A method for detecting ETC fraud

Abstract

The present invention proposes an ETC fraud detection method, comprising the following steps: collecting multi-source data and constructing a heterogeneous network; dynamically screening high-risk node association topology from the heterogeneous network through a bidirectional graph propagation analysis method; generating a behavioral feature vector through a neural network model, and optimizing the behavioral feature vector based on attribute similarity weighted neighborhood aggregation and spatiotemporal trajectory fusion to obtain an optimized feature vector; fusing static risk value, dynamic risk value, and topological risk value to generate a composite risk index, and triggering a graded response mechanism based on the composite risk index; and outputting a fraud determination result including a multidimensional scoring matrix and an associated topological evidence chain. The present invention overcomes the technical bottlenecks of multi-entity association analysis, dynamic pattern adaptation, and evidence chain construction in ETC fraud detection, achieves high fraud detection coverage, and simultaneously ensures normal traffic efficiency, thus having significant industrial application value.

Description

Technical Field

[0001] The present invention relates to the field of transportation, and in particular to an ETC fraud detection method. Background Art

[0002] The widespread adoption of ETC (Electronic Toll Collection) has significantly improved vehicle traffic efficiency, but it has also led to a variety of complex, coordinated, and covert fraudulent activities, such as vehicle spoofing. Traditional detection methods rely primarily on single-dimensional data such as credit scores and abnormal behavior markers, and follow pre-set rules. Due to a lack of multi-source data correlation mining and path tracing, these complex, coordinated, and covert fraudulent activities not only have extremely low detection success rates but are also prone to false positives and lack a complete chain of evidence. This urgently requires improvement. Summary of the Invention

[0003] To solve the technical problems existing in the background technology, the present invention proposes an ETC fraud detection method comprising the following steps:

[0004] S1, collect multi-source data and build heterogeneous networks;

[0005] S2, dynamically screening high-risk node association topologies from heterogeneous networks through bidirectional graph propagation analysis methods;

[0006] S3. Generate a behavior feature vector through a neural network model, and optimize the behavior feature vector based on attribute similarity weighted neighborhood aggregation and spatiotemporal trajectory fusion to obtain an optimized feature vector;

[0007] S4. A composite risk index is generated by integrating the static risk value, the dynamic risk value, and the topological risk value, and a hierarchical response mechanism is triggered according to the composite risk index;

[0008] S5. Output the fraud determination result including the multi-dimensional scoring matrix and the associated topological evidence chain.

[0009] Furthermore, the method further includes: S6, optimizing network parameters based on the feedback.

[0010] Furthermore, S1 specifically includes: S11, collecting multi-source data; S12 establishing a first relationship database between users and vehicles; establishing a second relationship database between vehicles and devices; establishing a third relationship database between transaction events and geographic space; establishing a fourth relationship database between users and Internet accounts; establishing a fifth relationship database for the ownership and flow of vehicles between users; S13, creating user entity nodes, vehicle entity nodes, device entity nodes, transaction event nodes, geographic location nodes, and Internet account entity nodes; S14, based on the user entity nodes, vehicle entity nodes, device entity nodes, transaction event nodes, geographic location nodes, and Internet account entity nodes, according to the first relationship database, the second relationship database, the third relationship database, the fourth relationship database, and the fifth relationship database, generating a legal ownership relationship chain between users and vehicles, a physical binding authentication chain between vehicles and devices, a spatiotemporal trajectory chain between transaction events and geographic space, an attention interaction chain between users and Internet accounts, and an ownership and flow chain of vehicles between users, thereby completing the construction of a heterogeneous network.

[0011] Furthermore, multi-source data includes: user characteristic data, vehicle characteristic data, device characteristic data, transaction characteristic data and Internet account characteristic data; user characteristic data is specifically fingerprint or face; vehicle characteristic data is specifically engine unique code; device characteristic data is specifically device unique code; transaction characteristic data specifically includes travel time, geographic location and abnormal transaction identification; Internet account characteristic data is specifically account unique identification or login behavior record.

[0012] Furthermore, S1 also includes: S15, real-time monitoring of vehicle status changes and user logout behavior, logical isolation of failed nodes, and regular execution of network weight decay calculation output, thereby realizing dynamic network update records with version identification.

[0013] Furthermore, S2 specifically includes: S21, calculating the timeliness weight of nodes based on the sliding transaction time window; S22, extracting cross-entity association paths through a bidirectional graph propagation analysis method; S23, determining high-risk nodes and high-risk user groups; S24, screening out the association topology of high-risk nodes;

[0014] Among them, the two-way graph propagation analysis method includes: forward tracing the transaction link of the user-bound vehicle, reverse tracing the ownership path of the transaction-related equipment, and integrating to generate a cross-entity association graph.

[0015] Furthermore, S2 also includes: S25, retaining the continuously active node topology and generating a risk network snapshot.

[0016] Furthermore, S3 specifically includes: S31, extracting multi-dimensional original features from heterogeneous networks; S32, inputting the multi-dimensional original features into the neighborhood aggregation module with weighted attribute similarity, and performing weight adjustment propagation within the multi-level neighborhood range, and outputting an intermediate feature vector containing the user-vehicle-device cross-entity association characteristics; S33, inputting the intermediate feature vector into the graph convolution module, performing spatial convolution operations along the transaction association edges, and outputting a high-order feature vector reflecting the risk signal propagation pattern through multi-layer graph convolution iterative analysis; S34, inputting the high-order feature vector into the dynamic trajectory generation module, performing time-space fusion, and multi-dimensionally splicing the time-series cumulative features with the spatial distribution features to generate a spatiotemporal feature vector that integrates the dynamic behavior pattern; S35, constructing positive sample pairs based on the identity authentication strength, maintenance cycle, and spatiotemporal distribution characteristics of normal transaction nodes, and outputting an optimized feature vector with fraud pattern discrimination ability by constraining the similarity of similar features and the distance of heterogeneous features.

[0017] Furthermore, S4 specifically includes: S41, extracting static features, dynamic features, and topological features from the optimized feature vector; S42, generating a static risk value, a dynamic behavior value, and a topological risk value; S43, generating a composite risk index; S44, triggering a hierarchical response mechanism according to the composite risk index;

[0018] Among them, generating a composite risk index includes: normalizing the static risk value, dynamic risk value, and topological risk value, and dynamically allocating weights based on the fraud type; among them, the path jumping fraud type focuses on the dynamic risk value weight, and the identity impersonation fraud type focuses on the static risk value weight.

[0019] Furthermore, S5 specifically includes: S51, receiving the multi-dimensional judgment basis input after optimization from the parameter update phase; S52, performing multi-dimensional analysis; S53, generating judgment conclusions and evidence chains; S54, generating a fraud judgment report including a multi-dimensional scoring matrix.

[0020] This paper proposes a systematic solution that integrates dynamic heterogeneous networks with multi-level feature optimization. The core technology architecture includes the following five key modules:

[0021] 1. Dynamic heterogeneous network construction and maintenance system.

[0022] By integrating user biometrics, vehicle unique codes, device hardware fingerprints, transaction spatiotemporal trajectories, and internet account behavior data, a multi-source association network covering user-vehicle-device-transaction-geographic nodes is constructed. This network integrates multi-dimensional topological structures such as legal ownership chains, physical binding authentication chains, and spatiotemporal trajectory chains, and uses version identification control and weight decay mechanisms to achieve dynamic updates. It monitors vehicle status changes and user deregistration in real time, logically isolates failed nodes, eliminates historical data interference, and improves the timeliness of network topology updates.

[0023] 2. Cross-entity risk map identification system.

[0024] Based on a bidirectional graph propagation analysis method, the system tracks the transaction chain between users and vehicles and traces the ownership path of transaction-related devices backwards, forming a cross-entity association graph. By combining judgment rules such as short-term high-frequency transaction characteristics and hardware fingerprint entropy fluctuations, it accurately identifies complex fraud patterns such as closed-loop paths with temporal and spatial contradictions. A risk network snapshot mechanism persistently stores active topology, providing a structured chain of evidence for judicial evidence collection, including key fields such as device tampering records and abnormal edge weights in transaction paths.

[0025] 3. Multi-level fraud feature optimization engine.

[0026] A neighborhood aggregation module weighted by attribute similarity is designed to integrate static features such as user authentication strength and vehicle maintenance cycles, as well as dynamic features such as the transaction spatiotemporal jump anomaly index. The graph convolution module dynamically adjusts attention weights to enhance the detection sensitivity of irregular transaction interval paths. Combined with a bidirectional gated recurrent unit, it analyzes device fingerprint mutation patterns and transaction behavior deviation trends, generating a spatiotemporal feature vector that incorporates cross-entity correlations. By constraining feature similarity and heterogeneous feature distance, the optimized feature vector significantly improves fraud pattern detection.

[0027] 4. Intelligent risk decision-making and coordinated response mechanism.

[0028] A fusion model of static, dynamic, and topological risk values ​​is constructed: the static risk value integrates user credibility scores and vehicle health indexes, the dynamic risk value calculates transaction time conflict probability and hardware tampering risk level, and the topological risk value calculates fraud node density and cross-provincial transaction path anomaly weights. Weights are dynamically assigned based on a normalized composite risk index, emphasizing dynamic behavior components for path-hopping fraud and static risk components for identity theft. A three-tier coordinated response strategy is implemented: real-time interception of high-risk transactions and initiation of biometric authentication, freezing of abnormal accounts and unbinding of devices, and permanent marking of fraudulent topologies and generation of legal reports, significantly reducing false alarm rates and optimizing response efficiency.

[0029] 5. Adaptive feedback optimization closed loop.

[0030] A reverse learning mechanism is established to integrate interception records, fraud case libraries, and performance metrics, dynamically adjusting neighborhood aggregation weights and graph convolution attention rules. By updating the device fingerprint entropy calculation logic in real time, new hardware parameter tampering attacks can be quickly identified, achieving highly efficient detection and response. This system simultaneously optimizes risk threshold parameters and model decision boundaries, maintaining high fraud detection coverage while ensuring industry-leading efficiency losses in normal traffic, thus overcoming the bottleneck of traditional model iteration lags. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a schematic diagram of the overall process of an implementation method of an ETC fraud detection method of the present invention;

[0032] Figure 2 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0033] Figure 3 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0034] Figure 4 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0035] Figure 5 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0036] Figure 6 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0037] Figure 7 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0038] Figure 8 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0039] Figure 9 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0040] Figure 10 This is a partial flow chart of an embodiment of an ETC fraud detection method of the present invention;

[0041] Figure 11 This is a schematic diagram of the overall process of another embodiment of an ETC fraud detection method of the present invention;

[0042] Figure 12 This is a partial flow chart of another embodiment of an ETC fraud detection method of the present invention;

[0043] Figure 13 This is a partial flow chart of another embodiment of an ETC fraud detection method of the present invention;

[0044] Figure 14 This is a partial flow chart of another embodiment of an ETC fraud detection method of the present invention. DETAILED DESCRIPTION

[0045] refer to Figure 1-10 The present invention proposes an ETC fraud detection method, comprising the following steps:

[0046] S1. Collect multi-source data and build a heterogeneous network. Specifically including:

[0047] S11. Collect multi-source data. Multi-source data includes: user feature data, vehicle feature data, device feature data, transaction feature data, and internet account feature data. User feature data specifically includes fingerprints or facial features; vehicle feature data specifically includes engine unique codes; device feature data specifically includes device unique codes; transaction feature data specifically includes travel time, geographic location, and abnormal transaction identifiers; and internet account feature data specifically includes account unique identifiers or login behavior records.

[0048] S12. Establish a first relationship database between users and vehicles; establish a second relationship database between vehicles and devices; establish a third relationship database between transaction events and geographic space; establish a fourth relationship database between users and Internet accounts; and establish a fifth relationship database for the ownership and flow of vehicles between users.

[0049] S13. Create a user entity node, a vehicle entity node, a device entity node, a transaction event node, a geographic location node, and an Internet account entity node.

[0050] S14. Based on the user entity node, vehicle entity node, device entity node, transaction event node, geographic location node, and Internet account entity node, a legal ownership relationship chain between the user and the vehicle, a physical binding authentication chain between the vehicle and the device, a spatiotemporal trajectory chain between the transaction event and the geographic space, a focus interaction chain between the user and the Internet account, and an ownership flow chain of the vehicle between users are generated according to the first relational database, the second relational database, the third relational database, the fourth relational database, and the fifth relational database, thereby completing the construction of the heterogeneous network.

[0051] S15. Real-time monitoring of vehicle status changes and user logout behavior, logical isolation of failed nodes, and regular execution of network weight decay calculation outputs, thereby achieving dynamic network update records with version identification.

[0052] S2. Dynamically screen high-risk node association topologies from heterogeneous networks using a bidirectional graph propagation analysis method. This includes:

[0053] S21. Calculate the timeliness weight of the node based on the sliding transaction time window. Specifically including:

[0054] S211. Collect real-time transaction time series data of device physical nodes.

[0055] S212: Perform real-time analysis on the transaction time series data of the device entity node, and generate risk identification information for the device entity node with short-term high-frequency transaction characteristics.

[0056] Specifically, real-time analysis of transaction time series data from device nodes is performed. The frequency and temporal distribution of transactions within a preset timeframe are analyzed to identify unusually active device nodes. Risk identification information is generated for device nodes with short-term, high-frequency trading patterns. This process inherits the version identification of dynamic network update records in heterogeneous networks to ensure that timeliness weight calculations are synchronized with network decay operations.

[0057] Specifically, the bidirectional graph propagation analysis method includes: forward tracing the transaction link of users binding vehicles, reverse tracing the ownership path of transaction-related devices, and integrating to generate a cross-entity association graph.

[0058] S22. Extract cross-entity association paths through bidirectional graph propagation analysis method.

[0059] Specifically, the association relationship between the user archive, vehicle registration database, and device fingerprint database is called, the transaction link of the user entity node binding the vehicle entity node is forward traced, the attribution path of the transaction event node associated with the device entity node is reversely traced, and the forward tracing results and the reverse tracing results are integrated to form a cross-entity association map.

[0060] S23. Determine high-risk nodes and high-risk user groups.

[0061] The criteria for determining high-risk nodes include, but are not limited to, one or more of the following:

[0062] The number of vehicle physical nodes bound to user physical nodes exceeds the preset threshold, the vehicle physical nodes frequently change the device physical node binding relationship within a limited time, the hardware fingerprint characteristics of the device physical nodes do not match the registration information characteristics, the cross-administrative region time interval of the transaction event nodes is lower than the requirements of traffic regulations, the transaction event nodes continuously trigger abnormal transaction identification, and the transaction path characteristics violate the laws of physical space movement.

[0063] The basis for determining high-risk user groups includes but is not limited to one or more of the following: the user entity node is repeatedly associated with the high-risk device entity node within a limited time, the formation of abnormal transaction closed-loop paths between user entity nodes, and abnormal login behavior of the Internet account feature data synchronization of the user entity node.

[0064] S24. Filter out the associated topology of high-risk nodes. The basis for determining the associated topology of high-risk nodes includes, but is not limited to, one or more of the following:

[0065] A single device entity node is alternately associated with multiple vehicle entity nodes with different locations, transaction trajectories form a closed-loop path with temporal and spatial logical contradictions between geographic location nodes, and risk signals show exponential diffusion characteristics through the link between user entity nodes, vehicle entity nodes, and then device entity nodes.

[0066] S25. Keep the continuously active node topology and generate a risk network snapshot.

[0067] Specifically, a list of candidate nodes and associated path graphs are obtained, the monitoring priority is adjusted according to the most recent update time of the topology structure, and active topologies that meet the weight decay calculation conditions are persistently stored.

[0068] This process inherits the logical isolation rules in the dynamic network update records, ensuring that the screening results form a logical closed loop with the user entity node deregistration behavior and vehicle entity node status change records. At the same time, it can provide a complete topological input for the subsequent behavior feature vector generation module.

[0069] S3. Generate a behavior feature vector through a neural network model and optimize the behavior feature vector based on attribute similarity weighted neighborhood aggregation and spatiotemporal trajectory fusion to obtain an optimized feature vector. Specifically, it includes:

[0070] S31. Extract multi-dimensional raw features from heterogeneous networks.

[0071] Specifically, the multi-dimensional original features include: the identity authentication strength feature of the user entity node, the maintenance cycle feature of the vehicle entity node, the hardware fingerprint entropy feature of the device entity node, and the spatiotemporal distribution feature of the transaction event node. Among them, the biometric matching degree and the device binding history can be integrated and calculated to generate the identity authentication strength feature, which inherits the user entity node deregistration behavior monitoring results; the maintenance cycle feature can be generated based on the integrity of the vehicle maintenance record and the quantification of the fault code association frequency, and the maintenance cycle feature is associated with the vehicle entity node status change record; the hardware fingerprint entropy feature can be obtained based on the consistency analysis of the device parameter discreteness and the firmware version, and the hardware fingerprint entropy feature inherits the hardware fingerprint verification result of the device entity node; the cross-provincial transaction density and the geographical path rationality are jointly calculated to obtain the spatiotemporal distribution feature, which can be integrated with the spatiotemporal trajectory chain data.

[0072] S32. Input the multi-dimensional original features into the attribute similarity weighted neighborhood aggregation module, perform weight adjustment propagation within the multi-level neighborhood range, and output an intermediate feature vector containing the user-vehicle-device cross-entity association characteristics.

[0073] The “neighborhood aggregation module for inputting multi-dimensional original features into attribute similarity weighted” specifically includes:

[0074] S321. Aggregate average maintenance cycle characteristics of vehicle entity nodes bound to user entity nodes to associate the topology structure of the legal ownership relationship chain.

[0075] S322. Extract the spatiotemporal jump anomaly index of the transaction event node associated with the vehicle entity node and inherit the dynamic analysis results of the spatiotemporal trajectory chain.

[0076] S323: Count the discrete values ​​of the identity authentication strength characteristics of the user entity node associated with the device entity node to integrate the change record of the physical binding authentication chain.

[0077] S33. Input the intermediate feature vector into the graph convolution module, perform spatial convolution operations along the transaction-related edges, and iteratively analyze through multi-layer graph convolution to output a high-order feature vector that reflects the risk signal propagation pattern.

[0078] Furthermore, the “inputting the intermediate feature vector into the graph convolution module and performing spatial convolution operations along the transaction association edges” is specifically as follows: constructing an attention weight matrix in the multi-entity association structure, automatically enhancing the path weight when it is detected that the adjacent transaction intervals of the device entity node violate traffic regulations, and reducing the confidence of the association edge when it is found that the user entity node is bound to multiple vehicle entity nodes and shares similar hardware fingerprint features.

[0079] S34. Input the high-order feature vector into the dynamic trajectory generation module, perform time-series space fusion, perform multi-dimensional splicing of the time series cumulative features and the spatial distribution features, and generate a spatiotemporal feature vector that integrates the dynamic behavior pattern.

[0080] The aforementioned “inputting high-order feature vectors into a dynamic trajectory generation module and performing time-space fusion” specifically involves: using a bidirectional gated recurrent unit to parse continuous transaction sequences, using forward cumulative features to capture the mutation pattern of device fingerprint entropy values, and using backward correlation features to identify the degree of deviation between transaction behaviors and historical time-space distributions.

[0081] S35. Construct positive sample pairs based on the identity authentication strength, maintenance cycle, and spatiotemporal distribution characteristics of normal transaction nodes. By constraining the similarity of similar features and the distance between heterogeneous features, output optimized feature vectors with fraud pattern discrimination capabilities.

[0082] S4. A composite risk index is generated by integrating the static risk value, the dynamic risk value, and the topological risk value. A hierarchical response mechanism is triggered based on the composite risk index, as follows:

[0083] S41. Extract static features, dynamic features, and topological features from the optimized feature vector.

[0084] Among them, static features include user identity authentication strength features and vehicle maintenance cycle features; user identity authentication strength features are generated by the fusion calculation of biometric matching degree and device binding duration, and inherit the user entity node deregistration behavior monitoring results; vehicle maintenance cycle features are generated by the quantification of vehicle maintenance record integrity and fault code association frequency, and are associated with vehicle entity node status change records.

[0085] Dynamic features include transaction time interval anomaly and device fingerprint entropy volatility. The transaction time interval anomaly is calculated by determining whether adjacent transaction intervals meet the minimum traffic regulations. The device fingerprint entropy volatility is generated based on the trend analysis of hardware parameter discreteness changes and inherits the hardware fingerprint verification results of the device physical node.

[0086] The topological features include the risk propagation intensity of associated nodes and the abnormal edge weight of transaction paths; the risk propagation intensity of associated nodes is calculated by calculating the density of fraud nodes in a multi-hop neighborhood; the abnormal edge weight of transaction paths is generated based on whether the attention weight of cross-provincial transaction paths exceeds the preset standard, and is integrated with the dynamic analysis results of the spatiotemporal trajectory chain.

[0087] S42: Generate static risk value, dynamic behavior value and topological risk value. Specifically including:

[0088] The "generating a static risk value" specifically includes: generating a credibility score based on the user's identity authentication strength characteristics and matching the user's credit rating standards, analyzing the vehicle's maintenance cycle characteristics and then calculating the vehicle's health index based on the maintenance missing records and the frequency of fault codes, and integrating the credibility score and the health index into a static risk value according to industry standard weight distribution rules.

[0089] The "generating dynamic behavior values" specifically includes: counting the conflict probability of the abnormality of transaction time intervals, analyzing the hardware tampering risk level of the device fingerprint entropy value volatility, and dynamically adjusting the weights of the two types of indicators based on the transaction frequency and then fusing them into a dynamic risk value.

[0090] The "generating topological risk value" specifically includes: extracting the proportion of fraudulent nodes in a multi-hop neighborhood to calculate the risk propagation intensity, counting the total weight of abnormal edges in cross-provincial transaction paths, and dynamically adjusting the parameter contribution according to the complexity of the topological structure and then fusing them into a topological risk value.

[0091] S43. Generate a composite risk index.

[0092] Specifically, the static, dynamic, and topological risk values ​​are normalized to eliminate dimensional differences, and then dynamically assigned weights based on fraud type. For path-hopping fraud, the dynamic behavior component weighting is emphasized, while for identity theft fraud, the static risk component weighting is strengthened. After weighted fusion, a composite risk index is output.

[0093] In this embodiment, generating a composite risk index includes normalizing the static risk value, dynamic risk value, and topological risk value, and dynamically allocating weights based on the fraud type; wherein, the path jumping fraud type focuses on the dynamic risk value weight, and the identity impersonation fraud type focuses on the static risk value weight.

[0094] S44. Trigger a graded response mechanism based on the composite risk index.

[0095] Specifically, when the composite risk index exceeds the mild fraud threshold, the first-level response mechanism is triggered to intercept the current transaction in real time and initiate biometric secondary authentication; when the composite risk index reaches the moderate fraud threshold, the second-level response mechanism is triggered to freeze cross-provincial high-frequency transaction-related accounts, forcibly unbind the abnormal equipment entity node binding relationship, and associate the vehicle maintenance cycle characteristics to check historical risks; when the composite risk index reaches the major fraud threshold, the third-level response mechanism is triggered, the fraud topology subgraph is permanently marked, and a judicial evidence report is generated.

[0096] S5. Output fraud determination results including a multi-dimensional scoring matrix and associated topological evidence chain. Specifically including:

[0097] S51, receiving the multi-dimensional judgment basis input after optimization in the parameter update phase.

[0098] Specifically, the judgment basis is divided into spatial dimension basis, temporal dimension basis, device dimension basis, and fraud judgment result basis. The spatial dimension basis includes the statistical value of cross-provincial transaction frequency and the results of geographical path rationality analysis; the temporal dimension basis includes the transaction time window density distribution characteristics and the compliance detection data of adjacent transaction intervals; the device dimension basis includes the on-board unit signal fingerprint similarity matching value and the historical record of hardware parameter mutation; the fraud judgment result is based on the spatial dimension comprehensive analysis data of the frequency of inter-provincial boundary breakthroughs, the temporal dimension detection data of the transaction time window density, and the device dimension verification data after the on-board unit signal fingerprint similarity.

[0099] S52. Perform multi-dimensional analysis.

[0100] Specifically, the analysis process needs to call the graph convolution attention calculation rule framework reconstructed in the parameter update phase to enhance the sensitivity to abnormal correlation paths across entities.

[0101] "Performing multi-dimensional analysis" specifically means: converting the multi-dimensional judgment basis into spatial anomaly judgment and temporal contradiction judgment.

[0102] Spatial anomaly assessment is performed by comparing the degree of deviation between cross-provincial transaction frequencies and the historically normal fluctuation range for the same vehicle type, and combining this with the consistency between geographic routes and the actual road network topology to generate a spatial anomaly score reflecting the fraud risk level. For example, detecting traffic records on unopened road sections can trigger a score surge mechanism.

[0103] Timing discrepancies are determined by analyzing whether the density distribution of transaction time windows conforms to human driving behavior and verifying whether the intervals between adjacent transactions meet the minimum travel time requirements stipulated by traffic regulations. This generates a timing dimension anomaly score reflecting the level of suspicion of time manipulation. For example, a high-frequency fixed-interval transaction pattern will trigger a cumulative scoring mechanism.

[0104] S53. Generate judgment conclusion and evidence chain. Specifically including:

[0105] S531. The spatial dimension anomaly score, the temporal dimension anomaly score, and the device dimension anomaly score are integrated, and the risk quantification value output by the composite risk index calculation module is superimposed to generate a comprehensive fraud probability.

[0106] S532: Generate a judgment conclusion.

[0107] Specifically, when all three types of scores exceed the dynamic calibration threshold, it is judged as collaborative fraud; when the spatial and temporal dimension scores jointly exceed the standard, it is judged as path forgery fraud.

[0108] S533. Build a chain of evidence.

[0109] Specifically, the abnormal records of the identity authentication strength characteristics of the associated user entity node are used to strengthen the basis for determining identity fraud, the missing data of the maintenance cycle characteristics of the bound vehicle entity node are used to support the suspicion of duplicate license plate vehicles, and the propagation path of historical risks within the three-hop neighborhood is traced to verify the continuity of the fraud pattern.

[0110] S54. Generate a fraud determination report including a multi-dimensional scoring matrix.

[0111] Specifically, the fraud determination report annotates core anomaly features and associated entity node topology, triggering a response mechanism to execute record writeback operations and update the dynamic heterogeneous network node status. For example, intercepted transaction numbers are added to a blacklist, associated accounts are frozen, fraudulent nodes are marked, and dormant anomaly-associated edges are synchronized to prevent the spread of risk. The network status update data output from this phase serves as a new input source for the network parameter optimization phase, forming a closed detection loop.

[0112] S6. Optimize network parameters based on feedback.

[0113] The process of optimizing network parameters based on feedback includes dynamic updating of node attribute weights, iterative reconstruction of topology association rules, and balancing and adjusting detection performance indicators, ensuring quantitative consistency between the risk propagation intensity index of the composite risk index calculation module and the multi-dimensional anomaly score of the fraud determination result output module.

[0114] The “optimization of network parameters based on feedback” specifically includes:

[0115] S61. Obtain feedback data.

[0116] The feedback data specifically includes the first type of feedback data that uses the hierarchical response execution results triggered by the composite risk index as the data source, the second type of feedback data that uses the confirmed fraud case feature library data as the data source, and the third type of feedback data that uses the model performance indicator data as the data source; the hierarchical response execution results triggered by the composite risk index include the transaction interception record files, biometric secondary authentication pass rate statistics files, and abnormal device entity node unbinding operation log files generated by the hierarchical response mechanism; the confirmed fraud case feature library data includes abnormal path pattern set data, identity fraud behavior set data, etc.; the model performance indicator data includes performance indicator data such as false alarm rate statistics and fraud detection coverage, as well as response action execution delay time records. The above feedback data inherits the risk judgment logic of the composite risk index calculation module and provides reverse verification support for the multi-dimensional joint analysis of the fraud judgment result output module.

[0117] S62: Generate an optimization strategy.

[0118] The optimization strategy forms a dynamic mapping relationship with the weight allocation rule of the composite risk index calculation module, and at the same time injects feature evolution basis into the intermediate judgment generation process of the fraud judgment result output module. Among them, the optimization strategy specifically includes but is not limited to one or more of the following: for the fraud feature patterns that appear frequently in real-time interception data, increase the weight ratio parameters of the corresponding fraud features in the neighborhood aggregation module; based on the biometric secondary authentication failure record file, reduce the initial confidence parameters of the identity authentication strength characteristics of the associated user entity node; extract the common abnormal edge weight patterns of cross-entity association paths in historical fraud cases, and reconstruct the attention calculation rule framework of the graph convolution module; update the hardware fingerprint entropy value feature calculation logic of the device entity node; reversely adjust the weight distribution ratio coefficient of the static risk value, dynamic risk value and topological risk value based on the false alarm rate fluctuation trend; according to the distribution characteristics of the fraud detection coverage gap, adjust the response threshold sensitivity parameters of specific fraud scenarios in a targeted manner.

[0119] S63: Execute parameter update.

[0120] The execution parameter update specifically includes but is not limited to one or more of the following: injecting adjusted feature weight parameters into the neighborhood aggregation module, enhancing the influence parameters of abnormal transaction paths in the feature propagation process, resetting the identity authentication strength feature baseline standard of user entity nodes, synchronously updating the dynamic heterogeneous network node attribute information library, deploying the reconstructed graph convolution attention calculation rule framework, blocking fraudulent behaviors implemented through historical vulnerabilities, applying the dynamically calibrated composite risk index threshold parameters, realizing the coordinated optimization of real-time interception of high-risk transactions and normal traffic efficiency, activating the adaptive learning mechanism to continuously absorb new attack mode data in the fraud judgment report, and optimizing the decision boundary parameters of the neural network model.

[0121] This paper proposes a systematic solution that integrates dynamic heterogeneous networks with multi-level feature optimization. The core technology architecture includes the following five key modules:

[0122] 1. Dynamic heterogeneous network construction and maintenance system.

[0123] By integrating user biometrics, vehicle unique codes, device hardware fingerprints, transaction spatiotemporal trajectories, and internet account behavior data, a multi-source association network covering user-vehicle-device-transaction-geographic nodes is constructed. This network integrates multi-dimensional topological structures such as legal ownership chains, physical binding authentication chains, and spatiotemporal trajectory chains, and uses version identification control and weight decay mechanisms to achieve dynamic updates. It monitors vehicle status changes and user deregistration in real time, logically isolates failed nodes, eliminates historical data interference, and improves the timeliness of network topology updates.

[0124] 2. Cross-entity risk map identification system.

[0125] Based on a bidirectional graph propagation analysis method, the system tracks the transaction chain between users and vehicles and traces the ownership path of transaction-related devices backwards, forming a cross-entity association graph. By combining judgment rules such as short-term high-frequency transaction characteristics and hardware fingerprint entropy fluctuations, it accurately identifies complex fraud patterns such as closed-loop paths with temporal and spatial contradictions. A risk network snapshot mechanism persistently stores active topology, providing a structured chain of evidence for judicial evidence collection, including key fields such as device tampering records and abnormal edge weights in transaction paths.

[0126] 3. Multi-level fraud feature optimization engine.

[0127] A neighborhood aggregation module weighted by attribute similarity is designed to integrate static features such as user authentication strength and vehicle maintenance cycles, as well as dynamic features such as the transaction spatiotemporal jump anomaly index. The graph convolution module dynamically adjusts attention weights to enhance the detection sensitivity of irregular transaction interval paths. Combined with a bidirectional gated recurrent unit, it analyzes device fingerprint mutation patterns and transaction behavior deviation trends, generating a spatiotemporal feature vector that incorporates cross-entity correlations. By constraining feature similarity and heterogeneous feature distance, the optimized feature vector significantly improves fraud pattern detection.

[0128] 4. Intelligent risk decision-making and coordinated response mechanism.

[0129] A fusion model of static, dynamic, and topological risk values ​​is constructed: the static risk value integrates user credibility scores and vehicle health indexes, the dynamic risk value calculates transaction time conflict probability and hardware tampering risk level, and the topological risk value calculates fraud node density and cross-provincial transaction path anomaly weights. Weights are dynamically assigned based on a normalized composite risk index, emphasizing dynamic behavior components for path-hopping fraud and static risk components for identity theft. A three-tier coordinated response strategy is implemented: real-time interception of high-risk transactions and initiation of biometric authentication, freezing of abnormal accounts and unbinding of devices, and permanent marking of fraudulent topologies and generation of legal reports, significantly reducing false alarm rates and optimizing response efficiency.

[0130] 5. Adaptive feedback optimization closed loop,

[0131] A reverse learning mechanism is established to integrate interception records, fraud case libraries, and performance metrics, dynamically adjusting neighborhood aggregation weights and graph convolution attention rules. By updating the device fingerprint entropy calculation logic in real time, new hardware parameter tampering attacks can be quickly identified, achieving highly efficient detection and response. This system simultaneously optimizes risk threshold parameters and model decision boundaries, maintaining high fraud detection coverage while ensuring industry-leading efficiency losses in normal traffic, thus overcoming the bottleneck of traditional model iteration lags.

[0132] refer to Figure 11-14 Another specific embodiment of the present invention provides an ETC fraud detection method, comprising:

[0133] S101, Dynamic Heterogeneous Network Construction. Including:

[0134] S1011. Data collection and node creation.

[0135] Collect the driver's biometrics to generate a user feature node, collect the truck's engine code to generate a vehicle feature node, and collect the ETC hardware's unique code to generate a device feature node.

[0136] Create transaction event nodes and geographic location nodes to establish initial node associations.

[0137] S1012: Generate a relationship chain.

[0138] Among them, the relationship chain includes: legal attribution chain, physical binding chain, dynamic update chain, and space-time trajectory chain; the legal attribution chain binds the driver node to the truck node; the physical binding chain binds the initial device node to the truck node; the dynamic update chain generates a new binding relationship chain when the driver registers a new device node through a non-bound user; the space-time trajectory chain generates a passage record for the truck node through the new device node, associating the transaction time and geographic location.

[0139] S1013. Real-time update of heterogeneous networks.

[0140] Specifically, when the initial device node is deregistered due to arrears, logical isolation is performed and historical bindings are retained; after the new device node is activated, the network version identifier is updated and the truck node binding change event is recorded.

[0141] S102, dynamic screening of high-risk topologies. Specifically including:

[0142] S1021. Timeliness weight calculation. Identify the continuous access records after the new device node is bound. If the time series shows short-term high-frequency transaction characteristics and is superimposed with the initial device deregistration record due to arrears, mark it as abnormally active after the device replacement.

[0143] S1022. Extract cross-entity association graphs. Specifically including:

[0144] Forward tracing, reverse tracing and graph generation.

[0145] Forward tracing: from the driver node to the truck node and then to the new device node;

[0146] Reverse tracing: The new transaction event node is connected to the new device node and then to the non-bound user node;

[0147] Graph generation: The driver node is connected to the truck node and then to the new device node, while the new device node is connected to the non-bound user node.

[0148] S1023. Determine high-risk nodes.

[0149] Specifically, nodes that meet both of the following characteristics are marked as high-risk nodes:

[0150] First, truck nodes frequently change device bindings within a limited timeframe, including immediately binding new devices after cancellation due to arrears.

[0151] Second, the non-bound user node is only associated with a single truck and has no other vehicle usage records.

[0152] S1024, fraud topology verification.

[0153] Specifically, when the truck node is alternately associated with device nodes of different affiliations, for example, the initial device belongs to the driver and the new device belongs to an unbound user, a snapshot of the complete association path of the driver, truck, and new device unbound user is saved.

[0154] S103, behavioral feature optimization and risk quantification. Specifically including:

[0155] S1031. Multi-dimensional feature extraction. For example:

[0156] From the user node dimension, we extract the features of non-bound user nodes with abnormal identity authentication strength, such as no driving qualifications or no historical transactions; from the truck node dimension, we extract the features of truck nodes with normal maintenance cycles but sudden changes in binding relationships; from the new device node dimension, we extract the features of new device nodes with hardware fingerprint entropy values ​​that present completely new features; from the transaction event node dimension, we extract the features of transaction event nodes that appear to pass across provinces immediately after the new device is activated.

[0157] S1032, critical path detection. Specifically, the driver node is indirectly linked to the non-bound user node through the truck node, forming a risk diffusion path; if the new transaction event is close in time and space to the overdue payment event but the device fingerprint is not associated, a time-space jump anomaly is triggered.

[0158] S1033. Calculation of composite risk index.

[0159] The compound risks specifically include: static risk: the identity strength of non-bound users is extremely low and is compounded by the driver's arrears record; dynamic risk: the transaction frequency surges after equipment replacement and there is no buffer period; topological risk: the truck binding change path shows the characteristics of fraud spread.

[0160] When the composite risk index exceeds the threshold, it is determined to be organized identity fraud.

[0161] S104. Response mechanism and fraud determination. The response mechanism is specifically a three-level response mechanism:

[0162] Level 1: Intercept the current transaction and freeze the non-bound user account;

[0163] Level 2: Forcefully unbind the new device from the truck;

[0164] Level 3: Cross-platform tracing of the temporal and spatial correlation between the driver’s overdue payment behavior and the binding of new equipment.

[0165] S105. Multi-dimensional fraud determination.

[0166] Multiple dimensions include:

[0167] Device dimension: New device binding violates usage rights rules, for example, non-bound users do not have the right to use a truck;

[0168] Spatial dimension: The truck's travel trajectory remains unchanged, but the payment subject switches from the driver to a non-bound user;

[0169] Timing dimension: The interval between cancellation of overdue payments and activation of new equipment is too short, which violates the normal repayment cycle.

[0170] The above are only preferred specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with this technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solutions and inventive concepts of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. An ETC fraud detection method, characterized in that: The steps include: S1, collect multi-source data and build heterogeneous networks; S2, dynamically screening high-risk node association topologies from heterogeneous networks through bidirectional graph propagation analysis methods; S3. Generate behavioral feature vectors for the selected high-risk node association topology through a neural network model, and optimize the behavioral feature vectors based on attribute similarity weighted neighborhood aggregation and spatiotemporal trajectory fusion to obtain optimized feature vectors; S4. Extract static features, dynamic features, and topological features from the optimized feature vector to generate a static risk value, a dynamic behavior value, and a topological risk value. Fuse the static risk value, the dynamic risk value, and the topological risk value to generate a composite risk index, and trigger a graded response mechanism based on the composite risk index. S5. Output a fraud determination result including a multi-dimensional scoring matrix and an associated topological evidence chain; Among them, step S3 specifically includes: S31, extracting multi-dimensional original features from heterogeneous networks; S32, inputting the multi-dimensional original features into the neighborhood aggregation module with weighted attribute similarity, and performing weight adjustment propagation within the multi-level neighborhood range, and outputting an intermediate feature vector containing the user-vehicle-device cross-entity association characteristics; S33, inputting the intermediate feature vector into the graph convolution module, performing spatial convolution operations along the transaction association edges, and outputting a high-order feature vector reflecting the risk signal propagation pattern through multi-layer graph convolution iterative analysis; S34, inputting the high-order feature vector into the dynamic trajectory generation module, performing time-space fusion, and multi-dimensionally splicing the time-series cumulative features and spatial distribution features to generate a spatiotemporal feature vector that integrates the dynamic behavior pattern; S35, constructing positive sample pairs based on the identity authentication strength, maintenance cycle, and spatiotemporal distribution characteristics of normal transaction nodes, and outputting an optimized feature vector with fraud pattern discrimination ability by constraining the similarity of similar features and the distance of heterogeneous features.

2. The method according to claim 1, characterized in that Also includes: S6. Optimize network parameters based on feedback.

3. The method according to claim 1, characterized in that S1 specifically includes: S11, collecting multi-source data; S12 establishing a first relationship database between users and vehicles; establishing a second relationship database between vehicles and devices; establishing a third relationship database between transaction events and geographic space; establishing a fourth relationship database between users and Internet accounts; establishing a fifth relationship database for the ownership and flow of vehicles between users; S13, creating user entity nodes, vehicle entity nodes, device entity nodes, transaction event nodes, geographic location nodes, and Internet account entity nodes; S14, based on the user entity nodes, vehicle entity nodes, device entity nodes, transaction event nodes, geographic location nodes, and Internet account entity nodes, according to the first relationship database, the second relationship database, the third relationship database, the fourth relationship database, and the fifth relationship database, generating the legal ownership relationship chain between users and vehicles, the physical binding authentication chain between vehicles and devices, the spatiotemporal trajectory chain between transaction events and geographic space, the attention interaction chain between users and Internet accounts, and the ownership and flow chain of vehicles between users, thereby completing the construction of a heterogeneous network.

4. The method according to claim 3, characterized in that Multi-source data includes: user characteristic data, vehicle characteristic data, device characteristic data, transaction characteristic data and Internet account characteristic data; user characteristic data specifically includes fingerprints or faces; vehicle characteristic data specifically includes engine unique codes; device characteristic data specifically includes device unique codes; transaction characteristic data specifically includes travel time, geographic location and abnormal transaction identification; Internet account characteristic data specifically includes account unique identification or login behavior records.

5. The method according to claim 3, characterized in that S1 also includes: S15, real-time monitoring of vehicle status changes and user logout behavior, logical isolation of failed nodes, and regular execution of network weight decay calculation output, thereby realizing dynamic network update records with version identification.

6. The method according to claim 1, characterized in that S2 specifically includes: S21, calculating the timeliness weight of nodes based on the sliding transaction time window; S22, extracting cross-entity association paths through a bidirectional graph propagation analysis method; S23, determining high-risk nodes and high-risk user groups; S24, screening out the association topology of high-risk nodes; Among them, the two-way graph propagation analysis method includes: forward tracing the transaction link of the user-bound vehicle, reverse tracing the ownership path of the transaction-related equipment, and integrating to generate a cross-entity association graph.

7. The method according to claim 1, characterized in that S2 also includes: S25, retaining the continuously active node topology and generating a risk network snapshot.

8. The method according to claim 1, characterized in that Generating a composite risk index includes normalizing the static risk value, dynamic risk value, and topological risk value, and dynamically allocating weights based on the fraud type; among them, the path jumping fraud type focuses on the dynamic risk value weight, and the identity impersonation fraud type focuses on the static risk value weight.

9. The method according to claim 1, characterized in that S5 specifically includes: S51, receiving the multi-dimensional judgment basis input after optimization from the parameter update phase; S52, performing multi-dimensional analysis; S53, generating judgment conclusions and evidence chains; S54, generating a fraud judgment report containing a multi-dimensional scoring matrix.

Images