Abnormal node detection method for financial transaction information based on attribute enhancement

Abstract

The present invention discloses a method for detecting abnormal nodes in financial transaction information based on attribute enhancement. The method obtains an adjacency matrix, a diagonal matrix, and a standardized adjacency matrix according to the graph data; determines the connection strength in combination with each current node in the node set; determines the sampling probability of each current node according to the frequency weight and the connection strength; determines a sampling subgraph according to the graph data and the sampling probability; determines the distance and predicted probability between each current node and its adjacent nodes by combining a distance function with a feature representation; if the adjacency matrix of the current node and its adjacent nodes under different relationships is greater than zero, the connection relationship is true; if it is equal to zero, the connection relationship is false; determines the target probability of each current node by a Softmax activation function; when the target probability is greater than or equal to 0.5, the corresponding current node is an abnormal node. The method effectively captures the long-distance dependency information of the graph data, improves the expression ability of the model, and improves the accuracy of financial network anomaly detection.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal node detection in financial transaction information, and in particular to a method for detecting abnormal nodes in financial transaction information based on attribute enhancement. Background Art

[0002] Graph data (graph-structured data) can be applied to many real-world scenarios, such as communication networks, financial networks, social networks, etc. Anomaly detection in graph data is an important task in graph data mining and has wide applications in the real world. For example, in social networks, the connections between users can be viewed as graph data. Through graph anomaly detection, fake accounts, abnormal user behaviors, or unusual social patterns can be detected, thereby improving the credibility of social networks and the security of user experience networks; in financial risk management, transactions between financial users can be viewed as graph data, and graph anomaly detection can be used to identify abnormal transactions and fraudulent behaviors, thereby reducing financial losses.

[0003] In the task of anomaly detection in graph data, the primary goal is to generate effective node representations and accurately identify anomalous nodes in the graph data. In graph data, some anomalous nodes are often interconnected, forming clusters, while others are scattered among normal nodes, forming contextual anomaly nodes. The features of contextual anomaly nodes differ significantly from those of surrounding normal nodes, effectively violating the homogeneity assumption. Because graph neural networks update node features by aggregating features from neighboring nodes, the presence of these cluster structure anomalies and contextual anomalies prevents graph neural networks from achieving satisfactory results in graph anomaly detection. Furthermore, in existing graph neural network modeling, most shallow models are unable to fully exploit the deep semantic information of graph data or capture long-range dependencies. This limits the model's expressive power and impacts the accuracy of anomaly detection in financial networks. Summary of the Invention

[0004] Based on this, it is necessary to address the above problems and propose an abnormal node detection method for financial transaction information based on attribute enhancement.

[0005] A method for detecting abnormal nodes in financial transaction information based on attribute enhancement is provided. The financial transaction information is obtained from the T-Finance dataset and is converted into graph data. The graph data is composed of a node set, an edge set, and a node feature matrix. The method is implemented based on the AEGN model. The method implemented by the AEGN model includes:

[0006] Obtaining an original adjacency matrix and a diagonal matrix according to the graph data; the original adjacency matrix is ​​the sum of the adjacency matrices of all relationships, and the elements in the diagonal matrix are the degrees of each node;

[0007] Determine a standardized adjacency matrix according to the original adjacency matrix and the diagonal matrix;

[0008] Determining a connection strength of each current node according to each current node in the node set and the normalized adjacency matrix;

[0009] Determine the frequency weight of the category to which each current node belongs, and determine the sampling probability of each current node in combination with the connection strength corresponding to each current node;

[0010] Determine a sampling subgraph according to the graph data and the sampling probability of each current node;

[0011] Determine the feature representation of each current node under different relationships and different layers, and determine the distance and predicted probability between each current node and its adjacent nodes by combining the feature representation with a distance function;

[0012] Determine an adjacency matrix between each current node and its adjacent nodes under different relationships, if the adjacency matrix is ​​greater than zero, then the connection relationship between the current node and its adjacent nodes under the corresponding relationship is true; if the adjacency matrix is ​​equal to zero, then the connection relationship between the current node and its adjacent nodes under the corresponding relationship is false;

[0013] Determine a target node set according to the connection relationship and the distance;

[0014] pass The activation function determines the output of each current node at different layers by combining the target node representations of the target nodes in the target node set at different layers and the current node representations of each current node at different layers;

[0015] Determine an enhanced representation of each current node according to the output of each current node in the last layer and the original adjacency matrix;

[0016] The target probability of each current node is determined by combining the Softmax activation function with the enhanced representation. When the target probability is greater than or equal to 0.5, the corresponding current node is an abnormal node.

[0017] In one embodiment, the normalized adjacency matrix, the connection strength, the sampling probability, and the sampling subgraph are respectively implemented by the following expressions:

[0018] (1)

[0019] (2)

[0020] (3)

[0021] (4)

[0022] Where A is the original adjacency matrix; is the normalized adjacency matrix, D is a diagonal matrix, where the elements are the degrees of each node; is the connection strength; v is the current node in the node set V; is the sampling probability corresponding to the current node v; is the frequency weight of the category to which the current node v belongs; C is the frequency information; is the sampling subgraph; G is the graph data; It is based on the corresponding sampling probability of each node Functions that construct graphs.

[0023] In one embodiment, the distance and the predicted probability are respectively realized by the following expressions:

[0024] (5)

[0025] (6)

[0026] in, For the The distance between the current node v and its adjacent node u; is the first weight matrix; For the current node v in the relationship r, The feature representation of the layer, the value is same; For the adjacent node u under the relationship r, Feature representation of the layer; For the relationship r The bias vector of the layer; is the activation function; the input is hour, = ; is constituted; is the predicted probability.

[0027] In one embodiment, the connection relationship is determined by the following expression:

[0028] (7)

[0029] in, Represents the connection relationship between the current node v and the adjacent node u under the relationship r; is the adjacency matrix under relation r;

[0030] The target node set is determined by the following expression:

[0031] (8)

[0032] in, is the target node set; is the sampling subgraph; v is the current node in the node set V; is undersampling, is oversampling, The node selection function selects the target node set based on the input ; For the The distance between the current node v and the adjacent node u; is the threshold.

[0033] In one embodiment, the output of each current node at different layers is determined by the following expression:

[0034] (l=1 )(9)

[0035] in, For the current node v in The output of the layer; is the activation function; is the second weight matrix; AGG is the average aggregation function; Target node In the layer The target node under is represented by; For the current node v in layer The representation of ; the input layer 0 is , target node set Contains the current node and candidate neighbors, is the output of each current node v in the last layer, which can also be expressed as .

[0036] In one embodiment, the enhanced representation and the target probability are respectively determined by the following expressions:

[0037] (10)

[0038] (11)

[0039] in, is the enhanced representation; A is the original adjacency matrix; is the binarization function; Represents the attention mechanism calculation process; is the output of each current node v in the last layer; is a hyperparameter; is the target probability; is the weight matrix; is the bias vector.

[0040] In one embodiment, the abnormal node detection method for financial transaction information based on attribute enhancement further includes: determining the mapping probability of each current node by combining the output of each current node in the last layer with the Softmax activation function; determining the overall classification loss based on the probability that the output of each current node in the last layer is normal or abnormal and the probability that the node predicted by the enhanced representation is normal or abnormal, and optimizing the AEGN model based on the overall classification loss; the overall classification loss is implemented by the following expression:

[0041] (12)

[0042] (13)

[0043] in, is the mapping probability; is the weight matrix; is the bias vector; is the output of each current node v in the last layer; is the overall classification loss, which is used to optimize the classification performance of the model; V is the node set; For the current node The actual node label belonging to class k, which is normal or abnormal; For the original representation node The probability of belonging to category k; To enhance the representation Predicted nodes The probability of belonging to category k; The set of nodes used belongs to the previously selected graph.

[0044] In one embodiment, the method for detecting abnormal nodes in financial transaction information based on attribute enhancement further includes: determining the actual label of each current node, and optimizing the first weight matrix and bias vector in the distance function using a distance function loss; the distance function loss is implemented by the following expression:

[0045] (14)

[0046] in, is the distance function loss; For the current node The true label of is the predicted probability.

[0047] In one embodiment, the abnormal node detection method of financial transaction information based on attribute enhancement further includes: determining the enhanced representation loss according to the enhanced representation and the output of each current node at the last layer, and The second weight matrix in the activation function is optimized, and the enhanced representation loss is realized by the following expression:

[0048] (15)

[0049] Where L is the enhanced representation loss, which is used to optimize the quality of the enhanced representation; For the current node The true label of If the current node If it belongs to category k, the value is 1, otherwise it is 0; The current node predicted for the enhanced representation The probability of belonging to category k; is the target probability; represents the distance between the output of each current node v in the last layer and the enhanced representation.

[0050] In one embodiment, the graph data is expressed as: G={V, E, X};

[0051] V is a node set, V=[user account, bank card, device, merchant];

[0052] E is the edge set, E=[transfer, consumption, device binding];

[0053] X is the node feature matrix, which represents the attributes of the node, X = [user occupation, account balance, transaction frequency, merchant industry category].

[0054] The present application obtains an adjacency matrix and a diagonal matrix according to the graph data; the original adjacency matrix is ​​the sum of the adjacency matrices of all relationships, and the elements in the diagonal matrix are the degrees of each node; a standardized adjacency matrix is ​​determined according to the original adjacency matrix and the diagonal matrix; the connection strength of each current node is determined according to each current node in the node set and the standardized adjacency matrix; the frequency weight of the category to which each current node belongs is determined, and the sampling probability of each current node is determined in combination with the connection strength corresponding to each current node; a sampling subgraph is determined according to the graph data and the sampling probability of each current node; the feature representation of each current node under different relationships and different layers is determined, and the distance and predicted probability between each current node and its adjacent nodes are determined by combining the distance function with the feature representation; the adjacency matrix of each current node and its adjacent nodes under different relationships is determined, if the adjacency matrix is ​​zero, the connection relationship between the current node and its adjacent nodes under the corresponding relationship is true; if the adjacency matrix is ​​equal to zero, the connection relationship between the current node and its adjacent nodes under the corresponding relationship is false; the target node set is determined according to the connection relationship and the distance; The activation function combines the target node representations of the target nodes in the target node set at different layers and the current node representations of each current node at different layers to determine the output of each current node at each layer. An enhanced representation of each current node is determined based on the output of each current node at the last layer and the original adjacency matrix. A softmax activation function is then combined with the enhanced representation to determine the target probability of each current node. When the target probability is greater than or equal to 0.5, the corresponding current node is considered an anomaly. This effectively captures the long-range dependency information of the graph data, improves the model's expressiveness, and enhances the accuracy of financial network anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0056] in:

[0057] Figure 1 This is a diagram illustrating an application environment of a method for detecting abnormal nodes in financial transaction information based on attribute enhancement in one embodiment;

[0058] Figure 2 Flowchart of a method for detecting abnormal nodes in financial transaction information based on attribute enhancement in one embodiment;

[0059] Figure 3 A graph showing the impact of feature enhancement diversity weight on model performance in one embodiment;

[0060] Figure 4 is a graph showing the effect of shielding ratio on model performance in one embodiment;

[0061] Figure 5 FIG. 1 is a structural block diagram of a computer device in one embodiment. DETAILED DESCRIPTION

[0062] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0063] Figure 1 FIG1 is an application environment diagram of an abnormal node detection method for financial transaction information based on attribute enhancement in one embodiment. Figure 1The abnormal node detection method for financial transaction information based on attribute enhancement is applied to an abnormal node detection system for financial transaction information based on attribute enhancement. The abnormal node detection system for financial transaction information based on attribute enhancement includes a terminal 110 and a server 120. The terminal 110 and the server 120 are connected via a network. The terminal 110 can be a desktop terminal or a mobile terminal. The mobile terminal can be at least one of a mobile phone, a tablet computer, a laptop computer, etc. The server 120 can be implemented as an independent server or a server cluster consisting of multiple servers. The terminal 110 is used to obtain an adjacency matrix and a diagonal matrix based on the graph data; the original adjacency matrix is ​​the sum of the adjacency matrices of all relationships, and the elements in the diagonal matrix are the degrees of each node. The server 120 is used to determine a standardized adjacency matrix based on the original adjacency matrix and the diagonal matrix; determine the connection strength of each current node based on each current node in the node set and the standardized adjacency matrix; determine the frequency weight of the category to which each current node belongs, and determine the sampling probability of each current node in combination with the connection strength corresponding to each current node; determine a sampling subgraph based on the graph data and the sampling probability of each current node; determine the feature representation of each current node under different relationships and different layers, and determine the distance and predicted probability between each current node and its adjacent nodes through a distance function combined with the feature representation; determine the adjacency matrix of each current node and its adjacent nodes under different relationships, if the adjacency matrix is ​​zero, the connection relationship between the current node and its adjacent nodes under the corresponding relationship is true; if the adjacency matrix is ​​equal to zero, the connection relationship between the current node and its adjacent nodes under the corresponding relationship is false; determine the target node set based on the connection relationship and the distance; through The activation function combines the target node representations of the target nodes in the target node set at different layers and the current node representations of each current node at different layers to determine the output of each current node at different layers; the enhanced representation of each current node is determined based on the output of each current node at the last layer and the original adjacency matrix; the target probability of each current node is determined by the Softmax activation function combined with the enhanced representation. When the target probability is greater than or equal to 0.5, the corresponding current node is an abnormal node.

[0064] A method for detecting abnormal nodes in financial transaction information based on attribute enhancement, wherein the financial transaction information comes from the T-Finance dataset and is converted into graph data. The graph data is composed of a node set, an edge set, and a node feature matrix. The method is implemented based on the AEGN model. In this application, the graph data is expressed as follows: G={V,E,X}; V is the node set, V=[user account, bank card, device, merchant]; E is the edge set, E=[transfer, consumption, device binding]; X is the node feature matrix, representing the attributes of the node, X=[user occupation, account balance, transaction frequency, merchant industry category].

[0065] like Figure 2 As shown, the method for executing the AEGN model includes:

[0066] S1: Obtain an original adjacency matrix and a diagonal matrix according to the graph data; the original adjacency matrix is ​​the sum of the adjacency matrices of all relationships, and the elements in the diagonal matrix are the degrees of each node;

[0067] S2: Determine a standardized adjacency matrix according to the original adjacency matrix and the diagonal matrix;

[0068] S3: determining the connection strength of each current node according to each current node in the node set and the standardized adjacency matrix;

[0069] S4: determining the frequency weight of the category to which each current node belongs, and determining the sampling probability of each current node in combination with the connection strength corresponding to each current node;

[0070] S5: Determine a sampling subgraph based on the graph data and the sampling probability of each current node;

[0071] S6: Determine the feature representation of each current node under different relationships and different layers, and determine the distance and predicted probability between each current node and its adjacent nodes by combining the feature representation with a distance function;

[0072] S7: Determine an adjacency matrix between each current node and its adjacent nodes under different relationships. If the adjacency matrix is ​​greater than zero, the connection relationship between the current node and its adjacent nodes under the corresponding relationship is true; if the adjacency matrix is ​​equal to zero, the connection relationship between the current node and its adjacent nodes under the corresponding relationship is false.

[0073] S8: Determine a target node set according to the connection relationship and the distance;

[0074] S9: Pass The activation function determines the output of each current node at different layers by combining the target node representations of the target nodes in the target node set at different layers and the current node representations of each current node at different layers;

[0075] S10: determining an enhanced representation of each current node according to the output of each current node in the last layer and the original adjacency matrix;

[0076] S11: Determine the target probability of each current node using a softmax activation function combined with the enhanced representation. When the target probability is greater than or equal to 0.5, the corresponding current node is an anomaly. For example, the current node corresponds to a user account in the node set. Types of anomalies in this user account include: abnormal fund flow: an ordinary user account (with the attribute "personal small account") conducts large-value transfers with dozens of unfamiliar accounts in a short period of time, and the transaction frequency is much higher than that of similar nodes (possibly a money laundering account); isolated structure but frequent transactions: the user account rarely participates in the transaction circle of normal users (sparsely connected), but frequently conducts small-value transactions with known fraudulent nodes (possibly a "money laundering transit station"); etc. By converting the T-Finance dataset of financial transaction information into graph data, the present invention can only determine anomalies for the current node (user account, bank card, device, or merchant) in the node set. The final determination of anomalies in the node can assist professionals in further determining anomalies in financial transaction information, such as fraud, hacking, and other illegal and criminal activities.

[0077] This application effectively captures the long-distance dependency information of graph data through the above-mentioned method steps, improves the expressiveness of the model, and improves the accuracy of financial network anomaly detection.

[0078] In one embodiment, the normalized adjacency matrix, the connection strength, the sampling probability, and the sampling subgraph in steps S1-S5 are respectively implemented by the following expressions:

[0079] (1)

[0080] (2)

[0081] (3)

[0082] (4)

[0083] Where A is the original adjacency matrix; is the normalized adjacency matrix, D is a diagonal matrix, where the elements are the degrees of each node; is the connection strength; v is the current node in the node set V; is the sampling probability corresponding to the current node v; is the frequency weight of the category to which the current node v belongs; C is the frequency information; is the sampling subgraph; G is the graph data; It is based on the corresponding sampling probability of each node Functions that construct graphs.

[0084] Specifically, first calculate the sampling probability To specify how the sampler selects nodes and edges to build the graph, this sampler uses the frequency information C of the label and the standardized adjacency matrix when processing category imbalanced data. The probability P of each current node being selected is adjusted to ensure that the current nodes of the minority class are sampled more frequently. With the current node The strength of the connection with its neighboring nodes and the current node It is proportional to the node category it belongs to. Measure the current node The expected connection strength of the neighbors, emphasizing the current node The importance of its neighborhood, i.e. Numerical and is proportional to the connection strength, that is, proportional to the sampling intensity. Is the current node The frequency weight of the category, that is, the minority class has a higher , helps balance the sampling probability of different nodes.

[0085] Then the graph nodes need to be selected and constructed. Since the current nodes of different categories in the graph data often have different frequencies of occurrence, the sampler is used to select nodes from the training set (that is, the node set) based on the connection strength and label frequency of each current node and its adjacent nodes. and the edges associated with the nodes , It is based on the corresponding sampling probability of each current node To select the appropriate node to build the graph function, when When it is greater than a certain set value, select the corresponding current node , thus forming a sampling subgraph , improve the training opportunities for minority classes, as shown in formulas (2)-(4);

[0086] In order to overcome the problem that the model fits a minority of nodes, neighborhood sampling and data augmentation are used to increase the generalization ability of the model. First, different sampling strategies are implemented for different categories of nodes using neighborhood sampling. Then, learnable data augmentation is used to enhance the node embedding data through attention mechanism and masking technology.

[0087] In one embodiment, the distance and predicted probability in step S6 are respectively realized by the following expressions:

[0088] (5)

[0089] (6)

[0090] in, For the The distance between the current node v and its adjacent node u; is the first weight matrix; For the current node v in the relationship r, The feature representation of the layer, the value is same; For the adjacent node u under the relationship r, Feature representation of the layer; For the relationship r The bias vector of the layer; is the activation function; the input is hour, = ; is constituted; is the predicted probability.

[0091] Specifically, the distance function filters out irrelevant neighbor nodes by calculating the distance between nodes. The Euclidean distance is widely used in feature measurement and is defined as , Indicates the current node exist However, in the anomaly detection task, such distance function fails to incorporate label information. Therefore, we introduce a parameterized distance function to enhance the model’s support for potential embedded information and integrate real label data, as shown in Formula (5).

[0092] In order to make the behavior of the neighborhood sampler learnable, the node sampling process in the graph data is optimized through a parameterized distance function. Learning this ability enables the model to fully utilize the relationship between nodes during the sampling process. The model adjusts and learns how to measure distances based on the actual data distribution and label information between nodes, thereby effectively identifying and strengthening the sampling intensity of the sampler for minority classes. It can improve the flexibility and effectiveness of the model in processing unbalanced graph data, making it more adaptable to various complex graph structures and dynamic changes. Distance function loss Mainly used to evaluate the predicted probability With the current node The true label The difference between Indicates that under the relationship r, it is based on the distance function For the current node The anomaly probability calculated at level l.

[0093] In one embodiment, the connection relationship is determined by the following expression:

[0094] (7)

[0095] in, Represents the connection relationship between the current node v and the adjacent node u under the relationship r; is the adjacency matrix under relation r;

[0096] Specifically, Indicates whether node v and adjacent node u are connected under relationship r. If there is a connection, the model will consider incorporating adjacent node u into the neighborhood sampling of the current node v. If there is no connection, the adjacent node u is usually ignored. The specific expression is as shown in formula (7).

[0097] The target node set in step S8 is determined by the following expression:

[0098] (8)

[0099] in, is the target node set; is the sampling subgraph; v is the current node in the node set V; is undersampling, is oversampling, The node selection function selects the target node set based on the input ; For the The distance between the current node v and the adjacent node u; is the threshold.

[0100] Specifically, Indicates whether node v and adjacent node u are connected under relationship r; is the adjacency matrix under the relation r; therefore, the equation for sampling of different categories is expressed as , the neighborhood of the current node v that belongs to the minority class in the dataset can be enhanced by oversampling, selecting nodes that are far away from the current node v but have a certain similarity, while undersampling is performed on the nodes that belong to the majority class in the dataset.

[0101] In one embodiment, the output of each current node at different layers in step S9 is determined by the following expression:

[0102] (l=1 ) (9)

[0103] in, For the current node v in The output of the layer; is the activation function; is the second weight matrix; AGG is the average aggregation function; Target node In the layer The target node under is represented by; For the current node 𝑣 in layer The representation of ; the input layer 0 is , target node set Contains the current node and candidate neighbors, is the output of each current node v in the last layer, which can also be expressed as .

[0104] Specifically, during the aggregation process, each current node v has an associated representation ,here Represents the number of layers, r represents the relationship, and for each relationship r, the model aggregates the information of all selected neighbors. This step uses the average aggregation function AGG. This aggregation function calculates the average of all selected neighbors in the layer The following expression Then, this average value is obtained by the concatenation operation ( ) and the representation of the current node v in the previous layer Merge. Specifically, for a node v and a relation r, first collect the representations of all its neighbor nodes u under the relation r , and feed these representations into the average aggregation function AGG. The average aggregation function is used to calculate the arithmetic mean of these neighbor representations to obtain a summary of the neighbor information representation. Next, this representation is used together with the representation of node v in the previous layer. Perform the concatenation operation to obtain an extended feature vector. After obtaining the concatenated vector, the model uses the weighted matrix Perform a linear transformation on the connected vectors to integrate the information of different dimensions into a whole, thus preparing for the nonlinear activation function. , applied to this linearly transformed vector to introduce nonlinear processing, enhance the model's expressiveness, and help the model capture complex patterns and relationships and interactions between nodes. Through this process, the new representation of each node v It is able to comprehensively consider information from its neighbors as well as information from its own previous layers, thereby propagating and updating information in the graph, providing a basis for deeper network learning and feature extraction.

[0105] In one embodiment, the enhanced representation in step S10 and the target probability in step S11 are respectively determined by the following expressions:

[0106] (10)

[0107] (11)

[0108] in, is the enhanced representation; A is the original adjacency matrix; is the binarization function; Represents the attention mechanism calculation process; is the output of each current node v in the last layer; is a hyperparameter; is the target probability; is the weight matrix; is the bias vector.

[0109] Specifically, in order to select the dimensions to be retained, the attention mechanism is used to calculate the weight of each dimension, and the weight is set to 0 or 1 according to the predefined masking rate. A simplified version of the attention module can be expressed as , where 𝑊 and 𝑏 are the weight matrix and bias vector, respectively. This operation provides a quantitative basis for subsequent dimension screening, enabling the enhancement module to identify the features that are most critical for model training. The core idea of ​​the process is to select and retain those feature dimensions that are important to the task in the input representation, set their weight dimension to 1, clearly retain the most important feature dimension in the input representation, and set the remaining less important weight dimensions to 0, thereby filtering out minor information. The retention ratio is determined by the hyperparameter Decision,control the proportion of retained features and reduce unnecessary noise. is the target probability obtained according to the enhanced representation.

[0110] In one embodiment, the abnormal node detection method for financial transaction information based on attribute enhancement further includes: determining the mapping probability of each current node by combining the output of each current node in the last layer with the Softmax activation function; determining the overall classification loss based on the probability that the output of each current node in the last layer is normal or abnormal and the probability that the node predicted by the enhanced representation is normal or abnormal, and optimizing the AEGN model based on the overall classification loss; the overall classification loss is implemented by the following expression:

[0111] (12)

[0112] (13)

[0113] in, is the mapping probability; is the weight matrix; is the bias vector; For each current node At the output of the last layer; is the overall classification loss, which is used to optimize the classification performance of the model; V is the node set; For the current node The actual node label belonging to class k (normal or abnormal); For the original representation node The probability of belonging to class k (normal or abnormal); To enhance the representation The current node of the prediction The probability of belonging to category k; The set of nodes used belongs to the previously selected graph.

[0114] In one embodiment, the method for detecting abnormal nodes in financial transaction information based on attribute enhancement further includes: determining the actual label of each current node, and optimizing the first weight matrix and bias vector in the distance function using a distance function loss; the distance function loss is implemented by the following expression:

[0115] (14)

[0116] in, is the distance function loss; For the current node The true label of is the predicted probability.

[0117] Specifically, the function is designed to minimize the cross entropy between the predicted probability and the true node label, thereby optimizing the classification performance of the model. Calculate its embedded representation in each relationship r and the layer l, and use the parameterized distance function Calculate the predicted probability. Since its calculation uses the node's own characteristics and the relative position and similarity between nodes, the model can analyze the characteristics more carefully. Then use the current node The true label and predicted probability Calculate the cross entropy loss of the entire graph. Each iteration can reduce the difference between the model output and the actual label, improving the model's ability to predict various complex relationships in the graph. The specific loss function is shown in Formula (14).

[0118] In one embodiment, the abnormal node detection method of financial transaction information based on attribute enhancement further includes: determining the enhanced representation loss according to the enhanced representation and the output of each current node at the last layer, and The second weight matrix in the activation function is optimized, and the enhanced representation loss is realized by the following expression:

[0119] (15)

[0120] Where L is the enhanced representation loss, which is used to optimize the quality of the enhanced representation; For the current node The true label of If the current node If it belongs to category k, the value is 1, otherwise it is 0; The current node predicted for the enhanced representation The probability of belonging to category k; is the target probability; represents the distance between the output of each current node v in the last layer and the enhanced representation.

[0121] Specifically, in each iteration, the augmentation loss is first calculated. This loss guides the optimization of the learnable data augmentation module to generate more discriminative augmented representations. The module then uses the updated augmented representations in combination with the cross-entropy loss to optimize model parameters, ensuring that the model is able to distinguish between normal and abnormal nodes. In this section, we will explain the specific loss function in detail. The augmentation loss function consists of two main components: a similarity loss that emphasizes the similarity between the original and augmented representations, ensuring that the augmentation process does not change the category and destroy information; and a difference loss that emphasizes the feature differences between the original and augmented representations, keeping the changes within a reasonable range. Indicates the distance between the original representation and the enhanced representation. For the enhanced representation, the predicted value is calculated based on For the original representation, it has its predicted value , and then the classification loss is used to enable the model to have classification capabilities, as shown in formula (15).

[0122] The beneficial effects of the present invention are: by calculating the sampling probability, combining the connection strength and category frequency information, it is ensured that the minority class nodes are sampled more and the model performance is improved. In addition, by constructing subgraphs and optimizing neighbor selection, information loss is avoided, the training opportunities for minority class nodes are improved, and the model's ability to learn important features is enhanced. The feature dynamic enhancement module aims to solve the problem that the model tends to fit minority class nodes, and improves the generalization ability of the model through neighborhood sampling and data enhancement methods. First, differentiated neighborhood sampling strategies are adopted for nodes of different categories; then, learnable data enhancement technology is used to effectively enhance node embedding through attention mechanism and masking strategy. Finally, the enhanced representation loss is calculated through the multivariate guidance module to guide the learnable data enhancement module to perform optimization, generate better enhanced representation, and achieve more effective anomaly detection. A large number of experiments have demonstrated the effectiveness of the method proposed in the present invention.

[0123] 1. Dataset Processing: We evaluate the proposed method on four benchmark datasets, including Amazon, YelpChi, T-Finance, and T-Social, which are widely used in previous studies:

[0124] (1) Amazon: The goal of this dataset is to identify fake buyers who pay to post fake reviews in the "Musical Instruments" category on the Amazon.com platform. Three types of associations are defined in the figure: UPU represents users who review at least one of the same products. USU is a user with at least one identical star rating within a week. UVU is a user with a top 5% mutual review similarity.

[0125] (2) YelpChi: This dataset aims to identify unusual reviews on Yelp.com that contain inappropriate promotions or disparagements of certain products or businesses. The figure shows three different types of edges, each representing a different relationship. Three types of relationships are defined in the figure: RUR represents reviews posted by the same user. RSR is reviews with the same star rating for the same product. RTR is reviews posted within the same month for the same product.

[0126] (3) T-Finance: The goal of this dataset is to identify accounts with abnormal behavior in the transaction network. Each node represents a unique anonymous account, and its characteristics are composed of 10 dimensions, covering information such as registration time, login behavior, and interaction frequency. The edges in the graph are used to indicate that transactions have occurred between two accounts. If an account is involved in abnormal behavior such as fraud, money laundering, or online gambling, it will be manually annotated by experts and marked as an abnormal node.

[0127] (4) T-Social: This dataset focuses on detecting abnormal users in social networks. Its node features include 10 attributes such as registration duration, login behavior, and interaction frequency. The annotation method is consistent with the T-Finance dataset, and experts manually annotate based on account behavior. Nodes are connected if they have maintained a friendship for more than three months. The data volume of T-Social far exceeds that of YelpChi and Amazon, reaching 100 times their size.

[0128] 2. Comparative Models and Evaluation Metrics: The proposed method was compared with seven benchmark methods, including CARE-GNN, GraphConsis, PC-GNN, BWGNN, GHRN, GDN, and GAGA. CARE-GNN uses a neural classifier to evaluate the similarity distribution between nodes and their neighbors and, based on the evaluation results, removes neighboring nodes with significant differences. A reinforcement learning mechanism is employed to dynamically optimize the screening threshold, while a relation-sensitive aggregation operator is designed to accommodate the feature fusion requirements of heterogeneous relational graphs. GraphConsis proposes a systematic solution to three types of inconsistencies in graph anomaly detection: context, feature, and relational dimensions. To address contextual inconsistency, a dynamic context embedding mechanism is introduced to represent the local topological features of nodes. To resolve feature dimension conflicts, a neighborhood screening module based on semantic consistency assessment is constructed. For relational inconsistency, cross-relational information integration is achieved through relation-specific representation learning and an attention-weighted fusion strategy. PC-GNN proposes an inverse label frequency weighting strategy to optimize the training sample selection process and adjusts the sampling weights of nodes and edges using a label distribution balancing algorithm. A differentiated neighborhood sampling strategy is also developed, focusing on enhancing the local topological sampling intensity of suspicious nodes while simultaneously reducing the neighborhood coverage density of regular nodes. BWGNN reveals the low-frequency to high-frequency energy migration caused by abnormal nodes in the graph energy distribution, and constructs a bandpass filter with joint spatial and frequency domain properties based on the Beta kernel function. Two processing paradigms are proposed for multi-relationship graphs: the topological fusion mode integrates multiple relationships into a single graph for convolution, while the independent relationship mode performs convolution operations on each relationship subgraph separately and then uses max pooling to achieve feature integration. GHRN, based on graph signal processing theory, demonstrates the equivalence of spatial domain heterogeneous edge identification and frequency domain high-frequency component extraction, proposes a spectral analysis-based heterogeneous edge removal algorithm, and reconstructs a purified graph structure for model training. It inherits the two processing modes of the BWGNN framework, maintaining compatibility with the original model architecture. GDN establishes a two-factor decomposition framework for node representation, decoupling the feature space into a class feature vector and an environmental feature vector. Class consistency constraints are imposed to ensure the close proximity of similar nodes in the class feature space, while topological proximity constraints are constructed to maintain the continuity of adjacent nodes in the environmental feature space. GAGA implements a neighborhood triplet classification mechanism (normal / suspicious / unlabeled) based on semi-supervised label information. Differentiated feature processing flows are designed for different groups. Multimodal feature enhancement is performed through learnable skip connections, relationship weights, and group identifiers. Finally, a Transformer architecture is employed to achieve cross-group feature interaction and representation optimization. Furthermore, the performance of AEGN and comparison methods is measured using the average of three evaluation metrics (AUROC, AUPRC, and Macro F1) obtained from five physical training cycles.The three evaluation metrics are described in detail below: AUROC evaluates model performance by calculating the area under the receiver operating characteristic curve (ROC curve). The specific calculation process is as follows:

[0129] (16)

[0130] Among them, TPR is the true positive rate and FPR is the false positive rate.

[0131] AUPRC (Area Under the Precision-Recall Curve) is an important indicator for evaluating the performance of classification models on imbalanced datasets. It measures the performance of the model by calculating the area under the Precision-Recall Curve. Unlike AUROC (Area Under the Receiver Operating Characteristic Curve), AUPRC is particularly suitable for situations where the class distribution is unbalanced because it pays more attention to the detection ability of the minority class. Therefore, in an imbalanced dataset where the number of samples in the minority class is far less than that in the majority class, traditional evaluation indicators (such as accuracy) may mask the performance of the model on the minority class due to the majority class. AUPRC, by combining accuracy and recall, can more comprehensively reflect the classification effect of the model on the minority class. The specific calculation process is as follows:

[0132] (17)

[0133] Among them, Precision is the accuracy rate and Recall is the recall rate.

[0134] The macro F1 score is the harmonic average of precision and recall, which takes into account both recall and precision and has better stability for unbalanced data. This means that the model has achieved a good balance between precision and recall. First, the calculation formula of F1 score is as follows:

[0135] (18)

[0136] is the average F1 score of all categories:

[0137] (19)

[0138] Where C is the total number of categories, The F1 score of the i-th class.

[0139] 3. Experimental results and analysis:

[0140] Performance Comparison: We first compared the performance of AEGN with other algorithms. The results for the Amazon and YelpChi datasets are shown in Table 1, and for the T-Finance and T-Social datasets in Table 2. The highest and second-highest results are highlighted in bold and underlined, respectively. The proposed AEGN performs well in most scenarios, demonstrating its effectiveness in graph anomaly detection. In contrast, the remaining methods failed to achieve competitive performance, highlighting the effectiveness of the learnable data augmentation and multi-dimensional guidance modules.

[0141] Table 1 Performance comparison of anomaly detection methods on Amazon and YelpChi datasets

[0142]

[0143] Table 2 Performance comparison of anomaly detection methods on T-Finance and T-Social datasets

[0144]

[0145] Parameter Analysis: Next, we conduct sensitivity analysis on key hyperparameters in the AEGN model, including feature enhancement diversity weights , masking ratio. For Amazon and YelpChi datasets, The performance is best when the value of α is around 1.0. For T-Finance, the performance is best when the value of α is around 5.0.

[0146] Specifically, The control model retains the original feature information and prefers the feature diversity generation during the dynamic enhancement process. Detailed explanation and rationality analysis of different values: When the value is larger, the model tends to retain the important information of the original features and prevent the enhanced features from deviating from the original data distribution. This helps maintain the inherent pattern of abnormal nodes and prevents feature distortion caused by excessive enhancement. When it is smaller, the model is more likely to generate diverse enhanced features and simulate potential abnormal patterns by introducing reasonable perturbations. This helps improve the model's generalization ability for minority class abnormal nodes and avoid overfitting on minority class samples. The recall rate of the model for the minority class abnormal nodes may be higher, but the accuracy rate is lower. The value allows the enhanced features to differ greatly from the original features, generating more diverse abnormal patterns, but may introduce noise. It is suitable for scenarios where labels are extremely scarce and abnormal patterns are complex. This moderate When the value is set, the model can retain the key information of the original features while introducing limited diversity, balancing the accuracy and robustness of anomaly detection. It is suitable for scenarios with moderate class imbalance and relatively clear anomaly patterns. At higher values, the similarity between the enhanced features and the original features will be strictly constrained, which is suitable for scenarios where the abnormal pattern is highly dependent on the original attributes. This will suppress diversity and cause the model to be unable to capture abnormal patterns of potential variation. Figure 3 , demonstrating the impact of feature enhancement diversity weights on model performance.

[0147] In the dynamic feature enhancement module, the masking rate 𝜆 controls the proportion of node feature dimensions retained in the learnable masking module. λ determines the proportion of important dimensions in the node feature vector that are retained during the enhancement process. Specifically, it highlights attributes that are critical to the anomaly detection task by masking out minor or noisy feature dimensions. Furthermore, it enhances generalization by randomly masking some features to simulate potential anomaly patterns and prevent the model from overfitting to the specific attributes of minority class samples.

[0148] Low values ​​retain fewer feature dimensions, enhance diversity but introduce noise. It is suitable for scenarios where abnormal patterns are highly sparse. If the masking rate λ is set too low, the model will degenerate into a basic model and will not be able to effectively utilize the potential valuable information in the unlabeled data for training. On the other hand, a too high λ value may lead to the loss of important information, making it difficult for the model to recognize meaningful patterns. Figure 4 , demonstrating the impact of occlusion ratio on model performance.

[0149] Ablation study: Next, an ablation study is conducted to verify the effectiveness of each component in AEGN. AEGNw / oDiv and AEGNw / oMut represent the AEGN framework without the feature dynamic enhancement module and the AEGN framework without the multivariate guidance module, respectively. The feature dynamic enhancement module dynamically adjusts the neighborhood distribution through a parameterized distance function and a learnable neighborhood sampling strategy, and combines the attention mechanism to generate diverse enhanced representations. After removing the dynamic enhancement module, the neighborhood noise increases, and the model directly uses the original adjacency matrix for neighborhood aggregation, resulting in the retention of noisy neighbors of majority class nodes, which interferes with the feature propagation of minority class nodes. It will also lead to increased class imbalance, and the neighborhood information of minority class nodes is difficult to fully learn, resulting in a decrease in the model's sensitivity to abnormal nodes. After removing the multivariate guidance module, the constraints between the enhanced representation and the original representation are released, which may cause the enhanced features to deviate from the true semantics and reduce the classification confidence. As shown in Table 3, the AEGN proposed in this invention achieves the highest AUROC and F1 values ​​on the four benchmark datasets.

[0150] Table 3 AUROC and F1 values ​​of AEGN in the framework and its variants

[0151]

[0152] Extensive experiments on four benchmark datasets demonstrate the effectiveness of the proposed method. Ablation experiments compare the performance of the variant framework with the original framework, which also verifies the effectiveness of this scheme for practical application tasks.

[0153] Figure 5 FIG1 shows an internal structure diagram of a computer device in an embodiment. The computer device can be a terminal or a server. Figure 5 As shown, the computer device includes a processor, a memory, and a network interface connected via a system bus. The memory includes a non-volatile storage medium and an internal memory. The non-volatile storage medium of the computer device stores an operating system and may also store a computer program. When the computer program is executed by the processor, the processor can implement the abnormal node detection method based on attribute enhancement of financial transaction information. The internal memory may also store a computer program. When the computer program is executed by the processor, the processor can implement the abnormal node detection method based on attribute enhancement of financial transaction information. Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0154] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0155] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0156] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A method for detecting abnormal nodes in financial transaction information based on attribute enhancement, wherein the financial transaction information comes from the T-Finance dataset and is converted into graph data. The graph data consists of a node set, an edge set, and a node feature matrix. The method is characterized by: The method is implemented based on the AEGN model, and the method executed by the AEGN model includes: Obtaining an original adjacency matrix and a diagonal matrix according to the graph data; the original adjacency matrix is ​​the sum of the adjacency matrices of all relationships, and the elements in the diagonal matrix are the degrees of each node; Determine a standardized adjacency matrix according to the original adjacency matrix and the diagonal matrix; Determining a connection strength of each current node according to each current node in the node set and the normalized adjacency matrix; Determine the frequency weight of the category to which each current node belongs, and determine the sampling probability of each current node in combination with the connection strength corresponding to each current node; Determine a sampling subgraph according to the graph data and the sampling probability of each current node; Determine the feature representation of each current node under different relationships and different layers, and determine the distance and predicted probability between each current node and its adjacent nodes by combining the feature representation with a distance function; Determine an adjacency matrix between each current node and its adjacent nodes under different relationships, if the adjacency matrix is ​​greater than zero, then the connection relationship between the current node and its adjacent nodes under the corresponding relationship is true; if the adjacency matrix is ​​equal to zero, then the connection relationship between the current node and its adjacent nodes under the corresponding relationship is false; Determine a target node set according to the connection relationship and the distance; pass The activation function determines the output of each current node at different layers by combining the target node representations of the target nodes in the target node set at different layers and the current node representations of each current node at different layers; Determine an enhanced representation of each current node according to the output of each current node in the last layer and the original adjacency matrix; The target probability of each current node is determined by combining the Softmax activation function with the enhanced representation. When the target probability is greater than or equal to 0.5, the corresponding current node is an abnormal node.

2. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: The normalized adjacency matrix, the connection strength, the sampling probability, and the sampling subgraph are respectively implemented by the following expressions: (1) (2) (3) (4) Where A is the original adjacency matrix; is the normalized adjacency matrix, D is a diagonal matrix, where the elements are the degrees of each node; is the connection strength; v is the current node in the node set V; is the sampling probability corresponding to the current node v; is the frequency weight of the category to which the current node v belongs; C is the frequency information; is the sampling subgraph; G is the graph data; It is based on the corresponding sampling probability of each node Functions that construct graphs.

3. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: The distance and predicted probability are respectively realized by the following expressions: (5) (6) in, For the The distance between the current node v and its adjacent node u; is the first weight matrix; For the current node v in the relationship r, The feature representation of the layer, the value is same; For the adjacent node u under the relationship r, Feature representation of the layer; For the relationship r The bias vector of the layer; is the activation function; the input is hour, = ; is constituted; is the predicted probability.

4. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: The connection relationship is determined by the following expression: (7) in, Represents the connection relationship between the current node v and the adjacent node u under the relationship r; is the adjacency matrix under relation r; The target node set is determined by the following expression: (8) in, is the target node set; is the sampling subgraph; v is the current node in the node set V; is undersampling, is oversampling, The node selection function selects the target node set based on the input ; For the The distance between the current node v and the adjacent node u; is the threshold.

5. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: The output of each current node at different layers is determined by the following expression: （l=1 ）(9) in, For the current node v in The output of the layer; is the activation function; is the second weight matrix; AGG is the average aggregation function; Target node In the layer The target node under is represented by; For the current node v in layer The representation of ; the input layer 0 is , target node set Contains the current node and candidate neighbors, is the output of each current node v in the last layer, which can also be expressed as .

6. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: The enhanced representation and the target probability are respectively determined by the following expressions: (10) (11) in, is the enhanced representation; A is the adjacency matrix; is the binarization function; Represents the attention mechanism calculation process; is the output of each current node v in the last layer; is a hyperparameter; is the target probability; is the weight matrix; is the bias vector.

7. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: Also includes: The mapping probability of each current node is determined by combining the output of each current node in the last layer through the Softmax activation function; The overall classification loss is determined based on the probability that the output of each current node in the last layer is normal or abnormal and the probability that the node predicted by the enhanced representation is normal or abnormal, and the AEGN model is optimized based on the overall classification loss; the overall classification loss is implemented by the following expression: (12) (13) in, is the mapping probability; is the weight matrix; is the bias vector; is the output of each current node v in the last layer; is the overall classification loss, which is used to optimize the classification performance of the model; is a collection of nodes; For the current node The actual node label belonging to class k, which is normal or abnormal; For the original representation node The probability of belonging to category k; To enhance the representation Predicted nodes The probability of belonging to category k; The set of nodes used belongs to the previously selected graph.

8. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: Also includes: Determine the actual label of each current node and optimize the first weight matrix and bias vector in the distance function through the distance function loss; the distance function loss is implemented by the following expression: (14) in, is the distance function loss; For the current node The true label of is the predicted probability.

9. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: Also includes: Determine the enhanced representation loss according to the enhanced representation and the output of each current node in the last layer, and use the enhanced representation loss to The second weight matrix in the activation function is optimized, and the enhanced representation loss is realized by the following expression: (15) Where L is the enhanced representation loss, which is used to optimize the quality of the enhanced representation; For the current node The true label of If the current node If it belongs to category k, the value is 1, otherwise it is 0; The current node predicted for the enhanced representation The probability of belonging to category k; is the target probability; represents the distance between the output of each current node v in the last layer and the enhanced representation.

10. The abnormal node detection method based on attribute enhancement of financial transaction information according to claim 1 is characterized in that: The expression form of the graph data is: G={V,E,X}; V is a node set, V=[user account, bank card, device, merchant]; E is the edge set, E=[transfer, consumption, device binding]; X is the node feature matrix, which represents the attributes of the node, X = [user occupation, account balance, transaction frequency, merchant industry category].

Images