlines and details in an image, this technology enables the model to grasp the overall commonalities of groups of nodes in the graph while sensitively capturing the key differences between individuals. This dual interpretation capability is particularly useful in scenarios that require both understanding common patterns and identifying anomalies. For example, in social network analysis, it can understand the overall characteristics of a community while promptly identifying nodes with anomalous behavior, significantly enhancing the model's comprehensive understanding of complex graph data.

[0162] It should be noted that methods for determining convergence during training can include: (1) a slowing decline in loss: the loss value decreases very little (e.g., changes over multiple epochs). (2) a stable loss: the loss fluctuates slightly around a certain value and no longer decreases significantly. Optimizing models and confirming convergence through loss functions are common techniques in this field.

[0163] More preferably, in an exemplary embodiment, in step S4, the multi-source graph data integration and characterization step and the graph structure preprocessing step are sequentially performed on the collected fraud detection-related few-sample graph data, using the methods of steps S1 and S2 respectively;

[0164] Among them, in the step of graph structure preprocessing of the few-sample graph data, only the updated feature matrix of the few-sample graph data is calculated, that is, only steps S21 to S23 are executed; the few-sample graph data specifically refers to a small number of samples with labels.

[0165] Specifically, in this step, the training dataset is preprocessed and the processed data is input into the frozen model. The training dataset is a few-shot dataset, meaning only a small number of samples have labels, while a large number of samples do not. The training dataset is feature-projected and feature-rearranged, and the processed data is input into the frozen model.

[0166] More preferably, in an exemplary embodiment, Figure 3 As shown, in step S5, the reasoning stage includes the following sub-steps:

[0167] S51: Input the updated feature matrix and adjacency matrix of the few-sample graph data into the frozen GPR-GNN model to output the original node embedding , embed the original node Perform feature decoupling to obtain the features after feature decoupling , that is, calculating the low-frequency features and high-frequency features corresponding to a small number of sample nodes with labels; the calculation is performed using the method of step S31 and step S32;

[0168] Specifically, in step S51, based on the node features output by the frozen main model, a small number of sample nodes with annotations are selected for feature decoupling: low-frequency features reflecting local consistency are generated by fusing the central node features with the average value of its neighbor features (such as Figure 3 The low-frequency features shown in the figure are extracted by the difference between the central feature and the neighborhood mean, and the high-frequency features that highlight the specificity are extracted (such as Figure 3 high-frequency characteristics shown), Figure 3 The central node in represents the processing node.

[0169] S52: Two lightweight conditional networks CondNet receive the decoupled dual-path features to generate dynamic prompts. The formula is as follows:

[0170]

[0171] Where, are the learnable parameters of CondNet, For nodes Dynamic prompts, two channels corresponding to low-frequency personalized prompts and high-frequency personalized prompts respectively;

[0172] Specifically, in step S52, two lightweight conditional networks (CondNet) respectively receive the decoupled dual-path features. Each network consists of only two fully connected layers and dynamically generates two types of key information: high-frequency / low-frequency exclusive prompt vectors customized for each node (used to guide downstream task parameter fine-tuning).

[0173] S53: Node embedding adjustment is performed using element-wise multiplication, as follows:

[0174]

[0175] Where, Represents the node embedding adjustment result, and the two paths correspond to low-frequency node embedding and high-frequency node embedding respectively.

[0176] Specifically, in step S52 , the role of performing node embedding adjustment by element-by-element multiplication is to weight the high- and low-frequency information of the node.

[0177] Specifically, in this exemplary embodiment, this design avoids overfitting of few samples by freezing the main model parameters, and utilizes the dual-stream feature decoupling mechanism to simultaneously maintain the topological stability learned in pre-training (low-frequency pathway) and the differential perception of injected new tasks (high-frequency pathway). The dynamic prompts generated by the lightweight CondNet achieve computationally efficient feature adaptation, enabling the model to quickly capture local structural commonalities and boundary specificity even in scenarios with scarce annotations, significantly improving migration performance.

[0178] More preferably, in an exemplary embodiment, Figure 4 As shown, in step S5, the model fine-tuning stage includes the following sub-steps:

[0179] S54: Input the low-frequency node embedding and the high-frequency node embedding into the corresponding MLP classifier for preliminary reasoning, and obtain the output results of the low-frequency node embedding and the high-frequency node embedding input into the two MLP classifiers and ;

[0180] Specifically, in step S54, the low-frequency and high-frequency node embeddings generated by decoupling in step S53 are respectively input into two independent MLP classifiers for preliminary reasoning.

[0181] S55: Perform cross entropy calculation on the importance weights of low-frequency paths and high-frequency paths:

[0182]

[0183] ( Figure 4 (not shown in the figure) is the classification result of node i output by the MLP classifier in step S54, including and ; The cross entropy calculation result of the classification result is included and , j represents the number of nodes;

[0184]

[0185] in, Indicates the sensitivity of adjusting weight distribution, and Represents the weight coefficient, corresponding to Figure 4 The two cross entropy inputs are placed at the Softmax position;

[0186] Specifically, in step S55, each path dynamically evaluates prediction confidence by calculating the information entropy of the classification results. Low-frequency paths capture the characteristic stability of community commonality patterns, while high-frequency paths reflect the discriminative strength of boundary differences. An adaptive fusion mechanism is then introduced: using adjustable sensitivity parameters, the information entropy of the two paths is converted into weight coefficients. In step S56, weighted aggregation is used to generate a comprehensive representation that combines topological consistency and specificity.

[0187] It should be noted that Represents the cross entropy of the entire classification result, where What is calculated is the cross entropy of the classification of each node. The value stored in pi is in the form of [normal probability, abnormal probability]. The normal probability is * log normal probability + abnormal probability * log abnormal probability.

[0188] S56: Dynamically aggregate the reasoning results of the two paths to obtain the aggregated features , the formula is as follows:

[0189]

[0190] in, Corresponding to Figure 4 Mid- and low-frequency characteristics low The product "X" part with the Softmax output, Corresponding to Figure 4 Mid- and low-frequency characteristics The product "X" part with the Softmax output, Corresponding to Figure 4 The plus sign at the end.

[0191] S57: Aggregate features Input to the self-attention layer and use the Softmax classifier to output the prediction result (not shown in the figure);

[0192] S58: Aggregate features The input is sent to the self-attention layer and the MLP classifier for loss calculation. The cross entropy loss is calculated using the cross entropy formula in step S55 (not shown in the figure). The models other than the frozen GPR-GNN model are fine-tuned.

[0193] In step S57, the fusion results obtained in step S56 are then passed through a self-attention layer to capture cross-band feature interactions, and finally input into a Softmax classifier to output the prediction results. In step S58, the loss is calculated and backpropagation is used to perform lightweight fine-tuning of the CondNet network and the parameters of the aggregate inference.

[0194] Specifically, in step S58,

[0195] This design uses an entropy-driven dynamic weighting mechanism to enable the model to autonomously adjust the fusion ratio based on the predictive certainty of low-frequency features or the discriminative value of high-frequency features. It not only retains the pre-trained model's ability to grasp the commonalities of graph structures, but also enhances the response sensitivity to key difference signals in few-sample tasks. The introduction of the self-attention layer further explores the deep correlation between dual-frequency features, forming a complete representation closed loop from local stability to global discriminability, and ultimately achieves a significant leap in classification performance under conditions of very few labeled samples, while avoiding the overfitting risk brought by complex architectures.

[0196] It should be noted that in subsequent testing or use, the test data or usage data is preprocessed and input into the frozen model. In the fine-tuned Condnet network, the inference aggregation phase , after the self-attention layer and Calculate the classification result of the node, normal or abnormal.

[0197] Having the same inventive concept as the above exemplary embodiment, another exemplary embodiment of the present invention provides an electronic device, including a storage unit and a processing unit, wherein the storage unit stores computer instructions that can be executed on the processing unit, and when the processing unit executes the computer instructions, the steps of the graph training fine-tuning method for fraud detection as described in the first aspect are performed.

[0198] The electronic device is implemented as a general-purpose computing device. Components of the electronic device may include, but are not limited to, the at least one processing unit, the at least one storage unit, and a bus connecting different system components (including the storage unit and the processing unit).

[0199] The storage unit stores program codes that can be executed by the processing unit, so that the processing unit performs the steps according to various exemplary embodiments of the present invention described in the "Exemplary Method" section above. For example, the processing unit can perform the following steps: Figure 1 The method shown in .

[0200] The storage unit may include a readable medium in the form of a volatile memory unit, such as a random access memory unit (RAM) and / or a cache memory unit, and may further include a read-only memory unit (ROM).

[0201] The storage unit may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0202] The bus can represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0203] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. The network adapter communicates with other modules of the electronic device via a bus. It should be understood that other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0204] Through the above description, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented through software or through a combination of software and necessary hardware. Therefore, the technical solution according to this exemplary embodiment can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, a USB flash drive, a mobile hard drive, etc.) or on a network, and includes several instructions to enable a computing device (such as a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to this exemplary embodiment.

[0205] With the same inventive concept as the above exemplary embodiment, another exemplary embodiment of the present invention provides a storage medium having computer instructions stored thereon, which, when executed, execute the steps of the graph training and fine-tuning method for fraud detection as described in the first aspect.

[0206] Based on this understanding, the technical solution of this embodiment, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product (program product). The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention.

[0207] The program product may be implemented in any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0208] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0209] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0210] The program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's device, as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0211] Obviously, the above embodiments are merely examples for clarity of explanation and are not intended to limit the implementation methods. Those skilled in the art will readily appreciate that other variations or modifications can be made based on the above descriptions. It is not necessary and impossible to enumerate all implementation methods here. Obvious variations or modifications derived therefrom remain within the scope of protection of the present invention.

Claims

1. A graph training and fine-tuning method for fraud detection, characterized by: Including the following step: S1: Multi-source graph data integration and representation, including: collecting and integrating multi-source unlabeled graph data, where the unlabeled graph data includes node set matrix, node attribute set matrix, edge set matrix, and adjacency matrix. The node attribute set matrix, i.e., the original feature matrix, contains the eigenvalues ​​of each node, and the adjacency matrix contains the connection relationships between nodes. S2: Graph structure preprocessing, including: performing dimension mapping, normalization, and smoothing on the original feature matrix to obtain an updated feature matrix; using the adjacency matrix and the updated feature matrix, calculating the first difference between the eigenvalue of each node and the average of the eigenvalues ​​of its neighboring nodes; calculating the cosine similarity distance between the first difference of each node and the first difference of other nodes, and recording the k nodes with the largest cosine similarity distance as the positive sample set of each node's high-frequency features; S3: Pre-training model optimization, including: inputting the updated feature matrix and the adjacency matrix into the GPR-GNN model, and obtaining the propagation feature matrix after K-step propagation after GRP propagation; based on the propagation feature matrix, calculating the average of the sum of the eigenvalue of each node and the average value of the neighbors to obtain low-frequency features, and calculating the difference between the eigenvalue of each node and the average value of the neighbors to obtain high-frequency features, wherein the average value of the neighbors is specifically the average of the sum of the eigenvalues ​​of the neighboring nodes; calculating the low-frequency feature loss function based on the low-frequency features and the positive sample set of the low-frequency features of each node, and calculating the high-frequency feature loss function based on the high-frequency features and the positive sample set of the high-frequency features of each node, wherein the positive sample set of the low-frequency features of each node includes the neighboring nodes directly connected to the node; using the low-frequency feature loss function and the high-frequency feature loss function to train the GPR-GNN model until the model converges; S4: Few-sample feature engineering and migration, including: sequentially performing the multi-source graph data integration and characterization steps and the graph structure preprocessing steps on the collected few-sample graph data related to fraud detection; wherein, in the graph structure preprocessing step, only the updated feature matrix of the few-sample graph data is calculated, and the few-sample graph data specifically refers to a small number of labeled samples; S5: Lightweight fine-tuning optimization, including the inference stage and model fine-tuning stage; The inference phase includes: inputting the updated feature matrix and adjacency matrix of the few-sample graph data into the frozen GPR-GNN model, performing feature decoupling on the few-sample nodes with labels, that is, calculating the low-frequency features and high-frequency features corresponding to the few-sample nodes with labels; performing the following operations on the low-frequency features and high-frequency features corresponding to the few-sample nodes: inputting them into a lightweight conditional network to generate dynamic prompts, and using element-by-element multiplication to adjust the node embedding to obtain low-frequency node embedding and high-frequency node embedding; The model fine-tuning stage includes: inputting low-frequency node embeddings and high-frequency node embeddings into corresponding MLP classifiers for preliminary reasoning, then performing cross-entropy calculation on the importance weights of low-frequency paths and high-frequency paths, integrating the low-frequency node embeddings and high-frequency node embeddings with the corresponding importance weights, using a Softmax classifier to output the prediction results of fraud detection, and fine-tuning models other than the frozen GPR-GNN model using cross-entropy loss.

2. The graph training and fine-tuning method for fraud detection according to claim 1, characterized in that: In step S1, the collection and integration of multi-source unlabeled graph data includes: S11: Collect unsupervised graph data from different data sources and integrate them into a unified database, ensuring consistency in data format and structure, and uniformly numbering nodes; S12: Identify and remove noise data in the graph, including isolated nodes and duplicate edges; S13: For missing node features or edge features, use mean filling or interpolation to fill them; S14: Extract the features of each node, the features of the edge, and the connection relationship.

3. The graph training and fine-tuning method for fraud detection according to claim 1, characterized in that: In step S2, graph structure preprocessing includes the following sub-steps: The unlabeled graph data G in step S1 = ( , , ), contains n nodes and m edges, where and are the node set matrix and the edge set matrix respectively; the node attribute set matrix corresponds to the original feature matrix X, where each row represents the eigenvalue of the node; The connection relationship between nodes is represented by the adjacency matrix express; Collect the original feature matrix of k integrated graph data for step S1, where each Indicates the The node features of the graph data, is the number of nodes, is the characteristic dimension; S21: Utilizing the Feature Projection Block , which maps the feature matrix of each graph to a unified feature dimension Above; the feature projection block is expressed as a function: ； For each graph data , apply the feature projection block to obtain a feature representation of uniform dimension: ； in, It is The unified dimension feature matrix of each graph data after being processed by the feature projection block; S22: After feature projection, the unified dimension feature matrix of each graph data Perform normalization to obtain the normalized feature matrix , so that the L2 norm of each eigenvector is 1, which is achieved by the following formula: ； in, is the feature matrix The Frobenius norm of ; S23: Calculate the smoothness score and sort all features of each node in descending order according to the smoothness score so that features with similar smoothness are aligned in the dimensional space. This is achieved by the following formula: ； in, represents the number of edges, and Node and In the Normalized feature matrix on feature dimensions The characteristic value of Sort the eigenvalues ​​by smoothness from high to low, and get the updated feature matrix by rearranging the order of the features ; S24: For each node , calculate the first difference between the eigenvalue of each node and the average of the eigenvalues ​​of its neighboring nodes: ； in, is a node In updating the feature matrix The eigenvalues ​​in is a node The degree of the node The number of neighbor nodes; Representation node With node There is a connection relationship, specifically expressed as the adjacency matrix A The value is 1; S25: Calculate the cosine similarity distance between the first difference of each node and the first differences of other nodes, and record the k nodes with the largest cosine similarity distance as the positive sample set of the high-frequency feature of each node.

4. The graph training and fine-tuning method for fraud detection according to claim 3, characterized in that: In step S21, the feature projection block Using linear transformation, nonlinear activation function, and normalization; when implemented using the fully connected layer of the neural network layer, the formula is as follows: ； in, is the weight matrix, is the bias vector, is a non-linear activation function including ReLU.

5. The graph training and fine-tuning method for fraud detection according to claim 3 or 4, characterized in that: In step S3, the pre-trained model optimization includes the following sub-steps: S31: Input the updated feature matrix and adjacency matrix into the GPR-GNN model. After GRP propagation, the propagation feature matrix after K steps of propagation is obtained. The specific GRP propagation is: ； in, represents the propagation feature matrix after K steps of propagation, It is The weight coefficient of step propagation, is the adjacency matrix with self-loops added, , , represents the adjacency matrix with self-loops added in the k-th step of propagation; is the initial node feature matrix, that is, the updated feature matrix ; S32: Based on the propagation feature matrix, calculate the average value of each node's feature value and the average value of its neighbors to obtain the low-frequency feature , and calculate the difference between each node's eigenvalue and the average value of its neighbors to obtain the high-frequency feature , where the neighborhood average is specifically the average of the sum of the eigenvalues ​​of the neighboring nodes; S33: Based on low-frequency features Calculate the low-frequency feature loss function with the positive sample set of low-frequency features of each node , specifically: ； in, is the node set matrix, yes Any node in yes Any node in yes The negative sample node set of low-frequency features, that is, except for the node A randomly selected node outside the positive sample set of low-frequency features; The temperature coefficient calculated for low-frequency features needs to be manually set during model training. It controls the sharpness of the distribution, that is, whether the predicted probability is concentrated in a certain category. is the cosine similarity, which measures the similarity of vectors; for Low-frequency features of nodes, For nodes The positive sample set of the low-frequency features of , including the directly connected neighboring nodes of its node; and Respectively The low-frequency characteristics of the node and Low-frequency features of nodes; Based on high-frequency features And the high-frequency feature loss function is calculated based on the positive sample set of each node's high-frequency features , specifically: ； in, is the node set matrix, yes Any node in yes Any node in yes The negative sample node set of high-frequency features, that is, except for the node A randomly selected node outside the positive sample set of high-frequency features; The temperature coefficient calculated for high-frequency features needs to be manually set during model training to control the sharpness of the distribution; is the cosine similarity, which measures the similarity of vectors; for High-frequency features of nodes, For nodes The positive sample set of high-frequency features corresponds to the k nodes with the largest cosine similarity distance recorded in step S25 as the positive sample set of high-frequency features of each node; and Respectively High-frequency features of nodes and High-frequency features of nodes; S34: Use the low-frequency feature loss function and the high-frequency feature loss function to train the GPR-GNN model until the model converges. The total loss function is: ； in, is the balance coefficient, ∈[0,1].

6. The graph training and fine-tuning method for fraud detection according to claim 5, characterized in that: In step S4, the multi-source graph data integration and characterization step and the graph structure preprocessing step are sequentially performed on the collected fraud detection-related few-sample graph data, using the methods of steps S1 and S2 respectively; Among them, in the step of graph structure preprocessing of the few-sample graph data, only the updated feature matrix of the few-sample graph data is calculated, that is, only steps S21 to S23 are executed; the few-sample graph data specifically refers to a small number of samples with labels.

7. The graph training and fine-tuning method for fraud detection according to claim 6, characterized in that: In step S5, the inference phase includes the following sub-steps: S51: Input the updated feature matrix and adjacency matrix of the few-sample graph data into the frozen GPR-GNN model to output the original node embedding , embed the original node Perform feature decoupling to obtain the features after feature decoupling , that is, calculating the low-frequency features and high-frequency features corresponding to a small number of labeled sample nodes; Calculated using steps S31 and S32; S52: Two lightweight conditional networks CondNet receive the decoupled dual-path features to generate dynamic prompts. The formula is as follows: ； Where, is the learnable parameter of CondNet For nodes Dynamic prompts, two channels corresponding to low-frequency personalized prompts and high-frequency personalized prompts respectively; S53: Node embedding adjustment is performed using element-wise multiplication, as follows: ； Where, Represents the node embedding adjustment result, and the two paths correspond to low-frequency node embedding and high-frequency node embedding respectively.

8. The graph training and fine-tuning method for fraud detection according to claim 7, characterized in that: In step S5, the model fine-tuning phase includes the following sub-steps: S54: Input the low-frequency node embedding and the high-frequency node embedding into the corresponding MLP classifier for preliminary reasoning, and obtain the output results of the low-frequency node embedding and the high-frequency node embedding input into the two MLP classifiers and ; S55: Perform cross entropy calculation on the importance weights of low-frequency paths and high-frequency paths: ； , is the classification result of node i output by the MLP classifier in step S54, including and ; The cross entropy calculation result of the classification result is included and , j represents the number of nodes; ； in, Indicates the sensitivity of adjusting weight distribution, and represents the weight coefficient; S56: Dynamically aggregate the reasoning results of the two paths to obtain the aggregated features , the formula is as follows: ； S57: Aggregate features Input to the self-attention layer and use the Softmax classifier to output the prediction result; S58: Aggregate features The data is input to the self-attention layer and the MLP classifier for loss calculation. The cross entropy loss is calculated using the cross entropy formula in step S55. The models other than the frozen GPR-GNN model are fine-tuned.

Images