Financial transaction fraud identification method and system based on graph neural network

Abstract

The invention discloses a financial transaction fraud identification method and system based on a graph neural network, and the method comprises the following steps: S1, collecting financial transaction data, and carrying out the preprocessing of the data; s2, a heterogeneous graph structure is constructed, the heterogeneous graph structure comprises account nodes, equipment nodes and position nodes, and a heterogeneous transaction graph is formed; s3, embedding path-level context information into each edge in the heterogeneous transaction graph, and introducing a node type and edge type joint position index to form a multi-hop edge coding matrix; s4, constructing a graph neural network model, and outputting a node representation vector; s5, fusing node representations of adjacent layers by adopting a residual fusion strategy, and constructing a jump connection structure to form a node feature matrix; and S6, constructing a joint training task, carrying out joint training on the graph neural network model by adopting a multi-task loss function, and outputting a fraud identification and classification result. According to the invention, the accuracy and real-time response capability of transaction fraud detection are effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial technology, and particularly relates to a financial transaction fraud identification method and system based on a graph neural network. BACKGROUND

[0002] Under the background of the rapid development of financial technology, the number of financial transactions presents exponential growth, and the accompanying financial fraud behaviors are increasingly complex and hidden, which seriously threatens the safety of financial institutions and the property interests of users. Especially in the environment of popular digital payment, online transaction and cross-border transfer, the traditional fraud identification method relying on rule matching and static modeling has been unable to adapt to dynamic and diversified fraud behavior patterns. Most of the existing financial fraud detection technologies adopt the method based on feature engineering and traditional machine learning model, focusing on modeling and classifying the flat attributes of transaction data, lacking comprehensive understanding and deep semantic analysis of the complex interaction relationship between accounts, resulting in high false negative rate and false positive rate of fraud detection, and the recognition accuracy is difficult to meet the practical demand.

[0003] Specifically, the existing method usually flattens the transaction data into a structured table, and then uses a classifier such as random forest, support vector machine, gradient boosting decision tree, etc. for modeling. This kind of method relies on a large amount of artificial experience in feature construction, and it is difficult to cover the implicit path relationship in the financial network, and it is also difficult to effectively capture the fraud organizational structure across accounts and devices. In addition, the traditional model cannot model the non-Euclidean relationship between data, especially in the aspects of multi-hop transmission and group collaborative behavior recognition. After the deep learning method is gradually introduced into the field of financial risk control, although some research attempts to use graph neural network to model the financial transaction graph, most of them only consider the propagation mechanism of homogeneous graph or single edge type, ignoring the heterogeneous structure characteristics of transaction network and the fusion modeling demand of multi-source information such as device and geography, thereby limiting the generalization ability and attack tolerance of the model.

[0004] In current research and engineering practice, the graph structure modeling of financial transaction data often only involves the relationship of fund flow between accounts, ignoring the device binding, geographical access and other key information, which leads to insufficient performance of the model in dealing with behavior migration and hidden correlation. At the same time, in the structure design of graph neural network, the existing scheme often uses a single attention mechanism or static aggregation method, which is difficult to effectively capture path-level semantics and context evolution features. The existing graph neural network model also does not fully utilize the characteristics of cross-domain association in financial transaction behavior, such as device sharing, frequent address switching, time period linkage and other behaviors which have high value for identifying fraud patterns, but there is currently a lack of systematic modeling method. In addition, most fraud identification models have a single training target, only considering the node classification task, without modeling the time series features of the behavior edge, unable to establish the time sequence evolution mechanism of transaction behavior, resulting in the model being unable to identify potential fraudulent behavior in advance.

[0005] At the same time, in the training strategy of graph neural network, most methods still use single-task supervision mechanism, which is easy to cause the model to be insensitive to a small number of classes (such as fraudulent accounts), and unable to accurately extract high-risk features from a large number of non-fraudulent behaviors. More seriously, the graph neural network structure lacking residual fusion and skip connection mechanism has information decay problem in deep propagation, which makes the model face performance bottleneck in dealing with multi-hop propagation and path cumulative features. In addition, the expression mechanism of path context in the transaction graph is not perfect, and the existing method lacks structured modeling and coding strategy for the interaction between transaction path, edge type and node role, resulting in limited expression ability of the model when facing complex financial graph network.

[0006] Therefore, how to provide a financial transaction fraud identification method and system based on graph neural network is a problem that those skilled in the art need to solve. SUMMARY

[0007] One object of the present application is to provide a financial transaction fraud identification method and system based on graph neural network, which fully utilizes the heterogeneous graph modeling, multi-hop path coding and graph neural network fusion mechanism, and details the construction of heterogeneous transaction graph through the relationship of accounts, devices and geographical nodes, embeds path-level context information, and jointly uses type attention mechanism, cross-domain alignment strategy and multi-task supervision method to realize deep modeling and efficient identification of complex financial behavior patterns, with the advantages of high identification precision, strong generalization ability and fast response to hidden fraudulent behavior.

[0008] According to the financial transaction fraud identification method based on graph neural network, the method comprises the following steps:

[0009] S1, collecting financial transaction data and performing preprocessing;

[0010] S2. Constructing a heterogeneous graph structure based on the preprocessed financial transaction data. The heterogeneous graph structure includes account nodes, device nodes, and location nodes. The nodes are connected by transaction behavior edges, device binding edges, and location access edges to form a heterogeneous transaction graph.

[0011] S3. Embed path-level context information for each edge in the heterogeneous transaction graph. The path consists of a fixed-length transaction sequence and introduces a joint position index of node type and edge type to form a multi-hop edge encoding matrix.

[0012] S4. Build a graph neural network model based on the heterogeneous transaction graph. The graph neural network model includes a type attention unit, a path aggregation unit, and a cross-domain alignment unit, and outputs a node representation vector.

[0013] S5. Use the residual fusion strategy to fuse the node representation of the current layer with the node representation of the previous layer output, and build a skip connection structure to form a node feature matrix;

[0014] S6. Based on the node feature matrix, a joint training task is constructed, and a multi-task loss function is used to jointly train the graph neural network model. After completing the pre-training process, the fraud identification classification results are output.

[0015] Optionally, the financial transaction data includes account identification, transaction time, transaction amount, transaction object, transaction device identification and login geographic location, and the preprocessing includes data deduplication, missing value filling, outlier removal and data standardization.

[0016] Optionally, the type attention unit calculates the multi-head attention coefficient based on the node type and the edge type, the path aggregation unit performs a weighted aggregation operation based on the multi-hop edge encoding matrix, and the cross-domain alignment unit performs cosine similarity matching based on the edge embedding and the node embedding.

[0017] Optionally, the joint training task includes a binary classification fraud discrimination task for nodes and a time series prediction task for transaction behavior edges, device binding edges, and location access edges.

[0018] Optionally, the S2 specifically includes:

[0019] S21, set the pre-processed financial transaction data set as D = {d1, d2, ..., d n}, where d i Represents the i-th transaction data record, which contains the fields (a i ,t i ,m i ,o i ,e i ,l i ), representing account identifiers ai , transaction time t i , transaction amount m i , transaction object o i , transaction device identifier e i and login geographic location l i ;

[0020] S22, construct a heterogeneous node set V = V A ∪ V E ∪ V L , where V A represents the account node set, V E represents the device node set, and V L represents the location node set, and ∪ represents the union operation;

[0021] S23, construct a three-type edge set E = E T ∪ E B ∪ E P , where E T is a transaction behavior edge set connecting account nodes and transaction object nodes E B is a device binding edge set connecting account nodes and device nodes E P is a location access edge set connecting account nodes and location nodes

[0022] S24, in the edge set construction process, define the edge weight function as:

[0023]

[0024] wherein, represents the weighted edge weight between nodes v i and v j under edge type x ∈ {T, B, P}, m i represents the amount of transaction records corresponding to node v i , log2(·) is the logarithmic function, t i and t j represent the time stamp corresponding to the transaction data record, δ(e i = e j ) is an indicator function, which takes the value 1 when v i and v j are bound to the same device, otherwise it is 0, δ(l i = l j ) is an indicator function, which takes the value 1 when the login locations of the two nodes are the same, otherwise it is 0, and α, β, γ are weight coefficients for controlling the contribution proportion of different features to the edge weight.

[0025] S25, constructing a heterogeneous transaction graph G=(V, E, W) based on the node set V and the edge set E, wherein W is an edge weight matrix representing the weighted results of all edges in the graph.

[0026] Optionally, the S3 specifically comprises:

[0027] S31, extracting a fixed-length transaction path sequence centered on each edge in the heterogeneous transaction graph wherein the path length is fixed as l+1, wherein u, v∈V, x∈{T, B, P} represent edges of type x;

[0028] S32, defining a node type set as an edge type set as combining the type of each node in the path with the adjacent edge type to form a joint type sequence wherein

[0029] S33, constructing a multi-hop edge encoding matrix according to the joint type sequence The rth row of the multi-hop edge encoding matrix is defined as follows:

[0030]

[0031] wherein, represents the encoding vector of the rth hop in the path, represents a node type embedding function, i.e., the input node type corresponding to the output embedding vector, represents an edge type embedding function, i.e., the input edge type corresponding to the output embedding vector, η(w r represents an edge weight embedding function, i.e., the input edge weight w r corresponding to the output embedding vector, and Θ is an encoding transformation matrix, represents a vector-level concatenation operation, and σ(·) is a nonlinear activation function used to improve the expression ability of path information;

[0032] S34, storing the multi-hop encoding matrix of all edges as an edge encoding tensor set as the path-level context input of the graph neural network model.

[0033] Optionally, the S4 specifically comprises:

[0034] ​​S41, initialize the graph neural network, and construct a graph neural network model, and input the heterogeneous transaction graph G=(V, E, W) and the edge encoding tensor set As input, output the vector representation set H={h v | v∈V} of each node, where the initial node representation is

[0035] S42, construct a type attention unit, and set the adjacent node set of node v i For each pair of nodes v i and with edge type x, define a multi-head attention guide function as:

[0036]

[0037] where, is the attention coefficient of node v j to node v i under edge type x, is the representation of node v i , j is the representation of node v v at the l-th layer, φ(t e ) is a node type embedding function, ψ(t i ) is an edge type embedding function, is an edge weight embedding function, is the average vector in the edge encoding tensor set ,‖·‖1,‖·‖2 represent L1 norm and L2 norm respectively,· represents dot product operation, and tanh(·) represents hyperbolic tangent function;

[0038] S43, apply the attention weight to the aggregation operation of path enhancement, combine the average vector and the current adjacent node representation, and perform node update operation:

[0039]

[0040] where, is the representation of node v i at the (l+1)-th layer, is the representation of node v j at the l-th layer, W1,W2 are learnable weight matrices in the graph neural network model, and σ(·) is a nonlinear activation function.

[0041] S44, repeat the propagation process in the graph neural network, and output the vector representation set

[0042] Optionally, the S5 specifically comprises:

[0043] S51, after completing the propagation of the first layer graph neural network, obtaining the set of vector representations of all nodes, and retaining the set of vector representations of the nodes of the previous layer;

[0044] S52, for each node v i ∈V, using a residual fusion strategy to perform weighted fusion of the current layer representation and the previous layer representation , the fusion method is linear weighted superposition, and the superimposed representation is used as the cross-layer update vector of the node v i .

[0045] S53, to enhance the cross-layer flow ability of information, a skip connection structure is introduced into the graph neural network, the node representations of all historical layers are combined in a hierarchical splicing manner, and a node feature matrix H is generated. , wherein

[0046] Optionally, the S6 specifically comprises:

[0047] S61, based on the node feature matrix H * , a label y v ∈{0,1} is assigned to each account node, wherein y v =1 indicates that the node is a fraudulent account, y v =0 indicates that the node is a normal account, a discriminator network is introduced to assist in implementing the binary classification fraud discrimination task of the account node, and the node representation vector is used as input for classification prediction.

[0048] S62, according to the transaction behavior edge E T , the device binding edge E B and the location access edge E P in the edge set, the timestamp sequence of each type of edge is extracted, the time sequence prediction task corresponding to the edge type is constructed, the start and end nodes of each edge are set as input, and the real time sequence of the edge is set as label, and the node feature matrix H * and the edge encoding tensor set are combined to perform time sequence prediction.

[0049] S63, the account node fraud classification task and the multi-type edge time sequence prediction task are combined to construct a joint training task, a unified training target is set, and a multi-task loss function is used to train and optimize the graph neural network, the node classification error and the edge time sequence prediction error are minimized during the training process, and the fraud identification classification result corresponding to each account node is output after pre-training.

[0050] The financial transaction fraud identification system based on the graph neural network according to the embodiment of the application comprises:

[0051] The data processing module is used for collecting and preprocessing the financial transaction data.

[0052] The heterogeneous graph construction module is used for constructing a heterogeneous graph structure, wherein the heterogeneous graph structure comprises account nodes, device nodes and location nodes, the nodes are connected through transaction behavior edges, device binding edges and location access edges, and a complete heterogeneous transaction graph is formed.

[0053] The path encoding module is used for embedding path-level context information in each edge of the heterogeneous transaction graph, the path is composed of a fixed-length transaction sequence, and a joint location index of node type and edge type is introduced to form a multi-hop edge encoding matrix.

[0054] The model construction module is used for constructing a graph neural network model, wherein the graph neural network model comprises a type attention unit, a path aggregation unit and a cross-domain alignment unit, and outputs a node representation vector.

[0055] The feature fusion module is used for adopting a residual fusion strategy to fuse the current layer node representation and the last layer node representation, constructing a skip connection structure and forming a final node feature matrix.

[0056] The classification training module is used for constructing a joint training task, adopting a multi-task loss function to jointly train the graph neural network model, and outputting a fraud identification classification result after completing a pre-training process.

[0057] The financial transaction fraud identification system based on the graph neural network according to the embodiment of the application has the following beneficial effects:

[0058] Firstly, the heterogeneous transaction graph composed of the account nodes, the device nodes and the location nodes is constructed, the limitation of traditional flat data modeling is effectively broken, the multi-dimensional association relationship between the account behavior, the device use and the geographic location access in the financial transaction can be completely expressed, and the structure capturing ability of the complex fraud behavior chain is significantly improved. Through the introduction of the transaction behavior edge, the device binding edge and the location access edge, the cross-domain behavior fusion modeling in the transaction scene is strengthened, and the recognition ability of the model to the hidden account group, the abnormal device switching and the disguised login behavior is enhanced.

[0059] Secondly, the application introduces a path-level context embedding mechanism and a multi-hop edge encoding strategy in the graph neural network structure, so that each edge not only carries current behavior information, but also can perceive path evolution characteristics and upstream and downstream propagation relationship, improving the semantic integrity of node representation. Through the collaborative work of the type attention unit, the path aggregation unit and the cross-domain alignment unit, feature extraction is realized from three dimensions of node type, edge type and structural position in the graph, significantly enhancing the relationship modeling capability between nodes. At the same time, the application adopts residual fusion and skip connection structure to alleviate the gradient attenuation and information dilution problems in the deep propagation process, ensuring the stability and expression ability of the graph neural network after multi-layer stacking.

[0060] Finally, the application jointly models the fraud identification task of the node and the time series prediction task of the edge, constructs a multi-task supervised training framework, and effectively solves the training bias problem faced by the traditional model in identifying a small number of fraud behaviors. By introducing the time series prediction of the edge, the modeling capability of the model for the dynamic evolution of transaction behavior is enhanced, and the early discovery effect of the latent fraud account is improved. In combination with the above innovations, the application exhibits the beneficial effects of high recognition accuracy, large abnormality detection advance and strong model generalization in practical application, and has good practical value and promotion prospect. BRIEF DESCRIPTION OF DRAWINGS

[0061] The accompanying drawings are included to provide a further understanding of the application, and constitute a part of the specification, together with the embodiments of the application, to explain the application, and do not constitute a limitation on the application. In the drawings:

[0062] Figure 1 A flowchart of a financial transaction fraud identification method based on a graph neural network proposed by the application;

[0063] Figure 2 A heterogeneous graph structure relationship diagram of a financial transaction fraud identification method based on a graph neural network proposed by the application;

[0064] Figure 3 A module structure diagram of a financial transaction fraud identification system based on a graph neural network proposed by the application. DETAILED DESCRIPTION

[0065] The application will now be described in further detail with reference to the drawings. These drawings are simplified schematic diagrams, and only illustrate the basic structure of the application in a schematic manner, and therefore only show the components related to the application.

[0066] REFERENCE Figures 1-2 A financial transaction fraud identification method based on a graph neural network, comprising the following steps:

[0067] S1, collect financial transaction data and perform preprocessing;

[0068] S2, based on the pre-processed financial transaction data, a heterogeneous graph structure is constructed, the heterogeneous graph structure comprising account nodes, device nodes and location nodes, the nodes being connected through transaction behavior edges, device binding edges and location access edges, forming a heterogeneous transaction graph;

[0069] S3, embedding path-level context information in each edge of the heterogeneous transaction graph, the path being composed of a fixed-length transaction sequence, and introducing a joint location index of node type and edge type, forming a multi-hop edge encoding matrix;

[0070] S4, based on the heterogeneous transaction graph, a graph neural network model is constructed, the graph neural network model comprising a type attention unit, a path aggregation unit and a cross-domain alignment unit, and outputting a node representation vector;

[0071] S5, adopting a residual fusion strategy to fuse the current layer node representation with the node representation output by the previous layer, and constructing a skip connection structure to form a node feature matrix;

[0072] S6, based on the node feature matrix, a joint training task is constructed, a multi-task loss function is used to jointly train the graph neural network model, and after completing the pre-training process, a fraud identification classification result is output.

[0073] The application can deeply model the multi-dimensional behavior relationship in the complex financial transaction network by constructing a heterogeneous transaction graph structure with account, device and geographic nodes as the core, and combining the type attention mechanism, path aggregation mechanism and cross-domain alignment mechanism in the graph neural network, thereby improving the detection accuracy of high-concealment fraud behavior.

[0074] In the embodiment, the financial transaction data includes account identifier, transaction time, transaction amount, transaction object, transaction device identifier and login geographic location, and the preprocessing includes data deduplication, missing value filling, outlier removal and data standardization.

[0075] The application has strictly standardized the original financial transaction data, ensured the accuracy and consistency of the data basis for graph structure construction, and improved the robustness and stability of the identification model in the multi-source heterogeneous environment from the source.

[0076] In the embodiment, the type attention unit calculates multi-head attention coefficients according to node type and edge type, the path aggregation unit performs weighted aggregation operation according to the multi-hop edge encoding matrix, and the cross-domain alignment unit performs cosine similarity matching based on edge embedding and node embedding.

[0077] The graph neural network structure provided by the application significantly enhances the distinguishability of node representation and effectively improves the expression capability of the model in complex graph structures by simultaneously introducing a multi-head attention mechanism of node type and edge type, an aggregation strategy based on path context, and a semantic alignment method of edges and nodes.

[0078] In the embodiment, the joint training task includes a binary classification fraud discrimination task of nodes and a time sequence prediction task of transaction behavior edges, device binding edges and location access edges.

[0079] The joint training mechanism constructed by the application can simultaneously learn the node fraud state and the edge time sequence relationship, breaking through the limitations of traditional single task supervision methods, so that the model can not only identify known fraudulent accounts, but also predict and intercept potential fraud evolution paths.

[0080] In the embodiment, the S2 specifically includes:

[0081] S21, set the preprocessed financial transaction data set as D={d1, d2, …, d n}, wherein d i represents the i-th transaction data record, and the transaction data record includes fields (a i , t i , m i , o i , e i , l i ), respectively representing account identifier a i , transaction time t i , transaction amount m i , transaction object o i , transaction device identifier e i and login geographic location l i ;

[0082] S22, constructing a heterogeneous node set V=V A ∪V E ∪V L according to D, wherein V A represents an account node set, V E represents a device node set, V L represents a location node set, and ∪ represents a union operation;

[0083] S23, constructing a three-class edge set E=E T ∪E B ∪E P , wherein E T is a transaction behavior edge set, connecting account nodes and transaction object nodes E BBind the edge set to the device and connect to the account node With device node E P Access edge sets for locations, connecting account nodes With location node

[0084] S24. During the edge set construction process, the edge weight function is defined as:

[0085]

[0086] in, Represents a node v under edge type x∈{T,B,P} i With v j The weighted edge weight between i Represents node v i The amount of the corresponding transaction record, log2(·) is the logarithmic function, t i and t j Indicates the timestamp corresponding to the transaction data record, δ(e i =e j ) is the indicator function, when v i With v j The value is 1 when bound to the same device, otherwise it is 0. i =l j ) is an indicator function, which takes the value of 1 when the two nodes have the same login position, and 0 otherwise. α, β, and γ are weight coefficients used to control the contribution ratio of different features to edge weight;

[0087] S25. Based on the node set V and the edge set E, a heterogeneous transaction graph G = (V, E, W) is constructed, where W is the edge weight matrix, which represents the weighted result of all edges in the graph.

[0088] The heterogeneous graph construction method proposed in this invention achieves accurate expression of financial transaction behavior at the structural level through node category division, three-type edge type association design, and fine-grained definition of edge weight function, providing a more semantically rich input graph for graph neural networks.

[0089] In this embodiment, S3 specifically includes:

[0090] S31. From each edge of the heterogeneous transaction graph Extracted from A fixed-length transaction path sequence centered on The path length is fixed to l+1, Represents an edge of type x, u, v∈V, x∈{T,B,P};

[0091] S32. Define the node type set as The edge type set is The type of each node in the path is combined with the adjacent edge type to form a joint type sequence wherein

[0092] S33, constructing a multi-hop edge encoding matrix according to the joint type sequence The rth row of the multi-hop edge encoding matrix is defined as follows:

[0093]

[0094] wherein, denotes the encoding vector of the rth hop in the path, denotes the node type embedding function, that is, the input node type corresponding output embedding vector, denotes the edge type embedding function, that is, the input edge type corresponding output embedding vector, η(w r ) denotes the edge weight embedding function, that is, the input edge weight w of the rth hop r corresponding output embedding vector, and Θ is an encoding transformation matrix, denotes a vector-level concatenation operation, and σ(·) is a nonlinear activation function, which is used to improve the expression ability of path information;

[0095] S34, storing all multi-hop edge encoding matrices of the edges as an edge encoding tensor set as the path-level context input of the graph neural network model.

[0096] The present application embeds a fixed-length path context sequence for each edge, constructs a multi-hop edge encoding matrix in combination with the node and edge type index, effectively enhances the context perception ability of the edge in the structure propagation process, and further improves the modeling effect of the model on the multi-hop fraudulent behavior path.

[0097] In the present embodiment, the S4 specifically comprises:

[0098] S41, initializing the graph neural network and constructing a graph neural network model, taking the heterogeneous transaction graph G=(V, E, W) and the edge encoding tensor set as input, outputting a vector representation set H={h v |v∈V} of each node, wherein the initial node representation is

[0099] S42, constructing a type attention unit, assuming that the adjacent node set of node v i is For each pair of nodes v i and The edge type is x, and the multi-head attention guidance function is defined as:

[0100]

[0101] in, Represents node v j For node v under edge type x i The attention coefficient, Represents node v i ,v j In the representation of layer l, φ(t v ) is the node type embedding function, ψ(t e ) is the edge type embedding function, is the edge weight embedding function, A collection of tensors encoding edges The average vector in , ‖·‖1 and ‖·‖2 represent the L1 norm and L2 norm respectively, · represents the dot product operation, and tanh(·) represents the hyperbolic tangent function;

[0102] S43. Attention weight Applied to the aggregation operation of path enhancement, combined with the average vector Execute node update operation with the current adjacent node representation:

[0103]

[0104] in, For node v i At the l+1th layer, For node v j In the representation of layer l, W1, W2 are the learnable weight matrices in the graph neural network model, and σ(·) is the nonlinear activation function.

[0105] S44. Repeat the propagation process in the graph neural network. After completing the l-layer iteration, output the vector representation set of all nodes

[0106] The graph neural network constructed by this invention introduces a multi-head residual attention mechanism, a path semantic enhancement aggregation strategy and an edge node similarity alignment mechanism, which improves the fine-grained expression ability of modeling the relationship between nodes in the graph and provides a more accurate judgment basis for fraud identification in complex transaction patterns.

[0107] In this embodiment, the S5 specifically includes:

[0108] S51. After completing the propagation of the l-th layer of the graph neural network, obtain the vector representation set of all nodes and retain the vector representation set of the nodes in the previous layer;

[0109] S52, for each node vi ∈V, the residual fusion strategy is used to combine the current layer representation with the last layer representation The fusion method is linear weighted superposition, and the superimposed representation is used as the cross-layer update vector of node v i .

[0110] S53, in order to enhance the cross-layer flow ability of information, a skip connection structure is introduced into the graph neural network, the node representations of all historical layers are combined in a hierarchical splicing manner, and a node feature matrix is generated Wherein The combined feature representation of node v is used for account node fraud classification task.

[0111] The present application effectively alleviates the gradient dissipation problem that may occur in the multi-layer propagation process of the graph neural network by designing residual fusion and skip connection structure, ensures the effective transmission of deep layer node semantic information between upper and lower layers, and improves the convergence speed and recognition accuracy of the model in the deep graph structure.

[0112] In the embodiment, the S6 specifically includes:

[0113] S61, based on the node feature matrix H * , each account node is assigned a label y v ∈{0,1}, wherein y v =1 indicates that the node is a fraudulent account, y v =0 indicates that the node is a normal account, a discriminator network is introduced to assist in realizing the binary classification fraud discrimination task of the account node, and the node representation vector is used as input for classification prediction;

[0114] S62, according to the transaction behavior edge E T , the device binding edge E B and the location access edge E P , the timestamp sequence of each type of edge is extracted, the time sequence prediction task corresponding to the edge type is constructed, the start and end nodes of each edge are set as input, and the real time sequence of the edge is set as label, and the node feature matrix H * and the edge encoding tensor set are combined to perform time sequence prediction;

[0115] S63, the account node fraud classification task and the multi-type edge time sequence prediction task are combined to construct a joint training task, a unified training target is set, and a multi-task loss function is used to train and optimize the graph neural network, the node classification error and the edge time sequence prediction error are minimized during the training process, and the fraud identification classification result corresponding to each account node is output after pre-training.

[0116] The application combines node classification and edge time sequence prediction to construct a multi-task joint training target, optimizes the supervised targets of nodes and edges through a shared feature matrix, improves the accuracy of the model in identifying fraudulent accounts, has the ability to predict abnormal transaction time sequence links, and has stronger generalization ability.

[0117] Reference Figure 3 A financial transaction fraud identification system based on a graph neural network comprises:

[0118] A data processing module is configured to collect financial transaction data and perform preprocessing.

[0119] A heterogeneous graph construction module is configured to construct a heterogeneous graph structure, wherein the heterogeneous graph structure comprises account nodes, device nodes and location nodes, and the nodes are connected through transaction behavior edges, device binding edges and location access edges to form a complete heterogeneous transaction graph.

[0120] A path encoding module is configured to embed path-level context information in each edge of the heterogeneous transaction graph, wherein the path is composed of a fixed-length transaction sequence, and a joint location index of node type and edge type is introduced to form a multi-hop edge encoding matrix.

[0121] A model construction module is configured to construct a graph neural network model, wherein the graph neural network model comprises a type attention unit, a path aggregation unit and a cross-domain alignment unit, and outputs a node representation vector.

[0122] A feature fusion module is configured to adopt a residual fusion strategy to fuse the current layer node representation and the last layer node representation, construct a skip connection structure, and form a final node feature matrix.

[0123] A classification training module is configured to construct a joint training task, perform joint training of the graph neural network model using a multi-task loss function, and output a fraud identification classification result after completing the pre-training process.

[0124] The system proposed by the application divides the processing logic of each stage in a modular structure, has a complete process from data preprocessing, heterogeneous graph construction, context encoding, graph network modeling, feature fusion to training output, and has the comprehensive advantages of strong deployability, stable identification performance and high engineering adaptability.

[0125] Embodiment 1

[0126] In order to verify the feasibility of the application in implementation, the application is applied to the transaction risk control system of a certain large financial payment platform. The system processes transaction data amounting to tens of millions per day, covering financial terminals, user accounts and intelligent payment devices in multiple provinces across the country. There are a large number of highly complex financial transaction behaviors in this scenario, some of which are highly concealed. The traditional rule matching and shallow feature classification method cannot effectively identify some new fraud patterns, often resulting in high false negative and false positive rates, which seriously affects the user experience and transaction security of the platform. In order to solve this problem, the platform decides to introduce the financial transaction fraud identification method based on graph neural network proposed in the application to improve the detection ability and response efficiency of complex fraud behaviors.

[0127] In actual deployment, the system first accesses the historical transaction data of the platform in the past 90 days, involving 32.5 million account nodes, 4.8 million device nodes and 6.7 million geographic location nodes, and constructs a heterogeneous transaction graph containing three types of relationships: account-account transaction, account-device binding and account-location access. The platform uses the multi-stage preprocessing strategy in the method of the application to preprocess the data, including deduplication, missing value completion, anomaly removal and standardization, to ensure the standardization of the graph structure input. After constructing the heterogeneous graph, the system embeds the path-level context information in the continuous behavior trajectory in the transaction path. Each edge embeds a context sequence composed of fixed transaction paths with a length of 5. Through the joint indexing mechanism of node type and edge type, a multi-hop edge encoding matrix is generated to provide path-level semantic support for subsequent graph neural network learning.

[0128] The system uses a graph neural network model for training. The model contains a type attention unit, a path aggregation unit and a cross-domain alignment unit, which can capture the type heterogeneity between transaction nodes, the path structure dependency relationship and the semantic consistency of cross-behavior patterns. Each layer of the network uses a residual fusion strategy to build a skip connection structure, effectively solving the gradient decay problem in the training process of deep networks. During model training, a joint multi-task supervision mechanism is introduced to perform fraud or not binary classification on account nodes, and to perform time sequence order prediction on transaction behavior edges, device binding edges and location access edges, thereby improving the early prediction ability of the model for time-sensitive fraud behaviors.

[0129] After 60 rounds of training iterations, the model achieved a better recognition effect on the test set. The platform compared the method of the application with three existing mainstream fraud detection methods, including a feature classification method based on XGBoost, a time series behavior modeling method based on LSTM, and a GCN model based on isomorphic graph. The test results show that under the same transaction set and data window, the overall accuracy of the model of the application reaches 98.2%, which is about 9.6 percentage points higher than the XGBoost model and about 5.4 percentage points higher than the GCN model. In terms of AUC (area under the curve) index, the model of the application reaches 0.981, which is about 0.07 higher than the other models on average. In terms of recall rate, the recall rate of the method for malicious accounts is as high as 94.3%, which shows a significant advantage in identifying high-concealment group transactions.

[0130] In addition, in order to evaluate the response ability of the system to new fraud behaviors, the platform introduces a set of potential fraud behavior data that occurred in the last 7 days but was not labeled in history for simulation testing. The results show that the method of the application can still make early warnings for 82.7% of potential abnormal accounts without explicit supervision, and 60.5% of the accounts are confirmed to have suspicious behaviors subsequently, which shows that the model of the application has good generalization ability for abnormal structure patterns under unsupervised conditions.

[0131] Based on the above data, the platform intercepted a total amount of about 432 million yuan of suspected fraudulent transactions during the test period, covering more than 290,000 user accounts, and the average early warning time for each fraudulent transaction was about 4.2 hours in advance, which reserved sufficient time for subsequent manual review and account freezing. The overall system running efficiency is improved by about 36.8%, and the processing throughput capacity is maintained at a real-time response scale of more than 10 million transactions per day, which proves the stability and efficiency of the method of the application in financial business scenarios.

[0132] In order to more intuitively show the application effect of the method of the application in real scenarios, the table summarizes the comparison of the main performance indicators of the method of the application and the comparison models as follows:

[0133] Table 1 Comparison of performance of financial transaction fraud identification

[0134]

[0135]

[0136] The above test results and application feedback show that the application has significant advantages in multi-dimensional behavior modeling capability, fraud identification accuracy and system real-time performance, and provides reliable technical support for financial institutions to build an efficient, intelligent and secure transaction risk control system.

[0137] The above merely describes preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art, according to the technical solution and inventive concept of the present application, makes equivalent replacement or change within the technical range disclosed by the present application, which should be covered within the protection scope of the present application.

Claims

1. A method for identifying financial transaction fraud based on graph neural networks, characterized in that: The steps include: S1. Collect financial transaction data and perform preprocessing; S2. Constructing a heterogeneous graph structure based on the preprocessed financial transaction data. The heterogeneous graph structure includes account nodes, device nodes, and location nodes. The nodes are connected by transaction behavior edges, device binding edges, and location access edges to form a heterogeneous transaction graph. S3. Embed path-level context information for each edge in the heterogeneous transaction graph. The path consists of a fixed-length transaction sequence and introduces a joint position index of node type and edge type to form a multi-hop edge encoding matrix. S4. Based on the heterogeneous transaction graph, a graph neural network model is constructed. The graph neural network model includes a type attention unit, a path aggregation unit, and a cross-domain alignment unit, and outputs a node representation vector. S5. Use the residual fusion strategy to fuse the node representation of the current layer with the node representation of the previous layer output, and build a skip connection structure to form a node feature matrix; S6. Based on the node feature matrix, a joint training task is constructed, and a multi-task loss function is used to jointly train the graph neural network model. After completing the pre-training process, the fraud identification classification results are output.

2. The method for identifying financial transaction fraud based on graph neural network according to claim 1, characterized in that: The financial transaction data includes account identification, transaction time, transaction amount, transaction object, transaction device identification and login geographic location. The preprocessing includes data deduplication, missing value filling, outlier removal and data standardization.

3. The method for identifying financial transaction fraud based on graph neural network according to claim 1, characterized in that: The type attention unit calculates the multi-head attention coefficient according to the node type and the edge type, the path aggregation unit performs a weighted aggregation operation according to the multi-hop edge encoding matrix, and the cross-domain alignment unit performs cosine similarity matching based on the edge embedding and the node embedding.

4. The method for identifying financial transaction fraud based on graph neural network according to claim 1, characterized in that: The joint training task includes a binary classification fraud discrimination task for nodes and a time series prediction task for transaction behavior edges, device binding edges, and location access edges.

5. The method for identifying financial transaction fraud based on graph neural network according to claim 1, characterized in that: The S2 specifically includes: S21, set the pre-processed financial transaction data set as D = {d1, d2, ..., d n }, where d i Represents the i-th transaction data record, which contains the fields (a i ,t i ,m i ,o i ,e i ,l i ), representing account identifiers a i , transaction time t i Transaction amount m i 、Transaction object i , transaction device identification e i Login location i ; S22. Construct a heterogeneous node set V=V based on D A ∪V E ∪V L , where V A Represents the account node set, V E Represents a collection of device nodes, V L represents the set of position nodes, ∪ represents the union operation; S23. Construct three types of edge sets E=E T ∪E B ∪E P , where E T A collection of transaction behavior edges, connecting account nodes Transaction object node E B Bind the edge set to the device and connect to the account node With device node E P Access edge sets for locations, connecting account nodes With location node S24. During the edge set construction process, the edge weight function is defined as: in, Represents a node v under edge type x∈{T,B,P} i With v j The weighted edge weight between i Represents node v i The amount of the corresponding transaction record, log2(·) is the logarithmic function, t i and t j Indicates the timestamp corresponding to the transaction data record, δ(e i =e j ) is the indicator function, when v i With v j The value is 1 when bound to the same device, otherwise it is 0. i =l j ) is an indicator function, which takes the value of 1 when the two nodes have the same login position, and 0 otherwise. α, β, and γ are weight coefficients used to control the contribution ratio of different features to edge weight; S25. Based on the node set V and the edge set E, a heterogeneous transaction graph G = (V, E, W) is constructed, where W is the edge weight matrix, which represents the weighted result of all edges in the graph.

6. The method for identifying financial transaction fraud based on graph neural network according to claim 1, characterized in that: The S3 specifically includes: S31. From each edge of the heterogeneous transaction graph Extracted from A fixed-length transaction path sequence centered on The path length is fixed to l+1, Represents an edge of type x, u, v∈V, x∈{T,B,P}; S32. Define the node type set as The edge type set is Combine the type of each node in the path with the adjacent edge types to form a sequence of joint types in S33. Construct a multi-hop edge coding matrix based on the joint type sequence The rth row of the multi-hop edge coding matrix is ​​defined as follows: in, represents the encoding vector of the rth hop in the path, Represents the node type embedding function, that is, the input node type The corresponding output embedding vector, Represents the edge type embedding function, that is, the input edge type The corresponding output embedding vector, η(w r ) represents the edge weight embedding function, that is, the edge weight w of the input r hop r The corresponding output embedding vector, Θ is the encoding transformation matrix, represents the vector-level concatenation operation, and σ(·) is a nonlinear activation function used to improve the expressiveness of path information; S34, multi-hop coding matrix of all edges Stored as a collection of edge-encoded tensors Serves as path-level context input to graph neural network models.

7. The method for identifying financial transaction fraud based on graph neural network according to claim 1, characterized in that: The S4 specifically includes: S41. Initialize the graph neural network and build a graph neural network model, combining the heterogeneous transaction graph G = (V, E, W) with the edge coding tensor set As input, the output vector representation set H = {h v |v∈V}, where the initial node is represented as S42, construct type attention unit, set node v i The set of adjacent nodes of For every pair of nodes v i and The edge type is x, and the multi-head attention guidance function is defined as: in, Represents node v j For node v under edge type x i The attention coefficient, Represents node v i ,v j In the representation of layer l, φ(t v ) is the node type embedding function, ψ(t e ) is the edge type embedding function, is the edge weight embedding function, A collection of tensors encoding edges The average vector in , ‖·‖1 and ‖·‖2 represent the L1 norm and L2 norm respectively, · represents the dot product operation, and tanh(·) represents the hyperbolic tangent function; S43. Attention weight Applied to the aggregation operation of path enhancement, combined with the average vector Execute node update operation with the current adjacent node representation: in, For node v i At the l+1th layer, For node v j In the representation of layer l, W1, W2 are the learnable weight matrices in the graph neural network model, and σ(·) is the nonlinear activation function. S44. Repeat the propagation process in the graph neural network. After completing the l-layer iteration, output the vector representation set of all nodes 8. The method for identifying financial transaction fraud based on graph neural network according to claim 1, characterized in that: The S5 specifically includes: S51. After completing the propagation of the l-th layer of the graph neural network, obtain the vector representation set of all nodes and retain the vector representation set of the nodes in the previous layer; S52, for each node v i ∈V, using the residual fusion strategy to represent the current layer Compared with the previous layer Perform weighted fusion, the fusion method is linear weighted superposition, and the superposition representation is used as node v i Cross-layer update vector of ; S53. To enhance the cross-layer information flow capability, a skip connection structure is introduced into the graph neural network. The node representations of all historical layers are combined in a hierarchical manner and a node feature matrix is ​​generated. in Represents the combined feature representation of node v, which is used for the account node fraud classification task.

9. The method for identifying financial transaction fraud based on graph neural network according to claim 1, characterized in that: The S6 specifically includes: S61, based on the node feature matrix H * , assign label y to each account node v ∈{0,1}, where y v =1 means the node is a fraudulent account, y v = 0 means the node is a normal account. The discriminator network is introduced to assist in the binary fraud discrimination task of the account node, and the node representation vector is used. Take as input for classification prediction; S62, according to the transaction behavior edge E in the edge set T , device binding edge E B and location access edge E P , extract the timestamp sequence of each type of edge, build the time series prediction task corresponding to the edge type, set the start and end nodes of each edge as input, the real time sequence of the edge as the label, and combine the node feature matrix H * A collection of edge-encoded tensors Perform time-sequential forecasting; S63. Combine the account node fraud classification task and the multi-type edge timing prediction task to construct a joint training task, set a unified training goal, and use a multi-task loss function to train and optimize the graph neural network. During the training process, jointly minimize the node classification error and the edge timing prediction error. After completing the pre-training, output the fraud identification and classification results corresponding to each account node.

10. A financial transaction fraud identification system based on graph neural network, implementing a financial transaction fraud identification method based on graph neural network according to any one of claims 1 to 9, characterized in that: include: Data processing module, used to collect financial transaction data and perform pre-processing; A heterogeneous graph construction module is used to construct a heterogeneous graph structure. The heterogeneous graph structure includes account nodes, device nodes, and location nodes. The nodes are connected by transaction behavior edges, device binding edges, and location access edges to form a complete heterogeneous transaction graph. The path encoding module is used to embed path-level context information for each edge in the heterogeneous transaction graph. The path consists of a fixed-length transaction sequence and introduces a joint position index of node type and edge type to form a multi-hop edge encoding matrix. A model construction module is used to construct a graph neural network model, which includes a type attention unit, a path aggregation unit, and a cross-domain alignment unit, and outputs a node representation vector; The feature fusion module is used to fuse the node representation of the current layer with the node representation of the previous layer using a residual fusion strategy, and to construct a skip connection structure to form the final node feature matrix; The classification training module is used to construct joint training tasks, jointly train the graph neural network model using a multi-task loss function, and output the fraud identification classification results after completing the pre-training process.

Images