Account fraud user identification method in operation transaction network

Abstract

The embodiment of the invention provides an account fraud user identification method in an operation transaction network, and belongs to the technical field of data processing, and the method specifically comprises the steps: 1, collecting basic data in a target network, and constructing graph structure data according to the basic data; 2, extracting spectral structure features and spatial structure features of the graph structure data to obtain multi-scale representation of each node in the graph structure data; 3, introducing a multi-scale attention mechanism to screen and combine multi-scale representation to obtain fusion representation; 4, introducing comparative learning as an auxiliary task, and constructing a training strategy; 5, training the graph neural network and the attention network based on the fusion representation and the training strategy to obtain a recognition model; and step 6, inputting node data to be identified in the target network into the identification model to obtain a fraud prediction result. Through the scheme disclosed by the invention, the identification efficiency and accuracy are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and more particularly to a method for identifying account fraud users in an operational transaction network. Background Art

[0002] Fraud detection in graph-structured data is an important and challenging task in fields such as financial risk control and social network security. In practice, this often presents the following difficulties: First, labeled fraudulent samples are expensive to obtain and scarce, resulting in highly unbalanced datasets with a large number of normal samples and very few fraudulent samples. Second, fraudulent behavior is often disguised; fraudulent nodes often hide themselves by mimicking the behavior of normal nodes, making the abnormal pattern signal weak and difficult to detect by traditional methods.

[0003] Traditional graph anomaly detection and classification methods perform well with large, balanced data sets, but face significant challenges in small, highly unbalanced scenarios. For example, in a social network, where hundreds of millions of legitimate users coexist with a tiny fraction of fraudulent accounts, typical machine learning models may favor the dominant categories and ignore a few anomalies. Simple statistical methods struggle to discern these "clues" amidst the noise.

[0004] It can be seen that there is an urgent need for a method for identifying account fraud users in operational transaction networks with high recognition efficiency and accuracy. Summary of the Invention

[0005] In view of this, the embodiments of the present disclosure provide a method for identifying account fraud users in an operational transaction network, which at least partially solves the problem of poor identification efficiency and accuracy in the prior art.

[0006] The present disclosure provides a method for identifying account fraud users in an operational transaction network, comprising:

[0007] Step 1: Collect basic data in the target network and construct graph structure data based on it;

[0008] Step 2: Extract the spectral structure features and spatial structure features of the graph structure data to obtain a multi-scale representation of each node in the graph structure data;

[0009] Step 3: Introduce a multi-scale attention mechanism to filter and combine multi-scale representations to obtain a fused representation;

[0010] Step 4: Introduce contrastive learning as an auxiliary task and build a training strategy;

[0011] Step 5: Train the graph neural network and attention network based on the fusion representation and training strategy to obtain the recognition model;

[0012] Step 6: Input the node data to be identified in the target network into the recognition model to obtain the fraud prediction result.

[0013] According to a specific implementation of the embodiment of the present disclosure, step 1 specifically includes:

[0014] Step 1.1: Collect basic data of the target network. The basic data includes raw information of nodes and edges. Nodes represent users or account entities. Each node carries an attribute feature vector, which includes account age, number of transactions, evaluation score, and social attributes.

[0015] Step 1.2, according to the business scenario, determine the relationship between nodes and construct graph structure data according to the preset edge construction strategy, wherein the preset edge construction strategy includes inherent relationship-based graph construction, attribute similarity-based graph construction and mixed strategy graph construction.

[0016] According to a specific implementation of the embodiment of the present disclosure, step 2 specifically includes:

[0017] Based on the graph structure data, the corresponding Laplace matrix L is calculated, and the Laplace matrix L is spectrally decomposed to obtain eigenvalues and eigenvectors. Gaussian noise of different intensities is gradually injected into the eigenvector of each node to simulate the multi-step forward diffusion process from the original state to the high-noise state. By collecting the node representations under each diffusion step, each node forms a series of spectral domain perturbation features as spectral structure features. In addition, for each node, its multi-order neighbor node set is obtained from the adjacency matrix of the original graph, and the attribute features of each neighbor node are collected. The typical graph neural network message passing and aggregation mechanism is used to weightedly aggregate the features of the neighbor nodes to obtain the spatial domain multi-order neighbor aggregation sequence of the node as the spatial structure feature, and the spectral structure feature and spatial structure feature are used as multi-scale representations.

[0018] According to a specific implementation of the embodiment of the present disclosure, step 3 specifically includes:

[0019] Step 3.1: Take all multi-scale representations as candidate feature sets for nodes and design an attention network to assign an attention weight to each multi-scale representation in the candidate feature set, indicating the importance of the multi-scale representation for fraudulent node identification.

[0020] Step 3.2: For each node, perform weighted summation of its corresponding multi-scale representations according to the attention weight to obtain a fusion representation z i .

[0021] According to a specific implementation of the embodiment of the present disclosure, step 3.1 specifically includes:

[0022] A feature-level attention strategy is adopted to map each feature vector into a scalar score through a fully connected layer, and then softmax normalization is performed on all feature scores to obtain the normalized attention weight distribution.

[0023] According to a specific implementation of the embodiment of the present disclosure, step 4 specifically includes:

[0024] Step 4.1: construct two different perturbation views for each node and feed them into the shared parameter graph neural network to obtain two representations h of the node. i and h' i As positive sample pairs for contrastive learning, and the fusion representation between two nodes as negative sample pairs;

[0025] Step 4.2: For node i, calculate its positive sample pair h i and h' i The similarity between them, and the similarity between the negative sample pairs formed by the fusion representation between this node and other nodes j;

[0026] Step 4.3, construct contrast loss function

[0027]

[0028] Where sim(·) represents similarity and τ is the temperature coefficient;

[0029] In step 4.4, during model training, the contrast loss function and the supervision loss of the main task are weighted and summed according to the preset weights as the overall training target. Then, the parameters of the graph neural network and the attention network are updated simultaneously through backpropagation. The preset weights are adjusted according to the results of the validation set to maximize the discrimination of the representation while maintaining the classification accuracy. In each training batch, steps 4.1 to 4.2 are repeated to continuously optimize the model parameters.

[0030] According to a specific implementation of the embodiment of the present disclosure, step 5 specifically includes:

[0031] Step 5.1, initialize the parameters of the graph neural network and attention network;

[0032] Step 5.2: Input the fused representation into the initialized graph neural network and perform iterative training according to the training strategy;

[0033] In step 5.3, the performance indicators of the trained graph neural network are verified using the validation set. When the performance indicators no longer improve or begin to decline, the training is stopped and the graph neural network obtained from this iterative training is used as the recognition model.

[0034] According to a specific implementation of the embodiment of the present disclosure, step 6 specifically includes:

[0035] The graph neural network and attention network in the recognition model are used to calculate the embedding representation and fraud probability of each node to be identified to form a fraud prediction result.

[0036] The account fraud user identification scheme in the operational transaction network in the embodiment of the present disclosure includes: step 1, collecting basic data in the target network and constructing graph structure data based on it; step 2, extracting spectral structure features and spatial structure features of the graph structure data to obtain a multi-scale representation of each node in the graph structure data; step 3, introducing a multi-scale attention mechanism to screen and combine multi-scale representations to obtain a fused representation; step 4, introducing contrastive learning as an auxiliary task to construct a training strategy; step 5, training a graph neural network and an attention network based on the fused representation and training strategy to obtain a recognition model; step 6, inputting the node data to be identified in the target network into the recognition model to obtain a fraud prediction result.

[0037] The beneficial effects of the embodiments of the present disclosure are as follows: Through the disclosed solution, a GNN architecture is designed that integrates global graph structure and local neighborhood information. During the feature extraction phase, spectral structure features (generating a global multi-scale representation through Laplacian spectral analysis and diffuse noise) and spatial structure features (obtaining local patterns through neighbor aggregation) are simultaneously utilized. A multi-scale attention mechanism is then used to effectively integrate the two. Unlike traditional graph models that focus only on local neighbors, this architecture considers both abnormal patterns in the global topology and detailed features of local relationships, thereby making fraudulent nodes hidden in large-scale networks more prominent. In particular, by leveraging the multi-scale spectral perturbations introduced by the diffusion process, the model can capture high-frequency anomalies that are difficult to observe against a smooth background. Furthermore, through weighted attention fusion, the scale information that best characterizes fraudulent behavior plays a dominant role in the final decision. A contrastive learning mechanism is integrated into the training process of the few-shot graph anomaly detection model. By constructing different perturbed views of a node and introducing a contrastive loss, the model is forced to learn node representations that remain consistent in the presence of noise. This mechanism effectively adds a self-supervised regularization constraint to the model, effectively reducing the uncertainty introduced by few samples and noise. The node representations learned by the model are insensitive to minor perturbations and are more stable and reliable. Furthermore, normal and abnormal nodes are separated in the representation space, enhancing the signal-to-noise ratio for classification. This representation enhancement technique enables the model to maintain excellent discriminative performance even with extremely unbalanced data, significantly outperforming traditional methods that rely solely on supervised signal training, and improving recognition efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0039] Figure 1 A flowchart of a method for identifying account fraud users in an operational transaction network provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0040] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0041] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present disclosure.

[0042] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.

[0043] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure and are not drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component can be changed at will, and the component layout type may also be more complicated.

[0044] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0045] Traditional methods have the following technical limitations in detecting fraudulent images with few samples:

[0046] Excessive smoothing leads to loss of abnormal signals: General graph neural networks tend to smooth neighboring features when nodes are aggregated. This helps reduce noise for a large number of normal nodes, but it may also filter out the high-frequency features unique to abnormal nodes. In other words, when the model attempts to learn the global smooth pattern of the graph, the unique patterns of the already rare fraudulent nodes (high-frequency abnormal signals) are overwhelmed by noise, and the model's sensitivity to outliers decreases. As a result, fraudulent nodes are difficult to identify because they are "smoothed" to resemble the surrounding normal nodes.

[0047] Inaccurate neighborhood selection and feature dilution: When performing anomaly detection on a graph, how node neighbors are constructed and selected has a significant impact on the results. Traditional graph construction methods may simply connect nodes based on social connections or similarity, and fraudulent nodes are often connected to a large number of normal nodes. In this case, their neighbor features mainly come from normal nodes, and the abnormal features of the abnormal node itself are masked by the normal features of its neighbors, resulting in a phenomenon of "feature dilution." If the graph structure prior is incomplete or too many ordinary nodes are mistakenly connected as neighbors, the model will find it difficult to highlight the truly critical abnormal relationships during aggregation. This inaccurate neighborhood selection makes it difficult for the model to learn the unique relationship patterns of fraudulent nodes. In particular, disguised fraudsters often intentionally blend into normal communities, further exacerbating this problem.

[0048] Overfitting to a small number of samples and insufficient generalization: Training a model with very few anomalous samples often leads to the risk of overfitting. The model may memorize the occasional characteristics of these few fraudulent samples and lack the ability to generalize to the overall anomalous patterns. Furthermore, the presence of a large number of normal samples biases the model towards learning normal patterns, failing to learn the decision boundaries for anomalous patterns. When new fraudulent samples are presented, the model may be unable to correctly identify them. Furthermore, without additional measures, training with small samples is susceptible to noise and random factors, resulting in poor stability and robustness.

[0049] The present disclosure provides a method for identifying fraudulent users in an operating transaction network. The method can be applied to the identification of fraudulent users in scenarios such as financial risk control and social network security.

[0050] See also Figure 1 , is a flow chart of a method for identifying account fraud users in an operating transaction network provided by an embodiment of the present disclosure. Figure 1 As shown, the method mainly includes the following steps:

[0051] Step 1: Collect basic data in the target network and construct graph structure data based on it;

[0052] During implementation, basic data from the target network is collected, including raw node and edge information. Nodes typically represent user or account entities, and each node carries attribute feature vectors (such as account age, number of transactions, rating scores, social attributes, etc.). Based on the business scenario, the relationships between nodes are determined and the graph adjacency matrix is constructed. Edge construction strategies may include:

[0053] Graphing based on inherent relationships: Leveraging existing relational data in the system (e.g., friendships in social networks, transaction records in e-commerce platforms), edges are established between corresponding entity nodes, forming a natural relationship graph. These relationships directly reflect node interactions and can help uncover fraud rings or suspicious transaction chains.

[0054] Graph construction based on attribute similarity: When direct relationship data is lacking, node feature similarity can be used to construct a graph. For example, the similarity of user behavior patterns can be calculated and edges can be connected between users with high similarity to capture "similar behavior groups." For fraud detection, anomalous users sometimes share similar characteristics. Appropriately connecting these can form small suspicious groups for analysis.

[0055] Hybrid Graph Construction: For suspected fraud nodes that are nearly isolated in the graph, special connection strategies can be introduced to prevent them from being completely isolated from the graph structure. For example, a global "dummy node" can be added to connect all suspected fraud nodes, or isolated nodes can be connected to several nodes with similar characteristics to ensure that the model does not ignore these nodes in subsequent analysis. This strategy ensures that each potential anomalous node has a certain amount of graph connections to propagate and aggregate features.

[0056] By generating graph data using the above method, we obtain a network consisting of a large number of normal nodes and a small number of abnormal nodes. Each node has initial attribute characteristics, and the edges can be unweighted or weighted. This graph will serve as the input basis for subsequent models.

[0057] Step 2: Extract the spectral structure features and spatial structure features of the graph structure data to obtain a multi-scale representation of each node in the graph structure data;

[0058] In specific implementation, after the graph is constructed, features are extracted from the graph data from both spectral and spatial perspectives to obtain a multi-scale representation of each node:

[0059] Spectral structural feature extraction: Based on the entire graph, the Laplacian matrix L is calculated and spectrally decomposed to obtain eigenvalues and eigenvectors, allowing for macroscopic analysis of the graph's global topological patterns. Inspired by the diffusion model, we further inject Gaussian noise of varying intensities into each node's eigenvector, simulating a multi-step "forward diffusion" process from the original state to a high-noise state. For each step in the diffusion process, we diffuse the node features at that stage across the graph using graph signal processing methods such as polynomial filtering to obtain the node's representation vector under that specific noise perturbation. As the noise intensity increases from low to high, these representations encode structural information at different frequency components and neighborhood radii, ranging from fine-grained to smooth. By collecting node representations at each diffusion step, each node forms a series of spectral perturbation features, reflecting its global structural properties at different scales.

[0060] Spatial structural feature extraction: At the same time, for each node, the set of its first-order neighbor nodes is obtained from the adjacency matrix of the original graph, and the attribute features of each of these neighbor nodes are collected. If necessary, it can also be expanded to higher-order neighbors such as second-order and third-order neighbors to include a wider local environment. Using the typical graph neural network message passing and aggregation mechanism, the features of the neighbor nodes are weighted and aggregated to obtain the local neighborhood representation of the node. For example, the features of the direct neighbors can be averaged or weighted summed to obtain the first-order aggregate features of the node; if the second-order neighbors are considered, the aggregation results of the first-order neighbors can be further fused with the second-order neighbor features, or jump connections can be introduced to directly combine information of different orders to ensure that multi-order neighborhood features are taken into account.

[0061] The extraction of the aforementioned spectral and spatial structural features can be performed in parallel. Ultimately, each node will generate two types of multi-scale feature vector sequences: a spectral domain diffusion perturbation sequence (reflecting the impact of global topology on the node at different frequencies), and a spatial domain multi-order neighborhood aggregation sequence (reflecting the patterns of the local network within different neighborhoods). These feature sequences comprehensively describe the multi-scale representation of the node, providing a rich information foundation for subsequent fusion.

[0062] Step 3: Introduce a multi-scale attention mechanism to filter and combine multi-scale representations to obtain a fused representation;

[0063] In practice, to effectively fuse multi-scale features from the spectral and spatial domains, the present invention introduces a multi-scale attention mechanism to adaptively filter and combine representations of different scales. This is achieved as follows: All feature vectors obtained in step 2 are considered as candidate feature sets for the node (including both spectral structure perturbation feature sequences and spatial structure neighborhood feature sequences). An attention network is designed to assign an attention weight to each feature vector in this set, representing the importance of that scale feature to the current task (fraud node identification).

[0064] Attention weights are calculated using a "feature-level attention" strategy: each feature vector is mapped to a scalar score through a fully connected layer, and then all feature scores are softmax-normalized to obtain a normalized attention weight distribution. Higher weights indicate greater discriminative power of the corresponding feature in distinguishing fraudulent from legitimate nodes. During model training, the attention network automatically adjusts these weights based on task feedback, assigning higher weights to features that contribute significantly to the recognition result and reducing the influence of redundant or noisy features. This allows the model to adaptively highlight the scale information that best represents anomalous patterns.

[0065] Finally, for each node, we perform weighted summation of its feature vectors at multiple scales according to the attention weight to obtain a fused node representation vector z i This fused representation combines the global structural patterns and local relationship patterns of nodes and emphasizes the information most beneficial for fraud detection. The fused node representation will be used in downstream classification or anomaly scoring tasks to provide the final feature representation for each node.

[0066] Step 4: Introduce contrastive learning as an auxiliary task and build a training strategy;

[0067] In specific implementation, during the model training process, introducing contrastive learning as an auxiliary task can further improve the node representation's ability to discern abnormal patterns and its stability. The specific process is as follows:

[0068] Positive and negative sample generation: construct two different perturbation views for each node as positive sample pairs for comparative learning. This can be achieved by applying different random noises to the attribute features of the node to obtain two sets of slightly different features; or by using techniques such as DropEdge to randomly remove some edges in the graph, thereby obtaining two slightly different neighborhood subgraphs for the same node. The node inputs (including features and neighborhoods) obtained under these two different perturbations are respectively fed into the graph neural network with shared parameters. After processing in steps 2 and 3, two representations h of the node are obtained. i and h' i For any node i, these two representations correspond to different views of the same node and are recorded as a positive sample pair; while for node i and any other node j, their representations can be regarded as a negative sample pair.

[0069] Similarity calculation: Define an appropriate similarity metric (such as cosine similarity) to measure the distance between node representations. For node i, calculate its positive sample pair h i and h' iThe similarity between the representations of the node and the representations of other nodes (negative samples) is the same. Ideally, we hope that the representation distances of different views of the same node are as close as possible, while the representation distances between different nodes are as far as possible, so that abnormal nodes can be clearly distinguished from normal nodes.

[0070] Contrastive loss construction: Introduce contrastive loss functions such as InfoNCE to achieve the above goals. Take node i as an example, its two views (h i ,h' i ) is used as a positive sample pair, and all other node views are used as a set of disturbed negative samples. The contrast loss is defined as:

[0071]

[0072] where \textsim(·) represents a similarity metric (e.g., cosine similarity), and τ is the temperature coefficient. This loss aims to bring node i closer to its own two views while simultaneously increasing its distance from other nodes. By minimizing the global contrast loss, the model learns a more discriminative representation space: even with perturbations, the node representation remains stable, and the representation of anomalous nodes is clearly distinguishable from that of normal nodes.

[0073] Training strategy: During model training, the contrastive learning loss and the supervised loss of the main task (such as the cross-entropy loss for fraud / normal classification) are weighted and summed as the overall training objective. This weight hyperparameter can be adjusted based on the validation set performance to maximize the discriminability of the representation while maintaining classification accuracy. In each training batch, the above perturbation generation and contrastive loss calculation process are repeated to continuously optimize the model parameters. After multiple rounds of iterative training, a clear cluster structure will form in the model's embedded representation space: the representations of fraudulent nodes are clustered together and away from the representations of normal nodes. This means that the model has successfully learned to extract the patterns corresponding to fraudulent behavior, separating them from normal patterns in the representation space, which is beneficial for the final recognition decision.

[0074] Step 5: Train the graph neural network and attention network based on the fusion representation and training strategy to obtain the recognition model;

[0075] In specific implementation, combining the above steps, a complete model training process can be established:

[0076] Initialize the model: Initialize the parameters of the graph neural network and the attention module. Pre-train the basic representation capabilities of the GNN using a small amount of data to give the model a good starting point. Hyperparameters such as the temperature coefficient τ and loss weight for contrastive learning are also set.

[0077] Iterative training: In each epoch or each mini-batch training, the following process is performed:

[0078] Feature extraction and fusion: Based on the current adjacency matrix and model parameters, perform spectral structure and spatial structure feature extraction on all nodes as in step 2, and then fuse them through the attention mechanism as in step 3 to obtain the current node representation.

[0079] Forward prediction: The fused node representation is input into the task layer, and the prediction score or probability of each node being fraudulent or normal is calculated.

[0080] Contrastive loss calculation: As in step 4, randomly generate two perturbation views for contrastive learning for the node, and calculate the positive and negative sample similarity and InfoNCE loss of contrastive learning loss.

[0081] Parameter Update: The supervised loss for the main task, such as the binary cross entropy, is summed with the contrastive loss according to preset weights to obtain the total loss. Backpropagation is then used to simultaneously update the parameters of the GNN main model and the attention network. The introduction of contrastive learning provides additional self-supervisory signals, helping the model overcome the limitations of a small amount of labeled data and achieve better generalization during parameter updates.

[0082] Repeat the above process for multiple rounds of training to gradually converge the model.

[0083] Convergence determination: Monitor model performance metrics such as AUC and F1-score on the validation set to determine when training has reached convergence or optimal results. If validation performance stops improving or begins to decline, training is stopped to prevent overfitting to a small number of samples. An early stopping strategy can also be used to automatically terminate training based on changes in validation loss.

[0084] Step 6: Input the node data to be identified in the target network into the recognition model to obtain the fraud prediction result.

[0085] In practice, once the model training is complete, it can be applied to actual fraud detection tasks. For new node data, reasoning is performed according to the trained model process:

[0086] GNN and attention mechanism are used to calculate the embedding representation and fraud probability (or anomaly score) of each target node. The model outputs a prediction result for each node, such as a classification label of "normal" or "fraud", or a score indicating fraud risk.

[0087] The model's detection results are provided to the risk control or review system for subsequent decision support. For example, accounts with high risk scores can be further manually reviewed or automatically blocked.

[0088] Since the present invention integrates the attention mechanism, it can provide a certain degree of interpretability while outputting the results: the attention weight reveals which type of feature scale information the model attaches more importance to when making a judgment. For example, if a suspected fraud account is marked as abnormal, the model's attention weight may show that the characteristics of the node in the high-frequency component of the spectral domain occupy a higher weight, indicating that the account is significantly different from the normal pattern in the global structure; or the attribute differences with neighbors in the spatial domain are emphasized, indicating that there are abnormalities in the local relationship. With the help of these clues, risk control personnel can understand the basis of the model's judgment, such as knowing that the model judges it as suspicious because "the transaction pattern of the user is incompatible with the overall network structure." This explanatory ability increases the transparency and credibility of the model results, making it easier for professionals to accept and take corresponding measures.

[0089] This embodiment provides a method for identifying account fraud users in operational transaction networks. It designs a GNN architecture that integrates global graph structure and local neighborhood information. During the feature extraction phase, it simultaneously utilizes spectral structure features (generating a global multi-scale representation through Laplacian spectral analysis and diffuse noise) and spatial structure features (obtaining local patterns through neighbor aggregation). A multi-scale attention mechanism is then used to effectively fuse these two features. Unlike traditional graph models that focus only on local neighborhoods, this architecture considers both abnormal patterns in the global topology and detailed features of local relationships, thereby making fraudulent nodes hidden in large-scale networks more prominent. In particular, by leveraging the multi-scale spectral perturbations introduced by the diffusion process, the model can capture high-frequency anomalies that are difficult to observe against a smooth background. Furthermore, through weighted attention fusion, the scale information that best characterizes fraudulent behavior plays a dominant role in the final decision. A contrastive learning mechanism is integrated into the training process of the few-shot graph anomaly detection model. By constructing different perturbed views of a node and introducing a contrastive loss, the model is forced to learn node representations that remain consistent in the presence of noise. This mechanism effectively adds a self-supervised regularization constraint to the model, effectively reducing the uncertainty introduced by few samples and noise. The node representations learned by the model are insensitive to minor perturbations and are more stable and reliable. Furthermore, normal and abnormal nodes are separated in the representation space, enhancing the signal-to-noise ratio for classification. This representation enhancement technique enables the model to maintain excellent discriminative performance even with extremely unbalanced data, significantly outperforming traditional methods that rely solely on supervised signal training, and improving recognition efficiency and accuracy.

[0090] It should be understood that various parts of the present disclosure can be implemented in hardware, software, firmware, or a combination thereof.

[0091] The above description is merely a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A method for identifying account fraud users in an operating transaction network, characterized in that: include: Step 1: Collect basic data in the target network and construct graph structure data based on it; Step 2: Extract the spectral structure features and spatial structure features of the graph structure data to obtain a multi-scale representation of each node in the graph structure data; Step 3: Introduce a multi-scale attention mechanism to filter and combine multi-scale representations to obtain a fused representation; Step 4: Introduce contrastive learning as an auxiliary task and build a training strategy; Step 5: Train the graph neural network and attention network based on the fusion representation and training strategy to obtain the recognition model; Step 6: Input the node data to be identified in the target network into the recognition model to obtain the fraud prediction result.

2. The method according to claim 1, characterized in that The step 1 specifically includes: Step 1.1: Collect basic data of the target network. The basic data includes raw information of nodes and edges. Nodes represent users or account entities. Each node carries an attribute feature vector, which includes account age, number of transactions, evaluation score, and social attributes. Step 1.2, according to the business scenario, determine the relationship between nodes and construct graph structure data according to the preset edge construction strategy, wherein the preset edge construction strategy includes inherent relationship-based graph construction, attribute similarity-based graph construction and mixed strategy graph construction.

3. The method according to claim 2, characterized in that The step 2 specifically includes: Based on the graph structure data, the corresponding Laplace matrix L is calculated, and the Laplace matrix L is spectrally decomposed to obtain eigenvalues and eigenvectors. Gaussian noise of different intensities is gradually injected into the eigenvector of each node to simulate the multi-step forward diffusion process from the original state to the high-noise state. By collecting the node representations under each diffusion step, each node forms a series of spectral domain perturbation features as spectral structure features. In addition, for each node, its multi-order neighbor node set is obtained from the adjacency matrix of the original graph, and the attribute features of each neighbor node are collected. The typical graph neural network message passing and aggregation mechanism is used to weightedly aggregate the features of the neighbor nodes to obtain the spatial domain multi-order neighbor aggregation sequence of the node as the spatial structure feature, and the spectral structure feature and spatial structure feature are used as multi-scale representations.

4. The method according to claim 3, characterized in that The step 3 specifically includes: Step 3.1: Take all multi-scale representations as candidate feature sets for nodes and design an attention network to assign an attention weight to each multi-scale representation in the candidate feature set, indicating the importance of the multi-scale representation for fraudulent node identification. Step 3.2: For each node, perform weighted summation of its corresponding multi-scale representations according to the attention weight to obtain a fusion representation z i .

5. The method according to claim 4, characterized in that The step 3.1 specifically includes: A feature-level attention strategy is adopted to map each feature vector into a scalar score through a fully connected layer, and then softmax normalization is performed on all feature scores to obtain the normalized attention weight distribution.

6. The method according to claim 5, characterized in that The step 4 specifically includes: Step 4.1: construct two different perturbation views for each node and feed them into the shared parameter graph neural network to obtain two representations h of the node. i and h' i As positive sample pairs for contrastive learning, and the fusion representation between two nodes as negative sample pairs; Step 4.2: For node i, calculate its positive sample pair h i and h' i The similarity between them, and the similarity between the negative sample pairs formed by the fusion representation between this node and other nodes j; Step 4.3, construct contrast loss function Where sim(·) represents similarity and τ is the temperature coefficient; In step 4.4, during model training, the contrast loss function and the supervision loss of the main task are weighted and summed according to the preset weights as the overall training target. Then, the parameters of the graph neural network and the attention network are updated simultaneously through backpropagation. The preset weights are adjusted according to the results of the validation set to maximize the discrimination of the representation while maintaining the classification accuracy. In each training batch, steps 4.1 to 4.2 are repeated to continuously optimize the model parameters.

7. The method according to claim 6, characterized in that The step 5 specifically includes: Step 5.1, initialize the parameters of the graph neural network and attention network; Step 5.2: Input the fused representation into the initialized graph neural network and perform iterative training according to the training strategy; In step 5.3, the performance indicators of the trained graph neural network are verified using the validation set. When the performance indicators no longer improve or begin to decline, the training is stopped and the graph neural network obtained from this iterative training is used as the recognition model.

8. The method according to claim 7, characterized in that The step 6 specifically includes: The graph neural network and attention network in the recognition model are used to calculate the embedding representation and fraud probability of each node to be identified to form a fraud prediction result.

Images