Method for constructing transaction association graph and carrying out fraud detection by using community discovery
By constructing a transaction association graph and using community detection methods, combined with coherent Ising machines for community detection, the problem of low efficiency in identifying fraudulent behavior in large-scale complex transaction associations in existing technologies is solved, achieving efficient and accurate fraud detection and real-time response under data-constrained conditions.
Patent Information
- Application Number
- CN202410438117.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-12
- Publication Date
- 2025-10-21
AI Technical Summary
Existing fraud detection systems are inefficient when dealing with large-scale and complex transaction associations, and struggle to accurately identify fraudulent activities when data access is limited.
A transaction association graph is constructed and a community discovery method is used to identify high-risk communities by calculating AA similarity and optimizing the modularity function, combined with a coherent Ising machine.
It efficiently identifies potential fraudulent activities under data-constrained conditions, improves the accuracy and real-time response capability of fraud detection, and has flexibility and long-term adaptability, thereby enhancing the security of the transaction environment.
Smart Images
Figure CN120822955A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of big data analysis and relates to a method for fraud detection, and in particular to a method for constructing a transaction association graph and using community discovery to perform fraud detection. Background Art
[0002] Identifying and preventing fraudulent activities in transactions is a crucial measure for ensuring transaction security. With the rapid development of technology, the number and complexity of transactions have increased dramatically. At the same time, fraudulent methods have become more sophisticated and difficult to detect.
[0003] Many fraud detection systems currently on the market rely primarily on traditional data analysis techniques, which work well when dealing with simple or straightforward fraudulent activities. However, they face challenges in analyzing complex transaction relationships, especially when it comes to large-scale data and complex and changing fraud strategies. These fraud detection systems are often unable to effectively identify fraudulent activities that are carried out through complex relationships because the computing power and analytical depth of traditional technologies cannot meet the current industry's demand for efficient and in-depth analysis. In addition, the performance of existing fraud detection systems is affected when data access is limited (such as only transaction flows of the bank itself) because they cannot obtain sufficient contextual information to accurately identify fraudulent activities.
[0004] Therefore, in view of the defects in the above-mentioned prior art, it is necessary to develop a new method for fraud detection. Summary of the Invention
[0005] To overcome the shortcomings of the existing technology, the present invention proposes a method for constructing a transaction association graph and using community discovery for fraud detection. The method can efficiently process large-scale data sets and analyze complex transaction association graphs, thereby accurately identifying potential fraudulent behaviors. Moreover, even under conditions of restricted data access, the method can obtain corresponding community divisions by analyzing the association relationships in limited transaction data, greatly improving the accuracy and effectiveness of fraud detection.
[0006] In order to achieve the above object, the present invention provides the following technical solutions:
[0007] A method for constructing a transaction association graph and using community discovery to detect fraud, characterized by comprising the following steps:
[0008] Extract corresponding transaction flow data based on the user's transaction behavior, and the transaction flow data includes the account and each transaction generated by the account;
[0009] Converting the transaction flow data into a transaction association weight graph, wherein each account is regarded as a node in the transaction association weight graph, and the similarity between two accounts is regarded as an edge between two nodes in the transaction association weight graph;
[0010] Filtering the edges in the transaction association weight graph according to a similarity threshold to obtain a transaction association graph;
[0011] Constructing a modularity function for measuring community discovery based on the transaction association graph;
[0012] Optimize the module function to maximize the module function, and find the optimal solution through iteration to obtain the community discovery result.
[0013] The fraud risk of each community is evaluated based on the community discovery results to achieve fraud detection.
[0014] Preferably, the similarity between two accounts is calculated using an AA similarity calculation method.
[0015] Preferably, the AA similarity calculation method is specifically as follows:
[0016]
[0017] Where AA(u,v) represents the AA similarity between nodes u and v in the transaction association weight graph, N(u) and N(v) represent the sets of neighbor nodes of nodes u and v in the transaction association weight graph, respectively, N(z) is the set of common neighbor nodes z of nodes u and v, and |N(z)| represents the number of common neighbor nodes z of nodes u and v.
[0018] Preferably, when filtering the edges in the transaction association weight graph according to the similarity threshold to obtain the transaction association graph, the edges in the transaction association weight graph where the AA similarity between two accounts is less than the similarity threshold are deleted, and only the edges where the AA similarity between two accounts is greater than or equal to the similarity threshold are retained to obtain the transaction association graph.
[0019] Preferably, the similarity threshold is determined based on business experience or business effects discovered by the community.
[0020] Preferably, the modularity function constructed to measure community discovery is:
[0021]
[0022] Where Q is modularity, which is the total number of edges in the community minus the expected number of edges generated by nodes in the community; A vw A represents the connection between node v and node w in the transaction association graph. vw=1 means that node v is connected to node w, A vw =0 means that node v and node w are not connected; m is the total number of edges in the transaction association graph, c v represents the community to which node v is assigned, c w Indicates the community to which node w is assigned, using δ(c v ,c w )=1 means c v =c w , that is, it means that node v and node w are divided into the same community c, δ(c v ,c w )=0 means that node v and node w are not divided into the same community c; k v represents the degree of node v, which is the number of edges connected to node v, where k w represents the degree of node w, which is the number of edges connected to node w, where
[0023] Preferably, optimization is performed with the goal of maximizing the modularity function, and the optimal solution is found in an iterative manner to obtain the community discovery result. The community discovery algorithm Louvain algorithm or the coherent Ising machine is used to find the optimal solution.
[0024] Preferably, when assessing the fraud risk of each community based on the community discovery results, the external fraud scores of each account in each community are combined to calculate the fraud score of all accounts in each community, thereby assessing the fraud risk of each community.
[0025] Preferably, when evaluating the fraud risk of each community based on the community discovery results, the fraud labels of each account in each community are combined to calculate the proportion of fraudulent accounts in each community, thereby evaluating the fraud risk of each community.
[0026] In addition, the present invention also provides a device for constructing a transaction association graph and using community discovery to detect fraud, which is characterized by comprising:
[0027] at least one processor; and
[0028] at least one memory storing a computer program;
[0029] Wherein, when the computer program is executed by the at least one processor, the device for constructing a transaction association graph and using community discovery for fraud detection executes the steps of the method for constructing a transaction association graph and using community discovery for fraud detection as described above.
[0030] Compared with the prior art, the method of constructing a transaction association graph and using community discovery for fraud detection in the present invention has one or more of the following beneficial technical effects:
[0031] 1. This invention converts transaction flow data into a transaction association weight graph by calculating AA similarity, provides a similarity threshold selection method, and performs noise reduction on the data of the transaction association weight graph to obtain a transaction association graph, which is very important for analyzing the association between accounts when data is limited.
[0032] 2. This invention applies quantum computing technology based on coherent Ising machines for the first time to community discovery in transaction association graphs for fraud analysis. This innovation not only opens up new application paths for quantum computing in the transaction field, but also provides a new and efficient solution for fraud detection in transaction association graphs.
[0033] 3. This invention leverages the powerful computing power of the coherent Ising machine to deeply analyze the complex network structure of transaction flow data, effectively identifying and delineating community structures hidden in massive data. It can accurately identify high-risk communities even in networks with complex or sparse connections. This complex network analysis capability is difficult to match with traditional community discovery methods, providing institutions with a more powerful tool to identify and prevent potential fraud risks.
[0034] 4. The present invention supports real-time processing of transaction flow data, allowing institutions to promptly identify and respond to potential fraudulent activities. In addition, it has the ability to identify high-risk transactions that are densely associated with fraudulent transactions, and can more accurately locate the point where fraudulent activities occur, thereby taking effective measures to prevent losses from expanding. This significantly enhances the initiative and effectiveness of the institution's anti-fraud strategy and ensures the security and reliability of the transaction environment.
[0035] 5. The design of this invention takes into account the rapid changes in transaction behavior and fraud methods, and therefore has extremely high flexibility and scalability. This means that as the market develops and new fraud methods emerge, this invention can be easily adapted and upgraded to maintain its long-term effectiveness in anti-fraud strategies. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] Figure 1 Flowchart of the method of constructing a transaction association graph and using community discovery for fraud detection according to the present invention. DETAILED DESCRIPTION
[0037] Before describing in detail any embodiment of the present invention, it should be understood that the present invention is not limited in its application to the construction and arrangement details of the components set forth in the following description or illustrated in the following figures. The present invention is capable of other embodiments and can be practiced or carried out in various ways. In addition, it should be understood that the words and terms used herein are for descriptive purposes and should not be considered restrictive. The use of "including" or "having" and their variations herein is intended to cover the items and their equivalents set forth below and additional items. Unless otherwise specified or limited, the terms "mounted", "connected", "supported" and "coupled" and their variations are used broadly and cover direct mounting and indirect mounting, connection, support and coupling. In addition, "connected" and "coupled" are not limited to physical or mechanical connections or couplings.
[0038] Furthermore, in the disclosure of the present invention, the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the elements may be multiple, and the term "one" should not be understood as a limitation on the quantity.
[0039] In order to meet the business needs of quickly and accurately identifying and predicting potential fraud risks in transaction flows, the present invention converts transaction flow data into a transaction association weight graph by calculating AA similarity, provides a similarity threshold selection method, and performs noise reduction on the data of the transaction association weight graph to obtain a transaction association graph. It can analyze the association between accounts when data is limited, so that target accounts can be quickly divided, and based on fraudulent transactions or fraudulent accounts in the community, potential high-risk accounts or high-risk transactions can be identified, thereby effectively warning of fraud and money laundering.
[0040] Figure 1 The flowchart of the method for constructing a transaction association graph and using community discovery to detect fraud in the present invention is shown. Figure 1 As shown, the method of constructing a transaction association graph and using community discovery to detect fraud in the present invention includes the following steps:
[0041] 1. Extract corresponding transaction flow data based on the user's transaction behavior.
[0042] Because fraudulent behavior is ultimately related to economic interests, community discovery methods based on transaction flow data are particularly important in anti-fraud algorithms. The present invention first extracts corresponding transaction flow data based on the user's transaction behavior. The transaction flow data includes the account and every transaction generated by the account.
[0043] 2. Convert the transaction flow data into a transaction association weight graph.
[0044] After obtaining transaction flow data, it is necessary to convert this data into graph data to facilitate the discovery of information hidden within its complex structure. Because the data of an institution (such as a bank) is limited to its own transaction records, it is impossible to obtain complete transaction flow data. Therefore, it is particularly important to convert the direct transaction flow data of an account into a transaction relationship graph through a transaction intermediary.
[0045] In the present invention, the strength of the relationship between accounts is calculated by calculating the similarity between accounts to form a transaction association weight graph.
[0046] In the transaction association weight graph, each account is regarded as a node in the transaction association weight graph, and the similarity between two accounts is regarded as an edge between two nodes in the transaction association weight graph. That is, if the similarity between two accounts is greater than zero, an edge is formed between the two accounts, and the weight of the edge is the similarity between the two accounts.
[0047] Because Adamic-Adar similarity, or AA similarity for short, effectively considers the information of common neighbors between nodes and emphasizes the important contribution of rare common neighbors to similarity, AA similarity is a very good correlation evaluation metric in transaction network anti-fraud. Therefore, in this invention, the similarity between two accounts is calculated using the AA similarity calculation method.
[0048] The specific method for calculating AA similarity is:
[0049]
[0050] Where AA(u,v) represents the AA similarity between nodes u and v in the transaction association weight graph; N(u) and N(v) represent the sets of neighbor nodes of nodes u and v in the transaction association weight graph, respectively; N(z) is the set of common neighbor nodes z of nodes u and v, and |N(z)| represents the number of common neighbor nodes z of nodes u and v.
[0051] A neighbor node is a node with which a transaction has occurred. For example, if a transaction occurs between node a and node b, node a is a neighbor node of node b, and node b is also a neighbor node of node a. If a transaction occurs between node a and node c, and node b also has a transaction with node c, then node c is a common neighbor node of both nodes a and b.
[0052] 3. Filter the edges in the transaction association weight graph according to a similarity threshold to obtain a transaction association graph.
[0053] In the transaction association weight graph constructed using the AA similarity method, if there are occasional identical transactions, the transaction association weight graph will be noisy, affecting subsequent solution and community discovery. Therefore, in this invention, a similarity threshold is used to filter out the noise in the associated transaction weight graph to construct a transaction association graph.
[0054] Specifically, when filtering the edges in the transaction association weight graph according to a similarity threshold to obtain the transaction association graph, edges in the transaction association weight graph where the AA similarity between two accounts is less than the similarity threshold are deleted, and only edges where the AA similarity is greater than or equal to the similarity threshold are retained to obtain the transaction association graph. That is, if the AA similarity between two accounts is greater than or equal to the similarity threshold, an edge is formed between the two accounts and is represented by a "1" in the transaction association graph; if the AA similarity between the two accounts is less than the similarity threshold, no edge is formed between the two accounts and is represented by a "0" in the transaction association graph.
[0055] When setting the similarity threshold, it can be done based on business experience. Of course, the similarity threshold can also be determined based on the final business results (such as using information gain or KS evaluation). That is, first set the initial value of the similarity threshold based on business experience, and then evaluate the similarity threshold based on the subsequent business results of community discovery. If the subsequent business results of community discovery are not good, the similarity threshold is continuously adjusted and optimized manually until a better business result of community discovery is achieved.
[0056] Therefore, by analyzing the entire transaction flow data, calculating the AA similarity between accounts and setting the similarity threshold, a complete transaction association graph can be constructed.
[0057] 4. Construct a modularity function to measure community discovery based on the transaction association graph.
[0058] Community discovery, also known as community detection, aims to identify closely connected groups of nodes within complex network structures. These nodes are structurally closely connected to each other but weakly connected to other nodes. Through community discovery, functional modules, social circles, and information dissemination groups within complex network structures can be identified. This helps understand the organizational structure of complex networks, reveal the relationships between nodes, and gain insights and applications from them.
[0059] Fraud detection in the transaction field also involves efficiently extracting hidden information from complex network structures (i.e., transaction association graphs). In other words, it involves detecting abnormal transactions between different accounts from a large amount of transaction data. This problem also involves extracting network entity relationships and is also a community discovery problem.
[0060] Therefore, by performing community discovery based on the transaction association graph, it is possible to find closely connected account groups, that is, account groups that frequently trade, thereby facilitating subsequent detection of abnormal transactions between different accounts.
[0061] Modularity can be used to measure the quality of community division. If there are more edges within the divided community and fewer edges between communities, the modularity value is higher and the community division is better. Therefore, the community discovery problem can be transformed into the problem of maximizing the modularity of the transaction association graph.
[0062] In the present invention, we first define the adjacency matrix A, which is used to represent the connections between nodes (ie, accounts) in the transaction association graph. vw A represents the connection between node v and node w in the transaction association graph. vw =1 means that node v is connected to node w, A vw =0 means that node v and node w are not connected; define m as the total number of edges in the transaction association graph (the total number of edges after removing duplicate edges),
[0063] The basic idea of modularity-based community detection is to use the property that the number of edges within a community is relatively large. Assuming that the transaction association graph is divided into different communities, c v represents the community to which node v is assigned, c w Indicates the community to which node w is assigned, using δ(c v ,c w )=1 means c v =c w ,, that is, it means that node v and node w are divided into the same community c, δ(c v ,c w ) = 0 means that node v and node w are not divided into the same community c. Then the probability of an edge falling into a community c (that is, the two connected nodes are in the same community) can be expressed as:
[0064]
[0065] For this probability, if all nodes in the transaction association graph are assigned to a community, the value is the largest. Therefore, this indicator alone cannot measure the effect of community division. It needs to be combined with other metrics. This other metric should reflect the expected number of connections in a random community division. To this end, first define the degree k of node v v , which is the number of edges connected to node v, defines the degree k of node w w , which is the number of edges connected to node w, where
[0066] It can be seen that the probability of node w connecting to any node is Now node v has degree k v , so in the case of a random network, the expected number of edges between node v and node w is That is, within a community, The bigger the better.
[0067] In summary, the modularity function for measuring community discovery can be defined as:
[0068]
[0069] That is, Q is modularity, which is the expected number of edges generated by nodes within a community minus the total number of edges in the community. The total number of edges in a community is the sum of the edges generated by all nodes in the community. Furthermore, in the present invention, dividing the total number of edges by 2m can be understood as the ratio of the number of edges.
[0070] 5. Optimize the function with the goal of maximizing the modularity function, and find the optimal solution through iteration to obtain the community discovery result.
[0071] When the number of accounts and communities is small, the CIM simulator and real machines can be used to find the optimal solution to obtain community discovery results.
[0072] However, considering the large number of accounts and communities in transaction flow data, conventional solutions are difficult to find. Therefore, in this invention, the classic community discovery algorithm Louvain can be used to obtain community discovery results. Alternatively, the modularity function can be converted into a QUBO model and a coherent Ising machine can be used to find the optimal solution to obtain community discovery results.
[0073] The modularity function is converted into a QUBO model and a coherent Ising machine is used to find the optimal solution to obtain the community discovery result. Specifically, the following steps are performed:
[0074] First, the modularity function is transformed into a QUBO model, and the binary decision variable x is defined as vc and x wc , x vc =1 means node v is assigned to community c, x vc = 0 means node v is not assigned to community c, x wc =1 means node w is assigned to community c, x wc = 0 means that node w is not assigned to community c. The modularity of community c can be expressed as:
[0075]
[0076] Since a node can only be assigned to one community, for any node v, the following constraints are required:
[0077]
[0078] Written as QUBO model:
[0079]
[0080] Where H represents Hamiltonian, which is the target value for optimization; M is the penalty coefficient. M is determined based on experience. If it is too small, it will not have a penalty effect, and if it is too large, it will violate the convention. In the present invention, M is set to make M smaller than The size of is at least an order of magnitude larger.
[0081] In particular, when all nodes are divided into only two communities, no additional constraints are required and the above QUBO model can be further simplified as follows:
[0082]
[0083] Secondly, the QUBO model is solved by the coherent Ising machine to obtain the community discovery results.
[0084] The QUBO model is suitable for solving coherent Ising machines (CIMs). The implementation of the physical machine solution takes the CIM based on the degenerate optical parametric oscillator (DOPO) as an example. This is a hybrid quantum computing system consisting of optical and electrical parts. The optical part includes a laser, an amplifier, a periodically poled lithium niobate crystal (PPLN), and a fiber loop. The laser uses a femtosecond pulse fiber laser and an amplifier system. The amplified laser is first frequency-doubled using a PPLN crystal. The frequency-doubled laser is used as a pump source to synchronously pump the PPLN crystal in a fiber loop, forming a degenerate optical parametric oscillation. Hundreds of oscillation pulses can exist simultaneously in the fiber loop. The electrical part includes an FPGA (Field Programmable Gate Array), AD / DA (digital-to-analog / analog-to-digital conversion), and a phase detection part. The laser output from the fiber loop and the fundamental frequency laser are measured using a phase detector, allowing the phase of the output light to be tested. FPGA is used with high-speed AD / DA for optical pulse measurement and feedback control.
[0085] Unlike classical computers, which operate on semiconductor integrated circuits, CIM uses laser pulses in optical fibers as quantum bits for computation. In DOPO, pump light is incident on a nonlinear optical crystal, splitting it into two beams. These two beams have the same polarization direction and a frequency half that of the pump light, remaining in a compressed state and functioning as a quantum bit. By gradually increasing the pump light power above the oscillation threshold, the generated light becomes coherent, with its phase splitting into two states (phase 0 and π). This phase can then be set to ±1 relative to the spin, enabling optimization problems.
[0086] Using a coherent Ising machine, we find a set of solutions that minimize the target value H. This set of solutions is a set of 0 and 1 variables, such as [0, 0, 1, 1, 0, 0, 0, 1, 0, ...]. The number of elements in this list is the product of the number of accounts in the transaction association graph and the number of communities. A 1 in the solution indicates that the account is assigned to the corresponding community, while a 0 indicates that the account is not assigned to the corresponding community.
[0087] For example, if a transaction graph consisting of 10 nodes (i.e., accounts) is divided into three communities, then bits 1 to 3 in the variable combination represent the community to which node 1 belongs, bits 4 to 6 represent the community to which node 2 belongs, and so on. In the returned result, for example, [0, 0, 1, 1, 0, 0, ...], since bits 1 to 3 are 0, 0, 1, this means that node 1 belongs to community 3; bits 4 to 6 are 1, 0, 0, this means that node 2 belongs to community 1 (1 represents belonging to a community, 0 represents not belonging to that community). Therefore, by utilizing the coherent Ising machine, it is possible to quickly partition the communities to which nodes belong.
[0088] 6. Evaluate the fraud risk of each community based on the community discovery results to achieve fraud detection.
[0089] With the community discovery results, existing evaluation methods can be used to assess the fraud risk of each community to achieve fraud detection.
[0090] In the present invention, when evaluating the fraud risk of each community based on the community discovery results, the external fraud score of each account in each community can be combined (wherein the external fraud score of each account is quantitatively marked for each account by the bank system, etc. and is known) to calculate the fraud score of all accounts in each community (that is, the external fraud scores of all accounts in each community are added together to obtain the fraud score of the community), and the fraud risk of each community is evaluated using the community fraud score. For example, a community with a fraud score greater than 70 is regarded as a high-risk fraud community, a community with a fraud score less than 10 is regarded as a low-risk fraud community, and a community with a fraud score between 70 and 10 is regarded as a medium-risk fraud community. It should be noted that the size of the community fraud score used to evaluate the fraud risk of each community depends on the accuracy of the community discovery and can be adjusted as needed.
[0091] Of course, when evaluating the fraud risk of each community based on the community discovery results, the fraud labels of each account in each community can also be combined (wherein the fraud labels of each account are known by the bank system, etc.) to calculate the proportion of fraud-related accounts in each community (for example, if there are 10 accounts in a community, of which 4 accounts are marked as fraudulent, then the proportion of fraud-related accounts is 40%), and the fraud risk of each community can be evaluated based on the proportion of fraud-related accounts. For example, communities with a proportion of fraud-related accounts greater than 50% are considered high-risk fraud communities, communities with a proportion of fraud-related accounts less than 10% are considered low-risk fraud communities, and communities with a proportion of fraud-related accounts between 50% and 10% are considered medium-risk fraud communities. Similarly, it should be noted that the size of the proportion of fraud-related accounts used to evaluate the fraud risk of each community depends on the accuracy of community discovery and can be adjusted as needed.
[0092] In addition, the present invention also provides a device for constructing a transaction association graph and using community discovery to detect fraud, which includes:
[0093] at least one processor; and
[0094] at least one memory storing a computer program;
[0095] Wherein, when the computer program is executed by the at least one processor, the device for constructing a transaction association graph and using community discovery for fraud detection executes the steps of the method for constructing a transaction association graph and using community discovery for fraud detection as described above.
[0096] This invention converts transaction flow data into a transaction association weight graph by calculating AA similarity, provides a similarity threshold selection method, and performs noise reduction processing on the data of the transaction association weight graph to obtain a transaction association graph. This is very important for analyzing the association between accounts in data-limited situations. At the same time, this invention is the first to apply quantum computing technology based on coherent Ising machines to community discovery in transaction association graphs for fraud analysis. This innovation not only opens up new application paths for quantum computing in the transaction field, but also provides a new and efficient solution for fraud detection in transaction association graphs. Moreover, this invention utilizes the powerful computing power of coherent Ising machines to deeply analyze the complex network structure composed of transaction flow data, effectively identify and divide community structures hidden in large amounts of data, and accurately identify high-risk communities even in complex or sparsely connected networks. This complex network analysis capability is difficult to match with traditional community discovery methods, providing institutions with a more powerful tool to identify and prevent potential fraud risks. In addition, the present invention supports real-time processing of transaction flow data, which allows institutions to promptly identify and respond to potential fraudulent activities. Furthermore, it has the ability to identify high-risk transactions that are closely related to fraudulent transactions, allowing for more accurate location of the point at which fraudulent activities occur, thereby enabling effective measures to prevent losses from expanding. This significantly enhances the proactiveness and effectiveness of the institution's anti-fraud strategy and ensures the security and reliability of the transaction environment. Finally, the design of the present invention takes into account the rapid changes in transaction behavior and fraudulent methods, resulting in extremely high flexibility and scalability. This means that as the market develops and new fraudulent methods emerge, the present invention can be easily adapted and upgraded, maintaining its long-term effectiveness in anti-fraud strategies.
[0097] Finally, it should be noted that the above embodiments are intended only to illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention. Those skilled in the art may, based on the principles of the present invention, modify or replace the technical solutions of the present invention with equivalents without departing from the essence and scope of the technical solutions of the present invention.
Claims
1. A method for constructing a transaction association graph and using community discovery for fraud detection, characterized in that: The following steps are involved: Extract corresponding transaction flow data based on the user's transaction behavior, and the transaction flow data includes the account and each transaction generated by the account; Converting the transaction flow data into a transaction association weight graph, wherein each account is regarded as a node in the transaction association weight graph, and the similarity between two accounts is regarded as an edge between two nodes in the transaction association weight graph; Filtering the edges in the transaction association weight graph according to a similarity threshold to obtain a transaction association graph; Constructing a modularity function for measuring community discovery based on the transaction association graph; Optimize the module function to maximize the module function, and find the optimal solution through iteration to obtain the community discovery result. The fraud risk of each community is evaluated based on the community discovery results to achieve fraud detection.
2. The method for constructing a transaction association graph and using community discovery for fraud detection according to claim 1, characterized in that: The similarity between two accounts is calculated using the AA similarity calculation method.
3. The method for constructing a transaction association graph and using community discovery for fraud detection according to claim 2, characterized in that: The specific method for calculating AA similarity is: Where AA(u,v) represents the AA similarity between nodes u and v in the transaction association weight graph, N(u) and N(v) represent the sets of neighbor nodes of nodes u and v in the transaction association weight graph, respectively, N(z) is the set of common neighbor nodes z of nodes u and v, and |N(z)| represents the number of common neighbor nodes z of nodes u and v.
4. The method for constructing a transaction association graph and using community discovery for fraud detection according to claim 3, characterized in that: When filtering the edges in the transaction association weight graph according to the similarity threshold to obtain the transaction association graph, the edges in the transaction association weight graph where the AA similarity between two accounts is less than the similarity threshold are deleted, and only the edges greater than or equal to the similarity threshold are retained to obtain the transaction association graph.
5. The method for constructing a transaction association graph and using community discovery for fraud detection according to claim 4, characterized in that: The similarity threshold is determined based on business experience or business effects discovered by the community.
6. The method for constructing a transaction association graph and using community discovery for fraud detection according to claim 5, characterized in that: The modularity function constructed to measure community discovery is: Where Q is modularity, which is the total number of edges in the community minus the expected number of edges generated by nodes in the community; A vw A represents the connection between node v and node w in the transaction association graph. vw =1 means that node v is connected to node w, A vw =0 means that node v and node w are not connected; m is the total number of edges in the transaction association graph, c v represents the community to which node v is assigned, c w Indicates the community to which node w is assigned, using δ(c v ,c w )=1 means c v =c w , that is, it means that node v and node w are divided into the same community c, δ(c v ,c w )=0 means that node v and node w are not divided into the same community c; k v represents the degree of node v, which is the number of edges connected to node v, where k w represents the degree of node w, which is the number of edges connected to node w, where 7. The method for constructing a transaction association graph and using community discovery for fraud detection according to claim 6, characterized in that: The optimization is performed with the goal of maximizing the modularity function, and the optimal solution is found through iteration. When obtaining the community discovery result, the community discovery algorithm Louvain algorithm or the coherent Ising machine is used to find the optimal solution.
8. The method for constructing a transaction association graph and using community discovery for fraud detection according to any one of claims 1 to 7, characterized in that: When assessing the fraud risk of each community based on the community discovery results, the fraud score of all accounts in each community is calculated in combination with the external fraud score of each account in each community, thereby assessing the fraud risk of each community.
9. The method for constructing a transaction association graph and using community discovery for fraud detection according to any one of claims 1 to 7, characterized in that: When assessing the fraud risk of each community based on the community discovery results, the fraud labels of each account in each community are combined to calculate the proportion of fraudulent accounts in each community, thereby assessing the fraud risk of each community.
10. A device for constructing a transaction association graph and using community discovery for fraud detection, characterized in that: include: at least one processor; as well as at least one memory storing a computer program; Wherein, when the computer program is executed by the at least one processor, the device for constructing a transaction association graph and using community discovery for fraud detection performs the steps of the method for constructing a transaction association graph and using community discovery for fraud detection as described in any one of claims 1 to 9.