Abnormal transaction detection method based on zero-order optimization feedback

Abstract

The invention relates to an abnormal transaction detection method based on zero-order optimization feedback. The method comprises the following steps: acquiring transaction information of nodes of both parties of a target transaction; inputting transaction information of nodes of both parties of the target transaction into the optimized graph induction network model, and outputting an abnormal transaction output result; wherein the step of obtaining the optimized graph induction network model comprises the substeps of obtaining user transaction behaviors, and constructing a transaction database; constructing a transaction sub-graph of nodes of two transaction parties according to the database; obtaining hidden layer features of the LSTM network model according to the transaction sub-graph, training the graph induction network model according to the labeled fraud sample, and obtaining a trained graph induction network model; and disturbing the transaction sub-graph of the fraud node in the verification set to generate a fraud sample to evaluate the trained graph induction network model, and optimizing the trained graph induction network model to obtain an optimized graph induction network model. According to the method, a disturbance subgraph is constructed to optimize the model.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an abnormal transaction detection method based on zero-order optimization feedback. Background Art

[0002] In the financial sector, anomaly detection and identification of fraudulent transactions are critical tasks to protect institutions and consumers from significant financial losses. These tasks typically involve the use of a variety of model building techniques, including statistical analysis, rule-based systems, and machine learning models. These techniques can build a model of normal transaction behavior based on historical data and identify behavior that significantly deviates from this model, flagging it as potentially fraudulent or anomaly.

[0003] Graph networks, due to their unique ability to process and analyze relational data, are increasingly playing a vital role in anomaly detection and fraudulent transaction identification. By learning feature representations of nodes and their interconnections in a graph, graph networks can capture the complex dependencies between financial transactions. However, practical applications present significant challenges: the extremely small number of fraudulent samples in the overall data makes it difficult to evaluate models using fraudulent samples in the validation set. This scarcity of fraudulent samples in the dataset can lead to false or missed detections of fraudulent samples in the validation set, resulting in significant fluctuations in classification metrics such as F1-score and G-mean, making it difficult to accurately evaluate model performance and optimize model parameters. Summary of the Invention

[0004] The purpose of the present invention is to provide an abnormal transaction detection method based on zero-order optimization feedback, which uses a gradient expression based on zero-order optimization to determine the disturbance dimension and calculate the disturbance value of the dimension to form a disturbance subgraph to evaluate the impact on the model and optimize the model parameters.

[0005] To achieve the above object, the present invention provides the following solutions:

[0006] An abnormal transaction detection method based on zero-order optimization feedback, comprising:

[0007] Obtain transaction information of both nodes of the target transaction;

[0008] Input the transaction information of the target transaction parties into the optimized graph induction network model and output the abnormal transaction output results;

[0009] Wherein, obtaining the optimized graph induction network model includes:

[0010] Obtain user transaction behavior and build a transaction database;

[0011] Constructing a transaction subgraph based on the database;

[0012] According to the transaction subgraph, the transaction features of the nodes of both parties to the transaction are obtained and input into a graph induction network model, the latent features of the transaction features are obtained, and the graph induction network model is trained based on the labeled fraud samples to obtain a trained graph induction network model, wherein the graph induction network model is constructed based on an LSTM network;

[0013] By perturbing the transaction subgraph of the fraudulent node in the verification set, fraud samples are generated to evaluate the trained graph induction network model, and the trained graph induction network model is optimized to obtain an optimized graph induction network model.

[0014] Optionally, constructing a transaction subgraph includes: extracting neighbor nodes of the nodes of both transaction parties and transaction features of each neighbor node within a preset time window in the database to construct the transaction subgraph, wherein the two transaction parties include a payer and a payee.

[0015] Optionally, obtaining latent features of transaction features and training a graph induction network model based on labeled fraud samples includes:

[0016] Extracting transaction features of neighbor nodes of both transaction parties based on the transaction subgraph, and extracting hidden features of the payer and the payee based on the transaction features of the neighbor nodes of both transaction parties;

[0017] Fully connecting the hidden layer aggregate features of the payer and payee's neighbor nodes with the payer's hidden layer features and the payee's hidden layer features to obtain the hidden layer features of the transaction features, wherein the hidden layer aggregate features of the neighbor nodes are obtained from the transaction database;

[0018] Back propagation is performed to train the hidden layer features according to the labeled fraud samples, thereby training the graph induction network model.

[0019] Optionally, extract the payer's hidden features for:

[0020]

[0021] Extracting hidden features of the payee for:

[0022]

[0023] Among them, the tth LSTM i The input of each cell is the sorted neighbor features of the payer. and They represent the hidden layer features and cell states of the payer’s t-th time step of the i-th transaction, and They represent the hidden layer features and cell states of the payer’s i-1th transaction at the tth time step, m is the neighbor aggregation feature length, and the tth time step of the LSTM i The input of each cell is the sorted neighbor features of the payee. and They represent the hidden layer features and cell states of the t-th time step of the i-th transaction of the payee, and They represent the hidden layer features and cell states of the payee at the tth time step of the i-1th transaction respectively.

[0024] Optionally, the hidden features of the transaction features are:

[0025]

[0026] Among them, W k is the weight, σ is the activation function, h is the hidden layer feature of the transaction feature, h in 、h out are the hidden layer aggregation features of the payer and payee neighbor nodes respectively.

[0027] Optionally, perturb the transaction subgraph of the fraudulent nodes in the verification set, including:

[0028] S1. Set the outer node features in the transaction subgraph of the fraud node to all 1 vectors or all 0 vectors to generate a subgraph G. max and G min , and calculate the difference between before and after the disturbance;

[0029] S2. Select the outer nodes to be retained based on the difference between the before and after disturbance values;

[0030] S3. Select a perturbation dimension to perturb the selected outer nodes to obtain an initialized perturbation subgraph;

[0031] S4. Perform gradient calculation on the initialized perturbation subgraph. If the gradient is greater than a preset value, retain the perturbation dimension, calculate the perturbation value on the perturbation dimension, perturb the selected outer nodes according to the perturbation value, and return to S1 until the number of iterations is met. If the gradient is not greater than the preset value, do not retain the perturbation dimension and return to S3.

[0032] Optionally, selecting a perturbation dimension to perturb the selected outer nodes includes:

[0033] Graph G after adding perturbation in dimension j v，l1 ,

[0034] Graph G after reducing perturbations in dimension j v,l2 ,

[0035] Among them, e j is a unit vector in d-dimensional space where only the j-th dimension is 1 and the rest of the dimensions are 0, b is a constant, is the disturbance characteristic, x neighbour is the neighbor feature, l1 and l2 represent the feature set of the outer nodes after the feature changes, and v is the payment and receipt node of the fraudulent transaction.

[0036] Optionally, training the graph induction network model also includes calculating the difference between the observed true labels and the model-predicted labels for the predicted probabilities of normal and fraudulent transactions:

[0037]

[0038] Among them, a represents the maximum probability prediction label that is inconsistent with the true label, z represents the true label, F is the prediction probability, k is the parameter, G v，l is the perturbed graph, and l represents the node neighbor set.

[0039] The beneficial effects of the present invention are as follows: Based on a trained model, the present invention uses a feature inversion method to sequentially set the outer features of the transaction subgraph to all-one and all-zero vectors, forming a corresponding subgraph and calculating the impact on the nodes, retaining nodes with large perturbations for optimization. For the selected perturbation nodes, a gradient expression based on zero-order optimization is used to determine the perturbation dimension and calculate the perturbation value of the dimension, forming a perturbation subgraph to evaluate the impact on the model and optimize the model parameters. By adding perturbation attacks, the model's training parameters can be more objectively set to improve the model's detection rate of fraudulent samples, thereby improving the accuracy of abnormal transaction detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 A schematic diagram of a transaction subgraph constructed according to an embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram of an outer node according to an embodiment of the present invention;

[0043] Figure 3 This is a flow chart of an abnormal transaction detection method based on zero-order optimization feedback according to an embodiment of the present invention;

[0044] Figure 4This is a schematic diagram of transaction subgraph network data dimensions according to an embodiment of the present invention;

[0045] Figure 5 This is a schematic diagram of a transaction-based graph summary network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0048] like Figure 3 As shown, this embodiment provides an abnormal transaction detection method based on zero-order optimization feedback, including:

[0049] Obtain transaction information of both nodes of the target transaction;

[0050] Input the transaction information of the target transaction parties into the optimized LSTM network model and output the abnormal transaction output results;

[0051] Among them, obtaining the optimized graph induction network model includes:

[0052] Obtain user transaction behavior and build a transaction database;

[0053] Based on the database, construct a transaction subgraph of the nodes of both parties to the transaction;

[0054] Build a transaction subgraph based on the database;

[0055] Based on the transaction subgraph, the transaction features of the nodes of both parties are obtained and input into the graph induction network model to obtain the hidden features of the transaction features. The graph induction network model is then trained based on the labeled fraud samples to obtain the trained graph induction network model. The graph induction network model is built based on the LSTM network.

[0056] By perturbing the transaction subgraph of the fraudulent nodes in the verification set, fraud samples are generated to evaluate the trained graph induction network model, and the trained graph induction network model is optimized to obtain the optimized graph induction network model.

[0057] Furthermore, constructing a transaction subgraph includes: extracting neighbor nodes of the nodes of both transaction parties and transaction features of each neighbor node within a preset time window in the database to construct a transaction subgraph, wherein the transaction parties include a payer and a payee.

[0058] Specifically, this embodiment first utilizes a database capable of efficiently storing and querying transaction data, including key fields such as user ID, transaction time, transaction amount, and transaction type. When a user completes a transaction through an online trading platform or financial management system, the relevant data is recorded in a database, including but not limited to MySQL and Redis, ensuring that all necessary information is included to support subsequent analysis.

[0059] By defining a time window (e.g., monthly, weekly, etc.), we extract transaction data from the database for that time period. We aggregate each user's data to derive statistical metrics such as total transaction volume, number of transactions, and average transaction amount. Based on these statistical results, we construct a transaction aggregation feature vector for each user.

[0060] Before an account transaction occurs, four time windows can be used to analyze a user's trading behavior: one month, one week, one day, and one hour. For each time window, the user's transaction data is extracted from the database, and statistical indicators such as total transaction amount, number of transactions, average transaction amount, maximum and minimum transaction amounts, standard deviation of transaction amounts, and average transaction interval are calculated as aggregate features. For example, within a one-month window, a user performed 50 transactions with a total transaction amount of 5,000, resulting in an average transaction amount of 100. Based on the transaction details, the maximum, minimum, and standard deviation of the user's transaction amount are obtained. In addition, transaction time information can be obtained, such as an average transaction every 15 hours or a transaction four hours after the previous one. Based on these statistical results, an aggregated transaction feature vector is constructed for each user. These features can be presented in Table 1.

[0061] Table 1

[0062]

[0063] The aggregated features of the account transaction characteristics obtained can be divided into two types: collection and payment. Therefore, before the transaction occurs, the aggregated feature dimensions of accounts A and B in a period of time are 8+8, where the first dimension is the transaction amount, and the eight dimensions represent the aggregated features of collection and payment, respectively.

[0064] When four time windows (1 month, 1 week, 1 day, and 1 hour) are set, the aggregated features of an account are (8+8)*4=64 dimensions.

[0065] In the process of constructing a transaction subgraph, we first need to select an appropriate time window T to collect the historical transaction records of the two parties to the transaction (nodes A and B). Then, within the time window T, we collect all nodes that have transactions with nodes A and B and their transaction information. Based on this collected data, we use the database to obtain the transaction aggregation characteristics of each involved node, including transaction information such as transfer amount, number of transactions, average transaction amount, transaction amount variance, transaction time variance, and time since the last transaction. Finally, we directly obtain the transaction aggregation characteristics and network structure information through query, and generate a transaction subgraph covering nodes A and B. This subgraph includes first-order neighboring nodes. The specific steps are as follows:

[0066] Using the database and calculation method, we can obtain the transaction characteristics of accounts A and B before the transaction occurs in the total time window T, and obtain their first-order neighbors to construct a first-order transaction subgraph as follows: Figure 2 .

[0067] In this embodiment, the reasons for using the first-order transaction subgraph are: 1) the first-order neighbors have less time complexity. 2) since the account characteristics include the collection and payment characteristics, they contain some second-order neighbor information. Figure 1 .

[0068] Query the transaction object account set S of both parties in the time window T (T can also be set to 1 month) A 、S B , and again obtain S according to the time window T A 、S B The transaction set S A1 、S B2 , and calculate the aggregate features in Table 1. Calculate transaction features according to Table 1. In summary, the approximate calculation scope and data dimensions of this transaction are as follows Figure 4 shown.

[0069] Furthermore, obtaining the latent features of transaction characteristics and training the graph induction network model based on the labeled fraud samples include:

[0070] Extract the transaction features of the neighbor nodes of both parties to the transaction based on the transaction subgraph. Then, extract the hidden features of the payer and the payee based on the transaction features of the neighbor nodes of both parties to the transaction.

[0071] Fully connect the hidden layer aggregate features of the payer and payee's neighbor nodes with the payer's hidden layer features and the payee's hidden layer features to obtain the hidden layer features of the transaction features;

[0072] Perform back propagation to train the hidden layer features based on the labeled fraud samples, and then train the graph induction network model.

[0073] Specifically, a graph induction network is used to extract transaction features. The graph induction algorithm updates the feature representation of nodes by aggregating the neighbor transaction information of the receiving and paying nodes using the aggregation function LSTM. For each transaction record i, query the neighbors S of transaction accounts A and B within the time window T. A 、S B Aggregation features Sort by transaction time from earliest to latest, and use LSTM to extract hidden features of neighbor nodes. Take payer A as an example, assuming The length of m is obtained based on the average number of transactions in the time window T in the dataset. For each transaction i, the historical transaction features calculated based on its neighbor nodes and the previous hidden state Extracting the payer's hidden features As follows:

[0074]

[0075] t-th LSTM i The input of each cell is the sorted neighbor features of the payer. and They represent the hidden layer features and cell states of the payer’s t-th time step of the i-th transaction, and They represent the hidden features and cell states of the payer’s i-1th transaction at the tth time step, and m is the length of the neighbor aggregation feature.

[0076] Similarly, similar calculations are performed on the payee B to obtain the payee's hidden layer features: :

[0077]

[0078] t-th LSTM i The input of each cell is the sorted neighbor features of the payee. and They represent the hidden layer features and cell states of the t-th time step of the i-th transaction of the payee, and They represent the hidden layer features and cell states of the payee’s i-1th transaction at the tth time step. The neighbor node hidden layer aggregation features h in 、h out Hidden characteristics of the transaction parties and Perform full connection, using weight W k And the activation function σ is used to obtain the hidden feature representation of the transaction feature, as shown in the following formula:

[0079]

[0080] In the process of back propagation, fraud samples can be marked according to user feedback or reporting. The labels y of normal samples and fraud samples are used to train the hidden data h, and then predict whether it is fraud y. The process is as follows: Figure 5 shown.

[0081] Furthermore, the transaction subgraph of the fraudulent nodes in the verification set is perturbed by:

[0082] S1. Set the outer node features in the transaction subgraph of the fraud node to all 1 vectors or all 0 vectors to generate subgraph G. max and G min , and calculate the difference between before and after the disturbance;

[0083] S2. Select outer nodes to retain based on the difference between the before and after disturbance;

[0084] S3. Select a perturbation dimension to perturb the selected outer nodes to obtain an initialized perturbation subgraph;

[0085] S4. Perform gradient calculation on the initialized perturbation subgraph. If the gradient is greater than the preset value, retain the perturbation dimension and calculate the perturbation value on the perturbation dimension. Perturb the selected outer nodes according to the perturbation value and return to S1 until the number of iterations is met. If the gradient is not greater than the preset value, do not retain the perturbation dimension and return to S3.

[0086] Specifically, this embodiment uses the constructed network model and subgraph data to form a subgraph data perturbation based on zero-order optimization. This embodiment assumes that the network model architecture cannot be directly observed and only uses the prediction results to perform a more objective evaluation.

[0087] Assume that the input of the graph induction network is the transaction subgraph feature x neighbour , the output is F, which is the predicted probability. Observe the difference between the true label and the model predicted label based on the model's predicted probability for normal transactions and fraudulent transactions:

[0088]

[0089] Among them, G v，l is the perturbed graph, is the perturbation feature, z represents the true label, for example, normal samples are labeled 0 and abnormal samples are labeled 1, v represents the payment and receipt nodes for fraudulent transactions, and l represents the node's neighbor set. a represents the predicted label with the highest probability of being inconsistent with the true label. A parameter k >= 0 is introduced to prevent f from being overly biased towards the true label, which would result in excessive fluctuations. In the definition of function f, a log objective function is used to achieve smoothing. Because a well-trained graph neural network model will assign a high probability to the true label, using a log objective function can reduce the dominance of the dominant label and maintain monotonicity.

[0090] First, use the maximum and minimum normalization to normalize the features in the validation set. Assume that the transaction node is v and the outer node of the node transaction subgraph is u, which is represented by u∈N l (v) Outer nodes can use first-order neighbors, such as Figure 2 shown.

[0091] Assume that the transaction node is v and the outermost node of the node transaction subgraph is u, which is represented by u∈N l (v) For each fraudulent node in the validation set, the features of the outer node u are set to all 1 vectors or all 0 vectors to form the corresponding subgraph G max and G min , calculate the difference before and after the perturbation:

[0092] g i =|f(G max )-f(G min )|

[0093] Among them, f(G max ) and f(G min ) respectively represent the subgraph G max and G min The predicted value on g. i The larger the value, the greater the impact on v after u is significantly modified, and the node is retained, with u attack express.

[0094] For the outermost node selected by the fraudulent node v, that is, the fraudulent neighbor node u attack ,In the initial stage, a dimension j is randomly selected for modification.,j,represents a specific dimension in the feature vector and is the key,variable that determines the perturbation location.

[0095] Apply perturbation in dimension j: (1) G v,l1 : represents the graph after adding perturbations on dimension j, (2)G v，l2 : represents the graph after reducing the perturbation in dimension j, where ej is a unit vector in d-dimensional space where only the jth dimension is 1 and the rest are 0. b is a constant, usually set to 0.0001. l1 and l2 represent the feature sets of the outer nodes after the feature changes.

[0096] Based on G v，l1 and G v，l2 , this embodiment uses the symmetric difference quotient formula to construct the gradient expression of the objective function f:

[0097]

[0098] Get the gradient Then, the zero-order coordinate ADAM optimization method is used to calculate The perturbation value in the jth dimension. When the absolute value of is large, that is, greater than the preset gradient, it means that dimension j has a significant impact on the model prediction results, and the disturbance of this dimension is retained first. On the contrary, when When the absolute value of is small, that is, not greater than the preset gradient, randomly select dimension j again to generate a new And continue to optimize.

[0099] The specific method of obtaining disturbance features is as follows:

[0100] 1) Initialize each vector: P, M, T←d-dimensional all-zero vector, β1←0.9, β2←0.999, ε←10 -8 ;

[0101] 2) According to b and e j Initialize the perturbation subgraph G v，l1 and G v，l2 ;

[0102] 3) Calculate the gradient

[0103] 4) Compare the dimensions Determine the gradient grad of the maximum perturbation dimension j;

[0104] 5) T←T+1;

[0105] M←β1×M+(1-β1)×grad;

[0106] P←β2×P+(1-β2)×grad 2 ;

[0107]

[0108] 6) Add the perturbation Δx of this dimension to Right now Jump to 2) to perform calculations until the required number of iterations is met.

[0109] This example generates a perturbed subgraph for fraudulent nodes in the validation set, defining these as fraudulent samples. This subgraph is then added to the validation set to increase its sample size. Using the trained graph induction network, metrics related to binary classification, such as F1-Score, G-mean, and Binary Cross Entropy Loss, are evaluated to help find optimal parameters during model training.

[0110] In the specific implementation process, it can be set, for example, that after ten rounds of training, a perturbation subgraph is generated to obtain an indicator effect evaluation model in the validation set; after another ten rounds of training, a perturbation subgraph is generated again and evaluated until the indicator stabilizes.

[0111] The embodiments described above are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by persons skilled in the art should fall within the scope of protection defined by the claims of the present invention.

Claims

1. A method for detecting abnormal transactions based on zero-order optimization feedback, characterized in that: include: Obtain transaction information of both nodes of the target transaction; Input the transaction information of the target transaction parties into the optimized graph induction network model and output the abnormal transaction output results; Wherein, obtaining the optimized graph induction network model includes: Obtain user transaction behavior and build a transaction database; Constructing a transaction subgraph based on the database; According to the transaction subgraph, the transaction features of the nodes of both parties to the transaction are obtained and input into a graph induction network model, the latent features of the transaction features are obtained, and the graph induction network model is trained based on the labeled fraud samples to obtain a trained graph induction network model, wherein the graph induction network model is constructed based on an LSTM network; By perturbing the transaction subgraph of the fraudulent node in the verification set, fraud samples are generated to evaluate the trained graph induction network model, and the trained graph induction network model is optimized to obtain an optimized graph induction network model.

2. The abnormal transaction detection method based on zero-order optimization feedback according to claim 1 is characterized in that: Constructing a transaction subgraph includes: extracting neighbor nodes of the nodes of both transaction parties and transaction features of each neighbor node within a preset time window in the database to construct the transaction subgraph, wherein the two transaction parties include a payer and a payee.

3. The abnormal transaction detection method based on zero-order optimization feedback according to claim 2 is characterized in that: Obtaining the latent features of transaction characteristics and training the graph induction network model based on labeled fraud samples includes: Extracting transaction features of neighbor nodes of both transaction parties based on the transaction subgraph, and extracting hidden features of the payer and the payee based on the transaction features of the neighbor nodes of both transaction parties; Fully connecting the hidden layer aggregate features of the payer and payee's neighbor nodes with the payer's hidden layer features and the payee's hidden layer features to obtain the hidden layer features of the transaction features, wherein the hidden layer aggregate features of the neighbor nodes are obtained from the transaction database; Back propagation is performed to train the hidden layer features according to the labeled fraud samples, thereby training the graph induction network model.

4. The abnormal transaction detection method based on zero-order optimization feedback according to claim 3 is characterized in that: Extracting the payer's hidden features for: Extracting hidden features of the payee for: Among them, the tth LSTM i The input of each cell is the sorted neighbor features of the payer. and They represent the hidden features and cell states of the payer’s t-th time step of the i-th transaction, and They represent the hidden layer features and cell states of the payer’s i-1th transaction at the tth time step, m is the neighbor aggregation feature length, and the tth time step of the LSTM i The input of each cell is the sorted neighbor features of the payee. and They represent the hidden layer features and cell states of the t-th time step of the i-th transaction of the payee, and They represent the hidden layer features and cell states of the payee at the tth time step of the i-1th transaction respectively.

5. The abnormal transaction detection method based on zero-order optimization feedback according to claim 4 is characterized in that: The hidden features of the transaction features are: Among them, W k is the weight, σ is the activation function, h is the hidden layer feature of the transaction feature, h in 、h out are the hidden layer aggregation features of the payer and payee neighbor nodes respectively.

6. The abnormal transaction detection method based on zero-order optimization feedback according to claim 1 is characterized in that: The perturbation of the transaction subgraph of the fraudulent nodes in the verification set includes: S1. Set the outer node features in the transaction subgraph of the fraud node to all 1 vectors or all 0 vectors to generate a subgraph G. max and G min , and calculate the difference between before and after the disturbance; S2. Select the outer nodes to be retained based on the difference between the before and after disturbance values; S3. Select a perturbation dimension to perturb the selected outer nodes to obtain an initialized perturbation subgraph; S4. Perform gradient calculation on the initialized perturbation subgraph. If the gradient is greater than a preset value, retain the perturbation dimension, calculate the perturbation value on the perturbation dimension, perturb the selected outer nodes according to the perturbation value, and return to S1 until the number of iterations is met. If the gradient is not greater than the preset value, do not retain the perturbation dimension and return to S3.

7. The abnormal transaction detection method based on zero-order optimization feedback according to claim 6 is characterized in that: Selecting the perturbation dimension to apply perturbations to the selected outer nodes includes: Graph G after adding perturbation in dimension j v，l1 , Graph G after reducing perturbations in dimension j v,l2 , Among them, e j is a unit vector in d-dimensional space where only the j-th dimension is 1 and the rest of the dimensions are 0, b is a constant, is the disturbance characteristic, x neighbour is the neighbor feature, l1 and l2 represent the feature set of the outer nodes after the feature changes, and v is the payment and receipt node of the fraudulent transaction.

8. The abnormal transaction detection method based on zero-order optimization feedback according to claim 7 is characterized in that: Training the graph induction network model also involves calculating the difference between the observed true labels and the model-predicted labels for predicted probabilities of normal and fraudulent transactions: Among them, a represents the maximum probability prediction label that is inconsistent with the true label, z represents the true label, F is the prediction probability, k is the parameter, G v，l is the perturbed graph, and l represents the node neighbor set.

Images