Unsupervised fraud detection method and system based on iteration graph reconstruction

Abstract

The invention discloses an unsupervised fraud detection method and system based on iterative graph reconstruction, and the method comprises the steps: executing K times of iterative processing, and each time of iterative processing comprises the steps: calculating or updating the similarity between nodes; on the basis of the similarity between the nodes, dynamic graph reconnection operation is executed on the current graph structure, and a reconnection graph of the kth round is generated; on the reconnected graph of the kth round, a graph neural network model is used, the graph neural network model adopts a degree comparison weighted aggregation method to aggregate neighbor information, and node embedding of the kth round is generated according to a predefined optimization target; based on the node embedding of the kth round and the original edge structure of the graph data, determining the abnormal score of the kth round of each node; and after a preset number of times of iteration processing is completed, node anomaly scores obtained by each round of iteration are aggregated, and a final fraud node detection result is obtained. According to the method, the problems of heterogeneity and disguising in graph fraud detection are effectively solved under the unsupervised condition, and the detection effect superior to that in the prior art is achieved.

Description

Technical Field

[0001] The present invention relates to the field of machine learning, and in particular to an unsupervised fraud detection method and system based on iterative graph reconstruction. Background Art

[0002] With the rapid development of the internet and e-commerce, graph-structured data has shown great potential in describing various complex relational networks, such as social networks, transaction networks, and review networks. However, these networks have also become a breeding ground for fraudulent activities, such as fake accounts, malicious reviews, and transaction fraud. Therefore, how to effectively detect fraudulent nodes (i.e., abnormal nodes) in graph data has become an important research topic.

[0003] Graph Neural Networks (GNNs) have been widely used in fraud detection tasks based on graph data due to their powerful graph representation learning capabilities. However, existing GNN-based fraud detection methods often face the following challenges:

[0004] 1. Heterogeneity: Many real-world fraud graphs exhibit significant heterogeneity, meaning that fraudulent nodes tend to connect to legitimate nodes for disguise, rather than to other fraudulent nodes. Traditional GNNs are typically based on the homogeneity assumption (i.e., connected nodes tend to be similar). Directly aggregating information from heterogeneous neighbors can introduce noise, resulting in a degradation of node representation quality and poor fraud detection performance.

[0005] 2. Disguise problem: In order to evade detection, fraudsters will deliberately imitate the behavior patterns (feature camouflage) and connection patterns (relationship camouflage) of normal users, making it difficult to distinguish fraudulent nodes from normal nodes in terms of features and local structure.

[0006] 3. Label sparsity: In practical applications, labeled fraud samples are often very scarce or even completely missing. Many existing methods still partially or completely rely on label information for supervised or semi-supervised learning, which limits their application in unsupervised scenarios.

[0007] 4. Limitations of Existing Unsupervised Methods: Some existing unsupervised methods, such as graph autoencoders (GAEs) or methods based on contrastive learning, although independent of labels, are limited in their effectiveness in dealing with complex heterogeneity and camouflage. For example, some methods based on graph structure adjustment may only perform static edge removal (such as truncation), failing to fully utilize node representation information for dynamic adjustment or proactively build homogeneous connections. Furthermore, aggregation strategies may not be optimized for the adjusted graph structure.

[0008] Therefore, there is an urgent need for a new method that can effectively address the challenges of heterogeneity and double masquerade in graph data under unsupervised conditions and improve the accuracy of fraudulent node detection. Summary of the Invention

[0009] In order to solve the problems existing in the above-mentioned prior art, the present invention aims to provide a detection method and system that effectively solves the heterogeneity and camouflage problems in image fraud detection under unsupervised conditions, and achieves detection results that are superior to those of the prior art.

[0010] In order to achieve the above-mentioned object of the invention, the technical solution provided by the present invention includes:

[0011] An unsupervised fraud detection method based on iterative graph reconstruction processes graph data including nodes, edges between nodes, and node attributes, including the following steps:

[0012] S1. Perform K iterations, each of which includes:

[0013] S11. Calculating or updating the similarity between the nodes; wherein, when k>1, the calculation of the similarity is at least partially based on the node embedding information learned in the k-1th round of iteration;

[0014] S12. Based on the similarity between the nodes, a dynamic graph reconnection operation is performed on the current graph structure to generate a reconnection graph for the kth round;

[0015] S13. Using a graph neural network model on the reconnection graph of the kth round, the graph neural network model aggregates neighbor information using a degree comparison weighted aggregation method and generates node embeddings for the kth round according to a predefined optimization objective;

[0016] S14. Determine a k-th round anomaly score for each node based on the k-th round node embedding and the original edge structure of the graph data;

[0017] S2. After completing the preset number of iterative processes, aggregate the node anomaly scores obtained in each round of iteration to obtain the final fraudulent node detection result.

[0018] Preferably, the method for calculating or updating the similarity between the nodes in step S11 includes:

[0019] When k=1, the similarity value between nodes is calculated based on the original attributes of the nodes;

[0020] When k>1, for each node, a fused feature representation is generated by combining the original attribute vector of the node with the node embedding vector generated by the node in the (k-1)th iteration; based on the fused feature representations of each node pair, the similarity value between the node pairs is calculated.

[0021] Preferably, the dynamic graph reconnection operation in step S12 includes:

[0022] Remove a first set of edges between nodes, where the similarity values ​​between the node pairs corresponding to the first set of edges meet a preset removal condition;

[0023] A second set of edges between nodes is added, where similarity values ​​between node pairs corresponding to the second set of edges meet a preset adding condition.

[0024] Preferably, the dynamic graph reconnection operation further includes:

[0025] After removing the first set of edges, checking whether there are edges that only meet the removal condition on one side, and restoring the unremoved side of such edges;

[0026] Preferably, the preset removal condition and / or the preset addition condition involves comparing the similarity between the nodes with one or more dynamic thresholds, and the dynamic thresholds are determined based on neighborhood similarity statistics or global similarity statistics of the nodes.

[0027] Preferably, the degree comparison weighted aggregation method in step S13 includes:

[0028] h i (0) =x i ,

[0029]

[0030] Among them, h i (0) is the embedding vector of node vi at layer 0; x i is the original attribute vector of node vi; is the embedding vector of node vi in ​​layer l; w i，j is the aggregation weight when node vj transmits information to node vi; di, dj and dk represent the degrees of nodes vi, vj and vk respectively, and the degree is the number of edges connected to the current node.

[0031] Preferably, the predefined optimization objective in step S13 includes: maximizing the average local affinity of the nodes in the graph; the local affinity is the average cosine similarity between the embedding vector of the target node and the embedding vectors of its neighbor nodes in the k-th round of reconnection graph.

[0032] Preferably, the method for determining the k-th round anomaly score of each node in step S14 includes: calculating the local affinity of each node using the node embedding of the k-th round and the original graph, and taking the inverse of the local affinity as the anomaly score of the node in the k-th round.

[0033] The present invention also provides an unsupervised fraud detection system based on iterative graph reconstruction, which is used to implement the above-mentioned unsupervised fraud detection method based on iterative graph reconstruction.

[0034] Beneficial effects

[0035] 1. Effectively addressing heterogeneity and relationship camouflage: Through an iterative dynamic graph rewiring mechanism, not only are low-similarity heterogeneous edges removed based on node similarity, but homogeneous edges with high similarity are also proactively constructed. Furthermore, the node similarity used to guide rewiring is updated during iterations using node embedding information learned in the previous round. This makes graph structure adjustments more precise and adaptive, gradually optimizing graph homogeneity and effectively mitigating the negative impact of heterogeneity and relationship camouflage on subsequent representation learning.

[0036] 2. Enhance the discriminative ability of node representation: A degree comparison weighted aggregation strategy is proposed. When aggregating neighbor information, this strategy not only considers the degree of the node itself and its neighbors, but also introduces the degree comparison between the neighbor node and its own neighbors. It can better utilize the structural changes brought about by graph reconnection and assign higher weights to structurally more important neighbors, thereby learning more discriminative node embedding representations.

[0037] 3. Applicable to unsupervised scenarios and robust to feature spoofing: Maximizing node local affinity is used as the unsupervised optimization objective, independent of any label information. By maximizing the similarity between normal nodes and their neighbors (based on the original graph structure) in the embedding space, fraudulent nodes (even if spoofed) that differ significantly from their neighbors due to abnormal behavior or connectivity can be effectively identified. Furthermore, the final anomaly score is calculated based on the original graph structure, ensuring a more accurate assessment of actual connectivity.

[0038] 4. Improve detection accuracy and robustness: By continuously optimizing the graph structure and node representation through K rounds of iterations and aggregating the anomaly scores generated by multiple rounds of iterations, a more stable and reliable final detection result can be obtained. This reduces fluctuations caused by single reconnections or randomness during training, significantly improving the overall performance of fraud detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flow chart of an unsupervised fraud detection method based on iterative graph reconstruction provided in a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is further described below with reference to the accompanying drawings. In the description of the present invention, it should be understood that the terms "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inner", "outer", etc., indicating directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings and are only for the convenience of describing the present invention and simplifying the description. They do not indicate or imply that the devices or components referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0041] Example

[0042] like Figure 1 As shown, the present invention provides an unsupervised fraud detection method based on iterative graph reconstruction, which processes graph data including nodes, edges between nodes, and node attributes, including the steps of:

[0043] S1. Perform K iterations, each of which includes:

[0044] S11. Calculate or update the similarity between the nodes; wherein, when k>1, the calculation of the similarity is at least partially based on the node embedding information learned in the k-1th round of iteration.

[0045] The core of this step is to calculate or update the similarity of each node pair in the graph at the beginning of each iteration (round k, where k is an integer from 1 to the preset total number of iterations, K). This similarity is an important basis for subsequent dynamic graph rewiring operations. The special feature of this step is that the similarity calculation method evolves as the iterations proceed. In particular, when the number of iterations, k, is greater than 1, the results learned in the previous iteration (round k-1), namely the node embedding information, are utilized.

[0046] Usually, when there is no iterative learning or in the initial stage of iteration (k=1 round), the similarity between points is calculated mainly using the following methods:

[0047] 1. If each node in a graph has an initial, static set of attribute features (e.g., user age, occupation, transaction amount, etc.), various vector similarity metrics (such as cosine similarity, the inverse of the Euclidean distance, and the Pearson correlation coefficient) can be used to calculate the similarity between any two nodes based on their raw attribute vectors. However, this approach completely ignores the connectivity and neighborhood structure of nodes in the graph, which is crucial for understanding the underlying relationships between nodes. If the raw attribute features are of low quality, noisy, or exhibit "feature camouflage" (e.g., fraudulent nodes mimicking legitimate node features), the calculated similarity may be inaccurate or even misleading. Furthermore, similarity calculated solely based on raw attributes is static and cannot reflect the deepening and changes in understanding of nodes during subsequent learning. For tasks that require dynamic adjustments to the graph structure to optimize learning objectives (e.g., enhancing homogeneity), this static similarity cannot provide guidance for continuous optimization.

[0048] 2. Similarity based on the initial graph structure, for example, calculating the number of common neighbors, Jaccard coefficient, Adamic-Adar index, etc. This method is purely based on structural relationships and ignores the attribute characteristics of nodes. Furthermore, similarity based solely on the initial structure may be inaccurate in graphs with heterogeneous connections (such as fraudulent nodes connecting to normal nodes) or relationship disguise (fraudulent nodes mimicking normal connection patterns).

[0049] Therefore, within the context of the iterative learning framework of the present invention, if the calculation of node similarity remains solely based on raw information (such as raw attributes or initial structure), it will not benefit from iterative learning. Each round of iteration yields a more refined node representation (i.e., node embedding) that incorporates a deeper understanding of the node (incorporating both attributes and complex structural information). Without feeding these learning results back into the similarity calculation, the effectiveness of subsequent graph structure adjustments (e.g., graph rewiring) will be limited, making it difficult to continuously optimize the graph structure and more accurately depict node relationships.

[0050] Based on this, the present invention introduces a mechanism for dynamically updating the similarity calculation basis for the iterative process (when k>1), and clarifies the initial calculation method when k=1. In some preferred embodiments, a method for calculating or updating the similarity between nodes is provided, specifically including:

[0051] When k=1 (the first round of iteration), the calculation of the similarity between nodes is based on the original attributes of the nodes.

[0052] When k>1 (the second round of iteration and beyond), for each node, a fused feature representation is generated by combining the original attribute vector of the node with the node embedding vector generated for the node in the (k-1)th round of iteration; then, based on the fused feature representations of each node pair, the similarity value between the node pairs is calculated.

[0053] As iterations progress, in the previous round (round k-1), the graph neural network model has already learned and generated node embeddings for that round. These node embeddings are vector representations of nodes in a low-dimensional space. They not only encode the original attribute information of the nodes, but more importantly, through the aggregation mechanism of the graph neural network, they incorporate the neighborhood structure information of the nodes and the learning results of the previous round of reconnection graphs. Therefore, the node embeddings of round k-1 can more comprehensively and dynamically reflect the characteristics and relationships of the nodes in the current learning stage than the original attributes. The specific method is as follows:

[0054] Among them, x i is the original attribute of node i, is the embedding of node i in round k-1, Indicates splicing, W k is the learnable weight matrix in the kth iteration, used for dimension adjustment and feature conversion.

[0055] S12. Based on the similarity between the nodes, a dynamic graph reconnection operation is performed on the current graph structure to generate a reconnection graph of the kth round.

[0056] The core task of this step is to use the inter-node similarity calculated or updated in step S11 to actively and dynamically adjust the structure of the current graph. The purpose is to optimize the topology of the graph to make it more conducive to downstream tasks (such as fraud detection), especially by enhancing the homogeneity of the graph to mitigate the negative effects of heterogeneity and relationship disguise.

[0057] Those skilled in the art will appreciate that graph rewiring operations specifically involve removing (pruning) and adding (building) edges. A common approach is to set a global, fixed threshold based on some initial similarity between nodes (e.g., calculated based on raw attributes), and then remove all edges with a similarity below that threshold. This approach is one-time and static, focusing primarily on edge removal and less on edge addition. Furthermore, the global, fixed threshold may not be applicable to regions of the graph with varying densities or characteristics.

[0058] Therefore, in some preferred embodiments, a method more suitable for dynamic graph reconnection is provided, specifically including:

[0059] S121. Remove the first set of edges between nodes, where the similarity values ​​between the node pairs corresponding to the first set of edges meet the preset removal criteria. This step aims to remove connections in the graph with low similarity. These connections are likely to be heterogeneous connections (such as connections between normal nodes and fraudulent nodes) or weak connections that do not contribute much to the learning objective, thereby preliminarily purifying the graph structure.

[0060] The preset removal condition is not a fixed global value, but involves comparing the similarity between nodes with one or more dynamic thresholds. These dynamic thresholds are determined based on the neighborhood similarity statistics of the node (such as the minimum similarity between a node and all its neighbors) or the global similarity statistics (such as the average similarity of all edges in the current graph). In some preferred embodiments, for each node vi, if its minimum similarity with its neighbors is lower than the global average similarity, a threshold ri will be randomly selected between the two to decide which edges connected to vi and with a similarity lower than ri will be removed.

[0061] It should be understood that in complex graphs, edge removal decisions may exhibit asymmetry. For example, node vi may decide to remove its connection to vj based on its local information and a dynamic threshold, but from vj's perspective, it may not consider the connection to vi to be necessary. Alternatively, during the initial removal phase, only one direction of a directed edge may be processed. Therefore, to address this asymmetry and ensure that edge removal is carefully considered, some preferred embodiments check for edges that only meet the removal criteria unilaterally after removing the first set of edges, and restore the remaining side of such edges. This means that if an edge is only unilaterally removed, the removal operation may be undone, or the edge may be restored. This helps avoid over-removal caused by local perspective bias and preserves connections that, despite appearing to have low similarity from one side, still hold value from the other side or globally. This is particularly important when dealing with sparsely connected graphs. This improves the robustness of edge removal decisions, avoids unnecessary connection loss, and maintains reasonable connectivity in the graph.

[0062] S122. Add a second set of edges between nodes, where the similarity values ​​between the node pairs corresponding to the second set of edges meet the preset addition conditions. This step actively builds connections between highly similar nodes in the graph, even if they are not directly connected in the original graph. This helps to explicitly enhance the homogeneity of the graph, connecting nodes with similar characteristics or potentially belonging to the same category, providing richer homogeneity information for the graph neural network model.

[0063] The preset conditions for adding edges are also dynamically determined. In some preferred embodiments, a basic addition similarity threshold s_add is first calculated for each node v_i to be examined for adding edges. The s_add is set by taking the larger value of the following two: one is the α-quantile (denoted as s_i, α-quantile) in the set of similarity values ​​between node v_i and all its current neighboring nodes, and the other is the global average similarity S_mean of all existing edges in the current graph. Subsequently, the system will further determine a random threshold r_i for node v_i to be used for edge addition decision-making. The r_i is randomly selected within the interval [s_add, s_i, max], where s_i, max represents the highest similarity value between node v_i and all its non-directly connected nodes. Ultimately, only when the similarity value between a pair of non-directly connected nodes is higher than the random threshold r_i calculated for each of them (or one of them), will the pair of nodes be considered candidates and considered for adding a new connection edge between them.

[0064] Furthermore, the number of added new edges needs to be limited. For example, the number of new neighbors added to each node cannot exceed a certain multiple of the number of its original neighbors.

[0065] S13. Using a graph neural network model on the reconnection graph of the kth round, the graph neural network model adopts a degree comparison weighted aggregation method to aggregate neighbor information, and generates node embeddings of the kth round according to a predefined optimization objective.

[0066] This step uses the optimized graph structure as input and employs a graph neural network (GNN) model to generate a k-th round of node embeddings for each node in the graph, representing the node in a low-dimensional vector space. The key feature of this GNN model is its use of a degree-comparison weighted aggregation method to aggregate information about neighboring nodes.

[0067] Those skilled in the art will appreciate that in conventional GNNs, the weight assignment when aggregating neighbor information is typically relatively simple, such as the node degree-based normalization method used in GCN. However, given that the graph structure in this invention has been optimized through dynamic graph rewiring (enhancing homogeneity and changing the local connection density and importance of nodes), simply using the original GCN aggregation method may not fully utilize this optimized structure.

[0068] Therefore, some preferred embodiments consider introducing the Degree-Comparison Weighted Aggregation (DCWAgg). The key idea of ​​this method is that when aggregating neighbor information for a central node, the weight assigned to each neighbor node depends not only on the neighbor node's own degree, but also on the comparison of the degree of the neighbor node with its own neighbors (i.e., the central node's two-hop neighbors). The specific calculation formula is as follows:

[0069] h i (0) =x i ,

[0070]

[0071] Among them, h i (0) is the embedding vector of node vi at layer 0; x i is the original attribute vector of node vi; is the embedding vector of node vi in ​​layer l; w i，j is the aggregation weight when node vj transmits information to node vi; di, dj and dk represent the degrees of nodes vi, vj and vk respectively, and the degree is the number of edges connected to the current node; and are the neighbor node sets of nodes vi and vj in the original graph respectively.

[0072] The design ideas of DCWAgg are as follows:

[0073] Dynamic graph reconnection may cause some "normal" nodes with low degrees to increase in degree due to connecting with more similar nodes, while some fraudulent nodes may have their degrees reduced relatively due to removing disguised connections. DCWAgg aims to more finely identify and give higher aggregation weights to those neighbors that are more important in structure (especially those that are more homogeneous after reconnection). Among them, the weight ω i，j The calculation of not only looks at the degree dj of vj, but also compares it with the degrees of vj's own neighbors, and also normalizes this relative degree with all neighbors of the central node vi.

[0074] At this time, nodes whose own degree is high and whose average degree of neighbors is relatively low (meaning it is connected to many "leaf" or "edge" nodes, which may be local centers), or nodes whose degree is not high but whose connected neighbors have lower degrees, may get higher weights.

[0075] DCWAgg is better able to adapt to changes in graph structure after S12 dynamic rewiring. For example, if a node rewiring connects to many highly similar but previously sparsely connected nodes, DCWAgg can better identify these newly formed important connections. Even if a fraudulent node maintains a certain degree, if its connection pattern (as reflected by degree comparison) differs from that of legitimate nodes, DCWAgg can help mitigate its impact.

[0076] The predefined optimization objective refers to a loss function that guides the GNN to learn a node embedding that can effectively distinguish fraudulent nodes from normal nodes. Those skilled in the art will appreciate that the predefined optimization objective can be determined based on conventional techniques in the field of GNNs. In some preferred embodiments, a method for determining a predefined optimization objective that is more suitable for unsupervised scenarios is provided, including:

[0077] Maximize the average local affinity of the nodes in the graph; the local affinity is the average cosine similarity between the embedding vector of the target node and the embedding vectors of its neighbor nodes in the k-th round of reconnection graph, and its formula is as follows:

[0078]

[0079] in, is a predefined optimization goal, is the number of neighbors of node vi in ​​the original graph, hi and hj are the node embeddings of node vi and node vj respectively, sim(h i , h j ) represents the cosine similarity between the node embedding of node i and the node embedding of node j in the current round of reconnection graph. It should be understood that this loss function is defined as the negative of the aggregated local affinity. This means that in the iterative optimization process of the model parameters, the goal of maximizing the overall affinity of all nodes in the graph is equivalent to minimizing this loss function. This is because in real graph data, normal nodes usually constitute the vast majority. Therefore, by pushing the model to maximize the local affinity of all nodes, the model can be effectively guided to learn a more optimal node representation space. In this space, the affinity between normal nodes and their neighbors is enhanced, making normal patterns more clustered and obvious in the embedding space.

[0080] S14. Determine a k-th round anomaly score for each node based on the k-th round node embedding and the original edge structure of the graph data.

[0081] Even if the GNN model is trained on an optimized reconnected graph to learn better representations, the fraudulent nature of a node should ultimately be reflected in its inconsistency with its real-world neighbors. Therefore, by evaluating the local affinity of the learned embeddings within the original graph structure, we can more accurately reveal anomalous nodes whose behavior patterns do not match the real environment. Fraudulent nodes, even if their embeddings have been optimized to some extent, will typically have lower embedding similarity (affinity) with their real neighbors when placed back into their original neighborhood.

[0082] The original edge structure of the graph data refers to the set of edges that represent the initial connection relationship between nodes without any modification. The present invention uses the original edge structure because the final anomaly assessment is based on the real, unadjusted node relationship.

[0083] In some preferred embodiments, the method for determining the k-th round anomaly score of each node includes: calculating the local affinity of each node using the k-th round node embedding and the original graph, and taking the inverse of the local affinity as the k-th round anomaly score of the node. The specific formula is as follows:

[0084]

[0085] in, is the abnormality score of node vi; T represents the number of graph reconnection and GNN training in each round of iteration, that is, the number of inner loops; K represents the total number of iterations, that is, the number of outer loops.

[0086] Specifically, since cosine similarity is usually in the range of [-1, 1] or [0, 1] (if the embedding is non-negative), local affinity is also in this range. It is usually in an interpretable range (for example, if the affinity is in [0,1], then the anomaly score is also in [0,1]). When the average cosine similarity between the embedding vectors of a node vi and its neighbor nodes in the original graph is low, then its anomaly score is This indicates that despite GNN learning and representation optimization, the node exhibits low consistency or similarity with its directly connected nodes in its real, original social or transaction environment, which is a characteristic commonly exhibited by fraudulent nodes (or more broadly, abnormal nodes). Conversely, if a node has a high local affinity, its anomaly score is low, indicating that the node and its original neighbors show good consistency in the learned representation space and are more likely to be normal nodes.

[0087] S2. After completing the preset number of iterative processes, aggregate the node anomaly scores obtained in each round of iteration to obtain the final fraudulent node detection result.

[0088] After completing a preset number of iterations, the system has calculated and stored a series of anomaly indication values ​​for each node in each iteration. These anomaly indication information for each node across multiple rounds of iterations and multiple independent experiments are aggregated to generate a final, more stable and robust anomaly score for each node, and based on this, the detection results of fraudulent nodes are obtained.

[0089] In some preferred embodiments, the present invention further provides an unsupervised fraud detection system based on iterative graph reconstruction, which is used to implement the above-mentioned unsupervised fraud detection method based on iterative graph reconstruction.

[0090] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the foregoing embodiments. The foregoing embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. An unsupervised fraud detection method based on iterative graph reconstruction, wherein the method processes graph data including nodes, edges between nodes, and node attributes, and is characterized in that: Including steps: S1. Perform K iterations, each of which includes: S11. Calculating or updating the similarity between the nodes; wherein, when k>1, the calculation of the similarity is at least partially based on the node embedding information learned in the k-1th round of iteration; S12. Based on the similarity between the nodes, a dynamic graph reconnection operation is performed on the current graph structure to generate a reconnection graph for the kth round; S13. Using a graph neural network model on the reconnection graph of the kth round, the graph neural network model aggregates neighbor information using a degree comparison weighted aggregation method and generates node embeddings for the kth round based on the data; S14. Determine a k-th round anomaly score for each node based on the k-th round node embedding and the original edge structure of the graph data; S2. After completing the preset number of iterative processes, aggregate the node anomaly scores obtained in each round of iteration to obtain the final fraudulent node detection result.

2. The unsupervised fraud detection method based on iterative graph reconstruction according to claim 1, wherein: The method for calculating or updating the similarity between the nodes in step S11 includes: When k=1, the similarity value between nodes is calculated based on the original attributes of the nodes; When k>1, for each node, a fused feature representation is generated by combining the original attribute vector of the node with the node embedding vector generated by the node in the (k-1)th iteration; based on the fused feature representations of each node pair, the similarity value between the node pairs is calculated.

3. The unsupervised fraud detection method based on iterative graph reconstruction according to claim 1, wherein: The dynamic image reconnection operation in step S12 includes: Remove a first set of edges between nodes, where the similarity values ​​between the node pairs corresponding to the first set of edges meet a preset removal condition; A second set of edges between nodes is added, where similarity values ​​between node pairs corresponding to the second set of edges meet a preset adding condition.

4. The unsupervised fraud detection method based on iterative graph reconstruction according to claim 3, wherein: The dynamic graph reconnection operation further includes: After removing the first set of edges, it is checked whether there are edges that only meet the removal condition on one side, and the remaining side of such edges is restored.

5. The unsupervised fraud detection method based on iterative graph reconstruction according to claim 3, wherein: The preset removal condition and / or the preset addition condition involves comparing the similarity between the nodes with one or more dynamic thresholds, where the dynamic thresholds are determined based on neighborhood similarity statistics or global similarity statistics of the nodes.

6. The unsupervised fraud detection method based on iterative graph reconstruction according to claim 1, wherein: The degree comparison weighted aggregation method in step S13 includes: h i (0) =xi, Among them, h i (0) is the embedding vector of node vi at layer 0; x i is the original attribute vector of node vi; is the embedding vector of node vi in ​​layer l; ω i，j is the aggregation weight when node vj transmits information to node vi; di, dj and dk represent the degrees of nodes vi, vj and vk respectively, and the degree is the number of edges connected to the current node.

7. The unsupervised fraud detection method based on iterative graph reconstruction according to claim 1, wherein: The predefined optimization goal in step S13 includes: maximizing the average local affinity of the nodes in the graph; the local affinity is the average cosine similarity between the embedding vector of the target node and the embedding vectors of its neighbor nodes in the k-th round of reconnection graph.

8. The unsupervised fraud detection method based on iterative graph reconstruction according to claim 7, wherein: The method for determining the k-th round anomaly score of each node in step S14 includes: calculating the local affinity of each node using the node embedding of the k-th round and the original graph, and taking the inverse of the local affinity as the anomaly score of the node in the k-th round.

9. Unsupervised fraud detection system based on iterative graph reconstruction, characterized in that The system is used to implement the unsupervised fraud detection method based on iterative graph reconstruction according to any one of claims 1 to 8.

Images